Introduction
Digital lending has become one of the most visible features of financial inclusion in Tanzania. Individuals and small traders can apply for a loan through a mobile application, have their creditworthiness assessed automatically and receive the money in a mobile money wallet within minutes, without visiting a lender or signing a paper agreement. A large part of this market is served not by banks but by non-deposit-taking lenders, many of them operating only through smartphone applications. In Tanzanian law these lenders are Tier 2 microfinance service providers, and the Microfinance (Non-Deposit Taking Microfinance Service Providers) Regulations, 2019 recognise ‘digital microfinance lenders’ as one category of Tier 2 provider.1
The growth of this market has been accompanied by serious complaints from borrowers: high and poorly disclosed interest and fees, harvesting of telephone contacts, shaming and threatening messages sent to relatives and colleagues, and lenders whose identity and location cannot easily be established. In August 2024 the Bank of Tanzania (the Bank) responded by issuing the Guidance Note on Digital Lenders under Tier 2 Microfinance Service Providers (the Guidance Note), and in November 2024 it announced that sixty-nine digital lending applications had been blocked for operating without approval.2 These measures show that the regulator is aware of the problem. They also show its legal limits. The Guidance Note was issued under the general functions of the Bank in section 12 of the Microfinance Act, not as regulations under section 60, and the lenders that cause the greatest harm are those that never apply for a licence at all.3
There is therefore no shortage of law. Digital lending by Tier 2 providers is governed by a framework assembled from at least eight instruments, made at different times, for different purposes and by different authorities, and none of them was designed as a complete code for app-based lending. The question is not whether Tanzania has rules on digital lending but whether the rules it has are applicable to the persons who lend, and capable of being enforced against them. This study adopts a doctrinal legal research methodology,4 with Kenya as a limited comparator, because it is a neighbouring East African jurisdiction with a similar legal tradition and a digital credit market of comparable character, and because it adopted a dedicated licensing regime for digital credit providers in 2022. It is confined to Tier 2 providers and unlicensed persons lending in the same way in Mainland Tanzania.
The argument advanced is that the framework is extensive in coverage but deficient in three respects. It is deficient in legal force, because the rules that address digital lending most directly are in a guidance note that prescribes no sanctions. It is deficient in substance on the price of credit, which is controlled by disclosure alone, and in its binding treatment of data and debt collection, which is general. And it is deficient in reach, because the conduct rules attach to licensed institutions and therefore apply least to unlicensed and foreign-hosted lenders. The claim is one about statutory design, established by doctrinal analysis; it is not a claim about how the Bank or any other institution performs in practice, for which this study collected no data. It follows that much of the reform needed can be achieved by exercising powers that the Microfinance Act already confers, and not by waiting for a new statute.
Throughout, the article keeps three things apart: the rules that bind a digital lender as law, the rules that exist only as administrative guidance, and the reforms proposed in Part VIII to supply what is missing. It does not argue that Tanzanian law offers borrowers no protection. It argues that the protection is uneven, uncertain in its legal force and weakest against the lenders who need regulating most.
The article proceeds as follows. Part II sets out the background to the problem. Part III develops the theoretical framework and Part IV reviews the existing scholarship. Part V presents the Tanzanian and Kenyan legal frameworks, Part VI sets out the findings and Part VII discusses them. Part VIII concludes and makes recommendations, and Part IX identifies an agenda for further research.
Background to the problem
The history of digital lending in Tanzania is tied to the expansion of mobile money. The first electronic money services were launched in 2008, and mobile money quickly became the most widely used financial service in the country, reaching rural and low-income people who had never held a bank account.5 The data generated by millions of mobile transactions made it possible to assess creditworthiness without collateral or a credit history. The first digital credit products were offered by banks in partnership with mobile network operators, such as M-Pawa and Timiza.6 A second wave followed, in which non-bank lenders, some of them financed from abroad, began offering short-term loans directly through smartphone applications distributed on app stores. They rely on automated credit scoring, often using data taken from the borrower’s telephone, and they disburse and collect loans through mobile money.7
The benefits of the model are real: digital loans are fast, small and available to people who cannot borrow from banks. The international literature also records its characteristic risks, namely very high effective costs of credit, repeated short-term borrowing that leads to over-indebtedness, opaque terms, extensive collection of personal data and coercive collection practices.8 Those risks are greatest where lenders are unlicensed, because they are outside the reach of the supervisor and have little incentive to protect their reputation.
The legal framework developed in layers. Before 2018, non-deposit-taking lenders were not subject to a comprehensive licensing and supervisory regime under the Bank. The Microfinance Act, 2018 (now Cap 407) divided providers into four tiers and placed Tier 2 providers under the Bank’s licensing and supervision. It lists ‘transfer and payment services, including digital microfinance services’ among the activities that constitute microfinance business, gives the Bank the function of protecting consumers, ‘including sanctioning usurious lending practices’, and empowers it to make regulations on the ‘conditions and manners for providing digital microfinance business’.9 The Bank then made the 2019 Microfinance Regulations and, in the same year, the Financial Consumer Protection Regulations; in 2024 it issued the Guidelines on Fees and Charges and, in August, the Guidance Note.10 Alongside these sector-specific instruments, the Electronic Transactions Act, the National Payment Systems Act and the Personal Data Protection Act bear on digital lending, and article 16 of the Constitution protects the privacy of every person.11
The regulatory response since 2022 has developed in stages, and has relied mainly on notices and administrative action. In November 2022 the Bank warned the public that lending without a licence contravenes section 16(1) of the Microfinance Act.12 In January 2024 a task force working with the Police began operations against unlicensed lenders.13 The Guidance Note of August 2024 introduced minimum criteria for digital platforms, a procedure by which a licensed Tier 2 provider must obtain a letter of no objection before lending digitally, and a list of prohibited practices including the use of borrowers’ contacts and debt shaming.14 By mid-November 2024 only four of twenty formal applications under the procedure had been approved, and on 21 November 2024 the Bank announced the blocking of sixty-nine applications with the help of the Tanzania Communications Regulatory Authority (TCRA).15 The Bank has since maintained a public list of unapproved platforms, and in 2025 it amended the Financial Consumer Protection Regulations, circulated draft regulations to replace the 2019 Microfinance Regulations and began implementing self-regulation for Tier 2 providers.16 These measures show an active regulator. They also show that the response has relied on guidance, public warnings and reactive tools, rather than on binding regulations made for digital lending.
