How African MFIs Can Improve Regulatory Reporting Accuracy

Why can correct branches disagree?

Two branches can both be right and still produce totals that refuse to add up, because they're measuring different things with the same words. One branch books a group loan under a product code the head office treats as individual lending. Another posts a repayment on the value date while its neighbor uses the capture date. A third reports gross balances where the consolidation expects net of unearned interest.

That is definitional drift, and supervisors have been fighting it at the largest institutions for over a decade. The Basel Committee's 2020 progress report found that only 2 of 31 global systemically important banks had fully complied with its risk data aggregation principles, seven years after they were issued.

If banks with dedicated data teams and nine-figure budgets can't close that gap quickly, aggregation rules have to be written down and owned before any system can enforce them, and that work sits with your finance team rather than your vendor.

What reporting falls within scope?

This guide covers institution-level supervisory returns: the periodic statements of financial position and deposit and loan classification that your central bank or supervisory authority requires from the licensed entity as a whole.

Two things sit outside it. Credit bureau submissions follow a separate regime with their own file formats and dispute procedures. In Kenya, those obligations run through the Credit Reference Bureau Regulations, which govern data sharing between institutions and licensed bureaus rather than prudential returns. Detailed portfolio-at-risk methodology is also excluded, because arrears aging and provisioning deserve their own treatment.

The distinction matters more than it looks. Teams that merge bureau extracts and supervisory returns into one process end up with controls designed for the wrong failure mode, since a bureau file fails loudly on rejected records while a supervisory return fails quietly on a misclassified balance. Keep the pipelines separate even when they share source data.

How should the reporting cycle work?

A controlled reporting cycle moves branch records through fixed stages, where each stage has an owner and output that can be reproduced months later from the same inputs.

The sequence from extract to archive is simple to describe and hard to hold. What makes it work is that no stage can start until the previous one is signed off, and nothing bypasses the sequence because a deadline is near. The COSO internal control framework builds this logic into 17 principles across five components, with control activities and information quality treated as separate requirements rather than one.

That separation is the useful part for an MFI. Most reporting failures I've seen traced back to institutions that had controls (someone reviewed the numbers) without information quality (the reviewer had no way to tell whether the extract was complete). Reviewing a wrong file carefully produces a confidently wrong return.

How should source data be mapped?

Every field on a return must point to a named source system and a written transformation rule before consolidation starts. The loan master table and the rule for handling suspended interest together are a mapping.

Write it once and the cost curve bends. The European Banking Authority's 2021 cost of compliance study estimated that targeted changes to reporting processes could cut ongoing supervisory reporting costs by 15% to 24%, with smaller institutions carrying the heaviest proportional burden.

Smaller institutions gain the most because their reporting cost is concentrated in manual reconstruction each cycle. Mapping converts that recurring labor into a one-time asset you maintain, which is why it belongs in a document your auditor can read rather than in a spreadsheet someone built last quarter.

Which definitions must branches share?

A governed data dictionary is the artifact that keeps branches from disagreeing. It names every classification and currency treatment used in a return, and it assigns one accountable owner per definition.

Currency is the easiest place to see why ownership matters. ISO 4217 currency codes exist precisely so that KES and UGX mean one thing everywhere, yet institutions still carry local abbreviations and legacy codes inside their own systems.

Standards solve the external problem and leave the internal one untouched. Your dictionary has to say which code the extract uses and which rate source applies on which date. One owner per definition sounds bureaucratic until a supervisor asks why the foreign currency deposit line moved, and you can name the person who approved the rate source instead of opening an investigation.

When should reporting data close?

Every branch closes on the same cutoff date and the same posting rule, or your consolidation is comparing periods that don't exist together. Set the cutoff by calendar date and time and document exactly what happens to items that arrive after closing.

Late items need a route. International Accounting Standard 10 draws the line between adjusting and non-adjusting events after the reporting period, and the same logic applies to a branch deposit captured two days late: does it provide evidence of a condition that existed at the cutoff, or is it a new event?

Answer that once in policy and your month-end arguments mostly disappear. Branches stop negotiating individually with head office, because the question is which category the policy already places it in.

Which checks precede submission?

Nothing goes to the supervisor until completeness and reconciliation are finished. Completeness means every branch and every account range appears in the extract. Reconciliation means return totals tie to the general ledger and to subsidiary ledgers such as the loan and deposit masters, with differences explained rather than plugged.

Separate the people doing this work. The Institute of Internal Auditors' Three Lines Model, updated in 2020, places operational ownership in the first line and independent assurance in the third, with risk and compliance oversight between them.

Small MFIs often collapse all three into one finance manager, and that's where accuracy dies. You need the preparer and the reviewer to be different people, with the reviewer able to see the source extract rather than only the finished return.

What should a control table contain?

