On August 10, the Reserve Bank of India (RBI) released their <a class="Hyperlink SCXW9814176 BCX0" href="https://www.rbi.org.in/Scripts/BS_PressReleaseDisplay.aspx?prid=54187" target="_blank" rel="noreferrer noopener">recommendations on digital lending</a>. This is a significant moment, especially since the Indian government recently withdrew the data protection bill that aimed to protect consumers from the risks of digitalization and data proliferation. The bill, launched in 2019, was designed in light of concerns about data misuse by private players. A new bill is proposed as an alternative. However, while India awaits this, data regulation depends on sectoral regulations. These new recommendations on digital lending will help to regulate the multitude of digital lending apps that have exploded across India, and how they use consumer data.
<h1>Background on India’s Digital Lending Regulations</h1>
In this age of rapid digitalization, innovation opportunities grow as fast as the risks they pose to consumers, making it challenging for regulators to keep abreast of the changes. The RBI Working Group on digital lending reported that the <a class="Hyperlink SCXW115547155 BCX0" href="https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?UrlPage=&amp;ID=1189#S24" target="_blank" rel="noreferrer noopener">volume of digital credit has grown twelve-fold</a> between 2017 and 2020. <a class="Hyperlink SCXW115547155 BCX0" href="https://www.cgap.org/blog/evolving-nature-and-scale-consumer-risks-digital-finance#:~:text=These%20risks%20include%20mobile%20app,may%20result%20in%20over%2Dindebtedness." target="_blank" rel="noreferrer noopener">CGAP’s research on risks</a> in digital financial services (DFS) reveals that as of 2021 there are over 60 identified consumer risks, compared to only seven risks identified in 2015; and this list only continues to evolve.
<blockquote class="pullquote--left">India has been at the epicenter of DFS growth, but this growth has been accompanied by growing concerns about consumer risks.</blockquote>
India has been at the epicenter of <a href="https://www.imf.org/external/pubs/ft/fandd/2021/07/india-stack-financial-access-and-digital-inclusion.htm" target="_blank" rel="noopener noreferrer">DFS growth</a>, driven by extensive investments by the government in digital infrastructure, <a href="https://indiastack.org/" target="_blank" rel="noopener noreferrer">India Stack</a> – a comprehensive digital identity, payments and data management system, and investments. The <a href="https://www.investindia.gov.in/sector/bfsi-fintech-financial-services#:~:text=The%20digital%20investment%20market%20is,to%20%2410%20tn%20by%202026." target="_blank" rel="noopener noreferrer">digital investment market</a> in India is projected to be worth $14.3 billion in 2025, growing at a 5-year CAGR of 22.4 percent. This growth in DFS has been accompanied by growing concerns about consumer risks, such as <a href="https://themorningcontext.com/internet/why-does-upi-fail-so-often-for-banks-like-sbi" target="_blank" rel="noopener noreferrer">high failure rates in digital payments</a>, fraud, and poor redressal, among other challenges. Digital lending has been leading the charge on both innovations and rising consumer risks and, in response, the Reserve Bank of India (RBI) <a href="https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?UrlPage=&amp;ID=1189#S1" target="_blank" rel="noopener noreferrer">constituted a working group</a> on digital lending in 2021.

This is not the first time the RBI has needed to formulate regulations to protect consumers. The RBI’s past interventions in <a href="https://www.rbi.org.in/Scripts/PublicationsView.aspx?id=20377" target="_blank" rel="noopener noreferrer">microfinance</a> and <a href="https://www.rbi.org.in/Scripts/FS_report.aspx" target="_blank" rel="noopener noreferrer">digital payments</a> have allowed them to balance their conflicting goals of inclusion, consumer protection, stability, and growth-led innovation.

Digitalization and modularization of financial services create new regulatory challenges. Three challenges that stand out in the Indian context are lower entry barriers, India’s complex legal regime, and the absence of guidelines about what consumer data apps can collect.

To allow innovation, entry barriers are low, a concern raised in the<a href="https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?UrlPage=&amp;ID=1189" target="_blank" rel="noopener noreferrer"> working group’s report</a> especially as the market matures – a <a href="https://www.tuko.co.ke/378517-digital-lending-fixing-credit-access-barriers-fostering-growth-smes.html#:~:text=Digital%20lending%20is%20uniquely%20positioned%20to%20fix%20credit,poverty%20reduction%20and%20boosting%20national%20wealth%20and%20development." target="_blank" rel="noopener noreferrer">problem that previously has been seen and addressed</a> by regulators in Kenya. In India, this led to the <a href="https://www.centerforfinancialinclusion.org/combating-the-rise-in-fraudulent-fintech-apps">creation of lending apps, several of which were fraudulent and predatory</a>, and were launched during the pandemic when demand was high due to consumers’ loss or drop in income, loss of jobs, and health shocks.

India’s <a href="https://prsindia.org/files/policy/policy_committee_reports/1370600640_FSLRC%20Report%20Summary.pdf" target="_blank" rel="noopener noreferrer">complex and fragmented regulatory and legal regime</a> has been written about extensively in the past, and was acknowledged as a challenge by the RBI Working Group on digital lending in their recent report. In an era of modularization, where efficiency in delivery of digital credit is driven by partnerships with banks and non-bank finance companies, call centers, collection agents, and others, not all entities are directly regulated by RBI. This adds a layer of complexity to India’s already complex legal system that governs lending.

Earlier this month, India’s government <a href="https://themorningcontext.com/internet/india-withdraws-personal-data-protection-bill?type=short" target="_blank" rel="noopener noreferrer">withdrew the data protection bill</a>, which sought to empower citizens with rights related to their data. The removal of this bill now creates challenges for consumers in India, especially women and minority groups who can be targeted and don’t have control over how their data is used. Recent research in India showed that the very act of going online can <a href="https://www.dai.com/fi-cyber-user-trust.pdf" target="_blank" rel="noopener noreferrer">violate societal expectations of women</a>. Besides the obstacle this creates in narrowing the gender gap in India, the lack of laws and guidelines has led digital lending apps to seek <a href="https://www.cgap.org/blog/digital-consumer-credit-india-time-take-closer-look#:~:text=While%20there%20is%20no%20official%20count%20of%20the,least%20157%20apps%20operating%20as%20of%20July%202021." target="_blank" rel="noopener noreferrer">disproportionate permissions</a>, and then use consumer data to <a href="https://www.ft.com/content/16c86479-e88d-4a28-8fa4-cd72bace5104" target="_blank" rel="noopener noreferrer">“debt shame”</a> consumers who delay repayments. The prospect of social censure can be a powerful barrier for women in adopting DFS.
<blockquote class="pullquote--right">Digital environments exacerbate financial services risks that have existed for a long time.</blockquote>
It is worth repeating that digital environments exacerbate financial services risks that have existed for a long time. There are several ways that we see risks evolve in a digital era. Digital lenders in India communicate about prices in different ways, making it harder for consumers to compare and choose. Digital lenders requested processing fees upfront, regardless of whether or not a loan would be disbursed – a scheme profitable for lenders, but detrimental to consumers. Complaint channels in a digital environment are often non-existent or dehumanized, causing many consumers <a href="https://www.cgap.org/blog/analyzing-social-media-spot-digital-consumer-credit-risks-india" target="_blank" rel="noopener noreferrer">to resort to social media</a> to air their complaints. The absence of well-designed complaint channels can be a barrier to consistent use and can contribute to a lack of trust, especially among women. Finally, credit reporting during the pandemic took a backseat due to loan moratoria, and the modularized nature of digital lending meant that fintech lenders would often not report to credit bureaus, weakening existing credit reporting mechanisms even as the digital lending space evolved.
<h1>Positives of the New Recommendations</h1>
Not all digital lending is bad. We know that <a href="https://www.imf.org/-/media/Files/Publications/covid19-special-notes/en-special-series-on-covid-19-digital-financial-services-and-the-pandemic.ashx" target="_blank" rel="noopener noreferrer">timely access to affordable loans can help smooth cash flows, address emergency liquidity requirements, and offer consumers greater choice</a>. Therefore, the RBI’s recommendations based on the working group’s report are an encouraging first step to addressing consumer risks before trust in digital lending is eroded.

The <a href="https://www.rbi.org.in/scripts/BS_PressReleaseDisplay.aspx?prid=54187" target="_blank" rel="noopener noreferrer">recommendations for implementation</a> made by the RBI on August 10, include direct execution of loans, mandates to reveal the annualized percentage rate (APR), and a cooling off period that allows consumers to change their minds.

Now with these recommendations in place, regulated entities – institutions that are directly regulated by the RBI – must disburse directly to borrowers’ bank accounts, except in a narrow set of cases of co-lending transactions. This is a positive step that reduces the bargaining power of intermediaries that may be involved and clearly positions that the risk of lending lies with banks and non-banks and not the originators of loans. Therefore, the onus of consumer protection lies with the institution taking on the risk of lending.

The mandate to reveal the APR creates a standard playing field for all lenders and allows consumers to compare rates – a crucial step. Finally, the cooling off period with loans is an excellent move and sets a positive precedent for regulators in other jurisdictions. While this feature is normally associated with insurance products, the extension to loans provides consumers with choice and the ability to change their minds without facing financial losses. However, the operationalization of this recommendation will require consultation with market players, since it does impact lenders’ cash flows.
<blockquote>Even though these guidelines are not a perfect replacement for a comprehensive data protection bill, they do protect against misuse of consumer data gathered through digital lending apps.</blockquote>
While India awaits a new data protection bill and eventually a new law, individual regulators must safeguard consumers’ data privacy interests. Even though these guidelines are not a perfect replacement for a comprehensive data protection bill, they do protect against misuse of consumer data gathered through digital lending apps. They prevent disproportionate permissions from being sought by lending apps, allow access to camera, microphone, and location data as a one-time event during onboarding or checking KYC, and outline standards to be achieved in case of a security breach.
<h1>Gaps That Still Need to Be Filled</h1>
More is needed to establish a common understanding of consumer protection risks and redress mechanisms among all regulated entities and institutions involved in the delivery of loans.

While being transparent about APR is a positive first step, in a market with hundreds of lending apps and several more that launch daily, consumers must be able to compare lenders. This need presents a market opportunity: while price comparison sites exist for insurance products, it is time to have them for digital loans. Ideally, lenders would compete to provide the best terms to borrowers but we likely will need to wait some time for this advancement.

Complaint channels need to be redesigned to be consumer-friendly and regulators need to use <a href="https://www.cgap.org/topics/collections/market-monitoring/tools">appropriate market monitoring tools</a> to analyze and identify early warnings. This also presents an opportunity to test and evaluate consumer complaint mechanisms that exist – an area of emerging research interest for CFI.

And finally, the RBI proposes that underwriting algorithms used by lenders should be subject to audits. The RBI noted that while this recommendation was accepted in principle, it would require further examination prior to implementation. This is an important first step to ensure that high-stakes algorithms aren’t <a href="https://www.centerforfinancialinclusion.org/digital-credit-algorithms-in-india-expanding-access-or-cementing-exclusion">further cementing</a> financial exclusion. At the same time, algorithmic auditing, particularly by regulators of private sector algorithms, is a nascent field and must balance accountability with a company’s proprietary intellectual property. <a href="https://dai-global-digital.com/how-four-awardees-are-paving-the-way-for-a-more-equitable-ai-powered-future.html">Global research on this topic</a> is just beginning and partnerships with regulators would enable practical action.

It Is the Best of Times, and the Worst of Times: India’s New Digital Lending Recommendations

Imagine you’re a young mother living on the outskirts of Kampala, Uganda. Due to unexpected medical expenses for your son, you decide to apply for a digital loan. You download a credit app that you heard about from a neighbor, answer a few questions about yourself, consent to have data on your phone shared, and wait 30 minutes. Then, you receive a rejection message: “Your credit limit is 0 UGX.”

You heard that having an active mobile wallet would increase your chances of being approved for a loan and made sure your MTN mobile wallet was active before applying. You’re confused about why your loan application was rejected and wonder how to improve your future chances. Most importantly, you’re still unsure how you will cover your son’s medical expenses.

Understanding the reasons behind credit decisions is increasingly more difficult as algorithms, rather than front-line staff, make and communicate outcomes. <a href="https://centerforfinancialinclusion.org/accountability-for-algorithms-a-balancing-act-for-governments/">Complex algorithms</a>, fueled by alternative data, are driving finance decisions about and for customers -- from underwriting to insurance to <a href="https://centerforfinancialinclusion.org/responsible-social-protection-lessons-from-covid-19-digital-cash-transfers/">eligibility for social protection</a>. As algorithms become more commonplace, we must look for ways to increase transparency around decisions and inform low-income customers about their options for rectification.
<h1>In the Dark on Automated Decisions</h1>
In honor of <a href="https://www.consumersinternational.org/what-we-do/world-consumer-rights-day/" target="_blank" rel="noopener noreferrer">World Consumer Rights Day</a>, CFI is researching how credit decisions are made and communicated to low-income consumers, the rights consumers deserve, and the tools they need to understand – and be able to challenge – those decisions.

In the not-so-distant past, most financial institutions relied on front-line staff to make and communicate decisions to customers. If a customer was rejected for a loan or insurance product, she could ask a loan officer to explain how her history was evaluated and could work with the officer to correct data errors. However, as digital models leveraging algorithms gain traction, the transparency that customers used to rely on from their in-person engagements with loan officers or agents has disappeared.
<blockquote class="pullquote--right">As digital models leveraging algorithms gain traction, the transparency that customers used to rely on from their in-person engagements with loan officers or agents has disappeared.</blockquote>
Because most customers are unaware of how an underwriting algorithm works or what data inputs are used, many customers are also unclear about how a decision is made or whom to ask for more information. This lack of clarity was evident from <a href="https://centerforfinancialinclusion.org/trust-of-data-usage-sources-and-decisioning-perspectives-from-rwandan-mobile-money-users/">CFI’s survey-based research</a> in Rwanda. Out of a sample of 30 digital borrowers in Rwanda, 16 respondents had been rejected for a digital loan but only 10 of those recalled an explanation for the denial. Of those 10 who received an explanation, six were dissatisfied with the provider’s communication; some received only a basic explanation such as, “Your credit limit is zero.”

