AI Credit Scoring for SACCOs in Kenya: Data, Costs, Rules

Kenya's 355 regulated SACCOs carried KES 70.87 billion in non-performing loans at the end of 2024, an industry NPL ratio of 8.39%, and 112 of them sat above the 10% line that keeps boards awake. Machine learning credit scoring can cut appraisal time and catch defaulters that judgement-based appraisal misses, but only if you treat it as a statistics project with a compliance wrapper, not as a chatbot that approves loans. This post lays out what the published evidence actually shows, what data you need before you start, what the Data Protection Act demands, and what the whole thing costs.

What AI credit scoring means in a SACCO context

The phrase covers two separate components, and confusing them is the most common mistake in vendor demos.

The first component is document and data extraction. A loan officer receives an M-Pesa statement as a PDF, a bank statement, a payslip, maybe a CRB report. A large language model reads these and pulls out structured fields: monthly inflows, betting transactions, existing loan deductions, salary consistency. This is a parsing job, and LLMs are good at it.

The second component is the scoring model itself. This is a statistical model, usually logistic regression or gradient boosting, trained on your historical loans and their outcomes. It takes the structured fields and outputs a probability of default. No LLM is involved here, and none should be: the model must be explainable, reproducible, and auditable, which is exactly what a language model is not.

A working SACCO scoring stack is therefore: LLM extracts, statistical model scores, human officer decides. Keep those three roles separate and most compliance problems solve themselves.

The sector context: why this matters now

SASRA's SACCO Supervision Annual Report for 2024, released under section 22 of the Sacco Societies Act, puts hard numbers on the problem. Drawing on audited statements from 355 regulated SACCOs (177 deposit-taking, 178 non-withdrawable deposit-taking), the report shows:

• Total assets: KES 1,076.15 billion, up 10.72% from KES 971.96 billion in 2023
• Gross loans: KES 845.11 billion, up 11.41%
• Non-performing loans: KES 70.87 billion, an industry ratio of 8.39% (8.56% for deposit-taking SACCOs)
• Membership: 7,385,423 members, of whom 22.56% are dormant

Two comparisons make the 8.39% figure interesting. Commercial banks reported 17.10% and microfinance banks 33.60%, so SACCOs still lend better than the rest of the formal sector. But the average hides wide dispersion: agriculture-based deposit-taking SACCOs run an 18.69% NPL ratio, and 68 deposit-taking plus 44 non-withdrawable SACCOs individually exceed 10%. Average dividends on shares fell to 10.46% in 2024, the first decline in three years, and credit losses are a direct cause. The figures above are drawn from the SASRA 2024 supervision report as tabulated with page references by SenteRail's sector summary.

Loan disbursements reached KES 542.75 billion in 2024, led by land and housing (25.26%), education (22.02%) and agriculture (20.05%). That volume is the opportunity: every point of NPL avoided at this scale is roughly KES 8.5 billion of performing book.

What the research actually shows about accuracy

Two Kenya-relevant studies are worth reading before you believe any vendor slide.

A 2022 Strathmore Business School thesis by Silas Okeyo Juma took 783 real loans from a large Kenyan SACCO over one year (July 2018 to June 2019) and tested what happens when you add alternative behavioural data to traditional appraisal variables. With logistic regression, adding the alternative data improved accuracy by 12.1%, precision by 12.9% and area under the curve by 5%. With XGBoost, the area under the curve improved by 15%, and XGBoost outperformed logistic regression overall. The study also documents why SACCO appraisal is different from bank appraisal: decisions rest on guarantor deposits, share capital, internal savings history and the credit officer's judgement, and the data is scarce and messy. You can read the full thesis in the Strathmore University repository.

A 2026 paper in the African Journal of Empirical Research built a default prediction model on the German Credit dataset (1,000 records) as a proof of concept for SACCOs. Plain logistic regression beat a random forest: 77.0% accuracy, 0.795 ROC-AUC, and fewer false negatives, meaning fewer bad loans waved through. SHAP analysis showed the most influential features were checking account status and borrower age, not exotic variables. The authors themselves caution that the model must be retrained and validated on institution-specific SACCO data before production use. The paper is open access at AJERNET.

The lessons from both: simple, explainable models win; your own portfolio data beats any borrowed dataset; and alternative data (transaction behaviour, not demographics) is where the accuracy gains come from.

The data you need before you start

This is where most SACCO scoring projects die, so be honest about it first.

