Digital Lending and Consumer Protection in Uganda: Towards a Responsible Regulatory Framework for Data-Driven Credit

Full text

Text extracted from the article PDF for reading and search. Tables, figures and equations are in the PDF, which remains the authoritative version.

1. Introduction

Digital credit has become an important part of the changing financial landscape in Uganda. Consumers can increasingly obtain relatively small loans without visiting a lender's physical premises. Applications may be made through a mobile application, a web interface, a USSD channel or a platform connected to a mobile-money or other payment account. The practical attraction is obvious. Digital lending can reduce transaction costs, shorten the time between application and disbursement, and reach borrowers who may have difficulty satisfying the documentary and collateral requirements associated with conventional credit.[1] The same characteristics that make digital credit attractive, however, can intensify consumer vulnerability. A digital lender can assess a borrower remotely, process large quantities of personal information, issue repeated loans rapidly and communicate with a borrower through channels that are more intrusive than traditional correspondence. The speed of lending can also reduce the opportunity for a consumer to consider the cost of borrowing. Where a borrower obtains several short-term loans from different providers, the absence of effective affordability controls and real-time information about outstanding obligations may contribute 1 Tier 4 Microfinance Institutions and Money Lenders Act 2016 (Cap 61), ss 1–4.

Uganda has responded to these developments with a number of legal and regulatory measures. The Tier 4 Microfinance Institutions and Money Lenders Act, Cap 61, provides a statutory framework for money lending and expressly treats customer protection as including appropriate product design, avoidance of over-indebtedness, transparency in pricing, responsible pricing, avoidance of unethical debt collection, confidentiality of client data and complaints handling. The 2024 Digital Lending Guidelines were subsequently issued to address concerns surrounding app-based lending, including high charges, lack of identifiable physical addresses, privacy violations and confidentiality problems. The data-protection regime and payment-system rules add further obligations where digital lending involves regulated payment services and personal-data processing. [2] The existence of these instruments raises a more difficult question than whether Uganda has regulation at all. The question is whether the different components of the regulatory framework operate together effectively when credit is generated and administered through data-driven technology. A rule requiring fair lending may have a different practical meaning when the lending decision is produced by an automated scoring system. A rule protecting confidentiality may be difficult to apply when an application requests extensive access to a borrower's phone data. A rule against abusive debt collection may also require adaptation where collection is performed through automated messages, repeated calls or digital contact with persons associated with the borrower.

This article therefore asks: to what extent does Uganda's existing legal and regulatory framework protect consumers of digital credit from over-indebtedness, opaque or unfair credit decisions, misuse of personal data and abusive debt collection, and what reforms are necessary to establish a responsible digital lending regime?

The article advances three propositions. First, Uganda already possesses significant consumer-protection principles that apply to digital credit. Secondly, the central weakness is fragmentation, implementation and technological specificity rather than a complete absence of law. Thirdly, the regulatory response should be organised around a responsible digital lending framework that connects affordability, transparency, data governance, algorithmic fairness, ethical collection, redress and accountability.

The article first reviews the literature and analytical framework, then explains the methodology, examines Uganda’s regulatory framework and consumer risks, compares Kenya, assesses regulatory sufficiency, and proposes reforms.

2. Literature Review

The literature on digital credit generally identifies a tension between financial inclusion and consumer vulnerability. Digital finance can reduce the costs associated with small-value lending and make credit available to people who are poorly served by conventional financial institutions. At the same time, the use of alternative data and automated decision-making may create new forms of information 2 Uganda Microfinance Regulatory Authority, Digital Lending Guidelines for Tier 4 Microfinance Institutions and Money Lenders (January 2024). 3 Rafe Mazer and Kate McKee, Consumer Protection in Digital Credit (CGAP Focus Note No 108, World Bank Group 2017). asymmetry. The lender may possess extensive information about the consumer while the consumer has limited information about how the information is processed, how the price of the loan is determined or why an application has been rejected. [3] International financial-sector literature has increasingly connected digital credit with responsible finance. The emphasis is not simply on whether consumers can obtain credit, but whether the credit is suitable, affordable, transparent and administered in a manner consistent with fair treatment. This approach is particularly relevant to short-term digital loans because a product can expand nominal access to finance while simultaneously worsening a consumer's financial position if the cost, repayment schedule or cumulative debt burden is not adequately considered. [4] A second body of literature focuses on data governance. Digital lenders can use transaction histories, device information, location information, communications data and other digital traces to evaluate borrowers. Such practices can improve credit assessment where conventional credit histories are limited, but they also create risks of excessive collection, function creep, inaccurate information and discriminatory or unexplained automated decisions. Data protection therefore becomes part of consumer-credit regulation rather than a separate technological issue. A third strand concerns debt collection. Traditional debt collection is already subject to legal limits concerning harassment, threats and unfair practices. Digital lending can amplify these risks because the lender may have access to multiple communication channels and may be able to contact persons connected to the borrower. The reputational pressure produced by digital disclosure can become a mechanism of coercion. Uganda's 2024 Digital Lending Guidelines recognise this problem by placing restrictions on access to customer contact lists and by addressing abusive collection practices.