When the full survey sample was asked to describe what an acceptable explanation of loan denial might look like, there was a clear ask for more specificity and more communication. A 52-year-old woman shared her experience: “They denied me a loan because I delayed to repay when I was in a hospital and very sick. If they had called to explain the reason for the denial, I would have explained my condition.” A 38-year-old woman reasoned: “When you delay to repay, they call to remind you about the loan. They should then do the same when you are denied a loan.”
<h1>Help for Consumers: Legislation, Awareness, Support</h1>
So, what can consumers do in this increasingly digital era? Most data protection frameworks give consumers the right to access and rectify their data. However, our Rwanda research suggests that consumers are largely unaware of what is being inputted in the first place. While data protection efforts – like the 2019 Kenyan Data Protection Act that gives individuals the right to request the rectification of personal data that is “inaccurate, out-of-date, incomplete or misleading” – are a good first step, more needs to be done to communicate to customers about the inputs, decisions, and digital rights.
<blockquote class="pullquote--left">More needs to be done to communicate to customers about the inputs, decisions, and digital rights.</blockquote>
Many nascent data protection frameworks offer consumers the right to be informed if they’ve been subjected to an automated decision by an algorithm, for example. For instance, the <a href="https://www.minijust.gov.rw/fileadmin/user_upload/Minijust/Publications/Official_Gazette/_2021_Official_Gazettes/October/OG_Special_of_15.10.2021_Amakuru_bwite.pdf" target="_blank" rel="noopener noreferrer">Rwandan Data Privacy Law</a> mandates that individuals should be informed about the logic involved in their automated decision at the time of personal data collection. <a href="https://www.dataguidance.com/notes/brazil-data-protection-overview" target="_blank" rel="noopener noreferrer">Brazil’s Data Protection Act</a> gives consumers the ability to ask for a review of a decision made with their personal data taken solely through automated processing; included in the review should be the criteria and procedures used for the decision.

But what this will look like in practice, and how it will be enforced, remains to be seen. And given what we know about the challenges facing low-income consumers in accessing and feeling empowered to use grievance redressal mechanisms, there is concern that these data rights will not be fully exercised in a way that keeps companies accountable.

Consumer advocacy organizations are a potential avenue to help raise the voice of consumers vis-à-vis their digital rights. For instance, <a href="https://centerforfinancialinclusion.org/responsible-social-protection-lessons-from-covid-19-digital-cash-transfers/">our research</a> on government-to-person digital payments during COVID-19 found that civil society organizations often were the first to sound the alarm about digital systems failing or customers poorly served.

Whether it’s a mother in Kenya applying for a credit product to pay for medical expenses, or a farmer looking to insure his crops in the face of an increasingly unpredictable climate, we must support consumers’ voices and increase transparency around how digital decisioning is made.

Along with other leading consumer advocates around the world and in partnership with <a href="https://www.consumersinternational.org/" target="_blank" rel="noopener noreferrer">Consumers International</a>, we’re excited to participate at the <a href="https://www.consumersinternational.org/fair-digital-finance-forum-2022/" target="_blank" rel="noopener noreferrer">Fair Digital Finance Forum</a> this week. Take a look at their <a href="https://www.consumersinternational.org/fair-digital-finance-forum-2022/" target="_blank" rel="noopener noreferrer">program</a> to get a lay of the land and stay up to date with CFI’s <a href="https://www.centerforfinancialinclusion.org/research/consumer-protection">consumer protection</a> workstream.

Understanding the Decision: Consumer Rights and Algorithmic Decision-Making

The past decade has seen an increase in predatory and fraudulent practices in digital finance and fintech. In the last 10 months, there has been an increase in anecdotal evidence that the COVID-19 pandemic has led to a proliferation in the methods and tools predatory and fraudulent providers are using to exploit vulnerable households and businesses (see recent media coverage <a href="https://www.bloombergquint.com/law-and-policy/financial-frauds-have-seen-a-spike-due-to-dependence-on-digital-payment-platforms-ajit-doval" target="_blank" rel="noopener noreferrer">here</a> and <a href="https://www.mediapost.com/publications/article/354201/finance-mobile-apps-most-exposed-to-fraud-gaming.html/" target="_blank" rel="noopener noreferrer">here</a>).

In exploratory work using high-frequency mobile application data for 71 countries, we document the <a href="https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3588453" target="_blank" rel="noopener noreferrer">increasing scale and scope of these new methods</a>. We observe that some of the most downloaded mobile apps in a number of countries following the outbreak of COVID-19 include finance-related apps that show signs of being either predatory or entirely fraudulent. For example, there is a growth in personal lending apps luring new users to pay nominal service fees to obtain access to cheap loans, but which are revealed to offer no actual service. The release dates of these apps coincide with the onset of COVID and related government lockdowns and are initially buttressed by extremely high ratings driven by tens of thousands of apparently fake reviews. After a duration, some appear to be eventually removed or blocked on the app stores.

For this and other reasons, we categorize these apps as being highly likely instances of fraud. The graph below depicts this after the onset of lockdowns in India, where we saw a wave of lenders fitting these criteria pop up and quickly attract many users. Notably, the adoption of these fraudulent lending apps surpasses that of pre-existing lending apps from known, legitimate providers during this period. We also observe examples of apps set up to mirror legitimate sites (e.g., mimicking existing government or finance apps), but that appear to be designed to phish sensitive information from unsuspecting users. (India is used to illustrate such issues, but similar examples occur in a range of other markets, such as Nigeria, Philippines, etc.)

Combating the Rise in Fraudulent Fintech Apps

Just over one year ago, I joined the Center for Financial Inclusion (CFI), and what a year it has been. <a href="http://financialinclusionweek.org" target="_blank" rel="noopener noreferrer">Financial Inclusion Week</a> presents a great time for me to reflect on this past year and to share with you CFI’s plans for our next chapter. We are using Financial Inclusion Week to feature the work of so many of our partners. And we are also using the week to focus attention on the themes we have identified in our new strategy as the pillars for this week’s <a href="http://financialinclusionweek.org/event-calendar-2020" target="_blank" rel="noopener noreferrer">calendar of events</a>.

CFI emerged from the rubble of the financial crisis to spearhead the most pressing issue the inclusive finance field needed at the time: improved consumer protection. We are now well into our second decade and our industry is reeling from the ravages of the COVID-19 pandemic. It is perhaps the right time for CFI to reenergize its mandate and spearhead what we believe is needed to “build back better” as the saying goes. As tragic as the pandemic’s consequences have been and continue to be, it has at least laid undeniably bare the failures of the status quo and has created a heightened sense of urgency, for financial services to build back better.

CFI was founded at a particular moment when it was becoming more apparent that market forces alone would not ensure positive outcomes for financial inclusion, and that sustained intentionality would be necessary. The coronavirus pandemic has, at the September 2020 time of writing, infected more than 33 million people and killed nearly 1 million. Beyond the rapid and catastrophic spread of illness and death, the pandemic has devastated global economies. Millions of micro, small, and medium enterprises (MSMEs) around the world have seen revenues plummet and have suspended operations or gone out of business altogether. Hundreds of millions of families have lost jobs and incomes, and many of them live in countries where social safety-net protections are patchy at best. The pandemic also reversed, seemingly overnight, social and economic development gains that had taken decades to achieve: the World Bank estimates that 70 million people are at risk of falling back into poverty. Women and children have been among those most affected: children because schools around the world have been shuttered, and women because they are more likely than men to lose their jobs and to shoulder the responsibility of supervising and homeschooling children.

For CFI, the pandemic has reenergized our purpose. Financial services are critical to reducing low-income populations’ vulnerability and helping them to recover from this and other recurring crises in their lives. We believe we have a leadership role to play in this intensified global effort. We have more than a decade of recognized global leadership in understanding the financial needs and behaviors of low-income vulnerable populations. Complementing this demand-side expertise, our recent <a href="https://content.centerforfinancialinclusion.org/mix-and-cfi-announce-strategic-integration-to-drive-industry-knowledge-for-inclusive-finance/" target="_blank" rel="noopener noreferrer">integration</a> with MIX brings supply-side expertise to the table, as they have been studying and reporting about financial service providers for the past 20 years. These complementary strengths, combined with our history of thought leadership and our role as conveners, positions CFI to pursue an ambitious three-year strategy made all the more urgent in the context of the pandemic.
<blockquote>The pandemic has reenergized our purpose.</blockquote>
The strategic plan which will guide CFI’s work through 2024 focuses on four thematic areas. All of them, to significant degrees, have either been exacerbated by the pandemic or have been revealed by this crisis as urgent and under-attended priorities. The common thread among the themes is that progress in these areas is essential to ensuring that all people have the financial tools needed to improve their lives and to prosper.
<h2>Financial Services to Respond to the Risks of Climate Change</h2>
Just as the pandemic’s effects have been most severe on those who were already the most vulnerable, so too are the effects of climate change. Low- and moderate-income countries (LMICs) in the Global South are likely to experience longer, hotter heat waves and more extreme storms which in turn will create income loss, food insecurity, adverse health effects, and displacement that will hit already-vulnerable LMIC populations hardest.
<blockquote>Financial services are an indispensable tool to help prepare for climate-related shocks and recover.</blockquote>
CFI recognizes that climate change is ultimately an issue requiring long-term systemic changes to entrenched patterns of production and consumption. In the short term, however, financial services are an indispensable tool to help low-income vulnerable people prepare for climate-related shocks and recover from them when they happen. Our work in this theme will focus on understanding what those people need and the constraints they face, uncovering product innovations that can help, and then pilot testing such innovations and scaling-up lessons learned.
<h2>Women’s Financial Inclusion</h2>
Around the world, in many different geographies and socioeconomic contexts, women occupy a “last in, first out” position of vulnerability. The fall-out from the pandemic has made this abundantly clear. Whether it is a workplace where the more recently hired woman is let go before the more senior man, or a financial system that only prioritizes women’s needs when times are good, women’s economic inclusion is seen as a nice-to-have rather than a must-have. Women’s financial inclusion is powerfully shaped by broader societal norms, the unspoken assumptions and values governing men’s and women’s roles. CFI believes that efforts that focus solely on process fixes or product design will not succeed in women’s financial inclusion unless those efforts also seek to transform, rather than merely acknowledge, the underlying norms.

Our work in this area will accordingly include an intensive focus on research into successful norms-transformative initiatives, and how those might be scaled up. We will also work to improve the digital and financial capability of subsegments of women customers, and to influence the policy environment for women’s financial inclusion.
<h2>Data Risks and Opportunities</h2>
The pace of change created by the technology revolution is much faster than law, policy, or social mores can match. Although data privacy and protection regimes have begun to emerge, especially in wealthy countries, data by its nature is universal. To date, there is no universal framework setting forth who even owns personal data, much less governing how it can be used, by whom, and under which circumstances. The COVID-19 pandemic has provided a powerful illustration of both the risks and the opportunities of digitized data. The public health benefits of documenting and following diagnosed COVID-19 cases, and of tracing patients’ contacts, are obvious. But the risks to patients of stigmatizing, discrimination (whether of access to insurance, housing, employment, or otherwise), and other abuses are also very real.

Similarly, in financial services, data is the key that can unlock access to a full range of personalized, effective products that can help low-income people achieve their goals. The risk is that many LMICs have no effective consumer data protection regimes in place and that even where those exist, people with low levels of digital and financial sophistication may, in their eagerness to receive financial services, sign away their rights without even fully understanding them.
<blockquote>CFI will focus on means to bring transparency to data practices in DFS.</blockquote>
CFI’s work in this area will focus on means to bring transparency to the data practices of digital financial service (DFS) providers. We will also study how financial service providers use algorithms, which can be biased against already-underserved populations, in automated decision-making. We will monitor emerging frameworks around the world to document what does and does not work to advance financial inclusion while safeguarding data privacy, portability, and other consumer rights.
<h2>Consumer Protection in the Digital Economy</h2>
As the inclusive finance landscape evolves, so too must the approaches to consumer protection. Social platforms, ecommerce giants, fintechs, and pay-as-you-go providers are all relatively recent entrants into the field, and this means a multi-pronged approach is necessary to ensure safe practices are the norm. This is especially true since many of these business models fall beyond the scope of existing banking regulation. Consumer protection is an evergreen challenge, and one where CFI has long been active.
<blockquote>Consumer protection is an evergreen challenge.</blockquote>
We plan to devote intensive study to the practice of government-to-person (G2P) digital cash transfers, since these are often the on-ramp to digital financial services for low-income populations. We want to understand the risks that digitized G2P transfers present and how governments are mitigating those risks. We also want to document innovations around redress of grievances, financial capability-building add-on services, resolution of connectivity issues, and other relevant lessons learned.

In addition, CFI will partner with regulators and supervisors to test new technologies, such as chatbots or algorithmic audit tools, that can allow supervisors to be in direct dialogue with consumers, without consumer voices being mediated via the financial service providers. Such a dialogue can ultimately improve customers’ experience with financial services and democratize the financial sector by involving customers in the development of financial sector policies. To date, much of the recent work in regulatory technology (RegTech) and supervisory technology (SupTech) has prioritized the data reporting and compliance, but CFI believes its potential for advancing consumer protection has been underappreciated.
<h2>Conclusion</h2>
CFI developed its three-year strategic plan by weighing the needs of the inclusive finance industry against what we see as our own comparative advantages. We recognize that the four thematic priorities we intend to pursue are not an exhaustive list of everything that needs to happen to ensure positive outcomes for low-income people, and we also recognize that other individuals and organizations are doing excellent work in the areas we intend to pursue. We look forward to collaborating with all stakeholders who share the vision of a world where all people are able to equitably participate in the economy and are able to use financial tools to improve their lives and to prosper.