Minimum viable dataset. You need loan-level records with outcomes: was each loan repaid, restructured, or defaulted? Three or more years of history, and ideally several thousand loans. The Strathmore study worked with 783 loans from a single SACCO and got usable results, so the bar is lower than banks assume, but it is not zero. If your core banking system cannot export disbursement date, amount, product, member ID, and repayment status per loan, fix that first.

Alternative data. The accuracy gains in the research came from behavioural data. In Kenya that means M-Pesa statements and bank statements. A six-month M-Pesa statement shows income regularity, spending patterns, existing digital loan obligations and gambling activity, none of which appear in a payslip. Parsing these at scale is the LLM component described above.

CRB data. Kenya's licensed credit reference bureaus, such as Metropol, sell credit scores, full credit reports and status checks, and handle disputes. CRB data helps for members with formal credit history, but it has a structural gap: Kenyan scoring vendor PEMiG claims that more than 40% of creditworthy Kenyans are effectively unscoreable from bureau data alone because their files are too thin. Treat that figure as a vendor claim, not an audited statistic, but the direction matches what every SACCO credit officer knows: a member with five years of deposit history and no prior borrowing looks invisible to a bureau.

The compliance wrapper: Data Protection Act section 35

A credit decision is a decision with legal effect on a person, so the Data Protection Act 2019 applies directly. Section 35 gives every data subject the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or significantly affects them. There are three exceptions: the decision is necessary for entering or performing a contract, it is authorised by law, or the data subject consented.

Even when an exception applies, the Act imposes duties. If you take a solely automated decision, you must notify the member in writing, as soon as reasonably practicable, that the decision was automated. The member can then request that you reconsider the decision or take a fresh decision that is not solely automated, and you must comply and report the outcome in writing. The general penalty provision, section 73, allows fines up to KES 3 million and imprisonment up to ten years for offences under the Act. The full text is on Kenya Law.

Two practical consequences follow.

First, keep a human in the loop. If a credit officer reviews the model output and makes the final call, the decision is not "based solely on automated processing" and the notification and reconsideration machinery is not triggered in the same way. This is also just good lending: the model is a triage and consistency tool, not an autopilot.

Second, watch the sensitive data definition. The Act classifies property details and family details, including names of spouses and children, as sensitive personal data. SACCO loan files are full of guarantor and family information. Your scoring pipeline needs a documented basis for processing it, and your consent language at application time should cover profiling for credit assessment explicitly.

For SASRA-regulated SACCOs there is a further expectation of prudent credit risk management, and an undocumented model that nobody can explain will not survive an inspection. The discipline here, model documentation, validation reports, drift monitoring, is the same discipline bank supervisors apply; the EU is codifying it for credit scoring under its AI Act, which we covered in our post on the EU AI Act's high-risk rules for banks and insurers.

What it costs: a worked example

Take a mid-sized SACCO processing 500 loan applications a month, each with a six-month M-Pesa statement and a bank statement to parse.

LLM parsing cost. A six-month M-Pesa statement runs to roughly 15,000 tokens of text; extracting structured fields produces perhaps 2,000 output tokens. On Claude Haiku 5.5 at $0.10 per million input tokens and $0.50 per million output tokens (see Anthropic's published pricing), one statement costs about $0.0025. Five hundred applications a month cost about $2.50. Even using the stronger Sonnet 5.5 at $2 and $10 per million tokens, the monthly bill is under $60. The API line item is noise.

The real costs are everything else:

• Data engineering: exporting and cleaning three years of loan records from your core banking system, resolving member identities, labelling outcomes. This is usually the single largest work item.
• Model development: training, validating and documenting the baseline model. The tools (Python, scikit-learn, XGBoost) are free; the cost is skilled time.
• Integration: connecting the parser and the model to your loan origination workflow so the officer sees a score and the evidence behind it inside the system they already use. If your M-Pesa data is still arriving by email, our post on automating M-Pesa reconciliation with n8n and Daraja covers the plumbing side, and our business automation service is the done-for-you version of it.
• Compliance work: consent wording, DPA section 35 notices, reconsideration workflow, model documentation for SASRA.
• Ongoing: quarterly drift checks and annual retraining. Models decay as membership and the economy shift.

The alternative to building is buying a scoring API. Kenyan vendors exist: PEMiG, for instance, advertises a causal-AI scoring engine that parses M-Pesa and bank statements, returns a score in under three seconds and produces counterfactual explanations, with a founding-institution offer of KES 250,000 in scoring credits, per its launch announcement. Vendor APIs get you to a pilot in weeks and shift the model-risk burden partly to the vendor; the trade-off is per-score fees at volume, less control over features, and a dependency on the vendor's data handling passing your own DPA obligations.