The Kenyan experience has attracted particular attention because Kenya moved from a period in which many digital lenders operated outside dedicated financial-sector licensing to a statutory framework under which digital credit providers were licensed and supervised by the Central Bank of Kenya. The Kenyan model is useful to Uganda because it demonstrates the value of a clearly identifiable regulatory perimeter and public visibility of licensed providers. It also demonstrates that regulation must evolve as the market evolves: Kenya has since begun moving from the narrower concept of 'digital credit providers' toward a broader non-deposit-taking credit-provider framework. [5] The literature nevertheless leaves room for a specifically Ugandan legal analysis that brings these strands together. The important issue is not merely whether Uganda has provisions on interest, data protection or debt collection considered separately. It is whether the legal system adequately addresses the interaction between these issues when credit is delivered through automated, data-intensive platforms. This article addresses that gap by treating digital lending as a combined credit, data-governance and consumer-protection problem.

4 Organisation for Economic Co-operation and Development, G20/OECD High-Level Principles on Financial Consumer Protection 2022 (OECD Publishing 2022). 5 Central Bank of Kenya (Amendment) Act 2021 (Kenya); Central Bank of Kenya (Digital Credit Providers) Regulations 2022 (Kenya).

3. Conceptual and Theoretical Framework

3.1. Digital Lending

Digital lending means credit delivered through electronic channels where technology materially affects one or more stages, including application, identity verification, assessment, disbursement, communication or repayment.

3.2. Consumer Protection in Digital Credit

Consumer protection in digital credit comprises legal and institutional safeguards against unfair, deceptive, abusive or excessively risky lending. Uganda’s Tier 4 framework includes avoiding over-indebtedness, transparent and responsible pricing, ethical collection, data confidentiality and complaints handling.

3.3. Responsible Lending

Responsible lending requires an assessment of affordability, clear disclosure of material terms and avoidance of foreseeable unsustainable debt. Safeguards apply before disbursement, during contracting and when collecting repayment or addressing complaints.

3.4. Financial Inclusion

Financial inclusion supports digital lending, but regulation must remain proportionate so that consumer protection does not unnecessarily exclude low-value borrowers. The objective is to preserve access while controlling foreseeable harm.

3.5. Information Asymmetry

Information asymmetry arises where lenders know more than borrowers about pricing, data sources, risk criteria and collection practices. Disclosure helps only when information is understandable and enables realistic consumer choices.

3.6. Automated and Algorithmic Credit Assessment

Automated credit assessment can accelerate lending, but inaccurate data or unsuitable proxies may produce unfair outcomes. Section 27 of Uganda’s Data Protection and Privacy Act provides safeguards concerning solely automated decisions, subject to exceptions for decisions made in considering, entering into or performing a contract. It is not an unconditional right to human review of every loan decision.

3.7. Responsible Digital Lending as the Analytical

Framework Responsible digital lending is used here as an analytical framework, not as a claim that one Ugandan statute already establishes a complete regime. Its seven pillars are affordability, transparency, responsible data use, fair automated assessment, ethical collection, effective redress and regulatory accountability.

4. Methodology

The article adopts a doctrinal legal research methodology. Primary legal materials, including legislation, statutory instruments, regulatory guidelines and judicial decisions, are examined to determine the rights, obligations and 6 Tier 4 Microfinance Institutions and Money Lenders Act 2016 (Cap 61), ss 1–4. institutional responsibilities applicable to digital lending in Uganda. Particular attention is given to the Tier 4 Microfinance Institutions and Money Lenders Act, the Digital Lending Guidelines, the Lending Conditions Regulations, the Data Protection and Privacy Act and payment-system regulation.