We hope you will participate in the rest of Financial Inclusion Week, which is packed with amazing speakers, events and activities. And, we want to hear from you. Please participate and tell us what you think about CFI’s thematic priorities.

Reflecting on the Past and Charting a New Direction

<h1>Why Consumer Rights and Responsibilities?</h1>
The <a href="https://www.smartcampaign.org/about/smart-microfinance-and-the-client-protection-principles">Client Protection Principles</a> provide a common framework for financial service providers (FSPs), policymakers, and clients to better understand and discuss consumer protection issues. While much of the Center for Financial Inclusion’s (CFI) work with the financial inclusion industry has focused on providers and regulators, there is a third crucial constituency: clients.

Client awareness and capability is a critical component of effective financial consumer protection. Clients have the right to demand fair treatment and lodge complaints with government authorities, but these rights mean little if they don’t know what constitutes lawful treatment or how to access complaints channels. Similarly, clients play a role in protecting themselves by practicing behaviors to maintain their privacy and safety. While FSPs can institute protective processes and regulators can craft policy safeguards, improving client awareness of their rights and responsibilities helps consumers play their part to support a sustainable financial system.

This report provides lessons learned from initiatives in Ghana, Uganda, and Benin to raise consumer protection awareness among clients through multimedia campaigns, digital tools and other outreach strategies. It covers country-specific consumer protection issues and the individualized campaigns to address these issues. We also offer five key takeaways to help inform future client protection and empowerment awareness building activities.

Clients Deserve to Know: Using Radio to Educate and Empower Consumers in Africa

As more people are connecting to more financial services digitally, we’re seeing growing calls for individuals to have greater control over how their data is being used and by whom. At the heart of consumers’ ability to control their data is the notion of consent, but what consent means in practice can vary considerably and can often be difficult for providers to ascertain in a meaningful way from a consumer standpoint.

In the EU, the GDPR has <a href="https://gdpr.eu/gdpr-consent-requirements/">defined consent</a> as being free, informed, specific and unambiguous. It also necessitates an opt-out option for data subjects, allowing for the partial or complete withdrawal of any previously given consent, and for the removal of all gathered personal data. But while these requirements may be good for consumers, they’re also tough for providers to implement. Just ask Google, which was <a href="https://www.reuters.com/article/us-google-privacy-france/france-fines-google-57-million-for-european-privacy-rule-breach-idUSKCN1PF208">fined 50 million euros</a> last year after the French data protection authority concluded that it “lacked transparency and clarity in the way it informs users about its handling of personal data and failed to properly obtain their consent for personalized ads.”
<h2>Flexibility Needed for Smaller Providers</h2>
So, if a tech giant, operating in Europe with all the resources and expertise at their disposal, can run afoul of these new consent requirements, does it make sense for governments in developing countries to try to adopt similar rules? India’s response for now has been yes. The current version of its pending data protection bill incorporates the same consent principles as GDPR. However, one legal observer we spoke to expressed concerns that the bill says nothing about what this consent architecture will look like and the ways in which consent will be sought. For smaller providers like microfinance institutions, fintechs and small finance banks that are trying to reach underserved segments with higher levels of illiteracy, obtaining consent as currently defined in the bill would pose a significant challenge, as elaborated below. Moreover, providers leveraging digital technologies to serve customers who might not be that digitally literate or understand the ways their data can be used may find it nearly impossible to meet such high standards of consent. The likes of Google might be able to figure it out over time, but smaller providers would need more flexible rules and support to comply.
<blockquote>Google might be able to figure out high-standard consent, but smaller providers would need more flexible rules and support.</blockquote>
For further evidence on how providers are already coming up short on consent, a recent <a href="http://documents.worldbank.org/curated/en/677281542207403561/Financial-Consumer-Protection-and-New-Forms-of-Data-Processing-Beyond-Credit-Reporting">World Bank report on new forms of data processing</a> laid out many limitations of practices around consent, such as lengthy and complex consent forms, incomplete information, and standardized, inflexible terms offered on a “take it or leave it” basis. As a result, providers are often seen to be doing the bare minimum to comply with existing data protection requirements. In recounting the deficiencies identified in a study by the Centre for Internet and Society on fintech privacy policies in India, a <a href="https://cis-india.org/internet-governance/blog/the-wire-shweta-mohandas-july-30-2019-in-india-privacy-policies-of-fintech-companies-pay-lip-service-to-user-rights">recent article</a> noted that one rule “requires a fintech company to provide an option to withdraw consent. Twenty-three percent of the companies allowed the user to opt out or withdraw from certain services such as mailing list, direct marketing and in app public forums, but they did not allow the user to withdraw their consent completely.” Such findings have led various observers to rightly question <a href="https://www.cgap.org/blog/data-protection-and-financial-inclusion-why-consent-not-enough">how effective consent really is</a> in practice and to propose <a href="https://www.cgap.org/research/publication/making-data-work-poor">other approaches</a> to give consumers more meaningful control over their data.
<h2>The Futility of Trying to Keep Up with New Approaches to Consent</h2>
This all stands to reason, but it again begs the question as to how providers who are already having a hard time complying at a minimal level could ever keep up with these new approaches. Indeed, in discussing the variety of data protection principles and standards that already exist around the world, the previously mentioned World Bank report also hastened to point out that “such principles may often be difficult to implement, particularly in low-capacity environments and/or where changes in the financial sector are fast paced.” As our interviewees attested, low-capacity environments and fast-paced changes are very much the rule, not the exception, and the path from principles to implementation is littered with landmines.
<blockquote>Low-capacity environments and fast-paced changes are very much the rule, not the exception.</blockquote>
One case we encountered centered around the issue of informed consent. Last year, the Reserve Bank of India <a href="https://economictimes.indiatimes.com/industry/banking/finance/banking/rbi-slaps-rs-5-crore-penalty-on-airtel-payments-bank-for-violation-of-norms/articleshow/63235308.cms">fined Airtel Payments Bank</a> the equivalent of roughly $700,000 for “contravening the Operating Guidelines for Payments Banks and directions issued by RBI on Know Your Customer (KYC) norms.” Airtel Payments Bank is majority owned by Bharti Airtel, one of the largest mobile operators in India, and in 2017 complaints started to emerge among mobile subscribers that Airtel Payments Bank had opened new bank accounts without their consent. According to <a href="https://www.financialexpress.com/economy/uidai-airtel-payments-bank-case-company-claims-no-wrongdoing-heres-how-you-can-avoid-the-trap/979401/">reports</a>, when new Airtel mobile subscribers first opened their Airtel mobile app, a pre-ticked consent box would appear on the welcome screen which, unless unchecked, would authorize the use of the same <a href="https://uidai.gov.in/what-is-aadhaar.html">Aadhaar</a>-based eKYC verification required to open the mobile account to also open an Airtel Payments Bank account. Over 2.3 million customers reportedly had new bank accounts created that they did not realize had been opened. Further complicating the matter was the fact that government subsidies would automatically be sent as direct benefit transfers to each beneficiary’s most recent Aadhaar-linked bank account, resulting in the equivalent of about $6.6 million in subsidies being deposited into these accounts. Airtel Payments Bank maintained that it had properly obtained consent to open these accounts but committed to working with the government to ensure compliance. We spoke with Akhil Verma, the current Chief Information Security Officer of Airtel Payments Bank, and he said the bank’s failure to notify customers of this caveat and obtain their explicit permission before allowing this was considered grounds for insufficient consent.
<h2>Out of Step With Modern Digital Reality</h2>
Another concern we heard from the other side of the globe was that some consent requirements are out of step with modern realities. According to Mariano Fuentes, Legal Advisor with ASBANC, the banking association in Peru, its data protection law (which was originally passed in 2011) is outdated for the digital times we now live in and does not do a thorough job of clarifying the ways consent can be obtained. Banks in Peru can obtain consent for personal data digitally, but “sensitive” personal data, which not only includes data on things like race or health, but also biometric data and data pertaining to “personal habits” that could come from things like mobile phone usage patterns, still requires written consent. Since Peru’s data protection law was passed in 2011, it would not have been able to fully anticipate the ways in which people’s lives have been digitized and the new types of data that would emerge, so it’s not surprising that it was reported last June that the National Authority for the Protection of Personal Data in Peru had issued <a href="https://elcomercio.pe/economia/negocios/tres-anos-han-puesto-1-246-sanciones-faltas-proteger-datos-noticia-646513-noticia/">1,246 sanctions within three years</a> (across all sectors).  A scan of the sanctions imposed by the data protection authority also reveals that a significant share of these violations resulted from failures to properly obtain consent.

Whether these cases amount to violations is often a matter of interpretation. Mariano Fuentes of ASBANC underscored this by pointing out that five member banks are currently appealing their penalties because they disagree with the arguments made by the data protection authority. “The complete idea of consent is not represented by any technology, which is damaging in today’s times and is used against us to levy sanctions,” he added. Despite these challenges, Peru consistently ranks as one of the top country-wide regulatory environments for financial inclusion in the Economist Intelligence Unit’s <a href="https://www.centerforfinancialinclusion.org/global-microscope-2019">Global Microscope</a> assessment. In the 2019 version, it came in second partly because it “showed the greatest improvement in the consumer protection domain—specifically, for its data protection framework for financial customers.”
<h2>So How Are Consumers Supposed to Understand?</h2>
Given all the shortcomings with current consent practices around the world, it’s simply unfair to expect consumers to be able to fully understand what can and cannot happen with their data right at the point when they are about to access a new service or download an app. But at the same time, placing the burden on providers, especially those that are on the frontlines of underserved areas, to understand and apply high standards of consent is also proving to be a challenge. The reality is that this is a burden that both consumers and providers need to share, but not on their own. They need the right mix of policy and technology to help them get there. There are some emerging regulatory technology – or “regtech” – solutions providers in developed markets (like <a href="https://www.trunomi.com/">Trunomi</a>) that enable consent-based data sharing, for example.
<blockquote>This is a burden that both consumers and providers need to share, but not on their own.</blockquote>
As these solutions continue to advance, perhaps governments in developing countries could seek to attract such providers to adapt these solutions for their markets. It’s this type of innovation and collaboration that is needed to make consent work. The burden should be broadly shared.

Data Consent: Let’s Share the Burden for Effective Consumer Protection

All is not well in the country that pioneered mobile credit. A new <a href="/making-digital-credit-truly-responsible">report on digital credit in Kenya</a> from <a href="https://www.microsave.net/">MSC</a>, commissioned by <a href="/about/what-we-do/the-smart-campaign">the Smart Campaign</a> and the <a href="https://sptf.info/">SPTF</a>, shows that with continued dramatic growth rates, the sector also experiences cripplingly high default and delinquency, enabled by poor business practices and weaknesses in both the credit reporting infrastructure and regulatory jurisdiction.

Most notably, the report reveals very high rates of delinquency and default. Among active digital loans, more than a quarter are non-performing. About 2.2 million Kenyans are said to have delinquent loans. In some cases, liberal use of refinancing and rescheduling hides this level of delinquency in lender portfolios. At the same time, the report points out that about half of these non-performing loans are for amounts less than $10. These findings are broadly consistent with results cited by CGAP in 2016, which found that 50 percent of digital borrowers in Kenya repaid their loans late, and 12 percent defaulted.
<blockquote>Despite continued growth of digital credit in Kenya, high delinquency, default and interest rates persist in the market and credit bureaus haven't yet caught up with the digital age.</blockquote>
The report also details shortcomings in credit reporting, given that many digital lenders neither consult nor report to the credit reporting bureau as fully or regularly as they should. The credit reporting bureaus were clearly set up for a pre-mobile era, which suffer from issues related to inclusion of all types of lenders, frequency of uploading data (monthly, when daily is more relevant for today’s short term loans), and ease of connection among all the players in the credit reporting ecosystem. As a result, many lenders are not consistently using credit bureaus—neither ensuring that the information is updated and correct, nor fully consulting it prior to lending.

Pricing is also an issue. The market leader, M-Shwari, which accounts for about two-thirds of all digital loans, charges an annual percentage rate (APR) of 90 percent. The low-price option provided by Kenya Commercial Bank is a fairly reasonable 44 percent APR, but the high end of the price range includes providers charging APRs well into the hundreds. Granted that these are small, short term loans where interest payments are not expected to be sustained for an entire year. Nevertheless, the promise of digital to bring down prices does is not yet in sight.

Other issues noted in the report include non-transparency regarding portfolio quality, identity theft, misuse of client data, multiple borrowing and loan bicycling by clients, and client use of loan proceeds for sports betting.

The picture that emerges suggests that the still-exploding market of very small, “nano” loans needs to be brought into more orderly operation. Consumers and providers are operating in risky ways. The current state of the market is not beneficial for either.
<blockquote>Raising the bar for blacklisting customers and public awareness about defaulting on loans are among our recommendations for improving digital credit.</blockquote>
One issue specific to this nano-loan market concerns the reporting of very small non-performing loans to credit bureaus, with negative consequences, such as curtailing of access to credit, for hundreds of thousands of borrowers. MSC, the Smart Campaign and SPTF recommend that regulations be put in place such that delinquencies and defaults among loans below some fixed amount not be reported to the credit bureau (whether US$2, $5 or $10 – the report actually recommends a cutoff of 5% of the monthly per capita GDP). It also recommends that the government launch a public awareness campaign about how credit bureaus work and the consequences of default so consumers will better understand the risks involved in borrowing.

The regulators, credit reporting agencies and lenders in Kenya are aware of these concerns and working to improve the situation. A new association of digital lenders (Digital Lenders Association of Kenya) has been formed to create consumer protection standards and the central bank is exploring ways to upgrade the credit reporting ecosystem. The Smart Campaign recommends that both lenders and regulators consider adopting the <a href="http://www.smartcampaign.org/about/smart-microfinance-and-the-client-protection-principles/digital-credit-standards">digital credit standards</a> and <a href="https://www.smartcampaign.org/tools-a-resources/1210-handbook-on-consumer-protection-for-financial-inclusion">model regulations</a> covering issues ranging from transparency, to the fair use of algorithms, to protection of customer data.