Theoretical framework
The article uses three theories, each of which explains a different aspect of the problem, and a supporting perspective on code. Together they supply the evaluative standard applied in the findings, discussion and recommendations.
The public interest theory. The theory holds that regulation is justified as a response to market failure and is intended to serve the public as a whole. Its origins lie in Pigou’s account of how private markets may produce outcomes that diverge from social welfare,17 and later writers identified the main failures as monopoly, externalities, information asymmetry and the inability of some consumers to protect their own interests. Digital lending exhibits several of them. There is a pronounced asymmetry of information between a lender that designs the product and controls the data and a borrower who sees a few screens on a telephone; over-indebtedness and abusive collection impose costs on third parties, including the families and contacts of borrowers; and borrowers in urgent need have little bargaining power. These failures justify rules on disclosure, collection and data, and may justify control of price where disclosure cannot correct the failure. Stigler’s criticism that regulation is often captured by the regulated industry limits the theory as a description, but not its value as a normative standard.18
Entity-based and activity-based regulation. Financial regulation may attach obligations to institutions or to activities. Under entity-based regulation the obligations attach to a licensed type of institution because of its status; under activity-based regulation they attach to the activity, such as digital consumer credit, whatever the identity or licensing status of the person carrying it on. Entity-based regulation is administratively simple but invites regulatory arbitrage, because a person who carries on an economically identical activity outside the defined institutional category escapes the corresponding obligations.19 The Tanzanian framework for digital lenders is largely entity-based, and the theory therefore predicts that it will be least effective against unlicensed and offshore lenders.
Responsive regulation. Ayres and Braithwaite argue that regulators should respond to the regulated in a graduated way: most compliance should be secured by persuasion, but the regulator must be able to escalate to progressively severe sanctions, up to licence revocation and prosecution.20 The credibility of the sanctions at the apex of the enforcement pyramid is what makes the softer measures at its base effective. The theory supplies a standard for evaluating the sanctions available against digital lenders, and it explains the place of guidance and of industry self-regulation: both belong at the base of the pyramid and work only if backed by clear and credible sanctions.
Code. Lessig’s argument that the architecture of software regulates behaviour as effectively as law,21 and Zetzsche, Arner and Buckley’s related point that automated decisions make conventional supervision difficult,22 are used as a supporting perspective. They explain why the Guidance Note regulates the design of the lending platform itself, through consent and permission rules, and why rules on automated credit scoring and collection messages belong in an effective framework.
The theories yield a dual standard. A rule must be assessed by whether it addresses the market failures of digital lending, and also by whether it is binding, backed by a credible sanction and capable of reaching the persons who actually lend. The distinction between binding law, that is, Acts and published regulations that can create offences and penalties, and administrative guidance issued in the exercise of a regulator’s functions, is used throughout to classify each obligation of a digital lender.
Existing scholarship
The literature on digital lending is organised around the tension between the inclusion that it brings and the risks to consumers, and around the difficulty regulators have in keeping pace. Writers disagree on whether existing rules suffice or new mechanisms are needed. The works reviewed are grouped by the question they address.
Three writers address Tanzania directly. Njovu compares the regulation of digital lending in Tanzania and Kenya, identifies gaps in consumer protection, data privacy, interest-rate standards and oversight, finds Kenya’s model more developed in its mandatory licensing, centralised supervision and data protection, and recommends consolidating the Tanzanian instruments.23 Her analysis, however, treats the framework at a general level and does not examine the legal basis of the Guidance Note or the unused power under section 60(2)(q). Mpogole analyses consumer protection in app-based lending, argues that many provisions of the 2019 Regulations are impractical for lending through applications, and concludes that the administrative penalties under regulation 60 are too small to deter digital lenders.24 Mpogole also shows that the Guidance Note prohibits threats and access to the phone book without saying which methods of collection are lawful. His focus is consumer protection in general, and he does not ask how the framework applies to unlicensed lenders. Makungu examines much of the same framework and identifies three weaknesses: the absence of a binding cap on default charges, the limited legal force of guidance-based regulation and the lack of any requirement for algorithmic transparency in automated credit scoring.25 The second overlaps with the deficiency in legal force argued here; Makungu treats the reach of the rules to unlicensed and foreign-hosted lenders as an operational obstacle to enforcement.
A second group concerns the regulation of financial technology. Buckley, Arner and Zetzsche explain how digital platforms change financial intermediation and describe the distinction between regulating institutions and regulating activities,26 while Zetzsche and others trace regulatory responses from inaction to sandboxes and ‘smart regulation’.27 These accounts draw on developed and large emerging markets, and presuppose a level of supervisory capacity that Tanzania has not reached. They do not address the more basic problem examined here, that the conduct rules for digital lenders are not in binding law. Zetzsche, Arner and Buckley’s work on decentralised finance explains why automated systems are hard to supervise,28 although Tanzanian app-based lending is far less decentralised, since an identifiable company stands behind each application.
A third group concerns consumer protection in digital credit. Mazer and McKee identify poor disclosure, over-indebtedness, weak complaint mechanisms, abusive collection and data misuse as the main risks and recommend standardised disclosure of the total cost of credit;29 Sommer recommends closing licensing loopholes;30 the World Bank catalogues regulatory options including activity-based licensing;31 and Buckley and Webster show why disclosure written for sophisticated customers may not protect low-income borrowers.32 Sahay and others and Agur, Martinez Peria and Rochon confirm the regulatory lag that followed the acceleration of digital finance during the pandemic.33 These works supply the international benchmark but none tests a national statute.
A fourth group concerns data and institutions. Sarara argues that the Personal Data Protection Act does not specify sufficiently how consent is to be obtained, so that consent given through standard online forms may not be truly informed,34 and Ndikimi comments on the decision in Tito Magoti v. Attorney General, in which the High Court found sections 22(3) and 23(3)(c) and (e) vague.35 Mwenda’s argument that fragmented regulatory structures produce overlaps and gaps that providers can exploit,36 and Avgouleas’s observation that formal powers are of little value without capacity and independence,37 bear directly on the division of mandates between the Bank, the Personal Data Protection Commission and TCRA. None of these works examines digital lending in Tanzania.
