Who Is Protecting the Borrower? The Missing Duty of Care in Kenya’s Credit Reporting System

Co-authored by Tim Munyi Mugo and Judy Mathenge in the Credit and Governance Are Universal series.

A credit reference bureau listing in Kenya today carries weight far beyond the loan it describes, following a person into a job interview, a second lender’s underwriting system, a tenancy application. It has become a character reference issued by an algorithm. 

Yet the law governing how that reference comes into being assumes that harm only flows one way, and that a lender’s only duty is to warn before it causes damage.

Between us, we have examined a case neither of us experienced alone: one was given direct sight of it, and we have analyzed it jointly. It involves three encounters with this system in a single month, with three different lenders. None of what follows names an institution. The pattern is the point, not the parties.

The Listing with No Warning

In the first instance, a lender reported the account as written off and non performing, arrears stretching back well over a thousand days. The borrower learned of this only when applying for an unrelated facility and being turned away, with no notice of intention to list ever issued.

Personal payroll records told a different story: near continuous servicing for close to three years, with one explainable gap during a documented period of personal disruption. The lender’s account and the documentary record did not match.

Regulation 63(1)(a) of the Banking (Credit Reference Bureau) Regulations, 2020 requires an institution to notify a customer at least one month before a loan becomes non performing that it will be reported to a bureau, and Regulation 67 (supra) prescribes how that notice must be served, by registered mail, email, SMS, or physical delivery with acknowledgement, kept on record for seven years. That safeguard was never triggered at all.

The Listing Performed as Theatre

The second instance was, in its own way, worse, because the institution did not skip the rule, it performed it hollow. A written and in person instruction had cancelled a standing arrangement before it took effect. The bank proceeded regardless, then issued notice of listing. A colleague was reportedly tasked to call and explain; nobody called. The listing was discovered only through the borrower’s own enquiry, by which time the damage was done.

When raised directly with the branch, the borrower was told he owed the bank a duty of care, and asked whether the bank did not owe him the same before placing a permanent mark on his record. What followed was not resolution but minimization: an informal offer to subsidize the delisting fee, paired with a quietly inflated clearance timeline once payment was made.

This branch level pattern points to something larger: poor accountability where policy becomes practice, where lenders can disregard notification duties and shift the burden of error onto the consumer. Most of the damage sits in the gap between procedural compliance and substantive care, a gap Kenya’s supervisory framework has yet to name.

The Listing Nobody Thinks Is a Problem

The third instance is one the law barely regulates. A small facility taken out to clear the two listings above was reported the very next day, an almost cheerful positive listing meant to build credit history. Two days later, a top up application at a separate bank stalled, timing pointing squarely at the new entry.

Regulation 26(1) (supra) requires thirty days’ notice before negative information is submitted; Regulation 26(2) (supra) exempts positive information entirely, assuming it only ever helps a borrower. That assumption does not survive practice. A new facility appearing on a file the same week a second application is underway changes how a risk engine reads that file; whatever label is attached. 

The harm is real even where the law decided no warning was required, because it never imagined harm arriving dressed as good news.

One Asymmetry, Three Lenders

Lay these three side by side and one asymmetry runs through them: the lender bears no cost for acting first and explaining later, while the borrower absorbs the full consequence, a blocked application, a coerced settlement, a stalled facility. This is not an argument against credit reporting, which a functioning credit market needs. 

It is narrower: a duty of care running in only one direction is not a duty of care, it is a liability shield with a reporting requirement attached.

This imbalance now matters across banks, SACCOs, and digital lenders alike, where decisions are automated in seconds and a single listing, negative or positive, can change how another lender reads a file. Governance cannot focus on data availability alone, it must weigh how fairly data enters the system and how easily a borrower can contest it, or reporting becomes about speed rather than trust.

What Would Change This

South Africa’s National Credit Act already does part of what Kenya’s framework only gestures at: a Section 129 notice must reach the consumer before enforcement, with a defined window to act, and an independent National Credit Regulator and Tribunal exist solely to adjudicate borrower disputes.

Kenya’s dispute path runs through the bureau and the Central Bank, with no independent tribunal a borrower can approach directly. A more honest framework needs proof of an actual, successful contact attempt before any listing can influence a separate lender’s decision, and a recognized right to flag a listing as disputed at the point of discovery, visible to any institution viewing the file. None of this relieves borrowers of their obligations. 

It simply asks lenders to meet the same standard of care they so readily invoke when a borrower falls short. The true test of a credit system is its ability to self-correct when it errs, not its ability to record risk. 

Borrowers should repay their debts, but lenders should be held to a standard commensurate with the consequences they cause. Until that duty runs both ways, the bureau will function less as a record of behaviour and more as a weapon lenders deploy with certainty and no downside, against borrowers who discover the damage only once it is too late to prevent. 

The duty of care must become a foundational value of credit reporting, not a formality observed only in the breach.

About the Authors
 

Tim Munyi Mugo is the Manager, Legal & Board Affairs at Mombasa Water Supply and Sanitation (MOWASSCO), with experience spanning legal governance, board administration, and regulatory compliance in the water and sanitation sector. 

Connect on LinkedIn: linkedin.com/in/tim-munyi-mugo-8194b024
 

Judy Mathenge is a Credit Management Analyst with expertise in receivables analysis, credit risk assessment, and enforcement frameworks across public and private sector organizations in Kenya. 

Connect on LinkedIn: linkedin.com/in/judy-mathenge-62969219

 

 

Catch you in the next blog!

 

Disclaimer- The information provided is for general informational purposes only and should not be considered as professional advice. Please consult a qualified professional for specific guidance.