Kenya’s unprecedented dynamism in mobile money, digital credit and financial inclusion is envied across the world. If authorities and providers can bring the participants in these sectors into a better-functioning marketplace, Kenya will benefit greatly from the innovation the country continues to spawn.

Red Flags in Kenya’s Nano-Credit Market

Extensive coverage of the "You Deserve to Know" (#YouDeserveToKnow) campaign in the national Ghanian media features quotes from <a href="https://www.centerforfinancialinclusion.org/bio/alexandra-rizzi">Alex Rizzi</a>, Director of the Smart Campaign.

"This series aims to equip clients with the knowledge they deserve to know to make the best financial decisions for themselves,” Rizzi stated in a <a href="https://www.pulse.com.gh/lifestyle/events/consumer-protection-global-consumer-advocate-launches-you-deserve-to-know-campaign/72tlsjv">Pulse</a> article. Coverage of the campaign also appeared in <a href="https://www.graphic.com.gh/news/general-news/financial-literacy-campaign-launched.html">Graphic Online</a> and <a href="https://citinewsroom.com/2019/02/26/global-consumer-advocate-launches-youdeservetoknow-campaign/">Citi Newsroom</a>.

The campaign focuses on improving the financial enabling environment by educating the public in two topic areas, transparency and fraud.

Listeners in Ghana can tune in to <a href="https://www.facebook.com/adom106.3/">Adom 106.3 FM</a> on Thursdays, 5:30 pm local time, to hear the programs. The episodes include drama and expert interviews on the topics. <a href="https://radio.modernghana.com/station/adom1063fm">Live streaming</a> of Adom 106.3 FM is also available.

The "You Deserve to Know" campaign is in collaboration with <a href="http://www.fiforumafrica.org/">Financial Inclusion Forum Africa</a>.

This Smart Campaign video below provides an introduction.

Smart Campaign's "You Deserve to Know" Radio Campaign Featured in Ghanaian Media

As digital credit providers have grown exponentially over the past few years, and as digital products and models have proliferated, so too have concerns around consumer protection. In the recently published report, <a href="http://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/1036-responsible-digital-credit">Responsible Digital Credit</a>, I argue that ensuring that digital credit customers receive responsible treatment requires more than enhanced consumer protection laws and regulations. It also requires strong commitment from the digital credit industry. Finally, it needs consumers who are empowered to play a more proactive role in managing their digital credit responsibly.

Over the past year, I have interviewed digital credit industry associations, credit providers and their third-party data analytic providers, regulators, policy makers, and various consumer protection leaders. Many of these groups are working to develop responsible digital lending principles. With their input, my report proposes a guiding framework for responsible digital lending.  The framework uses the Smart Campaign <a href="https://www.smartcampaign.org/about/smart-microfinance-and-the-client-protection-principles">Client Protection Principles</a> as a basis for grouping the issues. In addition, I propose an eighth principle: security and fraud protection.

Digital credit, and especially the use of mobile phones, significantly alters interactions between borrowers and lenders. Lenders utilizing the mobile channel to advertise, acquire and transact with customers must pay particular attention to the limitations of mobile interaction with customers and follow industry <a href="http://onlinelendersalliance.org/wp-content/uploads/2016/03/Best-Practices-2016-1.pdf">mobile best practices</a>. While many of the standard consumer protection practices continue to apply, new concerns, or more accurately, new faces on older concerns, have emerged. In this post, I want to highlight several of the considerations I found most important and relevant for the digital lending industry.
<h2>Responsible Algorithms</h2>
Many digital credit models rely on algorithms to process data about clients and make credit decisions. Because most lenders consider their algorithms proprietary, it is difficult for observers to know on what basis credit decisions are actually made. This opaque situation raises the spectre of discrimination. Attributes that are considered inappropriate bases for differentiation, such as religion, language, gender, or ethnic origin, are areas of particular concern with regard to algorithm-based lending practices. As highlighted by a Smart Campaign <a href="http://www.centerforfinancialinclusion.org/publications-a-resources/browse-publications/916-smart-brief-tiny-loans-big-questions">report</a>, while credit offers may differ based on risk analysis, such differentiation should be consistently applied, stated in advance, and made with the goal of benefitting clients. To prevent discriminatory digital credit practices, some recommendations include:
<ul>
 	<li><a href="https://www.whitecase.com/publications/insight/algorithms-and-bias-what-lenders-need-know">Pretest, test and retest for potential bias</a>. Digital credit providers and third-party data analytics providers should continuously monitor the outcomes of their algorithmic programs to identify potential problems. Such testing could involve running scenarios to identify unwanted outcomes and developing and building controls that prevent adverse outcomes.</li>
 	<li><a href="http://www.ijmo.org/papers/43-A10212.pdf">Document the rationale for algorithmic features</a>. Digital credit providers should be able to provide visualization and a decision tree for the factors their algorithms analyze, as well as the justification for relying on these factors. The rationale should address how borrower debt capacity is assessed, given the importance of this concept in traditional underwriting.</li>
 	<li>Independent review of companies' proposed data sets and/or algorithms.</li>
</ul>
A self-regulatory approach could be used to develop best practices guidelines for data inputs and the development of nondiscriminatory artificial intelligence systems, following the model that has been successful for the Payment Card Industry Security Standards Council.
<h2>Indebtedness Monitoring</h2>
Because digital lending is often based on non-traditional underwriting criteria, to prevent over-indebtedness among digital borrowers it may be relatively more important to monitor outcomes at the portfolio level. Some of the ways to do this include:
<ul>
 	<li>Avoidance of debt traps by ensuring that clients are not forced into automated repeat loans.</li>
 	<li><a href="http://www.responsiblebusinesslending.org/">Responsible credit reporting</a> – Better compliance with reporting strengthens markets and leads to better client protection practices.</li>
 	<li><a href="http://www.centerforfinancialinclusion.org/storage/documents/Smart_Brief_Tiny_Loans_Big_Questions_Final_092617.pdf">Monitoring digital credit provider’s portfolio quality</a> – Industry benchmarks for portfolio quality can help to advance the understanding of risks and avoid business models that rely for their success on high default rates.</li>
</ul>
<h2>Digital Transparency </h2>
Digital credit platforms allow for 24/7 communications with clients that, if harnessed properly, can assist them with immediate technical support, remind them about upcoming payments and even identify counselors or resources for clients in financial stress. However, when communication is totally digital, there are heightened concerns about ensuring that clients really know what they are signing up for. Disclosure must lead to client understanding. Borrower disclosure standards should address:
<ul>
 	<li>Standards for honest advertising and penalties for misleading marketing materials of credit products. Furthermore, providers should advertise the name of the financial regulator they report to in all advertising materials.</li>
 	<li>Readability and format – Disclosures need to be easy to comprehend, available in the customer’s local language, and provided in print and digital formats.</li>
 	<li>Comparative tools – Standard summary disclosure documents would allow borrowers to compare credit offers, both digital and traditional.</li>
 	<li>Adequate notice periods – Consumers should be notified in advance of changes to interest rates, fees or terms and conditions.</li>
</ul>
A somewhat different but related and relevant concern, often overlooked in this context, is the vulnerability of individual investors who put their money into pure peer-to-peer (P2P) lending platforms. Protections need to be extended to them as well, with a focus on ensuring that they receive the information they need to evaluate risks and that they have recourse channels when something goes amiss.
<h2>Data Privacy and Usage Standards</h2>
While many regulators and most industry groups agree that it is important to protect the confidentiality and security of customers’ information, data use and the level of disclosure about its use are challenging topics. In the <a href="http://ec.europa.eu/justice/data-protection/reform/index_en.htm">EU</a> and in countries such as <a href="https://www.pc.gov.au/inquiries/completed/data-access/thedraft">Australia</a>, regulators are enacting rules mandating that individuals be notified about the use of their personal data and allowed to opt out. Opt-out rules should be considered as a potential requirement for all digital credit providers, especially in markets where mobile push-marketing has become problematic.

Over the next several years it will be important for laws or regulations to be put in place to protect consumer data privacy and guide information sharing. The rules need to:
<ul>
 	<li>Provide for informed consent, such that customers explicitly permit electronic data collection prior to its collection and use, and are given the option to consent or not.</li>
 	<li>Require providers to have a clear data collection and handling policy which limits the amount of data collected as well as the timeframe it is stored.</li>
 	<li>Inform clients about their data trails and credit histories, including the ability to ensure accuracy and correct for any errors or discrepancies.</li>
 	<li>Give regulators the power to discipline providers who repeatedly allow personal data to be misused.</li>
</ul>
<h2>Fraud Prevention and Security </h2>
New security vulnerabilities arising from digital credit strongly point to fraud and cyber-security as consumer protection concerns. It is increasingly urgent for digital credit providers to adopt standard security compliance measures and then to regularly test and update them. Providers must also be responsible for ensuring that the third-parties they use, including lead generators, brokers, agents, and data analytics providers, also have adequate security in place. Ultimately, providers need to be responsible for the actions of their third-parties (e.g., agents, contractors, lead generators, brokers and collectors).

Consumers should be made aware of the potential for fraud and encouraged to report suspected fraud cases or security breaches. Consumer awareness campaigns on the most common incidents of fraud (via the internet, SMS alerts, signage at agent kiosks, etc.) can help with this.

While the recommendations just listed do not apply in all markets, they do point to the urgent need for regulators, industry bodies, individual providers and consumers to work together to construct the ground rules for responsible digital credit that will ensure that consumers are adequately protected.

Editor's Note: This research was made possible by support from Mastercard Foundation and other partners.

&nbsp;

A Framework for Responsible Digital Credit

Can your skin color help predict whether you may be financially exploited in the United States? Unfortunately, even in 2018, the answer is still yes.

In February of this year, Wells Fargo was <a href="http://www.wisebread.com/how-to-fight-back-against-mortgage-discrimination">sued</a> by the city of Sacramento, California for allegedly discriminating against black and Latino mortgage borrowers since 2004. The specific charge, raised against the country’s third-largest bank in terms of assets, was providing these clients with more expensive loans compared to those offered to white borrowers.

Across the country, in Baltimore, Maryland, <a href="https://www.nytimes.com/2015/05/31/opinion/sunday/racial-penalties-in-baltimore-mortgages.html">a study</a> that found that black homeowners were charged higher interest rates and disadvantaged at every stage in the borrowing process compared to similarly qualified white borrowers – even taking into account factors such as credit scores, income and down payments. Over the span of a 30-year loan, the researchers say, discrimination against black borrowers cost them an extra $14,904 each, compared with white borrowers.

Homeownership is one of the most important ways for working and middle class families to build generational wealth. According to the U.S. Census Bureau, <a href="http://www.nareb.com/site-files/uploads/2017/09/SHIBA2017-final-for-web-0918.pdf">69 percent</a> of a household’s net worth in America lies in the net equity in their home. And investigations have repeatedly shown that people of color pay a heftier price to achieve wealth than their white counterparts.

What are the economic implications of financially exploiting people of color in home ownership? More expensive mortgage loans translate into higher monthly payments, lower savings, and a higher risk of default and foreclosure. On a macro-level, consequences include a stagnant homeownership rate among people of color, a yawning (<a href="https://qz.com/1087711/the-racial-wealth-divide-is-worse-than-people-think-and-its-growing/">and growing</a>) racial wealth gap, and continued institutional discrimination against people of color in the United States.

As a national consumer advocacy entity, the Consumer Financial Protection Bureau (CFBP) is designed to investigate claims of nefarious behavior among financial service providers and ensure that providers treat consumers fairly. However, its Office of Fair Lending and Equal Opportunity was <a href="https://www.americanbanker.com/news/cfpbs-mulvaney-strips-his-fair-lending-office-of-enforcement-powers">stripped of its power</a> earlier this year, with the removal from its mandate of oversight and enforcement. Commenting on the move, Lisa Donner, executive director of Americans for Financial Reform <a href="https://www.bostonglobe.com/news/politics/2018/02/01/trump-administration-strips-consumer-watchdog-office-enforcement-powers-lending-discrimination-cases/p7L5FAbNZisXTAuUvkeeAP/story.html">remarked</a>, ‘‘These changes . . . threaten effective enforcement of civil rights laws, and increase the likelihood that people will continue to face discriminatory access and pricing as they navigate their economic lives.”

The burst of the U.S. housing bubble yielded the Great Recession, which spread throughout world. Its origins in reckless lending in the subprime market convinced many people involved in the financial sector that consumer protection was urgently needed. In response to this gap, the 2010 Dodd-Frank financial reform law was passed. However, the current administration has since rolled back banking regulations, making it harder to detect discriminatory mortgage lending practices. <a href="https://www.stltoday.com/business/local/discriminatory-mortgage-lending-harder-to-detect-as-banking-regulations-rolled/article_c31cdd14-7b9e-5f55-80dd-28bbdf2fb6e3.html">Signed in May 2018</a>, the new Economic Growth, Regulatory Relief and Consumer Protection Act would exempt <a href="https://www.huffingtonpost.com/entry/bank-bill-deregulation-congress_us_5b043b70e4b0c0b8b23ea6cd">85 percent</a> of banks from reporting detailed information about mortgage loan applicants. This means it will be more difficult to identify systemic issues, conduct research about them, and respond with corrective action.

As borrowers of color in the U.S. continue to access credit with the goal of owning a home, and the steady deliberate weakening of institutional watchdogs and regulations continues, the future of consumer protection in financial services for all remains in jeopardy. As banks continue to backslide into more discriminatory and predatory practices towards people of color, we as consumers and advocates should continue to be aware of and vigilant about them.