A control table links each reported figure to its source and the supporting evidence. One row per reported line should be maintained every cycle.

• Gross loans: The source is the loan master, using codes 100–199. The transformation is principal outstanding, net of write-offs. Validation: ties to GL 1200. Owner / Reviewer: branch operations / Head of Finance. Evidence: reconciliation file and extract log. Status: cleared.

• Customer deposits: The source is the deposit master. The transformation is the sum by product, excluding staff accounts. Validation: ties to GL 2100. Owner / Reviewer: deposits officer / Financial Controller. Evidence: GL trial balance and variance notes. Status: exception open.

The evidence column carries weight. ISA 500, the International Standard on Auditing on sufficient appropriate audit evidence, requires evidence to be both relevant and reliable, which a screenshot taken after the fact rarely is.

Capture evidence at the moment the control runs. A reconciliation file saved three weeks later proves someone reconciled something.

How does Kenya illustrate local requirements?

Kenya shows how control mapping attaches to a specific template, and nothing more than that. Deposit-taking microfinance banks are licensed under the Microfinance Act and supervised by the Central Bank of Kenya, which prescribes the returns and formats that apply to each category of institution. As of 2025, the CBK lists 14 licensed microfinance banks operating in the country.

Fourteen institutions sharing one supervisor and one template still produce different internal mappings, because the template defines what is reported while each MFI decides which account ranges feed it. That gap is where your control table earns its keep.

Verify the current template and instruction set directly with the supervisor before each cycle, since field definitions and submission channels change without a public announcement. And treat none of this as a continental rule. Uganda and Ghana each set their own categories and filing calendars, so a Kenyan mapping transfers as a method rather than as content.

How should late adjustments be controlled?

Late adjustments need an approval threshold and a written assessment of whether the change touches returns you've already filed. Without those, a correction becomes indistinguishable from an unexplained restatement.

Build the policy around four decisions:

1. Who approves what, by amount and by return line, with a named alternate for each threshold.

2. Which reason code applies, drawn from a fixed list such as misclassification or system error.

3. Whether the prior period requires restatement, and under which criteria.

4. Whether the supervisor must be notified, and within what timeframe.

International Accounting Standard 8 requires prior period errors to be corrected retrospectively by restating comparative amounts, unless doing so is impracticable.

Supervisory returns don't offer the impracticability escape that accounting standards do. If the figure you filed was wrong, the regulator wants the corrected figure and the explanation, which means your rerun procedure has to reproduce an old period exactly with the mappings and rules that applied then rather than the ones you use now.

Is the institution ready to submit?

You're ready when every item below is complete and documented. Checklists work because they externalize memory under time pressure, and the evidence for that is strong outside finance entirely. The World Health Organization surgical safety checklist study published in the New England Journal of Medicine in 2009 found inpatient death rates fell from 1.5% to 0.8% across eight hospitals after a 19-item checklist was introduced.

Work through these before filing:

• Definitions and product codes standardized and current in the data dictionary

• Extracts complete for every branch, with record counts confirmed against the source system

• Return totals reconciled to the general ledger and subsidiary ledgers

• Exceptions investigated and cleared, with resolution notes recorded

• Adjustments approved at the correct threshold and coded

• Management sign-off obtained from a reviewer independent of the preparer

• Evidence archived, and the local template confirmed as the current version

The hospital result came from trained surgical teams who already knew every step. Your reporting team does too, which is exactly why the list matters.

What should technology providers prove?

Ask a provider to run your own reporting scenario in front of you and show the trail from a single reported figure back to the originating transaction. Demonstrations built on the vendor's sample data prove nothing about your product codes or your branch structure.

Require evidence of field-level traceability and reproducible extracts for a closed historical period. The Financial Conduct Authority and Bank of England's Digital Regulatory Reporting phase 2 work concluded that machine-readable reporting is technically feasible but depends on firms first resolving inconsistent internal data definitions.

That conclusion sets the order of operations for you. A system cannot infer which balance definition your branches intended, so a provider that promises to fix data quality through automation is selling you a faster path to the same disagreement. Buy traceability first and ask about automation second.

Could Doocat strengthen reporting controls?

Doocat is a configurable core banking platform with reporting capability, which makes it a candidate for centralizing branch operational data in one system rather than reconciling across several. When loans and the general ledger share a single data model, the mapping work described earlier gets shorter, because fewer definitional boundaries exist to govern in the first place.

That's a structural advantage. Sub-Saharan Africa recorded over 1.1 billion registered mobile money accounts in 2024 according to the GSMA, so any core system you select has to carry wallet and agent channel data into the same reporting pipeline as branch transactions, or your returns will understate activity.

Before committing, run your own supervisor's current return through a proof of concept and confirm that the template is supported as filed and that a closed period reproduces exactly. Ask Doocat to demonstrate it with your data. Contact Doocat to discuss the requirements.