The study also uses a comparative legal method. Kenya is selected as the principal comparator because it has experienced extensive digital-credit growth and developed a dedicated licensing and supervisory response to digital lenders. The comparison is not intended to suggest that Uganda should copy Kenyan law wholesale. Instead, it is used to identify institutional and consumer-protection mechanisms that may assist Uganda while recognising differences in legal structure and market conditions. Secondary materials include academic, policy and regulatory publications on digital credit, financial inclusion, consumer protection and data governance. The qualitative analysis evaluates the legal architecture rather than measuring the prevalence of consumer harm statistically.

5. Evolution of Digital Lending and Uganda's

5.1. Emergence of Digital Lending

Digital financial services let consumers obtain credit through mobile channels without visiting a lender’s premises. This can reduce transaction costs and reach borrowers who struggle to meet conventional documentation or collateral requirements, but it can also make the lender’s identity and regulatory status less visible.

The regulatory challenge is to identify the lender, its licence, the platform used and the responsible supervisor, particularly where technology companies, payment providers and telecom operators participate in one transaction.

5.2. The Tier 4 Regulatory Foundation

The Tier 4 Microfinance Institutions and Money Lenders Act, Cap 61, applies to Tier 4 microfinance institutions and money lenders and provides a statutory framework for money lending. Its definition of customer protection is particularly significant for digital credit because it expressly includes appropriate product design, avoidance of over-indebtedness, transparency in pricing, responsible pricing, avoidance of unethical debt collection, confidentiality of client data and complaints handling. [6] The Act contains important principles for responsible digital lending, but its general customer-protection provisions must be applied to automated, data-intensive business models.

5.3. The 2024 Digital Lending Guidelines The 2024 Digital Lending Guidelines respond to concerns about app-based lenders, including high charges, missing physical addresses, privacy violations and confidentiality problems. They address licensing, governance, consumer protection, reporting and oversight. [7] The Guidelines restrict practices involving access to customer contact lists, frequently dialled contacts and phone messages for electronic know-your-customer procedures or delinquency management. They also address threats, 7 Uganda Microfinance Regulatory Authority, Digital Lending Guidelines for Tier 4 Microfinance Institutions and Money Lenders (January 2024).

violence, obscene language, unauthorised contact with third parties and harassment during recovery. [8]

5.4. Credit Appraisal and Affordability

Rapid digital disbursement can encourage impulsive or repeated borrowing. Credit appraisal remains important even where an individual loan is small, because speed should not replace responsible assessment.

Loan stacking occurs when borrowers hold several loans that each appear affordable in isolation. Assessments should, where lawful and technically possible, consider existing obligations and repayment capacity rather than treating each loan as a separate transaction.

5.5. Interest and Total Cost

Uganda prescribes a maximum interest rate of 2.8 per cent per month (33.6 per cent annually) for money lenders under the Tier 4 framework. The ceiling is important, but it does not alone determine the full cost of credit. [9] Fees, penalties, service charges and rollover costs can increase the borrower’s obligation. Before acceptance, the borrower should see the principal, interest, compulsory charges, total payable, repayment date and default consequences clearly.

5.6. Data Protection

The Data Protection and Privacy Act 2019 regulates personal-data processing and gives data subjects rights. Sections 27 and 28 address automated decisions and remedies for inaccurate personal data, respectively. [10] Section 27 is not an unconditional right to human review. It contains exceptions for decisions made while considering whether to enter into a contract, with a view to entering it, or during performance. The article therefore focuses on transparency, accuracy, lawful purpose and proportionality. [11]

5.7. Debt Collection

Digital collection can involve repeated messages and calls across several channels. Access to contact lists may also expose borrowers to social or reputational pressure through third parties.

Prohibitions have limited value without accessible complaints and enforcement, especially where a lender is anonymous, unlicensed or difficult to identify.