&nbsp;

Skin Color Still Costly: Discrimination in the U.S. Mortgage Market

Alexandra (Alex) Rizzi

Senior Research Director, Consumer Data Opportunities and Risks

Mayada El-Zoghbi

Managing Director

Jayshree Venkatesan

Jonathan Fu

Mrinal Mishra

Malacci Ohrt

Alex Kessler

Ethan Loufield

Shweta Vashisht

Elisabeth Rhyne

John Owens

Carmen Paraison

Robin Brazier

Patrick Traynor

Kyle Burgess

Caitlin Sanford

India

South Asia

Benin

Ghana

Uganda

Latin America and The Caribbean

Peru

Kenya

Sub-Saharan Africa

United States

Dominican Republic

Paraguay

Ecuador

Pakistan

Complaint Resolution

Consumer Protection

Credit

Digital Credit

Enabling Environment

Policy, Regulation and Government Initiatives

Responsible Digital Finance

Transparency

Alternative Data

Financial Technology

Financial Service Providers

Fintechs

Fraud

Trends

Appropriate Product Design and Delivery

Challenges and Crises

Delivery Channels

Digital Financial Services

Financial Inclusion Strategy

Human Touch

Underserved Groups

Women

Client Treatment

Financial Capability

Privacy

Product Pricing

Telcos

Credit Provision

Customer Centricity

Default

Interest Rates

Nano Loans

Over-indebtedness

Mobile Banking

Housing Finance

Agent Banking

Microfinance Institutions

Smart Certification

Blog Post

Report

India is a global leader in financial inclusion. For over a decade, Accion has worked with and learned from India’s innovators, investors, and policymakers to expand economic opportunity for its people and businesses.

The majority of Kenyans have mobile money accounts; their activity demonstrates digital financial services’ potential. Accion helps Kenyan innovators harness emerging technologies to create new financial services.

March 15 is <a href="http://consumersinternational.org/what-we-do/world-consumer-rights-day/">World Consumer Rights Day</a> (WCRD), a day marked by the consumer movement each year to raise global awareness about consumer rights and needs. It’s an opportunity to demand that the rights of all consumers are respected and protected, and to protest against market abuses and social injustices which undermine those rights. The Smart Campaign marks this occasion by talking about the importance of transparency and grievance redressal as key tenets of client protection and building consumer trust.

WCRD’s theme this year is “Making Digital Marketplaces Fairer.” With the volume of online transactions increasing, consumers are exposed to new – sometimes not fully understood – risks. For this reason, WCRD 2018 is calling for access to fair and secure internet for all, action against scams and fraud, and better consumer protection online.

According to Consumers International, <a href="http://consumersinternational.org/media/154916/e-commerce-overview-report.pdf">nearly half</a> of consumers that have access to internet but do not shop online cite lack of trust as the reason. Similarly, <a href="http://consumersinternational.org/what-we-do/world-consumer-rights-day/2018-making-digital-marketplaces-fairer/">almost 70 percent</a> of online consumers worry their digital payments are unsafe. What contributes to this lack of trust? The causes vary, but they often hinge on two things: lack of transparency and insufficient grievance redressal mechanisms.
<h3>Transparency</h3>
For the Smart Campaign, transparency means much more than disclosure agreements. Even when these are in place, <a href="http://smartcampaign.org/storage/documents/Synthesis_Report_ENG_FINAL.pdf">research shows</a> that low-income clients rarely fully understand the terms and conditions (T&amp;Cs) of the product they purchased. Many times, when the T&amp;Cs are explained simply and thoroughly, they are <a href="https://www.itu.int/en/ITU-T/focusgroups/dfs/Documents/01_2017/ITU_FGDFS_Report-on-Review-of-DFS-User-Agreements-in-Africa.pdf">often in English</a> instead of in the language of the customer. Sometimes <a href="http://www.cgap.org/sites/default/files/Working-Paper-Competition-in-MFS-Kenya-Tanzania-Jan-2016.pdf">third-party charges or hidden fees</a> aren’t fully disclosed up front, but only after the purchase is finalized. In other cases, the entire price is hidden until <a href="http://www.cgap.org/sites/default/files/Focus-Note-Consumer-Protection-in-digital-Credit-Aug-2017.pdf">after the completion of the purchase</a>.

On World Consumer Rights Day, we remind digital financial service providers and online marketplaces to transparently and effectively convey important product information so their customers fully understand. As pointed out in our recent Smart Brief, <a href="http://smartcampaign.org/storage/documents/Smart_Brief_Tiny_Loans_Big_Questions_Final_092617.pdf">“Tiny Loans, Big Questions,”</a> clients should also be able to store and save T&amp;Cs related to their digital purchase or transaction, just as they should for a face-to-face one. If clients are confused or feel misled by the provider, trust is eroded. Alternatively, when providers meet consumers where they are by using their language and being completely transparent about business practices and pricing, they are taking an important step in building customer trust and loyalty.
<h3>Recourse Mechanisms</h3>
<img class="alignright wp-image-25279" style="border: 0 solid #000000" src="https://centerforfinancialinclusionblog.files.wordpress.com/2018/03/pull-quote-2.png" alt="" width="315" height="207" />Consumers of practically every product or service are bound to have complaints or questions regarding their purchase or transaction. This issue is especially relevant in digital marketplaces, since there tends to be limited human interaction. On top of that, customers who are new to the technology or not familiar with digital interfaces may be confused and are therefore likely to require customer service. <a href="http://smartcampaign.org/storage/documents/Smart_Brief_Tiny_Loans_Big_Questions_Final_092617.pdf">“Tiny Loans, Big Questions”</a> points out that problem resolution can be particularly difficult when clients are using a lending service that involves multiple companies, as in the case of mobile lenders using a mobile network operator’s agent network for cash-in and cash-out payments. Borrowers in this situation are interacting with agents who are not full-time employees and likely do not work for the lender. Although agents offer a human touch, as cash transactions are their primary duty, they may have little ability to field questions or resolve problems related to the loan product.

On World Consumer Rights Day, the Smart Campaign stresses the right of consumers to access simple, fair redress. We know that if customers do not have an easily accessible grievance redressal mechanism when things go wrong, they will be less likely to trust the product or service they’re buying. However, if the customer feels heard and sees that their needs are adequately addressed, trust is strengthened. Fair redress can be achieved by setting up well-staffed call enters or establishing online chats between staffers and customers, for example. <a href="http://www.centerforfinancialinclusion.org/storage/Uniting_TechandTouch_Kenya_FINAL.pdf">CFI Fellow Alexis Beggs Olsen</a> advocates for “centaur solutions” combining digital and human interfaces to best support low-income customers using digital financial services, while improving customer acquisition and retention.
<h3>Moving Forward</h3>
At the Smart Campaign, it’s our job to stay on top of risks to clients around the world and to work with financial service providers and other parties to help mitigate those risks.  While the risks themselves change over time, one thing remains constant: if consumers do not trust the service, product, provider or platform, these entities will struggle to reach their full potential and it will be harder to achieve meaningful financial inclusion.  At the end of the day, customers being heard and respected through grievance redressal channels and transparent business practices are two of the most critical components to building consumer trust. Only when this trust is in place can digital marketplaces and financial services providers do their part in making a <a href="https://twitter.com/search?q=%23BetterDigitalWorld&amp;src=tyah">#BetterDigitalWorld</a>.

Have you read?

<a href="https://cfi-blog.org/2017/06/05/the-smart-campaign-promotes-stronger-client-protection-and-sector-collaboration-in-uganda/">The Smart Campaign Promotes Stronger Client Protection and Sector Collaboration in Uganda</a>

<a href="https://cfi-blog.org/2017/08/03/the-microfinance-ceo-working-group-reports-out-consumer-protection-by-the-millions-and-other-updates/">The Microfinance CEO Working Group Reports Out: Consumer Protection By the Millions and Other Updates</a>

<a href="https://cfi-blog.org/2017/12/19/nigeria-needs-to-include-consumer-protection-in-its-ambitious-financial-inclusion-plans/">Nigeria Needs to Include Consumer Protection in Its Ambitious Financial Inclusion Plans</a>

&nbsp;

&nbsp;

&nbsp;

This World Consumer Rights Day, Let’s Build Trust

CFI Fellow Patrick Traynor, an Associate Professor in the Department of Computer and Information Science and Engineering (CISE) at the University of Florida, explains the second part of his research effort on the security and privacy of data in digital lending applications. Patrick’s previous post, explaining the first part of his research on evaluating the privacy policies of digital lending applications, can be found <a href="https://cfi-blog.org/2017/06/28/why-do-privacy-policies-matter-for-digital-credit/">here</a>.

“I’m sorry, but we are just not interested in providing security for our customers.”

Here is a phrase that you are unlikely to see from any company, at least if they want to stay in business. In fact, you are far more likely to see statements to the opposite. Yet time and again, the same services that tout security as something they care about prove to be tremendously vulnerable. Think about it – when was the last week that you didn’t hear about stolen Bitcoins, ransomware attacks, or data breaches?

If companies care so much about security, what is going on?
<h2>What Does "Secure" Mean?</h2>
Security is one of the least well-defined terms I know. By itself, it completely lacks context. Secure against what? Against whom? Under what conditions? Based on what assumptions?

As an analog, think about a restaurant that claims to care about “consumer health.” Is this statement regarding ingredients in their meals? Calories? What about cleanliness? How is the food prepared? Do employees really wash their hands after using the restroom? Most would agree that it is insufficient to simply trust such claims, and we rely on external entities (e.g., health department ratings, government regulations for calorie counts on menus, etc.) to give “consumer health” more measurable meaning.

The answers to my above “security in context” questions become deeply technical very quickly. In fairness, it is debatable whether it is realistic for the general public to understand these details. Regardless, this gap between specificity and understanding often permits real security considerations to end at exceedingly broad public statements. If nobody checks or bothers to define what security means, the thinking often goes, why bother to go further?

That’s where my team comes in – think of us as the health department for the security of online credit systems.

Before I go into further details, let’s make something clear. “Security” is hard. Even if you answer all of the context questions above, ensuring that you get it right all of the time in every location is something that nobody seems to know how to do well. Unlike most other engineering, where major assumptions remain within a predictable range (e.g., when building a bridge, winds, currents and the pull of gravity are all accounted for in the design), security faces the problem of constantly evolving adversaries. That means that what worked perfectly well yesterday may do very little to protect systems tomorrow. That said, we cannot write off security as an inevitable failure just because it is hard. Moreover, there are many tried and true techniques that absolutely should be in place for anyone to begin tossing around the word security. Our job is to ensure that we see these techniques in place and working correctly.
<h2>What Are We Measuring?</h2>
If we are specific about what we claim is secure, it is possible to understand the ways in which systems are likely to be strong. For my <a href="http://www.centerforfinancialinclusion.org/programs-a-projects/cfi-fellows-program">CFI Fellowship research</a> on the security of online credit applications, I am measuring the characteristics of the connection between mobile devices and the server within the application provider’s network. While it possible to measure the security of many parts of an online credit system, the most critical is ensuring that connections between mobile devices and the service provider’s servers is secure. Accordingly, we focus our attention here. The figure below shows this in more detail.

[caption id="attachment_23960" align="aligncenter" width="616"]<a href="https://centerforfinancialinclusionblog.files.wordpress.com/2017/08/patrick-traynor-graphic.png"><img class="wp-image-23960" src="https://centerforfinancialinclusionblog.files.wordpress.com/2017/08/patrick-traynor-graphic.png" alt="" width="616" height="215" /></a> A high-level overview of our security analysis[/caption]

Why is this the right thing to measure? Simply, if a user cannot communicate securely with a company’s server, nothing else matters. An adversary need not bother to try to breach other security if this portion is poorly executed. Think of it this way – if the online credit provider’s system were a castle, we are most interested in the protections around the drawbridge over the moat. If nobody is watching who and what comes across that drawbridge, it does not matter how high the castle walls may be. Said differently, systems that do not get this part of security correct might as well be saying that quotation from the beginning of this post.

My team will characterize security with regards to the following metrics. First, we will look to see whether or not the mobile device uses strong encryption algorithms to protect the confidentiality (i.e., the secrecy) and integrity of all communications. Mobile platforms contain many different encryption algorithms, but even the best algorithms can be used in dangerous ways. Accordingly, we will reverse engineer mobile applications (where available) and determine which algorithms their developers have chosen.

Second, we will measure how mobile devices confirm the identity of the server. This is critical – when done poorly, a mobile device is happy to divulge any and all secrets to an adversary on the other end of a connection. There are some standard ways that an expert would expect this step to be done, and our previous published work on mobile money (<a href="http://www.cise.ufl.edu/~traynor/papers/reaves-usenix15a.pdf">Reaves, et al., Mo(bile) Money, Mo(bile) Problems: Analysis of Branchless Banking Applications in the Developing World, Proceedings of the USENIX Security Symposium (SECURITY), 2015</a>) showed that approximately 50 percent of applications analyzed in that space did so incorrectly.

Finally, we will measure the configuration of the servers with which a mobile device communicates. Poor configuration here could again render the connection vulnerable as an adversary may be able to force the selection of weak/no cryptographic algorithms encrypting communications.

One major advantage to this analysis is that fixes to these problems can also be achieved at relatively low cost. Specifically, any faults that we find will not require impacted companies to spend hundreds of thousands of dollars to deploy advanced detection systems. Rather, a combination of changes by their development team and administrators can potentially address these issues in short order. We intend to alert all of the impacted companies prior to the release of our final report.

As a final note, finding no faults in this portion of a system does not mean that everything is secure. Moreover, this kind of analysis requires significant resources and time to carry out. It is our hope that each of the companies we study see these results as a first step, and use them to start a broader internal discussion about what they are doing to ensure security inside their company (e.g., creating policies about software updates and patching machines, establishing mechanisms for researchers who discover vulnerabilities to provide responsible disclosure of vulnerabilities, deployment of mechanisms for the secure storage of sensitive data, etc.).

No single analysis can measure all aspects of security. However, we look forward to sharing our results with the general public and the financial inclusion community in the near future. Together, we can ensure the transformative power of these systems while minimizing risks to users.

Have you read?

