# CYDM Regulatory Compliance - Tanzania Microfinance

## Regulatory Framework

| Regulation | Authority | Applies To |
|------------|-----------|------------|
| Microfinance Act 2018 | Bank of Tanzania (BoT) | All MFIs |
| Microfinance Regulations 2019 | BoT | Tier 2, 3, 4 providers |
| SACCOS Regulations 2019 | TCDC / BoT | SACCOS (Tier 3) |
| Community Microfinance Regulations 2019 | BoT | Tier 4 groups |
| Banking & Financial Institutions Act | BoT | Tier 1 (deposit-taking) |
| NPS Act 2015 + E-Money Regulations | BoT | Mobile money integration |
| PDPA 2022 | PDPC | All personal data |
| AML/CFT Act | FIA / BoT | All financial institutions |
| Cooperative Societies Act | TCDC | SACCOS governance |

---

## Licensing Requirements by Tier

### Tier 2: Non-Deposit Taking (Credit Companies, Digital Lenders)
- **Minimum Capital**: TZS 20,000,000
- **Application Fee**: TZS 500,000 (non-refundable)
- **Requirements**:
  - Companies Act incorporation
  - Business name includes "microfinance"/"finance"/"credit"
  - Lending policy (Reg 39 requirements)
  - Robust digital lending platform (if digital)
  - PDPC registration certificate
  - No-objection letter from BoT before launch

### Tier 3: SACCOS (Category A & B)
- **Category A**: Savings + Loans + Investments
- **Category B**: All Category A + Microleasing, Microinsurance, Agent Banking, Equity Investment, Debit Cards
- **Licensing**: TCDC registration + BoT license
- **Governance**: Board (min 5), Supervisory Committee, Internal Auditor (diploma + 1yr exp)

### Tier 4: Community Microfinance Groups
- **Members**: 10-50 persons with common bond
- **Registration**: BoT/Delegated Authority (Form 2)
- **Constitution**: Signed by all members
- **Restrictions**: No non-member savings, no branches, no foreign exchange

---

## Mandatory System Features (Per BOT/TCDC Guidelines)

### 1. Membership Management [M]
- Application form with all Reg 2019 required fields
- NIDA/TIN capture and verification
- Share capital tracking (compulsory + voluntary)
- Member progress toward full shares (24-month rule)
- Membership register with signatures

### 2. Loan Management [M]
- **Lending Policy** (Reg 28): Procedures, eligibility, collateral types, limits, interest, penalties, approval levels, guarantee requirements, monitoring, recovery
- **Loan Application** (Reg 29): All 15 mandatory fields + CRB consent
- **Loan Agreement** (Reg 31): 13 mandatory disclosures (amount, rate, fees, EIR, schedule, collateral, signatures)
- **Collateral Rules** (Reg 33): Max 10% core capital (secured), 5% (unsecured)
- **Classification & Provisioning** (Reg 40-41): 5-tier, accrual on delinquent
- **Restructuring & Write-off** (Reg 42-43): Board approval, provision reversal

### 3. Savings & Deposits [M]
- Compulsory & voluntary savings products
- Interest calculation & posting
- Collateral lock (pledged savings non-withdrawable)
- No reuse of collateral for multiple loans

### 4. Accounting & Finance [M]
- **General Ledger** with sub-ledgers per activity
- **Accrual basis** accounting
- **Reconciliation**: GL ↔ Sub-ledger, bank reconciliation
- **Fixed Asset Register**
- **Petty Cash** management

### 5. Reporting [M]
- **Monthly Supervision Plan (MSP)**: All 10 forms (MSP1-MSP10)
- **Quarterly Returns** to BoT/Delegated Authority
- **Annual Audited Financial Statements**
- **CRB Monthly Submission** (performing + non-performing)

### 6. Security & Audit [M]
- **2FA** for all users
- **Password Policy**: Complexity, 90-day expiry, history (5), lockout (3)
- **Audit Trail**: All actions, immutable, user attribution
- **Internal Audit Module**: Cash verification, bank recon, loan file check, provision adequacy, compliance
- **VAPT Reports**: < 3 months old for acquisition