Three gaps emerge. Existing Tanzanian scholarship treats the framework at a general level and, although Makungu notes the limited force of guidance, does not classify each obligation as binding or non-binding. The international works are not tested against the specific Tanzanian instruments. And none of these works examines how far the framework reaches lenders that are not licensed at all. This article fills those gaps through a focused doctrinal analysis of the instruments governing Tier 2 digital lenders.
The legal framework
A. The constitutional foundation and the Microfinance Act
The Constitution does not deal with lending, but two provisions shape the framework. Article 16 protects privacy, including private communications, and requires legal procedures for any encroachment; the harvesting of contacts and the messaging of third parties touch it directly. Article 13(6)(a) guarantees a fair hearing, which matters because a sanction imposed for breach of an obligation that is not clearly contained in law is vulnerable to challenge.38
The Microfinance Act is the principal statute. Section 4(3)(d) lists ‘digital microfinance services’ among microfinance activities, but does not define them, and section 5 places non-deposit-taking providers in Tier 2, so that digital lending is regulated as one variety of Tier 2 business; nothing in the Act distinguishes an app-based lender from a money lender who operates from a shop.39 Section 16(1) prohibits any person from carrying on microfinance business without a licence, and section 16(2)(a) punishes the Tier 2 offence by a fine of twenty to one hundred million shillings, imprisonment of two to five years, or both.40 It is addressed to ‘a person’ generally, and so is the main instrument against unlicensed digital lenders; but it is a criminal prohibition that requires the lender to be identified, located and prosecuted, and it does not subject an unlicensed lender to any conduct rule.
Section 12(3) gives the Bank its functions, including issuing circulars and guidelines and, in paragraph (h), protecting consumers ‘including sanctioning usurious lending practices’. That function shows that Parliament contemplated control of price and not only its disclosure, but the Act neither defines usury nor attaches a sanction to it.41 Part VII requires transparency on interest, fees and penalties (section 50(2)(f)) and voids clauses allowing unilateral changes to interest (section 50(4)); section 51 requires debts to be collected as prescribed in regulations, beginning with written notice, with attachment of property as a last resort. That section was drafted for secured lending, whereas digital loans are almost always unsecured and the harmful practices, messaging contacts and publishing details, are not attachment of property.42 Finally, section 60(2)(q) empowers the Bank to make regulations on the ‘conditions and manners for providing digital microfinance business’. That power shows that Parliament anticipated binding rules for digital lending.43 It had not been exercised in November 2025, when the Bank’s draft rules for digital financial platforms were reported to be still at the internal stage, and in January 2026 the Deputy Minister for Finance told the National Assembly that rules on digital lending were expected to take effect in the 2026/27 financial year.44
B. The regulations, guidelines and consumer protection rules
The 2019 Microfinance Regulations. Regulation 3 recognises ‘digital microfinance lenders’ but, beyond the definition, the Regulations contain no rule specific to digital lending.45 Regulations 37 and 39 require a lending policy and a loan agreement stating nominal and effective annual interest rates, fees, the total payable and the signatures of both parties, assuming a paper agreement and a place of business and saying nothing on how the contents are to be shown on a mobile screen. There is no limit on interest and no provision on usury; regulation 56(3) only prohibits charges not prescribed in the agreement. Regulation 56 requires fourteen days’ written notice before recovery and prohibits harassment, abuse, oppression, violence, obscene language and false representations, but in general terms that do not mention contacts, device data or online shaming. The maximum administrative penalty under regulation 60(1)(h) is five million shillings.46 The 2025 draft that is to replace the Regulations is reported to change capital, licensing and permitted activities, but it contains no provision on digital lending beyond the definition, no limit on interest and no collection rule directed at contacts, device data or online shaming. A separate draft, the Microfinance (Digital Lending) Regulations, 2025, made under section 60, would carry the prohibitions on contacts and shaming into regulations with sanctions, but it sets no limit on interest.47
The Financial Consumer Protection Regulations. Made under the Bank of Tanzania Act, these Regulations contain the most developed rules on disclosure, requiring disclosure of the total cost of credit including the annual percentage rate, a key facts statement and, since the 2025 amendment, calculation of interest on the reducing balance.48 They prohibit abusive debt recovery, require a complaints mechanism with a binding determination by the Bank and allow sanctions up to twenty million shillings.49 They do not mention platforms, device data or contacts, and they apply only to financial service providers licensed and supervised by the Bank: the Bank’s own notices warn that borrowers who deal with unapproved platforms may lose their protection.50
The Guidelines on Fees and Charges, 2024. The Guidelines prohibit named categories of fee, bar the bundling of fees under vague labels, and require the Bank’s approval of new or increased fees, but they require interest rates only to be published and set no ceiling on them. They allow a fine or penalty of up to twenty million shillings. For a short loan whose cost lies in interest or a flat charge, the distinction between fee and interest can be manipulated.51
C. The Guidance Note
The Guidance Note is, in substance, the instrument best suited to digital lending. It requires a licensed provider to operate a platform that obtains specific consent before accessing device data, limits permissions to what the credit process requires, displays its licensed name and its rates, fees and tenure before the borrower applies, and operates in Kiswahili; it requires a letter of no objection supported by the platform’s description, lending policy, pricing model and a registration certificate from the Personal Data Protection Commission; and it prohibits access to contacts, call logs, messages and photographs for identification or collection, offshore access to personal data, the use of guarantors without consent, threats, shaming and messages to the borrower’s contacts.52
Its weakness lies in its legal form, in three respects. First, it was issued under the function of issuing guidelines in section 12(3)(e) and not under the power to make regulations in section 60, so that it does not have the status of subsidiary legislation and does not by itself create enforceable obligations or offences. Secondly, it prescribes no sanction, so that the Bank must rely on a power found elsewhere, such as withdrawal of the no-objection letter or the administrative measures in the Regulations; some of its provisions map onto binding rules, but the prohibition on accessing contacts has no direct equivalent. Thirdly, it applies only to licensed providers with a no-objection letter, and is legally irrelevant to unlicensed lenders.53
D. The general statutes