5.8. Institutional Reform in 2025 Government budget documentation for FY 2025/26 records steps concerning the integration of UMRA functions into the Ministry of Finance, Planning and Economic Development, and 2025 statutory instruments changed references to the Authority in some Tier 4 rules. The precise scope and current legal effect of this transition should be stated cautiously, since UMRA’s current official website continues to describe its licensing and supervisory functions. [12] 8 Uganda Microfinance Regulatory Authority, Digital Lending Guidelines for Tier 4 Microfinance Institutions and Money Lenders (January 2024), provisions on customer data, confidentiality and debt collection. 9 Tier 4 Microfinance Institutions and Money Lenders Act 2016 (Cap 61), s 89; Tier 4 Microfinance Institutions and Money Lenders (Prescription of Maximum Interest Rate) Notice 2024, Legal Notice No 21 of 2024. 10 Data Protection and Privacy Act 2019 (Cap 97), ss 3, 12–17, 27–28. 11 Data Protection and Privacy Act 2019 (Cap 97), s 27(1)–(6). 12 Ministry of Finance, Planning and Economic Development, Background to the Budget for FY 2025/26, ‘Policy, Legal and Institutional The transition reinforces the need for a clear regulatory home for digital lending. Consumers should be able to seek assistance without first determining which regulator covers the loan, payment, data processing or communications.

6. Consumer Protection Risks in Uganda's Digital

6.1. Over-Indebtedness and Multiple Borrowing

Digital lending can make repeated borrowing easy. A borrower unable to meet one obligation may take another loan to service it, especially where lenders lack information about total outstanding debt. [13] Although Ugandan law recognises avoidance of over-indebtedness, this principle does not itself create a loan-stacking mechanism. Proportionate affordability checks and timely information about material existing obligations would strengthen protection.

6.2. Opaque Pricing and Small-Screen Contracting

Digital contracting can produce formal disclosure without meaningful understanding. If total cost, fees and default consequences are difficult to see on a small screen, consent may conceal an information problem. [14] Standardised, prominent disclosure should show total cost, repayment date, default consequences, lender identity and regulatory status before the borrower accepts the loan.

6.3. Automated Credit Decisions

Automated assessment raises questions of accuracy, explainability and accountability. A lender may use transaction patterns or other data as proxies for creditworthiness. If the data are incomplete or inaccurate, the resulting decision may be unfair and difficult to challenge. [15] Lenders using automated assessment should test model reliability, identify material errors, document significant outcomes and provide a way to challenge harmful decisions. Regulators need not require public disclosure of proprietary source code.

6.4. Inaccurate Data

Credit decisions can be affected by inaccurate information held by a lender or obtained from a third party. An incorrect default marker or identity match can affect more than one application, particularly when automated systems reuse the information. [16] Consumers need clear ways to challenge inaccurate information. Lenders should investigate credible disputes and avoid continuing to rely on materially contested data without appropriate review.

6.5. Intrusive Data Collection

The commercial value of digital-credit data creates an incentive to collect more information than is necessary. This is especially concerning where applications request access to Frameworks’; Uganda Microfinance Regulatory Authority, official website, ‘Regulation’ (accessed 28 October 2026). 13 Tier 4 Microfinance Institutions and Money Lenders Act 2016 (Cap 61), s 4 (definition of ‘customer protection’). 14 Rafe Mazer and Kate McKee, Consumer Protection in Digital Credit (CGAP Focus Note No 108, World Bank Group 2017). 15 Data Protection and Privacy Act 2019 (Cap 97), s 27; see also OECD, G20/OECD High-Level Principles on Financial Consumer Protection 2022. 16 Data Protection and Privacy Act 2019 (Cap 97), ss 15–16, 28.

contact lists, messages, device information or data about people who are not borrowers. [17] The 2024 Guidelines restrict access to contact lists and phone messages. The broader principle is data minimisation: collect only what is necessary for a legitimate lending purpose, retain it only as justified and protect it from misuse. [18]

6.6. Abusive Digital Debt Collection

Debt collection becomes abusive when it relies on threats, humiliation, harassment, coercion or unauthorised disclosure. Digital platforms can make such conduct easier to automate and scale. A borrower can be subjected to repeated messages or calls, while persons in the borrower's contact list can become targets of pressure. [19] The Guidelines address several abusive collection practices, but their effectiveness depends on enforcement and consumer awareness. Borrowers should be able to preserve evidence and complain without identifying the precise regulator themselves. [20]