### 7. Consumer Protection [M]
- **Transparent Pricing**: Interest, fees, penalties displayed pre-application
- **Loan Agreement**: All Reg 31 disclosures in Swahili/English
- **Complaints Mechanism**: Accessible channels, tracking, resolution SLAs
- **Financial Education**: Reg 80 topics (products, cash flow, records, decisions)
- **Data Privacy**: PDPA 2022 consent, no unauthorized device access

### 8. Digital Lending Specific (Guidance Note 2024) [M]
- **e-KYC**: NIDA integration, document upload, OTP verification
- **Landing Page**: "This App is owned by [Licensed Name]"
- **Interest/Fees Display**: Before application, per approved lending policy
- **Contact Info**: Phone/email for complaints on every page
- **Data Localization**: No customer data outside Tanzania without approval
- **Device Permissions**: No contacts, call logs, camera, location, social media access

---

## KYC/AML Requirements

### Customer Due Diligence (Reg 17A + AML Regulations)
| Risk Level | Measures |
|------------|----------|
| **Low** | Simplified CDD (verify identity post-relationship) |
| **Medium** | Standard CDD (NIDA + photo ID + address + source of funds) |
| **High** | Enhanced CDD (beneficial ownership, source of wealth, ongoing monitoring) |

### Mandatory KYC Fields
- Full legal name (as per NIDA)
- NIDA number (verified via API)
- Date of birth, gender
- Residential address (utility bill/letter from ward executive)
- Phone number (registered to member)
- Occupation / business details
- Source of income / funds
- Beneficial owners (for entities)
- Politically Exposed Person (PEP) check
- Sanctions screening (UN, OFAC, local)

### Transaction Monitoring
- **Threshold Reporting**: > TZS 50M single transaction / > TZS 100M daily aggregate
- **Suspicious Activity**: Structuring, unusual patterns, high-risk jurisdictions
- **STR Filing**: To FIA within 24 hours of detection
- **Record Retention**: 7 years minimum (transactions, KYC, correspondence)

---

## Capital Adequacy & Prudential Ratios

| Ratio | Requirement | Calculation |
|-------|-------------|-------------|
| **Core Capital** | ≥ 10% of risk-weighted assets | Paid-up shares + reserves + retained earnings |
| **Total Capital** | ≥ 12% of risk-weighted assets | Core + supplementary (revaluation, general provisions) |
| **Liquidity** | ≥ 20% of total deposits | Cash + bank balances + treasury bills / total deposits |
| **NPL Ratio** | < 5% (watch), < 10% (action) | Non-performing loans / gross portfolio |
| **Provision Coverage** | 100% of required provisions | Actual provisions / required provisions |
| **Single Borrower Limit** | ≤ 10% core capital (secured) / ≤ 5% (unsecured) | Reg 33 |
| **Insider Lending** | Board approval, arms-length, aggregate ≤ 20% capital | Reg 35 |

---

## Reporting Calendar

| Report | Frequency | Deadline | Recipient |
|--------|-----------|----------|-----------|
| MSP Forms 1-10 | Monthly | 15th of following month | BoT |
| Quarterly Financial Returns | Quarterly | 30 days after quarter end | BoT/TCDC |
| CRB Data Submission | Monthly | 10th of following month | Credit Reference Bureaus |
| AML/CTR/STR | As triggered | 24 hrs (STR), 7 days (CTR) | FIA |
| Annual Audited Accounts | Annually | 4 months after year end | BoT/TCDC/Registrar |
| AGM Report Pack | Annually | Before AGM | Members |
| Dividend Declaration | Annually | After AGM approval | Members, BoT |
| Tax Returns (PAYE, VAT, Corp) | Monthly/Annual | Per TRA calendar | TRA |

---

## System Configuration for Compliance

### Numbering Series (Per Institution)
```
Members: MBR/YYYY/#####
Loans: LN/YYYY/BRANCH/#####
Savings: SV/YYYY/#####
Shares: SH/YYYY/#####
Receipts: RCT/YYYY/#####
Vouchers: VCH/YYYY/#####
Checks: CHQ/YYYY/#####
```

### Interest Rate Conventions
- **Method**: Reducing balance (mandatory)
- **Day Count**: Actual/365 (Tanzania standard)
- **Posting**: Monthly accrual, quarterly capitalization (configurable)
- **Disclosure**: Nominal rate + EIR + all fees (Reg 31)

### Loan Classification Automation

> **⚠️ Corrected 16 Aug 2026** against the published text of the Microfinance
> (Non-Deposit Taking Microfinance Service Providers) Regulations 2019,
> **GN No. 679, Reg 45**. The buckets previously written here were wrong in a
> way that **understated provisions**: they placed Doubtful at up to 180 days
> and Loss beyond 180. The regulation puts **Loss at anything over 90 days**.
> A loan 120 days overdue requires a **100%** provision, not the 50% the old
> table implied. Full detail in [features/03-loans.md](features/03-loans.md).