The Personal Data Protection Act, in force since 1 May 2023, applies to every lender that processes personal data in Tanzania, whether or not licensed. It requires lawful, fair and necessary collection, limits use and disclosure to the purpose of collection, gives sensitive personal data, which includes financial transaction data, a higher level of protection, regulates transborder transfers and confers rights in relation to automated decisions.54 A lender that collects a whole contact list to assess or pressure a borrower collects data that is not necessary, and the contacts have neither consented nor been informed. The Act provides administrative fines of up to one hundred million shillings under section 47, and offences, and so a route of enforcement that does not depend on the lender being licensed. But it is a general statute that says nothing about device permissions, its reliance on consent is weak where the loan is urgently needed, and in Tito Magoti v. Attorney General the High Court found sections 22(3) and 23(3)(c) and (e), on collection and on when data need not be collected directly from the data subject, vague and ordered their amendment within one year of 8 May 2024, failing which they would be struck out.55 They are the provisions on which a digital lender’s collection of device data depends, and a review of Tanzanian data privacy law current to 10 September 2026 records no amending Act and no gazetted repeal.56
The Electronic Transactions Act supports the formation of digital loan agreements and applies consumer protection rules to online suppliers, but section 31(5) excludes financial services from the seven-day right to cancel an electronic transaction, so that the borrower has no statutory cooling-off period.57 The National Payment Systems Act protects customer information held by payment system providers and requires the Bank to cooperate with other regulators, but it imposes no duty on a provider to refuse service to an unlicensed lender, leaving the point through which every loan must pass unused as a point of control.58 The Cybercrimes Act creates offences of harassing electronic communication and of publishing false or abusive information, which may reach shaming messages, and the Law of Contract Act offers case-by-case relief for undue influence, a remedy impractical for small sums.59
E. The institutional framework
The Bank is the principal regulator: it licenses providers, issues no-objection letters, makes regulations and guidelines, imposes administrative sanctions and publishes lists of approved and unapproved platforms. The Personal Data Protection Commission registers controllers, investigates complaints and imposes fines on every lender that processes data in Tanzania; the only formal link between it and the Bank is the requirement that an applicant for a no-objection letter produce its registration certificate. TCRA has no mandate over lending, but its cooperation is needed to block applications. The Police and prosecutors enforce the criminal provisions. No instrument establishes coordination among them, and there is no reported judicial decision on digital lending.60
F. The Kenyan comparator
Kenya met the same problems with dedicated legislation. The Central Bank of Kenya (Amendment) Act, 2021 extended the Central Bank of Kenya Act to digital credit providers, and the Central Bank of Kenya (Digital Credit Providers) Regulations, 2022 applied to digital credit business defined by the activity.61 Regulation 4(1) prohibits operating a digital credit business without a licence. On price, the Central Bank’s prior written approval is required for changes to a pricing model, with thirty days’ notice and the customer’s acceptance before charges rise; on disclosure, a key information document and the total cost of credit, including the annual percentage rate, must be shown before credit is granted. Regulation 20 prohibits the use of the customer’s contacts, the publication of information to shame, and unauthorised messages to contacts. Regulation 14 excludes negative credit reports of one thousand Kenya shillings or less and requires notice before and after reporting, regulation 22 requires complaints to be resolved within thirty days, and regulation 37 allows monetary penalties, daily penalties and suspension or revocation of the licence.62 Those Regulations were replaced on 29 September 2026 by the Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026, following the widening of the Central Bank of Kenya Act by the Business Laws (Amendment) Act, 2024; the account above is of the 2022 text, on which this comparison rests.63
Findings
The analysis yields six principal findings.
First, the framework is extensive but its rules specific to digital lending lack legal force. The Microfinance Act has since 2018 empowered the Bank to make regulations on digital microfinance business, but the 2019 Regulations contain only a definition, and the detailed obligations of digital lenders, including the prohibitions on accessing contacts and on shaming, are in a guidance note issued under the Bank’s general functions, which prescribes no penalty. A sanction imposed solely for breach of the Note may be challenged as lacking a legal basis, and the Bank can usually avoid the difficulty only by invoking a binding provision that the same conduct also breaches.
Secondly, applicability depends on the category of lender. The framework applies fully only to licensed Tier 2 providers that hold a no-objection letter, a small group, since only four of twenty applications had been approved by November 2024. It applies partially to licensed providers that lend digitally without clearance, whose conduct contravenes the Note but not, in terms, any provision creating an offence, so that the Bank’s treatment of it as unlicensed business under section 16 is an interpretation not yet tested in court. And it applies hardly at all to unlicensed and foreign-hosted lenders: they commit an offence by lending, but they are not in breach of the disclosure rules of regulation 39 or the collection rules of regulation 56, because those rules do not apply to them. Their borrowers are protected only by the Personal Data Protection Act and the Cybercrimes Act, both enforced by authorities other than the Bank.
Thirdly, the framework controls the price of credit by disclosure alone. No instrument limits interest or the total cost of credit; the function of sanctioning usurious lending has no defined content; the Guidelines control fees but not interest, which invites substitution; the rules on presenting the annual percentage rate were designed for paper agreements, and the Guidance Note requires display ‘before applying for a loan’ without requiring the annual percentage rate as such; and the Electronic Transactions Act denies the borrower a cooling-off right. A flat charge of fifteen per cent for a thirty-day loan, for instance, corresponds to an annual cost of at least one hundred and eighty per cent, a figure the borrower who sees only ‘fifteen per cent’ may not appreciate.
Fourthly, the binding rules on data and debt collection are general and fragmented. The specific rules on device permissions, contacts and offshore access are in the Guidance Note, and the binding rules in the Personal Data Protection Act depend on a consent that is weak in urgent borrowing, cannot justify the collection of third persons’ data, and rest in part on provisions found vague in Tito Magoti. The prohibitions on abusive collection are spread across section 51 of the Act, regulation 56, the Financial Consumer Protection Regulations and the Guidance Note with different wording and sanctions; the rules say what lenders may not do but not what they may do; credit reporting, the principal lawful lever, is regulated by neither notice nor a minimum amount; and a third person who receives collection messages has no specific remedy. Nor do the instruments distinguish a guarantor, who has assumed liability, from an emergency contact, who has assumed none, or say how a guarantor’s consent is to be obtained digitally.