A reasonable budgeting heuristic: the LLM and software components are the cheap 10%; data cleaning, integration and compliance documentation are the expensive 90%. Any proposal where the API or licence fee is the headline number is priced wrong.

A step-by-step path to a first score

1. Audit the loan book. Export three or more years of loan-level data with outcomes. Count how many loans have complete fields and a clean repaid/defaulted label. If that count is under a few hundred, stop and fix data capture first.
2. Build a boring baseline. Logistic regression on traditional variables only: deposit history, shares, loan-to-deposit ratio, prior repayment behaviour, purpose, term. Publish its accuracy, precision and recall to the credit committee. This is your benchmark.
3. Add alternative data. Parse M-Pesa and bank statements into features, retrain, and compare against the baseline on the same holdout set. The Strathmore study suggests you should see a meaningful lift; if you do not, the features or the labels are the problem.
4. Run in shadow mode. For at least three months, score every application without showing the score to officers. Afterwards, compare model decisions against committee decisions and against actual outcomes. Disagreements are where you learn.
5. Go live with a human in the loop. The model recommends and explains; the officer decides. Log every override.
6. Close the compliance loop. Written automated-processing notices where applicable, a documented reconsideration path, consent language updated at application, and a model file (data, features, validation, drift checks) ready for SASRA.

When AI scoring is the wrong choice

Skip this project, for now, if any of these hold:

• Your core banking data cannot produce a clean loan-level export with outcomes. Fix the system of record first.
• You book fewer than a few hundred loans a year. The statistics will not support a model; a well-run checklist and CRB pull will serve you better.
• Your membership is a single employer payroll with strong check-off. The guarantor and payroll-deduction model already prices that risk accurately.
• Nobody in the organisation will own the model after go-live. An unmonitored model is worse than no model.

Common mistakes

• Training on someone else's data. The German Credit dataset and LendingClub dumps are fine for learning the mechanics, useless for production. The AJERNET authors say this explicitly.
• Letting the LLM make the decision. A language model cannot give you a stable, auditable probability of default, and "the model said so" is not a reconsideration answer under section 35.
• Skipping shadow mode. Going straight from training to live decisions is how you discover, expensively, that your labels were wrong.
• Treating CRB data as complete. Bureau files miss the thin-file majority of SACCO members; that is precisely the gap alternative data fills.
• Forgetting drift. A model trained on 2019 to 2022 data learned a pre-inflation economy. Schedule retraining and monitor score distributions monthly.

Frequently asked questions

Is AI credit scoring legal for SACCOs in Kenya? Yes, with conditions. The Data Protection Act 2019 permits automated decisions where they are contractually necessary or consented to, but section 35 requires written notification, a reconsideration right, and safeguards. Keeping a human officer as the final decision-maker avoids most of the "solely automated" obligations and is better practice anyway.

How much historical data does a SACCO need? The strongest Kenyan evidence worked with 783 loans from one SACCO over a single year, so a few thousand loans over three years is a realistic target, not tens of thousands. Data quality matters more than volume: every record needs a clean outcome label.

Can Claude or ChatGPT approve loans directly? No, and you should not want them to. LLMs are the parsing layer that turns M-Pesa statements and payslips into structured data. The approval probability should come from a validated statistical model whose features and weights you can show SASRA and an unhappy member.

What accuracy should we expect? Published Kenya-relevant work shows 77% accuracy on a benchmark dataset and a 12 to 15% lift in predictive power when alternative data is added to traditional variables. Your numbers will differ; that is exactly why shadow mode against your own committee's decisions is non-negotiable.

Do we still need guarantors? Yes, for now. Scoring changes how you price and triage risk; it does not replace the security structure SACCO lending is built on. Over time, good scores for low-risk members can justify faster turnaround on smaller unsecured amounts.

What will SASRA ask about the model? Expect questions on documentation, validation, data quality, and how exceptions and overrides are handled, the same themes as any credit risk review. A model file covering data sources, features, performance and drift monitoring answers most of them before they are asked.

Where to go from here

The model is the easy part; the pipeline around it, clean loan data, statement parsing, DPA-compliant workflows, SASRA-ready documentation, is where projects succeed or stall. We build exactly that plumbing for financial institutions: private model deployment, document extraction, evaluation and governance documentation, described on our enterprise AI service page. If you are earlier in the journey and weighing which AI use case to tackle first, our overview of AI for SACCOs in Kenya ranks the options by cost and payoff, and our guide to voice AI for SACCOs covers the member-facing side. When you want the scoring pipeline built rather than bought, our custom builds service covers it.