BOT Microfinance Regulations Explained

Why microfinance regulation exists

Microfinance regulation in Tanzania exists for three overlapping reasons: protecting borrowers who often have limited recourse and limited financial literacy relative to the institutions lending to them; protecting the stability of the wider financial system as microfinance lending grows in scale and interconnection with formal banking; and aligning the sector with Tanzania's anti-money-laundering and counter-terrorist-financing (AML/CFT) framework, since lending and cash movement are natural vectors for both legitimate and illicit financial activity. None of this is unique to Tanzania — it mirrors the logic behind microfinance regulation across most of East Africa — but the specific instruments, tiers, and thresholds discussed below are Tanzania-specific and administered by Bank of Tanzania (BOT).

The four tiers BOT recognizes — and where digital lenders fit

The Microfinance Act 2018 organizes Tanzania's microfinance sector into four tiers, and which tier an institution falls into determines which specific regulations apply to it. Tier 1 covers deposit-taking microfinance banks. Tier 2 covers non-deposit-taking microfinance service providers — credit and microcredit companies, financial organisations, housing microfinance companies, individual money lenders, and digital microfinance lenders — licensed and supervised by BOT under the Microfinance (Non-Deposit Taking Microfinance Service Providers) Regulations 2019 (GN No. 679). Tier 3 covers Savings and Credit Cooperative Societies (SACCOS), governed by the Microfinance (Savings and Credit Cooperative Societies) Regulations (GN No. 675). Tier 4 covers community microfinance groups — informal, member-based groups including many VICOBA/VSLA savings circles — which are registered at the local government level rather than fully licensed like Tiers 1–3.

To size these tiers as of the most recent published reporting period: BOT issued 765 Tier 2 licenses, the Tanzania Cooperative Development Commission licensed 80 Tier 3 SACCOS, and local government authorities registered 10,642 Tier 4 community groups in 2024 — with Tier 4 alone accounting for roughly 95% of all registered/licensed providers. These figures are drawn from BOT's Financial Sector Supervision reporting for the 2024 period and are a point-in-time snapshot rather than a fixed constant, so they should be treated as approximate and re-checked against the latest report before being cited elsewhere. A newer, narrower development worth noting: in August 2024, BOT issued a dedicated Guidance Note specifically for digital lenders operating under Tier 2, addressing lending transparency, fair pricing, responsible debt collection, and personal-data protection — noncompliance can lead to penalties, suspension of digital lending activity, or revocation of the Tier 2 license. The precise text and citation of this Guidance Note — and whether it has since been updated or absorbed into a full regulation — should be confirmed against BOT's current publications before it is relied on as settled.

The areas every microfinance institution needs to get right

Whatever tier an institution sits in, a recurring set of compliance areas tends to show up across Tanzania's microfinance regulatory framework and its international peers.

Affordability and responsible lending

Assessing a borrower's actual capacity to repay before disbursing — rather than lending against collateral value or a flat income proxy alone — is both a consumer-protection expectation and, increasingly, a supervisory one, particularly for digital lenders under the 2024 guidance referenced above.

Transparent pricing

Clear, standardized disclosure of the true cost of a loan — effective interest rate/APR, fees, and total repayment — commonly formalized through something like a Key Facts Statement, so a borrower can meaningfully compare loan offers rather than being misled by a low headline rate that hides fees elsewhere. See Lending operations for how this should surface in the loan-offer workflow.

Loan classification and provisioning

The five-band system — Current, Especially Mentioned, Substandard, Doubtful, and Loss — exists so that an institution's financial statements reflect the real, probability-weighted risk of its portfolio rather than treating every outstanding loan as equally collectible. See the companion article What is PAR30 and PAR90? for the full band-by-band breakdown and how it connects to portfolio-at-risk metrics.

Recovery notices before repossession

A lender generally cannot move straight from default to repossessing collateral — a formal recovery notice must typically be served first, giving the borrower a defined cure period to remedy the default before enforcement proceeds. See Collateral & insurance for how notice-gating should be built into a repossession workflow.

Complaints handling with defined resolution clocks

A structured complaints register, with defined timeframes for acknowledgment and resolution, is both a consumer-protection expectation and an audit trail a supervisor can request. See Compliance.

AML/CFT obligations

Sanctions and PEP (politically exposed person) screening at onboarding and periodically thereafter, plus filing Suspicious Transaction Reports (STRs) when warranted, are baseline AML/CFT expectations across all four tiers, scaled to institutional size and risk profile. See AML & FIU.

How these requirements translate into daily operations

These aren't abstract filing obligations that live in a compliance binder — done properly, they shape the shape of the workflow itself. Affordability assessment and pricing transparency show up in the loan origination screen, before a single disbursement happens. Loan classification and provisioning aren't a month-end spreadsheet exercise if the underlying days-past-due data is tracked continuously — they become a live view, not a retroactive report. Segregation of duties in the approval ladder (branch officer → committee → board, depending on loan size) exists specifically so that no single person can originate, approve, and disburse the same loan — a structural AML and fraud control, not just a governance nicety. And the collections process has to be sequenced so that the required recovery notice is served and its notice period respected before any repossession or legal escalation step fires, not after. This is where an article like this one earns the word "explained": the regulation isn't a separate track from operations, it is the operational design constraint.

What happens when compliance is treated as an afterthought

The operational risk here is real and not hypothetical. Tracking classification bands in a manual spreadsheet that gets updated at month-end means the number an institution is managing against is, by construction, already stale by the time anyone sees it — and drift between the spreadsheet and the actual loan book compounds every month it isn't reconciled. A complaints log kept in email threads or a shared document, with no enforced resolution clock, quietly lets response times slip past whatever standard the institution claims to hold itself to, with no way to prove otherwise if a regulator or a borrower disputes it later. And recovery or legal action initiated before a required notice period has actually elapsed — sometimes simply because nobody tracked the notice date against today's date — creates real legal exposure independent of whether the underlying default was genuine. None of this is a hard sell for any particular vendor; it's a description of what tends to go wrong when compliance workflow is bolted on as paperwork rather than built into the systems people use every day.

How Ustawi is built around these requirements

Ustawi treats the areas above as native workflow, not optional add-ons layered on top of a generic loan ledger. Affordability assessment and CRB checks run as part of loan origination itself, not a separate manual step. Loan classification into the five bands and the resulting provisioning are calculated continuously from live days-past-due data (the same mechanism described in the PAR30 article), not reconstructed at month-end. Repossession workflows are gated behind a recorded recovery notice and its cure period — the system will not let a repossession step fire before that gate clears. A complaints register carries resolution clocks and visible ageing, and AML screening plus STR filing preparation are built into onboarding and ongoing monitoring rather than run as a separate, disconnected process. See the Compliance & Regulatory app, the AML & FIU app, and the formal Regulatory Disclosures page for the complete picture.

Key takeaways

• •Tanzania's microfinance sector is organized into four BOT-recognized tiers, from licensed deposit-taking banks (Tier 1) down to locally registered community groups (Tier 4).
• •Digital lenders under Tier 2 are subject to a dedicated August 2024 BOT guidance note on transparency, fair pricing, and data protection.
• •Six recurring compliance areas — affordability, pricing transparency, classification/provisioning, recovery notices, complaints handling, and AML/CFT — show up across the framework regardless of tier.
• •These requirements aren't separate from daily operations — they shape the approval ladder, the disbursement checklist, and the sequencing of the collections process.
• •Treating compliance as bolt-on paperwork rather than built-in workflow is where real operational and legal risk creeps in.