Fifthly, sanctions are low and inconsistent. The maximum administrative penalty is five million shillings under the 2019 Regulations, twenty million under the Financial Consumer Protection Regulations and the Guidelines, none under the Guidance Note, and one hundred million under the Personal Data Protection Act. The criminal penalties are higher but depend on identifying and prosecuting the lender. Since a single failure to disclose a fee may breach three instruments, the Bank has a choice of sanction that the law does not guide.
Sixthly, enforcement faces structural obstacles beyond the content of the rules. Mandates are divided among the Bank, the Commission, TCRA and the Police with no formal coordination; unlicensed lenders can be reached only by detecting, blocking and prosecuting them, steps that are reactive and depend on administrative cooperation, since the law places no duty on app stores, mobile network operators or payment system providers; borrowers of unlicensed lenders have no financial-regulatory complaint route; and the Commission and the Bank are still building capacity. Self-regulation, begun in 2025, reaches only lenders inside the licensed sector.
Discussion of findings
A. Applying the theoretical standard
The findings confirm the theoretical expectations. On the public interest theory, disclosure corrects one market failure, the asymmetry of information, but not the others. It helps a borrower who can compare offers and refuse an expensive loan; for a borrower who needs money urgently and has no alternative, the problem is lack of bargaining power, and disclosure does not correct it. On the theory of entity-based and activity-based regulation, the framework attaches conduct obligations to the status of being a licensed provider, so that unlicensed lenders, who carry on exactly the same activity and often with worse practices, are outside the obligations. The framework therefore produces the regulatory arbitrage that the theory predicts: the lenders most likely to harm borrowers are those least bound by the rules. A comparison with bank and mobile-network-operator credit shows that the gap is not inherent in digital credit. The same technology offered by supervised institutions within a binding framework gives borrowers considerably more protection, so the reform needed is a reform of the perimeter and of legal force, not a prohibition of any technology. On responsive regulation, the Guidance Note and self-regulation sit at the base of the pyramid, but the upper tiers rest on instruments whose application to digital lending is uncertain, and the credible sanction at the apex, revocation of the licence or no-objection letter, is irrelevant to those who never obtained one.
B. Options for controlling price
If disclosure alone is insufficient, three further options exist in ascending order of intervention. The first controls elements of price without fixing its level, as Tanzania already does through the Guidelines and the reducing-balance rule. The second subjects each lender’s pricing model to the regulator’s prior approval, the Kenyan approach, already partly contemplated by the Guidance Note, which requires a pricing model with the no-objection application and approval of changes; what is missing is a legal standard by which to decide, and a binding basis. The third is a ceiling on interest or total cost, which gives the clearest protection but risks driving lenders from the highest-risk borrowers or into the unlicensed sector, where a ceiling cannot be enforced, and is hard to design for loans of a few days whose fixed costs a fixed annual rate may not cover. The least disruptive course is to combine the second option with a presumption: usurious lending defined by reference to a total cost of credit, expressed as an annual percentage rate, above which the lender must justify its price to the Bank. That would give section 12(3)(h) legal content without fixing a rigid ceiling.
C. Data, consent and third parties
The specific and the general rules are substantively complementary but differ in legal force and in whom they bind. A licensed lender that accesses a borrower’s contacts breaches a clear rule in the Note; an unlicensed lender that does the same breaches only the general principles of the Act, which require a contextual judgment case by case. Because a borrower cannot consent on behalf of the persons in his contact list, consent cannot justify the collection of their data at all, and the reform should therefore prohibit the collection of non-essential device data as a binding rule irrespective of consent. The same logic applies to guarantors and emergency contacts: a person named only as an emergency contact has no legal relationship with the lender, and any message to him about the debt discloses the borrower’s personal data and intrudes on his own privacy. Where lenders and servers are offshore and unlicensed, neither the Bank nor the Commission can inspect their systems, and the exception for ‘maintenance and improvement’ in the offshore-access prohibition is broad and undefined.
D. Lessons from Kenya
The Kenyan regime differs from the Tanzanian in three respects that bear directly on the gaps identified. It is activity-based, attaching licensing and conduct rules to the business of digital credit; its rules on contacts and shaming are in regulations with a statutory basis and prescribed penalties, not in guidance; and it controls price indirectly, through approval of pricing models, without a ceiling. Njovu likewise finds the Kenyan model more developed. The experience also shows the limits of regulation: licensing does not by itself eliminate unlicensed lending, effectiveness depends on supervisory capacity, and Kenya’s market is larger and its resources greater. The lessons are therefore of legal design and not models to be copied. The rules should be in binding regulations with sanctions; conduct rules should attach to the activity; price can be controlled through approval and standardised disclosure of the annual percentage rate if a ceiling is not yet acceptable; and credit reporting should be regulated as the principal lawful lever of collection.
E. Limits and qualifications
Several qualifications temper the analysis. The findings concern statutory design and not performance, and the Bank may use its tools more effectively than the text suggests. The Draft Regulations of 2025 and the rules on digital lending announced for 2026/27 may change the position, and the amendment ordered in Tito Magoti may already have been made. An activity-based perimeter cannot by itself make foreign-hosted lenders reachable; it must be combined with duties on the intermediaries through which they reach borrowers, and the practical reach of a domestic regime over offshore applications remains an open question. A ceiling on price may drive lending into the unlicensed sector. And capacity matters: regulations that the Bank and the Commission cannot supervise would add little. These qualifications explain why the recommendations below are sequenced, and why they build first on powers that already exist.
Conclusion and recommendations
A. Conclusion
This article has argued that the legal framework for digital lending by Tier 2 microfinance service providers in Tanzania is extensive in coverage but deficient in legal force, in substance on price and in reach. The rules that address digital lending most directly are in a guidance note rather than in regulations, although the Microfinance Act has since 2018 provided for regulations on digital microfinance business. The price of credit is controlled by disclosure alone, and the binding rules on data and collection are general and fragmented, with inconsistent sanctions. Because the conduct rules attach to licensed institutions, the framework is least effective against unlicensed and foreign-hosted lenders, which are the source of the greatest harm. These deficiencies confirm what the public interest theory, the distinction between entity-based and activity-based regulation and responsive regulation predict. The reform required is therefore not a wholly new legal regime but the conversion of existing rules into binding, activity-based regulations with consistent and deterrent sanctions, supported by a modest control of price, targeted amendment of data protection law and formal coordination between regulators.