6.7. Unlicensed Lenders

Unlicensed lending creates a fundamental consumer-protection problem. A consumer who cannot identify the legal entity behind an application may have difficulty enforcing contractual rights, seeking a refund, correcting data or making a regulatory complaint. Licensing therefore serves not only prudential purposes but also consumer visibility and accountability. [21] Recent decisions show that courts treat licensing and statutory lending requirements as substantive matters. The cases illustrate the importance of valid licensing, compliant loan documentation and scrutiny of money-lending practices. [22]

6.8. Complaints and Access to Redress

A consumer-protection regime is incomplete without an effective route to remedy. The Tier 4 framework recognises complaints handling, and data-protection law provides a route through the Data Protection and Privacy Office. Payment-system consumers may also fall within other complaint mechanisms. The resulting landscape can, however, be confusing. [23] A single transaction may raise issues about the loan contract, payment channel, data processing and collection. A one-stop complaint mechanism could route the case to the right authority while giving the borrower one reference number. [24]

6.9. Regulatory Fragmentation

Digital lending can involve several regulatory domains at once. The lender may be subject to Tier 4 regulation, payment 17 Data Protection and Privacy Act 2019 (Cap 97), ss 3, 12–14, 17. 18 Uganda Microfinance Regulatory Authority, Digital Lending Guidelines for Tier 4 Microfinance Institutions and Money Lenders (January 2024), provisions on access to contact lists and phone messages. 19 Rafe Mazer and Kate McKee, Consumer Protection in Digital Credit (CGAP Focus Note No 108, World Bank Group 2017). 20 Uganda Microfinance Regulatory Authority, Digital Lending Guidelines for Tier 4 Microfinance Institutions and Money Lenders (January 2024). 21 Tier 4 Microfinance Institutions and Money Lenders Act 2016 (Cap 61), ss 78 and 83. 22 Muzunduki Bob v Taija Holdings Ltd (Civil Appeal No 86 of 2024) [2026] UGCommC 41 (22 January 2026); Waneroba Patrick v Bumutsukhu Financial Service Ltd (Civil Appeal No 0103 of 2024) [2025] UGHC 456 services may fall within payment-system rules, personal-data processing falls within data-protection law, and communications may involve telecommunications regulation.

Regulators should use joint supervision, information sharing, coordinated complaint handling and common consumer-protection principles to reduce gaps between otherwise separate regimes.

7. Comparative Perspective: Uganda and Kenya

7.1. Why Kenya?

Kenya provides a useful comparator because its digital-credit market developed rapidly and generated concerns about high costs, unethical collection and misuse of personal information. In response, the Central Bank of Kenya Amendment Act 2021 gave the Central Bank of Kenya powers to license and supervise previously unregulated digital credit providers, followed by the Digital Credit Providers Regulations 2022. [25]

7.2. Licensing and Regulatory Visibility

The Kenyan model demonstrates the value of a clearly defined regulatory perimeter. The Central Bank of Kenya publishes a directory of licensed digital credit providers, giving consumers a practical means of checking whether a provider is authorised. Uganda's equivalent system should be equally accessible and should be designed around the reality that consumers encounter digital brands rather than legal statutes. [26]

7.3. Consumer Protection and Debt Collection

Kenya's 2022 framework was expressly developed in response to concerns about high cost, unethical debt collection and abuse of personal information. It therefore illustrates a regulatory model in which digital-credit supervision is connected directly to consumer protection rather than being limited to licensing. [27] Uganda has moved in a similar direction through the Digital Lending Guidelines. The comparison therefore does not reveal that Kenya has consumer protection while Uganda has none. Instead, it highlights the importance of a dedicated and visible supervisory perimeter and of continuous adaptation as lending models change.

7.4. Data and Credit Information

Both jurisdictions face the problem of using data to expand access to borrowers who may have limited traditional credit histories. The regulatory challenge is to make alternative data useful without allowing data collection to become excessive or opaque. Kenya's credit-information architecture also (26 June 2025); Wambwa Anne Nasimiyu v Muyesa Kenneth Masambu (Miscellaneous Application No 173 of 2025) [2025] UGHC 1264 (6 November 2025). 23 Tier 4 Microfinance Institutions and Money Lenders Act 2016 (Cap 61), s 4; Data Protection and Privacy Act 2019 (Cap 97), ss 31–33. 24 National Payment Systems Act 2020 (Cap 59); National Payment Systems (Consumer Protection) Regulations 2022. 25 Central Bank of Kenya (Amendment) Act 2021 (Kenya); Central Bank of Kenya (Digital Credit Providers) Regulations 2022 (Kenya). 26 Central Bank of Kenya, ‘Directory of Digital Credit Providers’ (19 September 2022, as updated). 27 Central Bank of Kenya (Digital Credit Providers) Regulations 2022 (Kenya).

