Insight
How should a microfinance institution in Zambia approach risk management?
In short
Microfinance institutions in Zambia are supervised by the Bank of Zambia under the Banking and Financial Services Act No. 7 of 2017 and are reporting entities for AML/CFT purposes. They carry the same categories of risk as a bank, credit, operational, liquidity and compliance, with two features that shape how those risks should be managed: a branch network where controls are applied by small teams far from head office, and a customer base whose identification and transaction patterns differ from a corporate bank's.
A workable programme for an MFI is therefore less about sophistication than about consistency: one register, controls that are actually performed in every branch, indicators that show when they are not, and AML controls that fit cash-heavy, mobile-money-linked lending.
The risk universe for an MFI
Credit risk dominates: portfolio concentration, arrears and the quality of loan appraisal. Operational risk follows closely, in cash handling, loan-officer fraud, system outages and data errors. Liquidity risk arises from mismatches between deposit or funding maturities and loan tenors. Compliance risk covers prudential returns to the Bank of Zambia, AML/CFT obligations to the FIC, consumer-protection expectations and, since 2021, data protection. Each belongs in the register with an owner and a score.
Branch-level controls
Most control failures in a network happen at the branch: a reconciliation skipped, a loan approved outside authority, a customer's ID not verified. The register should record which controls are performed where, and the RCSA cycle should reach branch managers, not stop at head office. Role-based access that scopes each branch to its own customers and cases both limits damage and makes it clear who is accountable. The RCSA and KRI guide covers the cycle.
Indicators that work for microfinance
Useful KRIs for an MFI can usually be computed from the loan book and the cash book: portfolio at risk by branch, the share of loans approved above authority, unreconciled cash days, staff turnover among loan officers, and the age of the oldest open AML alert. Thresholds should be set per branch as well as institution-wide, because a network average hides a failing branch.
- Portfolio at risk, by branch and by loan officer.
- Loans disbursed outside approval limits.
- Days since last completed cash reconciliation.
- Open AML alerts older than the SLA.
AML controls that fit the business
MFI customers are often paid and repay in cash or through mobile money, and many will not have a corporate footprint. KYC should still verify the NRC against the registry, screen for sanctions and PEP status, and record an expected activity profile, but the monitoring rules should reflect the business: structuring of repayments, group-loan members with identical funding sources, and dormant accounts reactivated with large deposits are more relevant than cross-border wire patterns. The microfinance page describes the module set.
Reporting to the Bank of Zambia and the FIC
Prudential returns to the Bank of Zambia and STRs or threshold reports to the FIC through goAML are the two external reporting streams. Both benefit from consolidation at branch level flowing to a single head-office view, so that the number reported is the number in the ledger. The specific returns, formats and frequencies come from the Bank of Zambia and the FIC and should be confirmed with them directly.
Training and attestation
Staff turnover in branches means training cannot be a one-off induction. A short mandatory course on AML red flags, cash-handling controls and data protection, repeated on a cycle with an attestation record, gives the supervisor evidence and gives the institution a defence when a control fails through ignorance rather than intent.
How ERMAML handles this
ERMAML, the Ontech Risk & Compliance Suite, gives an MFI one risk register with branch-scoped role-based access, RCSA cycles that reach branch managers, per-branch KRIs with automatic escalation, KYC with NRC registry verification and screening, monitoring rules tunable to a lending book, a case workflow with maker-checker review that drafts goAML reports, and a training and attestation module. See microfinance and enterprise risk management.
Frequently asked questions
Who regulates microfinance institutions in Zambia?
The Bank of Zambia, under the Banking and Financial Services Act No. 7 of 2017, licenses and supervises microfinance institutions. For AML/CFT purposes they are reporting entities and file with the Financial Intelligence Centre. Current directives and return formats are published by both bodies.
Does a small MFI need enterprise risk management?
It needs a proportionate version of it: a register of its main risks with owners, controls that are performed consistently across branches, a few indicators that show when they are not, and evidence a supervisor can inspect. The frameworks scale down; the categories of obligation do not disappear.
What is the most common control failure in an MFI network?
In general practice, controls skipped or overridden at branch level: unverified customer identification, approvals outside authority and unreconciled cash. Branch-scoped access, per-branch indicators and an RCSA that reaches branch managers are the usual responses.
Sources
See ERMAML on your own data
Request a demo with Ontech Solutions in Lusaka and see sanctions screening, KYC, transaction monitoring, goAML reporting and the risk register working together in one platform.