B. Recommendations
The recommendations are proposals for reform. They are to be distinguished from the rules that Tanzanian law already provides and from the gaps described in Parts V and VI.
First, make binding digital microfinance regulations. The Bank should exercise its power under section 60(2)(q) of the Microfinance Act to make Microfinance (Digital Microfinance Business) Regulations, published in the Gazette, incorporating the substance of the Guidance Note: minimum criteria for digital lenders, approval of each platform, the prohibitions on access to contacts and device data and on offshore access to personal data, and the prohibitions on abusive collection. They should prescribe administrative penalties for each category of breach under section 60(2)(n), and the Guidance Note can then be retained as an explanatory document. Arranged in parts on application and definitions, approval of platforms, pricing and disclosure, data, collection, complaints and reporting, and sanctions, the regulations would bring together the rules now spread across four instruments and remove the uncertainty about which applies.
Secondly, adopt an activity-based perimeter. Parliament should amend the Microfinance Act so that the conduct obligations on disclosure, data and collection apply to any person who carries on digital microfinance business, whether or not licensed, defined by the activity of extending credit through digital channels. The amendment should also require payment system providers and mobile network operators to refuse or suspend services to platforms on the Bank’s list of unapproved platforms, give TCRA an express duty to block access on the Bank’s request, and require the Bank to keep a public register of approved platforms so that borrowers can verify a lender.
Thirdly, give price a legal standard. The regulations should define usurious lending for the purpose of section 12(3)(h) by reference to a total cost of credit expressed as an annual percentage rate, above which a loan is presumed usurious and must be justified to the Bank; require prior approval of each pricing model and of changes to it; require a standardised key facts screen before the borrower accepts a loan, showing the principal, the total repayable, the repayment date and the annual percentage rate in Kiswahili and English; and give the borrower a short right of withdrawal, for example three days, by repaying the principal without charges, together with amendment of section 31(5) of the Electronic Transactions Act or a specific provision in the regulations.
Fourthly, strengthen data protection. Parliament should amend sections 22(3) and 23(3)(c) and (e) of the Personal Data Protection Act, as directed in Tito Magoti v. Attorney General, if this has not been done; the regulations should prohibit as a binding rule the collection of contacts, call logs, messages, photographs and other device data not strictly necessary for identification and credit assessment, irrespective of consent; the Commission should issue guidance for digital lenders on the data that may be collected, the form of consent and automated scoring; and the Bank and the Commission should agree a procedure for verifying where each approved lender’s data is stored.
Fifthly, adopt a single code of collection practice. The regulations should consolidate, for digital lenders, regulation 56 and paragraph 5.1(f) of the Guidance Note; specify the permitted methods, namely reminders to the borrower, contact with a guarantor who has given written consent, reporting to a credit reference bureau and legal proceedings, and prohibit other contact with third persons; limit the frequency and hours of contact; require at least fourteen days’ notice before reporting a default and set a minimum amount below which negative information is not reported; require a guarantor’s consent to be obtained directly from the guarantor through a verified channel before disbursement; and make the lender responsible for the conduct of its agents.
Sixthly, make sanctions consistent and deterrent. The Bank should amend regulation 60 of the 2019 Regulations, or provide in the new regulations, for administrative penalties consistent with those under the Financial Consumer Protection Regulations and proportionate to the scale of the lender’s business, with daily penalties for continuing breaches and publication of names, and should state which penalty applies where conduct breaches more than one instrument.
Seventhly, coordinate institutions and improve redress. The Bank, the Commission, TCRA and the Police should conclude a memorandum of understanding on referral of complaints, exchange of information, joint inspections and coordinated action against unlicensed lenders, and the duty of cooperation in section 55 of the National Payment Systems Act should in the longer term be matched in the Microfinance Act. The Bank should establish a single complaints channel accessible by telephone and short message, publish periodic reports on complaints and enforcement, run awareness campaigns with the Commission, develop supervisory technology to test the permissions applications request, and require self-regulatory associations to adopt codes of conduct consistent with the regulations.
The recommendations can be implemented in stages. In the short term, the Bank can make the digital microfinance regulations, amend regulation 60 and conclude the memorandum of understanding, none of which requires primary legislation. In the medium term the Commission can issue guidance and Parliament can amend the Personal Data Protection Act. In the longer term Parliament can adopt the activity-based perimeter and amend the National Payment Systems Act and the Electronic Transactions Act to support it. The sequence reflects the finding that much of the reform needed lies within the Bank’s existing powers.
Three anticipated objections deserve brief response. It may be said that the Bank already acts effectively through notices, lists and blocking. Those measures are valuable, but they are reactive and rest on guidance and cooperation, and a sanction that depends on legal ingenuity is weaker than one resting on clear rules. It may be said that a defined standard of usury or a ceiling will drive lenders into the unlicensed sector. That risk is the reason for recommending a presumption and prior approval and not a rigid ceiling, and for pairing the pricing reform with an activity-based perimeter and intermediary duties that reach unlicensed lenders. And it may be said that the regulators lack the capacity to supervise binding regulations. The objection is not dismissed, which is why the proposals begin with powers the Bank already holds and build institutional coordination and supervisory technology in stages.
Future research agenda
This study has provided a doctrinal analysis with a limited comparison, and several avenues remain open. First, empirical studies of the practices of licensed and unlicensed digital lenders in Tanzania, including the permissions their applications request, their pricing and their collection methods. Secondly, studies of the experience of borrowers and of third persons who receive collection messages, conducted under a proper research-ethics protocol. Thirdly, an assessment of the Bank’s enforcement actions and of the effect of the 2024 Guidance Note and the 2025 self-regulation initiative. Fourthly, a study of digital lending regulation in Zanzibar under the Zanzibar Microfinance Service Act, 2023. Fifthly, a study of the use of artificial intelligence and alternative data in credit scoring and its implications for data protection and discrimination. Finally, should the reforms proposed here be adopted, a longitudinal study of their first years would test the calibration choices defended in this article.
