In April 2024, the Central Bank of Nigeria (CBN) directed five fintechs — OPay, Paga, Moniepoint, Kuda, and PalmPay — to pause new customer onboarding. Although it was reversed in June, the affected fintechs were required to update their KYC processes.

The increased use of digital financial services in Nigeria has been accompanied by a rise in fraud and cyber attacks. Some of the fraud has been linked to porous onboarding processes used by digital financial services providers, hence the CBN’s directive.

Techpoint Africa caught up with Musty Mustapha, Managing Director of Kuda Microfinance Bank, to understand how the fintech handled the CBN’s request and its approach to regulation.

This interview has been edited for clarity and brevity.

How did Kuda approach regulation and regulatory compliance before the CBN’s ban on new customer onboarding?   

Our approach has been a proactive one with the regulator. We’ve always stayed engaged with the regulator, and we strive to also stay ahead of the regulatory requirements.

We view regulation as a framework to enhance trust and stability in the financial system and, most importantly, to bridge the gap between the service we’re offering and our customers as well. We continuously keep in touch with regulators, keeping in touch with new releases, circulars, and policies.

We also established an internal compliance programme within the organisation, and they have the responsibility to implement a robust internal compliance framework, stay ahead of new regulations, and ensure that we stay in compliance with the existing ones.

We’ve brought major innovation to the ways financial services are offered in the country today, and that means we are constrained by some of the regulations. This team has been saddled with the responsibility of ensuring that whatever we’re doing, we need to balance innovation with regulation as well. We think that is critical, and we’ve been doing well so far.

How did your team react to being asked to pause customer onboarding? Was it something you anticipated?   

No one would expect such directives. It came as a surprise given what we’ve done internally, as I mentioned earlier.

However, it wasn’t surprising, not necessarily from our own point of view. We are a unit of a whole. And by whole, I’m talking about the industry generally, which is, in this case, the fintech industry.

We see what others are doing and what others are not doing. We know what we are doing. So given the prevalence of cases of fraud and all of that within the industry, I think that necessitated the need for the measures taken by the regulators. It was surprising if we contextualised it to what we are doing, but in terms of the industry as a whole, it wasn’t surprising at all.

The CBN had some requirements that fintechs needed to meet before the ban was lifted. Can you share what these requirements were and the steps (immediate and ongoing) that Kuda has taken as a result?   

The requirement is definitely geared towards enhancing the integrity of the financial system, which is the core mandate of the CBN.

I think the requirement is a good one. It’s the right step in the right direction, and it borders on generally enhanced KYC processes, improved data protection measures, and, of course, a more rigorous customer verification protocol, which all financial institutions are expected to follow anyway.

For us, that requirement gives us a platform to do a thorough audit of all our KYC processes, which we already have. We strive as much as possible to stay way ahead, not just meeting the regulations but also staying ahead of it.

We’ve now instituted what I’ll call enhanced KYC processes. We reviewed and upgraded our KYC process to meet a new standard.

On the data protection aspect, we also implemented stronger data protection protocols. And, of course, regular monitoring and security audits. On the customer verification part, we initiated one of the most comprehensive address verification exercises so far in the industry for both new and existing customers.

Our ongoing steps include continuous monitoring of these processes to ensure that there are no lapses or any drop-off whatsoever.

We are also embarking on strong customer education because we are only going to to succeed when our customers are fully aware of what is expected of them and what thei  obligations are.

Also, we’ve established a very effective feedback mechanism to address customer concerns properly and also refine the processes as needed.

You were asked to verify customer addresses, but some customers didn’t seem happy about that. How have you handled complying with regulations and keeping your customers happy?   

Not everyone likes change as a matter of principle. Nobody would really embrace disruption, especially when it directly affects them. That’s generally speaking, but when that disruption now has to do with your financial lives, that gets even more complicated.

What we’ve done to minimise this disruption is take a systemic rollout approach. The rollout of address verification was in phases, and this meant that we were thorough enough to ensure the accuracy of the whole exercise and, most importantly, to minimise the impact on the customers.

We also collaborated with address verification experts to ensure that the process was smooth.