**Standard schedule — Reg 45(1) and 45(2)**

| Days past due | Classification | Minimum provision |
|---|---|---|
| 0 – 5 | Current | 1% |
| 6 – 30 | Especially Mentioned | 5% |
| 31 – 60 | Substandard | 25% |
| 61 – 90 | Doubtful | 50% |
| More than 90 | Loss | 100% |

**Housing microfinance — Reg 45(3) and 45(4)**

Housing loans get a separate, more lenient schedule. Applying the standard one
to a housing loan over-provisions and understates earnings.

| Days past due | Classification | Minimum provision |
|---|---|---|
| 91 – 180 | Substandard | 25% |
| 180 – 360 | Doubtful | 50% |
| 361 and more | Loss | 100% |

**Past due is measured on the whole loan — Reg 44(2)**

> "Loans which are payable in installments shall be considered past due in their
> entirety if any of the installments has become due and unpaid for one day or more."

One day late puts the **entire outstanding balance** past due, not merely the
missed instalment. Reg 45(5) extends this to interest-only shortfalls, and
Reg 44(3) cascades it across group loans where the other members do not cover
the default. PAR therefore takes the full outstanding balance as its numerator.

```php
// Automated daily classification job
$daysPastDue = $loan->daysPastDue();   // whole-loan basis, Reg 44(2)

$classification = $loan->product->is_housing_microfinance
    ? match (true) {                          // Reg 45(3)
        $daysPastDue <= 90  => 'current',
        $daysPastDue <= 180 => 'substandard',
        $daysPastDue <= 360 => 'doubtful',
        default             => 'loss',
    }
    : match (true) {                          // Reg 45(1)
        $daysPastDue <= 5   => 'current',
        $daysPastDue <= 30  => 'especially_mentioned',
        $daysPastDue <= 60  => 'substandard',
        $daysPastDue <= 90  => 'doubtful',
        default             => 'loss',
    };

$provisionRate = [
    'current' => 0.01, 'especially_mentioned' => 0.05,
    'substandard' => 0.25, 'doubtful' => 0.50, 'loss' => 1.00,
][$classification];
```

### Mobile Money Compliance (NPS Regulations)
- **Trust Account**: Customer funds segregated in trust account
- **Transaction Limits**: Per BoT tiered KYC matrix
- **Agent Management**: Agent agreements, training, monitoring
- **Reconciliation**: Daily settlement vs system records
- **Consumer Disclosure**: Fees, limits, complaints process in Swahili

---

## Data Residency & Localization

- **Database**: Hosted in Tanzania (TCDC-approved data center)
- **Backups**: Stored in Tanzania
- **No Cross-Border Data Flow**: Without PDPC + BoT approval
- **Language**: Full Swahili + English UI, documents, SMS
- **Currency**: TZS only (integer cents storage)
- **Timezone**: Africa/Dar_es_Salaam (UTC+3)

---

## Audit Requirements

### Internal Audit (Quarterly Minimum)
- [ ] Cash verification (surprise)
- [ ] Bank reconciliation (all accounts)
- [ ] GL ↔ Sub-ledger reconciliation
- [ ] Loan file compliance (sample 10% + all >10M)
- [ ] Provision adequacy review
- [ ] Policy & regulatory compliance
- [ ] IT systems audit (access, changes, backups)
- [ ] Report to Board + Supervisory Committee

### External Audit (Annual)
- [ ] Licensed auditor (NBAA registered)
- [ ] Financial statements per IFRS + Tanzanian regulations
- [ ] Management letter response tracking
- [ ] Submission to BoT/TCDC within 4 months

### BoT Inspection Readiness
- [ ] Real-time MSP data accuracy
- [ ] Loan classification evidence
- [ ] KYC files complete (100% sampled)
- [ ] Audit trail accessible
- [ ] Business continuity plan tested
- [ ] Complaints register up to date