*****
Footnotes
1. Microfinance (Non-Deposit Taking Microfinance Service Providers) Regulations, 2019, GN No. 679 of 2019, reg. 3 (Tanz.).
2. Bank of Tanzania, Guidance Note on Digital Lenders under Tier 2 Microfinance Service Providers, 2024 (Aug. 2024), https://www.bot.go.tz/Publications/Acts,%20Regulations,%20Circulars,%20Guidelines/Guidelines/en/2024082813141188.pdf; Esther Takwa, Bank of Tanzania Blocks 69 Unlicensed Loan Apps, Daily News (Dar es Salaam), Nov. 21, 2024, https://dailynews.co.tz/bank-of-tanzania-blocks-69-unlicensed-loan-apps/.
3. Microfinance Act, Cap. 407 R.E. 2023, §§ 12, 60 (Tanz.).
4. Terry Hutchinson & Nigel Duncan, Defining and Describing What We Do: Doctrinal Legal Research, 17 Deakin Law Review 83 (2012), https://doi.org/10.21153/dlr2012vol17no1art70.
5. Alliance for Financial Inclusion, Digital Credit Regulation in Tanzania (Case Study, 2020).
6. Id.
7. Financial Sector Deepening Trust, FinScope Tanzania 2023 (2023).
8. Rafe Mazer & Kate McKee, Consumer Protection in Digital Credit (CGAP Focus Note No. 108, 2017); Christoph Sommer, Addressing the Challenges of Digital Lending for Credit Markets and the Financial System in Low- and Middle-Income Countries (German Development Institute Briefing Paper 23/2021, 2021).
9. Microfinance Act, supra note 3, §§ 4(3)(d), 12(3)(h), 60(2)(q).
10. Bank of Tanzania (Financial Consumer Protection) Regulations, 2019, GN No. 884 of 2019 (Tanz.); Bank of Tanzania, Guidelines on Fees and Charges for Microfinance Service Providers, 2024, https://www.bot.go.tz/Publications/Acts,%20Regulations,%20Circulars,%20Guidelines/Guidelines/en/2024071716375097.pdf.
11. Electronic Transactions Act, Cap. 442 R.E. 2023 (Tanz.); National Payment Systems Act, Cap. 437 R.E. 2023 (Tanz.); Personal Data Protection Act, Cap. 44 R.E. 2023 (Tanz.); Constitution of the United Republic of Tanzania, 1977, art. 16.
12. Tenda Msinjili & Barbara Mawalla, Prohibition of Lending without a Licence, Clyde & Co (Jan. 10, 2023), https://www.clydeco.com/en/insights/2023/01/prohibition-of-lending-without-a-licence (last visited Oct. 21, 2026).
13. E. Onyango, BoT Continues to Tighten Control on Deceitful Digital Money Lenders, The Guardian (Dar es Salaam), Mar. 12, 2025, https://www.ippmedia.com/the-guardian/features/read/bot-continues-to-tighten-control-on-deceitful-digital-money-lenders-2025-03-11-172916.
14. Guidance Note, supra note 2, paras. 3.1, 4.1, 5.1.
15. B. Karashani, Tanzania Cracks Down on Unlicensed Digital Lenders, The EastAfrican (Nairobi), Nov. 21, 2024, https://www.theeastafrican.co.ke/tea/business-tech/tanzania-cracks-down-on-unlicensed-digital-lenders-4831680; Takwa, supra note 2.
16. Bank of Tanzania, List of Unapproved Digital Lending Platforms, https://www.bot.go.tz/BankSupervision/digitalLanding (last visited Oct. 21, 2026); Bank of Tanzania (Financial Consumer Protection) (Amendment) Regulations, 2025, GN No. 298 of 2025 (Tanz.); Clyde & Co, An Overview of Tanzania’s Microfinance Regulations: Key Changes for Non-Deposit Taking Microfinance Service Providers (Apr. 9, 2025), https://www.clydeco.com/en/insights/2025/04/an-overview-of-the-microfinance-regulations-2025 (last visited Oct. 21, 2026); TanzaniaInvest, Bank of Tanzania Begins Implementation of Self-Regulation for Tier II Microfinance Providers, Sets Six-Month Deadline to Join National Associations (Aug. 8, 2025), https://www.tanzaniainvest.com/finance/banking/tier-2-microfinance-self-regulation-launch.
17. A.C. Pigou, The Economics of Welfare (4th ed. 1932).
18. George J. Stigler, The Theory of Economic Regulation, 2 Bell Journal of Economics and Management Science 3 (1971), https://doi.org/10.2307/3003160.
19. Ross P. Buckley, Douglas W. Arner & Dirk A. Zetzsche, FinTech: Finance, Technology and Regulation (2024).
20. Ian Ayres & John Braithwaite, Responsive Regulation: Transcending the Deregulation Debate (1992).
21. Lawrence Lessig, Code: Version 2.0 (2006).
22. Dirk A. Zetzsche, Douglas W. Arner & Ross P. Buckley, Decentralized Finance, 6 Journal of Financial Regulation 172 (2020), https://doi.org/10.1093/jfr/fjaa010.
23. Radhia Njovu, Digital Lending Regulation in Tanzania: Lessons from Kenya and Policy Insights, 8(2) East African Journal of Law and Ethics 125 (2025), https://doi.org/10.37284/eajle.8.2.4029.
24. Matunda Mpogole, The Examination of Consumer Protection and Digital Lending Law and Practice in Tanzania, 7(1) East African Journal of Law and Ethics 172 (2024), https://doi.org/10.37284/eajle.7.1.2496.
25. Dominic Karoli Makungu, Consumer Protection in Digital Lending in Tanzania: Assessing Legal Adequacy and Operational Compliance Challenges, 9(3) East African Journal of Law and Ethics 432 (2026), https://doi.org/10.37284/eajle.9.3.5758.
26. Buckley, Arner & Zetzsche, supra note 19.
27. Dirk A. Zetzsche, Ross P. Buckley, Janos N. Barberis & Douglas W. Arner, Regulating a Revolution: From Regulatory Sandboxes to Smart Regulation, 23 Fordham Journal of Corporate and Financial Law 31 (2017).