<a href="https://cfi-blog.org/2017/05/01/how-secure-is-data-used-in-digital-credit/">How Secure Is Data Used in Digital Credit?</a>

<a href="https://cfi-blog.org/2017/05/15/data-are-not-neutral-part-1-of-2/">Data Are Not Neutral (Part 1 of 2)</a>

<a href="https://cfi-blog.org/2017/06/28/why-do-privacy-policies-matter-for-digital-credit/">Why Do Privacy Policies Matter for Digital Credit?</a>

&nbsp;

How Secure Are Emerging Digital Credit Services?

&gt; Posted by Kyle Burgess, Executive Director and Editor in Chief, Consumers Research

[caption id="attachment_23631" align="aligncenter" width="490"]<img class="wp-image-23631 size-large" src="https://centerforfinancialinclusionblog.files.wordpress.com/2017/05/4880265002_5bf1a62db3_z.jpg?w=490" alt="From cash to digital currency" width="490" height="210" /> Image Credit: <a href="https://www.flickr.com/photos/famzoo/">FamZoo Staff</a>. No alterations made. <a href="https://creativecommons.org/licenses/by-sa/2.0/">CC BY-SA 2.0</a>[/caption]

Digital currencies, such as Bitcoin and its underlying blockchain protocol, introduce a technical platform for a new global payment infrastructure that <a href="http://consumersresearch.org/research/bretton-woods-2015-white-paper/">has the potential</a> to level the playing field for the 2.5 billion people across the globe who are unbanked or underbanked. The immutable and distributed nature of digital currencies and a number of the platforms built on top of blockchain protocols can provide improved security, efficiency, affordability, privacy, and transparency in financial transactions, as well as a whole host of other transfers of value or information. Furthermore, thanks to the proliferation of mobile devices, blockchain-based digital currencies can even remove the middleman, and serve as a bank in your pocket. However, fully removing a third party intermediary comes with significant risks, as there’s no one to call if you lose your private key (which functions as your password), break your hardware wallet (which acts as your digital vault), or want to dispute a payment because the goods you purchased are damaged (because digital currency transactions are irreversible). Like any other product, consumer protection must be at the forefront of the development and implementation of digital currency and blockchain-based financial services.



Over the last few years, policy makers and federal regulators have been advising the blockchain community to develop a set of best practices to address such consumer protection concerns. Several have even cautioned that government solutions may prove to be over-burdensome if the industry fails to demonstrate that it takes consumer protection seriously. This has the potential to diminish the benefits of blockchain technology and limit its ability to foster financial inclusion. Each year <a href="http://consumersresearch.org/">Consumers’ Research</a> hosts a workshop in Bretton Woods, New Hampshire, in the spirit of the first such conference in 1944. The <a href="http://www.brettonwoods2016.com">Bretton Woods 2016</a> conference brought together representatives from legislative, regulatory, and enforcement bodies, as well as a diverse array of fintech, traditional financial industry, and blockchain experts in order to tackle these consumer protection challenges collaboratively. Consumers’ Research, along with the help and expertise of its workshop participants, produced the first industry-led, self-regulatory consumer protection effort in the digital currency space.

The guiding principles document, “<a href="http://consumersresearch.org/research/bretton-woods-2016-protecting-consumers-in-the-digital-currency-economy/">Consumer Protection in the Digital Economy</a>” has four main components:
<ol>
 	<li> The State of Consumer Protection in the Financial Services Industry&nbsp;

This section identifies the assumptions from which current consumer protection models are derived – the first being that consumers must trust their money and information to third parties in order to participate in the formal economy and the second being that individual consumers are ill-equipped to assess the trustworthiness of third parties. It then describes how blockchain-based digital assets, such as bitcoin or a tokenized property title, challenge those assumptions. This section also identifies which types of digital currency entities the proposed guiding principles are meant for, and reviews the U.S. government entities that have released consumer advisories, taken enforcement actions, or developed rules regarding bitcoin, other digital currencies, and the entities utilizing digital currencies and assets."</li>
 	<li> Consumer Bill of Rights &amp; Guiding Principles&nbsp;

A consumer bill of rights and 14 parallel guiding principles address consumer protection challenges in terms of security, privacy, usability, and disclosures and liability. The bill of rights outlines the baseline "rights" of consumers along with the minimum standards needed to protect those rights. Furthermore, it encourages companies to uphold these guiding principles by implementing processes and detailed protocols that are well-suited to their unique business models, instead of prescribing a one-size-fits all set of mechanisms that may work for some businesses but not others.</li>
 	<li> Consumer Protection Challenges&nbsp;

This section examines the flaws, failures, and weaknesses of existing financial industry frameworks, as well as newer digital currency and distributed ledger products and services. Using a top down approach, this section identifies the problems faced by consumers using traditional financial services and digital currency or distributed ledger financial services, as well as the source of those problems – be it regulation, corruption, or bad design.</li>
 	<li> Recommended Solutions&nbsp;

Working from the bottom up, this section recommended solutions to the problems posed in the previous section are offered, identifying which guiding principles address the various challenges faced by consumers.</li>
</ol>
Across the globe, policymakers and regulators that are prioritizing financial inclusion efforts, tend to achieve the most success in places where policy and regulatory environments protect consumers while fostering innovation and encouraging competition through “regulatory sandboxes.” As such, it’s urgent that the blockchain industry demonstrates that it takes consumer protection seriously in order to stave off regulation that hampers the value proposition of digital currencies and blockchain technologies. If the industry fails to take action to put consumers first, it is possible that government entities will take a reactionary and overzealous approach to solving issues as they arise.

We are already seeing U.S. regulators shoehorn some digital currency businesses into ill-fitting or inappropriate regulatory frameworks. For example, some state licensing regimes apply money transmitter laws to <a href="https://coincenter.org/entry/food-for-thought-a-federal-safe-harbor-for-non-custodial-cryptocurrency-users">non-custodial blockchain businesses</a> that do not have custody of or control the movement of digital currencies; rather, they manage and supply the infrastructure that enables other businesses or individuals to hold and move digital currencies. This harms American consumers, because these businesses cannot afford to operate in an environment that requires unnecessary licenses. Instead, these businesses seek safe harbor abroad, taking their innovations and product offerings with them.

Furthermore, no consumers are better off when the regulatory environments of states with strong institutions and effective rule of law are so cumbersome that businesses flee to states where consumer protection laws are paltry or unenforced. Thankfully, as blockchain businesses adopt consumer protection best practices, regulators may be encouraged to put down Maslow’s hammer and focus on offering light-touch regulation, only where necessary. This will give businesses the breathing room they need, and it will afford consumers greater access to these transformative technologies, along with the protections necessary to safeguard their meaningful participation.

Protecting Consumers in the Digital Currency Economy

CFI Fellow Patrick Traynor, an Associate Professor in the Department of Computer and Information Science and Engineering (CISE) at the University of Florida, is launching his research effort on the security of data in mobile lending applications.

Mobile phones and networks are transforming the world of financial inclusion. However, we know that we cannot simply “copy and paste” traditional financing mechanisms into this mobile context and expect widespread inclusion. For example, the traditionally-excluded often lack the standard data lenders use to underwrite credit decisions (such as government audited tax forms, formal pay stubs, property deeds, and so forth). A plethora of companies are attempting to measure creditworthiness using alternative data – including the data trail created through mobile money applications. Alternative data for underwriting holds the potential to dramatically expand access to credit if successful, but it also poses new challenges.

For instance, how secure is data used in digital credit?

In my CFI Fellowship, I will measure the state of data security in the mobile money space and provide both a goal and a path towards responsible online credit.

My team and I are performing an extensive teardown of mobile applications including those offering online credit. After a technical analysis of these applications and how they handle user data, we plan to evaluate the privacy policies for each application to see if they describe how the data will be protected, how it will be used, and the recourse available to users should it be incorrect.

It is only by having deeply characterized the behaviors of the industry that we can begin to offer recommendations for what responsible online credit looks like and how far the industry is from achieving it. We expect to find that the integrity of data gathered from mobile money applications will vary dramatically and that the lack of a process to verify and/or challenge such information will limit the reach of alternative efforts to establish creditworthiness.

Methodological approach:

My past research looked at the security of mobile money applications for the Android mobile platform. Through that work, I was able to demonstrate that much of the industry fails to adhere to security best practices. Moreover, the terms of service dictated by companies in this space hold users liable for all fraud. These findings have called the industry to attention and provoked corrective efforts. Under the CFI Fellowship, I will conduct a similar analysis targeting specifically online credit applications for mobile money users.
<ul>
 	<li>App Identification and Gathering: The first step is to work with stakeholders throughout the community to identify candidates for analysis. This process will allow to identify the most relevant players in this space (i.e., those with the largest potential market and impact), and ensure a geographically representative sample.</li>
 	<li>App Teardown and Analysis: Analysis of the collected mobile applications will involve automated techniques. The tools that allow rapid assessment of the state of communications security between the mobile device and the online credit provider’s back end servers. This analysis will include not only a determination of whether or not the mobile application properly determines identity at the other end of communications, but also whether the back end servers are properly configured against the most up-to-date attacks against the SSL/TLS security suites.</li>
 	<li>Policy Analysis: Each application comes with a terms of service document. My past experience demonstrated that such documents place the consequences of fraud solely upon the user regardless of the technical soundness of the application. Accordingly, in this round, I will analyze terms of service documents for online credit providers, looking specifically for language that indicates 1) which data will be targeted by the provider, 2) how it will be used to determine creditworthiness, 3) how users can challenge or confirm the validity of such data, and 4) if such data can be resold to other parties without further explicit notification to the user.</li>
</ul>
All technical advances made as part of this work will be offered to the public as free, open-source projects. One broad objective of the work is that these tools will enable students from universities across the world to be trained in the security analysis of applications, and that the companies in this industry will recreate the methodology and apply it to future offerings of their products to improve security.

Have you read?

<a href="https://cfi-blog.org/2017/03/01/mobile-money-in-myanmar-going-directly-from-cash-to-digital/">Mobile Money in Myanmar: Going Directly from Cash to Digital</a>

<a href="https://cfi-blog.org/2017/02/07/modelo-peru-whats-next-for-the-groundbreaking-mobile-money-platform/">Modelo Peru: What’s Next for the Groundbreaking Mobile Money Platform?</a>

<a href="https://cfi-blog.org/2016/02/01/why-do-we-so-often-get-the-mobile-money-agent-value-proposition-wrong/">Why Do We So Often Get the Mobile Money Proposition Wrong?</a>

&nbsp;

How Secure Is Data Used in Digital Credit?

When most microfinance clients start out, they’re first-timers at a formal financial institution. Like anything unfamiliar, a first foray with banks can be intimidating. You don’t want to be duped or make a mistake and lose precious savings. Peace of mind was granted to clients of two microfinance institutions, one in Paraguay and the other in the Dominican Republic recently as the first <a href="http://smartcampaign.org/certification/">Smart Certifications</a> in those countries were awarded. Fundacion Paraguaya and Banco ADOPEM were certified as meeting all the standards needed to treat their clients with adequate care. This certification demonstrates to prospective clients as well as investors and other industry stakeholders that their institutions are operating responsibly.

Fundacion Paraguaya and Banco ADOPEM are both market leaders in their own right. Banco ADOPEM is one of the largest microfinance institutions in the Dominican Republic. According to the MIX, 351,000 depositors in the Dominican Republic bank with Banco ADOPEM. When Banco ADOPEM pursues and achieves Smart Certification, that sends a message to MFIs and other stakeholders in the country that client protection is a key priority. In 2014 ADOPEM was named “Most Innovative Microfinance Institution of the Year” by Citi, in part because of <a href="https://www.google.com/url?sa=t&amp;rct=j&amp;q=&amp;esrc=s&amp;source=web&amp;cd=1&amp;cad=rja&amp;uact=8&amp;ved=0ahUKEwiqm5rRtcvNAhVBVT4KHQJ6A7AQFggfMAA&amp;url=http%3A%2F%2Fwww.bancoadopem.com.do%2Fapp%2Fdo%2Fproductos.aspx%3Fid%3D1408%26iid%3D1406&amp;usg=AFQjCNGgptkSBD2J3D7ZsUJPbBnM2oBakA&amp;sig2=2F9CvETC8A2D75Fe1H3ozw">ATA-Movil</a>, a portable electronic application that allows credit advisers to assess customers in their businesses or in their homes. The mobile information system also allows for convenient and direct communication with clients.

Mercedes de Canalda, President and Founder of Banco ADOPEM, told the Smart Campaign that the MFI’s decision to pursue Smart Certification was to evaluate the institution’s policies and practices against the industry’s best practices in areas like transparency and communication with clients. She said, “The deep evaluation of our policies and procedures opened our eyes to what we can improve. The biggest advantage is that it gave us reasonable and concrete goals and a specific timeline to improve our practices. It was a detailed requirement. It challenged us to innovate and continue to improve to ensure that clients are treated well and that they are heard.”

Fundacion Paraguaya has long been a leader and innovator in microfinance and in the broader fight against poverty, contributing to areas like <a href="http://www.fundacionparaguaya.org.py/?page_id=490">poverty assessment</a>, <a href="https://cfi-blog.org/2013/09/05/disability-inclusivity-and-the-smart-campaign-at-fundacion-paraguaya/">financial inclusion for persons with disabilities</a>, and <a href="http://www.fundacionparaguaya.org.py/?page_id=77">youth empowerment</a>. The <a href="http://www.centerforfinancialinclusion.org/publications-a-resources/global-microscope">Global Microscope</a> 2015 reports that client protection regulation in Paraguay is lacking. For example, it lacks strong grievance redressal mechanisms and does not adequately prevent aggressive collection practices. The report also finds there are mounting concerns over over-indebtedness among lower-income groups in the country and that the government needs to devise and implement a national program to ensure greater education about financial services. Fundacion Paraguaya, along with its strong client protection practices, offers <a href="http://www.fundacionparaguaya.org.py/?page_id=491">a range of financial education services</a>, including services to <a href="http://www.fundacionparaguaya.org.py/?page_id=517">children and youth</a> via uniquely structured, financially sustainable programs.