The third approach, which I think is the most important as far as the customer is concerned, is to involve them in the process. We do this by educating them on the importance and steps that they need to take to ensure that there is little to no disruption to their financial services accessibility on Kuda.

Of course, we will have some customers who are not pleased, but we take full responsibility for that as they are our customers.

What has your customer verification process looked like?   

For us, we leverage technology as much as possible to streamline that process and ensure its effectiveness.

It’s important to say that not all of the over seven million customers we have are required to go through address verification. We have three tiers of accounts: tier one, tier two, and tier three. Only Tier 3 customers are required to go through address verification.

That ensures that the vast majority of our customers are not affected by these processes. For those who are affected, we’ve made it easier using technology.

Once you’ve been prompted to go through the address verification process on our app now, you’ll be given a form to fill out, which will contain your address, typically as detailed as possible.

We’ve been able to break it down, so we can  identify your specific address to the minutest details. There’s also a place for you to upload your utility bill or any document that will confirm that you indeed have access to that address.

Also on the app, you can take a picture of the house or the street and some other data that enhances the quality of the information that we can then pass on to the address verification agency that will eventually go and do the physical verification.

What were some assumptions that you had before starting the address verification process, and how have the changed over time?   

I wouldn’t say it’s an assumption. Right now, the provision allows for physical address verification, so we would be looking for a regulatory allowance that would allow us to verify the address electronically.

That’s ultimately where we want to get, but we do understand and are fully in compliance with the current regulatory regime.

We know that the regulators and other stakeholders are working to put together a robust framework that will be secure and meet the requirements of every party in terms of e-address verification.

How do you balance regulatory compliance on the one hand with the agility that we expect from a startup of your size?   

You can put that together in what we call regulatory agility. We’re building a culture that sees compliance as a facilitator rather than a hindrance to innovation. How you see regulations is very critical, and the culture that you’ve entrenched in your organisation is also critical.

I always say business is a two-legged table; one leg is regulatory compliance, and the other leg is the customer we’re serving. If you take one leg off, that is, if you ignore or are falling short on regulatory compliance, the table is going to fall.

On the other hand, you have to balance it with the customer experience, because if you don’t have customers, you might as well just close the shop. We’re developing a flexible compliance framework that can quickly adapt to regulatory changes where we are proactively monitoring and engaging regulators, and not waiting until a pronouncement before we start scampering around to stay compliant.

We have cross-functional teams that include compliance experts in product development and strategic planning, so we would not get to a point where the product is ready for release before compliance gets to know about it. We’re regularly reviewing and refining our processes to maintain compliance while fostering innovation.

What are some lessons you’ve learnt about building fintech products for Nigerians?   

One that comes to mind clearly is regulation. Regulation is very critical, and you have to take it seriously at the beginning of your business.

We were fortunate enough to have taken that into consideration. Otherwise, I don’t know where we would be now if we hadn’t prioritised regulations. This has helped since the early days.

Those who were fortunate enough to start the business with us have experience in banking, dealing with the CBN, and different government agencies that oversee different aspects of our operations.

Another thing is that Nigerians are sophisticated people; they know what they want, and they will reward you when you offer them specifically what they want. Of course, they will punish you when you give them what you think they want, but not necessarily what they want.

So I think it’s extremely important to understand the nuances of the local requirements. It’s so easy to sit down in your office and come up with products and think that’s what people need.

You’d be surprised that when you release that product, what they’re actually using it for or what they need is far different from what you initially conceptualised. So I think user research is essential: understanding customer needs, contextualising their needs, and then using that knowledge to come up with the right product for them.

Are there any new developments that we should be expecting from Kuda over the next few months?   

Absolutely. We are an innovative company, so in terms of product innovation, you should definitely expect new features and services aimed at enhancing the customer experience and financial inclusion.

We have upcoming partnerships with key industry players that will broaden our service offerings and expansion plans, including plans for geographic and service expansion to better serve our growing customer base in Nigeria.

We’re also launching lots of community-focused initiatives that are aimed at giving back and supporting economic development in Nigeria.