28. Zetzsche, Arner & Buckley, supra note 22.
29. Mazer & McKee, supra note 8.
30. Sommer, supra note 8.
31. World Bank, Consumer Risks in Fintech: New Manifestations of Consumer Risks and Emerging Regulatory Approaches (Policy Research Paper, 2021).
32. Ross P. Buckley & Sarah Webster, FinTech in Developing Countries: Charting New Customer Journeys, 44 Journal of Financial Transformation 151 (2016).
33. Ratna Sahay et al., The Promise of Fintech: Financial Inclusion in the Post COVID-19 Era (IMF Departmental Paper No. 20/09, 2020); Itai Agur, Soledad Martinez Peria & Celine Rochon, Digital Financial Services and the Pandemic: Opportunities and Risks for Emerging and Developing Economies (IMF Special Series on COVID-19, 2020).
34. M.C. Sarara, Is Consent Truly Informed? A Critical Analysis of Consent under the Tanzania Personal Data Protection Act, 2022, 9(1) East African Journal of Law and Ethics 454 (2026), https://doi.org/10.37284/eajle.9.1.4870.
35. Stella Ndikimi, Legal Challenges and Constitutional Issues on the Personal Data Protection Act 2022: Analysis of the Case of Tito Magoti v. The Attorney General, Mondaq (June 27, 2024), https://www.mondaq.com/data-protection/1571706 (last visited Oct. 21, 2026).
36. Kenneth K. Mwenda, Legal Aspects of Financial Services Regulation and the Concept of a Unified Regulator (2006).
37. Emilios Avgouleas, Governance of Global Financial Markets: The Law, the Economics, the Politics (2012).
38. Constitution of the United Republic of Tanzania, 1977, arts. 16, 13(6)(a).
39. Microfinance Act, supra note 3, §§ 4(3)(d), 5.
40. Id. §§ 16(1), 16(2)(a).
41. Id. § 12(3)(e), (h).
42. Id. §§ 50(2)(f), 50(4), 51.
43. Id. § 60(2)(n), (q).
44. Rosemary Mirondo, Bank of Tanzania Drafts Regulations to Oversee Digital Financial Platforms, The Citizen (Dodoma), Nov. 20, 2025, https://thecitizen.co.tz/tanzania/news/national/bank-of-tanzania-drafts-regulations-to-oversee-digital-financial-platforms-5271234; Sauli Giliard, Government Tightens Screw on Predatory Lending Practices, Daily News (Dar es Salaam), Jan. 29, 2026, https://dailynews.co.tz/?p=126887.
45. Microfinance Regulations, supra note 1, regs. 3, 37, 39, 56.
46. Id. regs. 56(3), 60(1)(h).
47. Clyde & Co, supra note 16; Bank of Tanzania, Draft Microfinance (Non-Deposit Taking Microfinance Service Providers) Regulations, 2025, https://www.bot.go.tz/webdocs/Feedback/sw/2025021417073455.doc; Bank of Tanzania, Draft Microfinance (Digital Lending) Regulations, 2025, https://www.bot.go.tz/webdocs/Feedback/en/2025021417082152.docx.
48. Financial Consumer Protection Regulations, supra note 10, regs. 22, 26(1)(d), 27; Financial Consumer Protection (Amendment) Regulations, supra note 16.
49. Financial Consumer Protection Regulations, supra note 10, regs. 11, 61(1), pt. IX.
50. Bank of Tanzania, List of Unapproved Digital Lending Platforms, supra note 16.
51. Guidelines on Fees and Charges, supra note 10, guidelines 16 to 23; the fine or penalty is fixed by guideline 21(1).
52. Guidance Note, supra note 2, paras. 3.1, 4.1, 4.3, 5.1, 6.1.
53. Id.; Microfinance Act, supra note 3, §§ 12(3)(e), 60.
54. Personal Data Protection Act, supra note 11, §§ 3, 5, 22, 23, 25, 26, 30, 31, 32, 36.
55. Tito Magoti v. Attorney General, Misc. Civ. Cause No. 18 of 2023, [2024] TZHC 1939 (High Ct. Tanz. May 8, 2024); Ndikimi, supra note 35; Personal Data Protection Act, supra note 11, § 47; DLA Piper, Data Protection Laws of the World: Tanzania (last modified Mar. 24, 2026), https://www.dlapiperdataprotection.com/index.html?t=law&c=TZ (last visited Oct. 21, 2026).
56. Recording Law Editorial Team, Tanzania Data Privacy Laws: PDPA 2022 Guide (2026), Recording Law (reviewed Sept. 10, 2026), https://www.recordinglaw.com/world-laws/world-data-privacy-laws/tanzania-data-privacy-laws/.
57. Electronic Transactions Act, supra note 11, §§ 4, 5, 22, 27, 29, 31(5).
58. National Payment Systems Act, supra note 11, §§ 48, 52, 55.
59. Cybercrimes Act, Cap. 443 R.E. 2023, §§ 16, 23 (Tanz.); Law of Contract Act, Cap. 345 R.E. 2019, § 16 (Tanz.).
60. Personal Data Protection Act, supra note 11, § 6; Guidance Note, supra note 2, para. 4.1.
61. Central Bank of Kenya (Amendment) Act, 2021 (Kenya); Central Bank of Kenya (Digital Credit Providers) Regulations, 2022, Legal Notice No. 46 of 2022 (Kenya), https://www.centralbank.go.ke/wp-content/uploads/2022/03/L-.N.-No.-46-Central-Bank-of-Kenya-Digital-Credit-Providers-Regulations-2022.pdf.
62. Central Bank of Kenya (Digital Credit Providers) Regulations, supra note 61, regs. 4(1), 13, 14, 17, 20, 22, 25, 26, 27, 29, 37.
63. Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026, Legal Notice No. 191 of 2026 (Kenya), https://new.kenyalaw.org/akn/ke/act/ln/2026/191/eng@2026-09-29; MMS Advocates, The Central Bank of Kenya (Non-Deposit Taking Credit Providers) Regulations, 2026, https://mmsadvocates.co.ke/the-central-bank-of-kenya-non-deposit-taking-credit-providers-regulations-2026/.