There have been a number of other recent Smart Certifications: Amret Microfinance, Prasac, Sathapana Bank, and VisionFund in Cambodia; Grooming Centre and Fortis Microfinance Bank in Nigeria; AgroInvest in Serbia; Pro Mujer in Nicaragua; FINCA in Georgia; Annapurna Microfinance in India; Tamwil El Fellah in Morocco; Pichincha Microfinanzas in Ecuador; and FINCA in Mexico. The total number of certified institutions is now 60, and together these institutions serve over 26 million consumer protected clients.

For more on Smart Certification, including a listing of certified institutions, visit <a href="http://smartcampaign.org/certification/certified-organizations">the Smart Campaign website</a>.

Have you read?

<a href="https://cfi-blog.org/2016/03/21/a-client-protection-milestone-50-smart-certified-institutions-25-million-clients-covered/">Disability Inclusion, in Ecuador and Around the World: An Interview with Larry Reed</a>

<a href="https://cfi-blog.org/2016/03/21/a-client-protection-milestone-50-smart-certified-institutions-25-million-clients-covered/">A Client Protection Milestone: 50 Smart Certified Institutions; 25 Million Clients Covered</a>

<a href="https://cfi-blog.org/2015/03/26/smart-certification-kashf-foundation-takes-the-lead-in-pakistan/">Smart Certification: Kashf Foundation Takes the Lead in Pakistan</a>

&nbsp;

Client Protection Firsts in Paraguay and the Dominican Republic

Jeffrey Riecke

If you’re plugged into the world of online marketplace lending then you heard this week’s <a href="http://www.pymnts.com/news/alternative-financial-services/2016/lending-club-investigation-renaud-laplanche/">news</a> about Lending Club’s internal scandal which culminated in the resignation of its founder, chairman, and chief executive, Renaud Laplanche. Lending Club, a U.S.-based company, is the first billion dollar online lending marketplace, and Laplanche was viewed by many as the industry’s biggest advocate and one of its pioneers. Accordingly, industry participants and followers are wondering what Lending Club’s news means for the future of the company and the industry. Is this a sign that the promise of marketplace lending is too good to be true?

For dramatic pause, and context, a few facts on what happened. On Monday, after an internal review, Lending Club <a href="http://ir.lendingclub.com/file.aspx?IID=4213397&amp;FID=34233669">announced</a> that $22 million in subprime loans sold in March and April of this year to a single investor went against the investor’s expressed terms. Furthermore, certain staff members, including Laplanche, were aware that the loans did not meet the investor’s criteria, and during the review process there was less than full disclosure by staff including Laplanche, which the board deemed unacceptable.

The review also revealed that, in an unrelated matter, Laplanche failed to disclose personal interests he held in a third-party fund while Lending Club was considering an investment in the same fund. Lending Club conducted the review under the supervision of a sub-committee of its board of directors with the assistance of independent outside counsel and other advisors.

Laplanche and three other senior staff resigned or were fired. The company’s stock price slid dramatically, and investors <a href="http://www.marketwatch.com/story/goldman-jefferies-stopped-buying-lendingclub-loans-2016-05-10">Jeffries LLC and Goldman Sachs paused their purchase of loans from Lending Club</a> as they review the events. Jeffries, for example, had been looking to package roughly $150 million of Lending Club loans into bonds for investor sales in early May.

What does this mean? In the immediate aftermath of the announcement, industry players and commentators had mixed reactions. Some pointed to Lending Club’s falling stock prices and <a href="http://www.pymnts.com/news/alternative-financial-services/2016/lending-club-investigation-renaud-laplanche/">other signals</a> from marketplace lenders as evidence of industry weakness. Others are taking a more <a href="http://www.bloomberg.com/news/videos/2016-05-10/is-lendingclub-a-warning-on-peer-to-peer-lending">optimistic view</a>, asserting that as an emerging asset class, marketplace lending needs greater transparency as part of the process of reaching maturity.

Lending Club for its part, has managed to sustain impressive <a href="http://www.nbcnews.com/business/business-news/lendingclub-founder-s-surprise-exit-leaves-industry-lurch-n572066">year-on-year growth</a>. The company had $1 billion in loan originations in 2012, $7 billion in 2014, and at the end of the most recent quarter (ending March 31, 2016) it neared $18 billion. During this same quarter, Lending Club reported a  modest <a href="http://ir.lendingclub.com/file.aspx?IID=4213397&amp;FID=34233669">$4.1 million net profit</a>.

Looking to the future, marketplace lending is <a href="http://www.businessinsider.com/goldman-sachs-and-jefferies-stop-buying-lendingclub-loans-following-ceos-exit-2016-5">forecasted to grow immensely</a>. Lending Club started out in consumer loans and has since begun lending to small businesses and medical offices. It’s estimated that small businesses make up 99 percent of companies in the United States as well as 54 percent of total sales and 55 percent of all jobs. However, only half of small businesses with $100,000 to $1 million in annual revenue received at least a portion of the financing they applied for from conventional banks in 2015. Business Insider estimates that the volume of potential loans that are not made reached nearly $100 billion in the fourth quarter of 2015.

But of course, this forecasted growth is only as the good as growth in borrower and investor interest, and marketplace players’ abilities to sustainably match the two. While the models first started as peer-to-peer lenders, sourcing funds from individuals, they have for several years been dominated by institutional investors. Indeed, to sustain its volume of lending outfits like Lending Club need big investors. It is notable that the issues raised in this episode raised all relate to dealings with investors, not placement of funds with borrowers, so that aspect of the business model has not been challenged.

Some investors are <a href="http://www.bloomberg.com/news/videos/2016-05-10/is-lendingclub-a-warning-on-peer-to-peer-lending">already declaring</a> that the way Lending Club is handling the situation provides the assurance they need to continue trusting that the company’s operations, including their alternative credit-scoring methods, are sound. In a <a href="http://ir.lendingclub.com/file.aspx?IID=4213397&amp;FID=34233669">press release</a> Lending Club reported: “The Company took, and will continue to take, remediation steps to resolve the material weaknesses in internal control over financial reporting identified in the first quarter of 2016 -- one related to the sales of non-conforming loans and the other to the failure to disclose the personal investment interests -- and to restore the effectiveness of its disclosure controls and procedures.”

Notably, last month Lending Club <a href="http://blog.lendingclub.com/lending-club-partners-funding-circle-prosper-launch-marketplace-lending-association/">partnered</a> with Funding Circle, Prosper and other marketplace lenders to form the Marketplace Lenders Association, which seeks to promote responsible business practices and sound public policy to benefit borrowers and investors. The Association established Marketplace Lending Operating Standards, addressing transparency for investors, responsible lending, governance and controls, and risk management.

A day after Lending Club’s news broke, the U.S. Department of Treasury <a href="https://www.treasury.gov/press-center/press-releases/Pages/jl0452.aspx">released</a> a white paper on marketplace lending, which offers an overview of the evolving market landscape, acknowledges its risks and benefits, reviews stakeholder opinions, and provides policy recommendations.

It is hard to say at this point whether Lending Club’s scandal represents minor growing pains, significant company concerns, or issues that are widespread and threatening for the entire industry. Though regardless, it’s never a bad investment to instill strong internal controls and transparency, especially when strong – and sustainable – growth is planned.

Have you read?

<a href="https://cfi-blog.org/2015/09/15/insights-into-an-evolving-peer-to-peer-lending-industry-in-china/">Insights into an Evolving Peer-to-Peer Lending Industry in China</a>

<a href="https://cfi-blog.org/2013/09/27/financially-included-through-crowdsourced-financing/" target="_blank" rel="noopener">Financially Included Through Crowdsourced Financing?</a>

<a href="https://cfi-blog.org/2014/10/30/fueling-the-economic-engine-global-experiments-in-small-enterprise-lending/">Fueling the Economic Engine: Global Experiments in Small Enterprise Lending</a>

The Lending Club Scandal and What It Means for Marketplace Lending

&gt; Posted by the Smart Campaign

For a brief moment on Monday, all eyes in Tbilisi, Georgia were on the Smart Campaign and its findings on the well-being of microfinance clients. The Campaign presented its <a href="http://smartcampaign.org/tools-a-resources/1075">Client Voices</a> report in a high-profile event at the Georgian Parliament. Joining the event were 12 Members of Parliament from both majority and minority factions of the Government; leadership from the Central Bank, Ministry of Finance and Ministry of Agriculture; a multitude of microfinance practitioners; press and three television stations. This was the first time government representatives of the majority party, minority party, executive branch, industry, and Central Bank all got together to talk about how microfinance clients are treated. Needless to say, it was immensely encouraging to witness this demonstrated interest in the fair and responsible treatment of microfinance clients in Georgia.

The Client Voices project is a four-country research investigation that directly asked microfinance clients about their experiences and treatment. Along with Georgia, the studied countries are Benin, Pakistan, and Peru. Georgia was selected because its market hosts strong and representative institutions conducive to consensus building, and the industry’s decision-makers are currently working to update its regulatory and legal framework. The launch of the Client Voices report positioned the market to act on the project’s recommendations.

The event was co-hosted by the Business and Economic Center (BEC), a non-partisan, not-for-profit institution that works to facilitate understanding and discussion among MPs around financial, economic, and business topics. Following opening remarks by Natia Katsiashvili, Executive Director of BEC, and Giorgi Volski, MP and Chairman of the majority Georgian Dream faction (think Majority Leader in the U.S. House of Representatives), the main findings from the Client Voices project were presented. Here are a few of the key findings:


<ul>
 	<li>Georgian Clients Are Generally Happy with their Lenders: Clients were generally satisfied by how MFIs treated them. Only 5 percent said they had a “bad” or “very bad” experience with MFIs. Compared with the project countries of Pakistan and Benin, aggressive and overt client abuse is rare.</li>
 	<li>Client Understanding of Loan Terms and Conditions Is Lacking: Twenty-eight percent of clients did not know the interest rate on their loan, and another 22 percent could not recall the total amount to be paid on their loan.</li>
 	<li>Overindebtedness Is an Issue: Households with active credit report a median monthly debt-to-income ratio of 37 percent of monthly income allocated to debt repayment. Thirty-seven percent of clients have taken a loan from another source to pay a debt to an MFI, and 21 percent reported reducing food consumption to repay a debt.</li>
 	<li>Clients Are Not Well-Informed on Credit Bureaus: Clients are not aware of how CreditInfo Georgia, the only Georgian credit bureau, works. Many MFI clients fear the negative repercussions of paying late and do not have a clear idea of how credit histories are recorded and used. As a result of this fear, clients may be making extreme sacrifices to comply with tight repayment schedules.</li>
 	<li>Risky Behavior: Taking Out Loans for Others: Ten percent of loans were taken out in someone else’s name, usually by another household member or family member. A relatively higher proportion of these respondents have had a negative record with CreditInfo Georgia. They may have chosen to borrow via another formal borrower because they are unable to borrow themselves.</li>
 	<li>Complaints Mechanisms Are Lacking: Only 4 percent of respondents said that they have ever had a reason to complain to an MFI. This suggests that treatment by MFIs is generally positive. However, only 38 percent were told where to complain, and the vast majority of these were directed to a loan officer or group leader, which may deter clients from voicing concerns.</li>
</ul>
The most fervently debated topic was the dollarization of loans. MFIs in Georgia receive investments denominated in U.S. dollars, so their incentives are to give out dollarized loans. Many MFIs also issue dollar-denominated loans to hedge against currency risk. However, this risk is passed entirely to borrowers. Generally, clients don’t understand what this means and are not fully aware of the high risks associated with taking loans in U.S. dollars. They often take dollarized loans out of ignorance or pressure from the loan officer. As the currency fluctuates, they end up paying back far more than they expected. Out of those surveyed in the Client Voices project in Georgia, 30 percent of clients have a U.S. dollar-denominated loan outstanding, and 13 percent of these did not realize the risks prior to taking the loan.

Between January and October 2015, the Lari depreciated 27 percent compared with the U.S. dollar. Just recently, this practice caused widespread defaults next door in Baku, as Azerbaijan’s currency devaluation led to mass defaults. During the event discussion, the case of Azerbaijan was mentioned as a warning of what could happen if this issue wasn’t controlled in Georgia.

To respond to this problem, a focus on transparency was suggested. If clients have to bear the risk of dollarization they should know and fully understand what they are getting into and what the consequences can be. Additionally, some countries have chosen to limit dollarized loan disbursal, and some MFIs have relied on foreign-exchange swaps to enable them to lend in local currency.

Given the political divisions that exist in Georgia, it is notable that representatives came together from across Georgia’s political spectrum, including the ruling Georgian Dream faction, the Free Democrats, and the United National Movement. There were a number of people asking when Parliament is going to act on client protection, and what changes they’re going to make. A new client protection bill is long overdue.

The Client Voices report was featured on prime-time Georgian TV Monday evening with an interview of  the Smart Campaign’s Eastern Europe and Central Asia Lead, Daniel Balson, on Maestro TV, which you can watch, here: http://bit.ly/1Uv0hck

For more, including additional findings, read the <a href="http://smartcampaign.org/storage/documents/Voices_from_Georgia.pdf">Georgia report</a> from the Client Voices project.

Have you read?

<a href="http://cfi-blog.org/2016/02/18/my-turn-to-speak-voices-of-microfinance-clients-in-benin-pakistan-peru-and-georgia/">My Turn to Speak: Voices of Microfinance Clients in Benin, Pakistan, Peru, and Georgia</a>

<a href="http://cfi-blog.org/2015/10/22/what-do-clients-care-about-results-from-benin/">What Do Clients Care About? Results from Benin</a>

<a href="http://cfi-blog.org/2015/11/09/what-do-clients-care-about-results-from-research-in-pakistan/">What Do Clients Care About? Results from Research in Pakistan</a>

“Client Voices” at the Georgian Parliament

&gt; Posted by Nadia van de Walle, Lead, Africa Partnerships and Programs, the Smart Campaign

<img class="alignright wp-image-21015" style="border:0 solid #000000" src="https://centerforfinancialinclusionblog.files.wordpress.com/2016/03/thumb_117214149e4947a6a244d87b7bbf7640.jpg" alt="" width="330" height="220" />The Central Bank of Nigeria (CBN) is preparing to issue a Guide to Charges for Banks and Other Financial Institutions for providers in Nigeria, which sets out rules for commissions, charges, and rates on various products and services. It has shared the draft Guide on its <a href="http://www.cbn.gov.ng/Out/2016/FPRD/GUIDE%20TO%20CHARGES%20FOR%20BANKS.pdf">website</a> for a period of public review and commentary.