illustrates the importance of mechanisms through which borrowers can challenge inaccurate information. [28]

7.5. Kenya's Current Transition

The Kenyan framework is itself evolving. The Central Bank of Kenya has developed a broader non-deposit-taking credit-provider framework following amendments to the Central Bank of Kenya Act, reflecting a recognition that regulation based solely on the word 'digital' may become outdated as technology becomes embedded in ordinary lending. The 2026 regulatory materials describe the move as an effort to widen the scope beyond the earlier digital-credit-provider concept. [29] This development is particularly instructive for Uganda. Regulation should target the economic activity and the consumer risk rather than assume that a particular technological channel will remain distinctive. A loan can be digitally originated today and through a different interface tomorrow. The legal obligation should follow the risk.

7.6. Lessons for Uganda

• Maintain a clear and public register of licensed digital lenders. • Regulate the credit activity rather than relying solely on the technology used to deliver it. • Make consumer protection a core licensing and supervisory requirement. • Provide effective controls against abusive collection and misuse of personal information. • Strengthen credit-information and affordability mechanisms to address loan stacking. • Review the regulatory perimeter periodically as lending technology changes.

7.7. What Uganda Should Not Copy

Uganda should not adopt foreign rules mechanically. Kenya's institutional arrangements, market size and financial architecture differ from Uganda's. Uganda should also avoid creating a compliance system so expensive that legitimate small-value lenders exit the market or pass excessive regulatory costs to consumers. Proportionality should remain central.

8. Is Uganda's Regulatory Framework Sufficient?

8.1. Affordability

The framework is partially sufficient. Uganda recognises avoidance of over-indebtedness and credit appraisal, but stronger cross-lender information is needed to assess total exposure.

8.2. Transparency

The framework requires pricing disclosure, but digital presentation may still obscure the true cost. Standardised total-cost disclosure would improve understanding.

8.3. Interest Regulation

The interest-rate ceiling is useful but must be considered alongside compulsory fees and default costs that can increase the effective burden.

28 Rafe Mazer and Kate McKee, Consumer Protection in Digital Credit (CGAP Focus Note No 108, World Bank Group 2017).

8.4. Data Protection

Data-protection law provides significant rights, but general rules do not answer every credit-specific question. Guidance is needed on alternative data, minimisation, model governance and disputed credit information.

8.5. Automated Decisions

Section 27 provides safeguards for automated decisions but includes contractual exceptions. Sector-specific rules should require meaningful explanations of material credit outcomes, governance records and human escalation for serious disputes.

8.6. Debt Collection

Uganda's 2024 Digital Lending Guidelines are a significant strength. They directly respond to the forms of abusive collection that digital technology can facilitate. The remaining problem is enforcement, especially where a provider is unlicensed or difficult to identify.

8.7. Redress

Redress is fragmented because different parts of a digital loan may involve different institutions. A one-stop complaints mechanism could improve access without creating a single regulator for all digital finance.

8.8. Overall Assessment

Uganda’s framework is substantially developed but only partially sufficient. It needs greater coherence, technological specificity, enforcement capacity and coordination, rather than another layer of rules for its own sake.

9. Towards a Responsible Digital Lending Framework

9.1. Unified Digital Credit Regulatory Register

Government should establish a public register of authorised digital lenders, identifying each provider’s legal name, licence status, address, approved digital brands and responsible regulator. The register should be mobile-friendly and easy for consumers to check before borrowing.

9.2. Stronger Affordability Assessment

Lenders should conduct proportionate affordability assessments before disbursement, considering repayment capacity, existing obligations where lawfully accessible, loan duration and likely default consequences. Requirements should reflect loan size and risk.

9.3. Loan-Stacking Mechanism

Uganda should improve credit-information sharing to identify material concurrent borrowing. The aim is not to prohibit multiple loans automatically, but to prevent lenders from ignoring clear evidence that further credit may be unsustainable.

9.4. Standardised Total-Cost Disclosure

Before acceptance, a standard digital screen should display the principal, interest, compulsory fees, total amount payable, repayment date, late-payment consequences and lender 29 Central Bank of Kenya, Regulatory Impact Assessment: Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations 2026.

identity. This information should also appear in the confirmation and remain accessible during the loan.

9.5. Algorithmic Credit Accountability

Lenders using automated credit models should identify data categories, test accuracy, monitor material outcomes, preserve audit trails and investigate significant complaints. Regulators should be able to inspect systems without requiring public disclosure of proprietary source code.

9.6. Data Minimisation

Data should be collected only for legitimate and proportionate lending purposes and retained only as justified. Contact lists, messages, photographs, location information and other device data should not become routine sources of leverage merely because technology permits access.

9.7. Digital Debt Collection Code

A consolidated code should prohibit threats, humiliation, harassment, unauthorised third-party disclosure, impersonation, deceptive messages and other coercive practices. Recovery agents should identify themselves and preserve records of collection communications.

9.8. One-Stop Complaints Portal

A borrower should be able to submit a complaint through one portal, whether the dispute concerns lending conduct, data processing, payment services or collection. The portal should route the matter internally while providing a single case reference.

9.9. Regulatory Coordination

The ministry responsible for Tier 4 regulation, Bank of Uganda, Personal Data Protection Office, Uganda Communications Commission and other relevant institutions should establish formal procedures for information sharing, joint investigations and consumer education.

9.10. Enforcement Against Unlicensed Lenders

Enforcement should address the lender and the digital distribution channel. Authorities should be able to identify unlicensed providers, issue public warnings and pursue lawful restrictions or referrals, working with payment providers and technology intermediaries where appropriate and consistent with due process.

9.11. Regulatory Sandbox

A regulatory sandbox can allow new credit models to be tested while consumer-protection risks are assessed. Participation should not exempt providers from basic consumer rights.

9.12. The Proposed Model

The proposed Responsible Digital Lending Framework has seven connected pillars: • Affordability: the borrower should not be placed in foreseeable unsustainable debt. • Transparency: the consumer should understand the true cost and material consequences of the loan. • Data governance: personal information should be collected and processed lawfully, proportionately and securely. • Algorithmic fairness: automated credit systems should be accurate, governed and capable of meaningful review. • Ethical debt collection: default should not justify harassment, humiliation or unlawful disclosure. • Effective redress: consumers should have a simple and accessible route to challenge harmful conduct. • Regulatory accountability: lenders and regulators should be capable of demonstrating compliance and responding to emerging risks.

The framework is cumulative. Affordability is weakened where existing debt is invisible; transparency is weakened where decisions cannot be explained; and collection rules are less effective where consumers cannot identify the lender or access redress.

10. Conclusion

Digital lending can widen access to finance, reduce transaction costs and reach consumers outside conventional banking. Those benefits must be balanced against repeated borrowing, opaque automated decisions, excessive data collection and abusive collection.

Uganda has a meaningful legal foundation: the Tier 4 Act recognises consumer-protection principles, the 2024 Guidelines address app-based lending, and data-protection and payment-system rules add safeguards depending on the transaction.

The problem is fragmentation, enforcement, technological specificity and coordination, not a complete regulatory vacuum. Existing principles may fail where debts are invisible, models opaque, data excessive or providers unidentifiable.

A Responsible Digital Lending Framework should centre on affordability, transparency, responsible data use, accountable automated assessment, ethical collection, accessible redress and regulatory coordination. Its purpose is to preserve innovation while reducing foreseeable harm. Digital credit should not receive weaker protection because it is automated. Greater capacity to collect data, make remote decisions and recover debt digitally requires clear accountability and accessible remedies.

11. Areas for Further Research

Further empirical research is needed on the prevalence and severity of loan stacking among Ugandan digital-credit users, the effectiveness of credit-information sharing for small-value digital loans, and the practical operation of the 2024 Digital Lending Guidelines. Future studies should also examine how digital lenders use alternative data, whether consumers understand total borrowing costs, and the extent to which complaints are successfully resolved. Additional comparative research could examine Tanzania, Rwanda and other East African jurisdictions as their digital-credit frameworks develop. There is also scope for interdisciplinary research combining law, computer science and behavioural economics to assess algorithmic credit models, consumer decision-making and the design of effective digital disclosures.