As a campaign that seeks to keep the client at the center, the Smart Campaign is always happy to see provisions in such financial sector guidelines or regulations related to thoughtful transparency and disclosure requirements. We are, however, more cautious when it comes to mandated pricing limits, given the unexpected implications we have seen them bring for clients’ lives. We notice that the CBN file introduces monthly interest rate caps.

This is at odds with the suggested policies in the <a href="http://cfi-blog.org/2016/02/23/dla-piper-drafts-legal-framework-to-support-financial-inclusion/">Model Legal Framework for Financial Consumer Protection</a>, which is based on the Campaign’s seven <a href="http://smartcampaign.org/about/smart-microfinance-and-the-client-protection-principles">client protection principles</a>. The Framework’s section on pricing procedures advises supervisory authorities to not set price or interest rate ceilings or floors, but rather to seek long-term solutions related to improving disclosures and facilitating market competition.

The Central Bank of Nigeria is certainly not alone in considering such caps. Interest rate ceilings are typically introduced as a government response to concerns about predatory lending, when consumers are struggling to afford high-priced loans, and particularly in markets where disclosure and transparency are poor and financial literacy is low. In Africa alone, at least <a href="http://www.slideshare.net/CGAP/2011-subsaharan-africa-regional-snapshot-12100792">twenty other countries have</a> at one point or another introduced caps, including the <a href="http://www.boz.zm/Publishing/66/66_Monetary%20Policy%20Statement%20Jul-Dec%202012.pdf">Bank of Zambia in January 2013</a> (on effective interest rates charged by NBFIs) and the West Africa Economic and Monetary Union (which recently lowered the interest rate ceiling by 3 percent).

While well-intentioned, such caps have not been proven to help customers and in some cases could do more harm than good to their financial lives and level of service access. The first problem is lack of transparency. In an attempt to cover costs, sometimes institutions opt not to comply with these ceilings and instead mask their true prices with fees. Too-low caps may cause institutions’ growth to slow. Further, as summarized <a href="http://www.cgap.org/sites/default/files/CGAP-Donor-Brief-The-Impact-of-Interest-Rate-Ceilings-on-Microfinance-May-2004.pdf">in a recent CGAP brief</a>, such caps could distort the market and prevent financial institutions from offering loans to customers near the base of the economic pyramid who have no alternative access to credit. Evidence suggests that with caps, FIs face alternatives such as withdrawing from the market, <a href="http://www.microfinancegateway.org/sites/default/files/publication_files/sos-15-zm43-uk-nu-final.pdf">reducing their work in rural and other costly markets</a>, increasing their loan sizes, and going up market. In sum, efforts to cap the cost of credit end up reducing access to credit.

When stringent caps have been tried elsewhere, there have been negative results including dropout of small MFIs, flat or negative portfolio growth, and the movement of poor clients to informal, dangerous markets. When <a href="http://www.syminvest.com/news/ecuador-interest-rate-caps-forcing-microlenders-to-increase-loan-amounts/2010/5/6/2364">Ecuador introduced caps</a> in 2007 and again in 2010, MFIs went up market in reaction. India in 2011 <a href="http://www.livemint.com/Industry/nAptDws1eOrnHgqeyMdP1H/RBI-eases-lending-norms-for-microfinance-institutions.html">enacted a margin cap</a>, which led to slower borrowing and lower formal financial access. Based on the Campaign’s own market experiences, we suspect that many Nigerian institutions would not be able to meet these regulatory standards and may similarly exit the market.

Thinking through these measures is particularly relevant in the African region, which has been found to have extremely high operating expense ratios and pricing, and often suffers from missing or poorly functioning credit bureaus (e.g. see research from MFTransparency on <a href="http://www.mftransparency.org/microfinance-pricing/Uganda/">Uganda</a> and <a href="http://www.mftransparency.org/microfinance-pricing/Ghana/">Ghana</a> and from the Smart Campaign on <a href="http://www.smartcampaign.org/tools-a-resources/1030">Uganda</a> and <a href="http://smartcampaign.org/tools-a-resources/1076">Benin</a>). When such ceilings have been tried before in Africa, it has been found that low income populations’ access to microfinance is lowered, transparency falls, and equity impact investors leave.

These are hard questions without easy answers. The Campaign continues to explore and advocate for alternative measures regulators and supervisors could consider to improve the health of the sector and protect clients.

We suggest focusing on <a href="http://cfi-blog.org/2016/03/16/towards-authentic-transparency-a-radical-rethinking-of-disclosure-in-financial-inclusion/">transparency</a>, including the publishing and advertising of lending rates, creating credit bureaus with mandatory financial institution participation, supporting product innovation that improves cost-efficiency, consumer protection supervision, investments in financial literacy, and consumer awareness/empowerment efforts.

The Model Legal Framework suggests considering guidelines on product risk management, and affordability and suitability assessments. Others, such as DFID, <a href="http://r4d.dfid.gov.uk/pdf/outputs/EPS/Interest_rate_caps_and_their_impact_on_financial_inclusion.pdf">remind</a> regulators to “let the market determine the interest rate,” by promoting competition, which compels lenders to increase efficiency and reduce costs and profit margins. In an IDB survey of financial institution managers in Latin America and the Caribbean, competition was cited as the largest factor determining the interest rate they charged. The macro evidence supports this view. Latin American countries with the most competitive microfinance industries, such as Bolivia and Peru, generally have the lowest interest rates.

There is <a href="http://www.cgap.org/sites/default/files/CGAP-Donor-Brief-The-Impact-of-Interest-Rate-Ceilings-on-Microfinance-May-2004.pdf">evidence</a> that market competition can cause interest rates in Africa to decline, despite increasing financial expenses, credit losses, and inflation. Further, in addition to ethical concerns, <a href="http://r4d.dfid.gov.uk/pdf/outputs/EPS/Interest_rate_caps_and_their_impact_on_financial_inclusion.pdf">some studies indicate</a> that usurious lending practices are not commercially sustainable due to demand elasticity, so the government does not need to prioritize capping interest rates, as they will fall on their own over time.

The Guidelines in Nigeria may be modified to account for such pricing cap findings or stakeholder push-back. Regardless, the weight of experience and research reminds us once again of the importance in considering the implications of well-intentioned rules on clients.

You can comment on Nigeria’s Guidelines on charges of financial providers, <a href="http://cbn.gov.ng/Out/2016/FPRD/GUIDE%20TO%20CHARGES%20FOR%20BANKS.pdf">here</a>.

Image credit: Accion

Have you read?

<a href="http://cfi-blog.org/2016/02/23/dla-piper-drafts-legal-framework-to-support-financial-inclusion/">DLA Piper Drafts Legal Framework to Support Financial Inclusion</a>

<a href="http://cfi-blog.org/2016/02/26/disability-inclusion-progress-in-india-ecuador-nigeria-and-elsewhere/">Disability Inclusion Progress - in India, Ecuador, Nigeria, and Elsewhere</a>

<a href="http://cfi-blog.org/2015/08/13/the-hold-up-with-mobile-money-in-nigeria/">The Hold-Up with Mobile Money in Nigeria</a>

Interest Rate Caps in Nigeria May Not Be Good for Clients

&gt; Posted by Caitlin Sanford, Bankable Frontier Associates, and Alexandra Rizzi, the Smart Campaign

<a href="http://smartcampaign.org/tools-a-resources/1075"><img class="alignright wp-image-20644" style="border:0 solid #000000" src="https://centerforfinancialinclusionblog.files.wordpress.com/2016/02/cv-cover.png" alt="" width="300" height="389" /></a>“Sandra” from Lima described her experience talking to a loan officer:

“You don’t understand anything [the microfinance staff members] says, because of how fast he talks.  It is almost as if his tongue is twisted. You end up not understanding in the end. [He says] ‘But ma’am I’ve explained it to you, why can’t you understand? I’ve been very clear.’” 

New <a href="http://smartcampaign.org/tools-a-resources/1075">Client Voices</a> research from the Smart Campaign and Bankable Frontier Associates (BFA) finds that although microfinance providers may be complying with disclosure regulations, clients are not adequately absorbing information about their financial products.  A regulatory compliance-based approach to consumer protection in which providers focus on meeting minimum disclosure requirements risks losing sight of the main objective of transparency— that clients understand what they are signing up for. With clients inadequately informed about many aspects of microfinance, even in countries with strong transparency regulations like Peru and Georgia, the Client Voices findings demand a radical rethinking of transparency.  Namely, emphasis should widen from what information is provided to how much clients understand.

In the Client Voices project we solicited input from clients about what they consider good and bad treatment in their interactions with microfinance service providers, and assessed the prevalence of consumer protection problems in Benin, Pakistan, Peru, and Georgia.  We found that clients in all four countries have an inadequate understanding of the basic attributes of their microfinance products.  Although most clients do receive some information about their loan products, overall they report low levels of understanding of their loan terms and conditions, regardless of education level.  In Benin, Pakistan, and Peru, 50 percent, 49 percent, and 43 percent of respondents respectively report that they understood loan terms only somewhat or not at all at the time of taking out the loan. Self-reported understanding of loan terms and conditions is highest in Georgia, where 79 percent reported understanding the terms and conditions.

[caption id="attachment_20901" align="alignright" width="330"]<img class="wp-image-20901" src="https://centerforfinancialinclusionblog.files.wordpress.com/2016/03/photo-1.jpg" alt="" width="330" height="246" /> Photograph taken by client in Benin[/caption]

The lack of understanding is more alarming with respect to insurance that is often bundled with microfinance loans: 24 percent of clients in Peru did not know whether or not they had insurance with their loan. Among clients who had insurance accompanying a microfinance loan in Pakistan, only 13 percent reported that they knew how insurance works.

“But the problem with these [microfinance providers] is that there are some false charges called “insurance” in addition. Finally the amount to borrow becomes insignificant after such costs are deducted.”

-Female, Cotonou, Benin

In Georgia, many MFIs issue loans in U.S. dollars rather than Georgian lari to protect themselves against devaluation. As a result of exchange rate fluctuations in the past year, the monthly repayment of a client who took a dollar-denominated loan in January 2015 would be more than 25 percent larger by October of that same year.  Our research found that 13 percent of respondents with dollar-denominated loans claimed they were not aware of this risk when they took out the loan, and 52 percent felt the information provided on exchange rates was somewhat to not clear at all.

[caption id="attachment_20902" align="alignright" width="330"]<img class="wp-image-20902" style="border:0 solid #000000" src="https://centerforfinancialinclusionblog.files.wordpress.com/2016/03/photo-2.png" alt="" width="330" height="253" /> Photo taken by client in Georgia[/caption]

“[I took the picture of the] empty wallet to signify monthly expenditures, the increase of dollar rate…”

-Male, Kutasi, Georgia

Whether it is currency fluctuations in Georgia or an unknown fee in Peru, clients are often surprised during transactions with MFIs. Regardless of whether these surprises are due to client misunderstanding or staff malfeasance, they damage client trust. We believe that disclosure practices must widen to encompass both what information is shared with the client as well as ways to check client understanding.

Here is some food for thought on ways to rethink transparency and disclosure:
<ul>
	<li>Prior to disbursement, providers could ask clients to describe their understanding of their product, with staff correcting any misunderstandings. Institutions could even apply a short and easy quiz after presenting information to verify that clients have understood key details, such as the term, how often payments should be made, late penalties, the currency of the loan, etc.</li>
	<li>Providers could present information in innovative ways. For example, Georgian clients report that they really like the short videos that Georgian microfinance providers show. Other ideas include calendars for literate populations, songs, and simple infographics. We call for rigorous research to test which types of disclosure mechanisms actually work.</li>
	<li>Client protection standards could define best practices in transparency as not just disclosure but checks (and even monitoring) of client understanding of terms and conditions. SMS and <a href="https://en.wikipedia.org/wiki/Interactive_voice_response">interactive voice response technology</a> could be low-cost methods for implementation.</li>
	<li>Regulators may wish to build verification of client understanding into supervision. This could involve surprise mystery shopping visits to institutions, or questioning clients about high-stakes information. Regulators may consider issuing fines to microfinance institutions if a certain percentage of clients do not know critical information.</li>
	<li>Insurance bundled with loans may deserve more attention from regulators, as client understanding of insurance—even whether they have a policy or not— is especially low.</li>
</ul>
Because transparency efforts have focused on complying with disclosure requirements rather than making sure users understand their rights and responsibilities, information that microfinance institutions provide tends to be copious, technical, and complicated.  Current disclosure methods are not resulting in sufficient client understanding.  We look forward to hearing from the industry on how to shift away from “tongue twisted speeches” used to explain financial products.

For more, check out the <a href="http://smartcampaign.org/tools-a-resources/1075">Client Voices project</a>.

Have you read?

<a href="http://cfi-blog.org/2016/02/18/my-turn-to-speak-voices-of-microfinance-clients-in-benin-pakistan-peru-and-georgia/">My Turn to Speak: Voices of Microfinance Clients in Benin, Pakistan, Peru, and Georgia</a>

<a href="http://cfi-blog.org/2015/10/22/what-do-clients-care-about-results-from-benin/">What Do Clients Care About? Results from Benin</a>

<a href="http://cfi-blog.org/2016/02/22/borrowing-blind-in-peru-findings-from-the-client-voices-project/">Borrowing Blind in Peru: Findings from the Client Voices Project</a>

Towards Authentic Transparency: A Radical Rethinking of Disclosure in Financial Inclusion