WHEN THE ALGORITHM DECIDES: LEGAL ACCOUNTABILITY FOR ARTIFICIAL INTELLIGENCE-DRIVEN DECISIONS IN NIGERIAN FINANCIAL SERVICES

A customer applies for a loan through a banking or fintech app, completes the required checks and submits the application. Within seconds, the application is declined with no loan officer to speak to and often no explanation beyond a message that it “did not meet the institution’s criteria.”

Behind that outcome may sit a system assessing transaction history, credit data, behaviour and identity information, a system that has spotted a pattern, relied on third-party data or reached a conclusion no human reviewer would have reached, one that determines whether they get credit, keep access to an account or complete a transaction.

This phenomenon raises the legal debate; when an algorithm makes a decision that materially affects a customer, who is responsible for it?

The answer cannot be “the algorithm.” An algorithm holds no banking licence, owes no contractual or regulatory duty and cannot respond to a regulator or a customer. Responsibility remains with the institution that deploys the technology and relies on its output. To the customer, none of this is an interesting technological experience floating free of consequence, it is the institution’s decision and the institution’s responsibility however the decision was reached.

This is no longer a hypothetical concern. According to the Central Bank of Nigeria’s Fintech Report 2025, published in February 2026, fraud detection is the most common reported use of Artificial Intelligence (AI) among Nigerian fintechs (87.5%), followed by chatbots/customer service (62.5%), and credit scoring/risk modelling and customer onboarding/KYC (37.5% each). The question is no longer whether AI is used in Nigerian financial services, it already is. The question is whether the legal and governance structures around its use are keeping pace.

Nigeria has no single statute dedicated to artificial intelligence. Accountability for AI-driven financial decisions instead comes from existing frameworks principally the Nigeria Data Protection Act 2023 (“NDPA”), the Central Bank of Nigeria’s consumer-protection regime and in the capital markets, the Securities and Exchange Commission’s Rules on Robo-Advisory Services. Read together, they point to one principle: ‘Financial institutions may automate decisions. They cannot automate responsibility’.

THE NDPA FRAMEWORK: DATA, AUTOMATED DECISIONS AND TRANSPARENCY

AI systems run on data and financial institutions hold plenty of it; identity, transaction, credit and behavioural data. Section 24 of the NDPA requires that personal data be processed fairly, lawfully and transparently; collected for specified purposes; limited to what is necessary; and kept accurate, complete and up to date. A fraud-detection system may flag a transaction, a credit-scoring system may decide whether financing is approved, an onboarding system may determine whether a customer is admitted to a platform and an investment algorithm may determine a recommended portfolio but an algorithm that is technically accurate can still produce an unlawful or unfair outcome if the data feeding it is wrong, incomplete or inappropriate. Data governance is therefore part of AI governance not a separate IT concern.

Section 37 goes further and is the most consequential NDPA provision for this topic. Section 37(1) gives a data subject the right not to be subject to a decision based solely on automated processing including profiling that produces legal or similarly significant effects. That right is not absolute: section 37(2) permits such decisions where necessary for entering into or performing a contract, authorised by written law containing appropriate safeguards or based on the data subject’s consent. But even where an exception applies, section 37(3) requires suitable safeguards including the right to obtain human intervention, express a point of view and contest the decision.

The distinction matters. Nigerian law does not prohibit automated decision-making, it limits when it can be used alone and requires safeguards where it is. A customer should never be left with only “the system rejected your application.” Where section 37 is engaged, there must be a genuine avenue for review not necessarily a manual review of every application, but a real one where the section applies. The distinction between automating a decision and automating accountability is critical: the former may be lawful; the latter is not a sustainable compliance model.

Transparency reinforces this. Section 27 requires a data controller, at the point of collection, to inform the data subject of matters including the existence of automated decision-making or profiling and its significance and likely consequences in language that is clear, concise and accessible. A privacy policy that vaguely refers to “risk assessment” or “service improvement” is unlikely to meet this bar. In digital financial services, where a customer may never interact with a human before a consequential decision is made, transparency has to be built into the design of the service not added to the website after the technology has been deployed.

DPIAs: ASSESS THE RISK BEFORE THE SYSTEM GOES LIVE

Section 28 requires a Data Privacy Impact Assessment (“DPIA”) before processing likely to result in a high risk to a data subject’s rights and consultation with the Nigeria Data Protection Commission (“NDPC”) where high risk remains despite mitigation. For AI-driven financial services, a DPIA should shape the decision to deploy a system not simply document one already approved. Before launch, an institution should be able to answer what categories of data will the system use and why is each necessary; how reliable is the data and where does it come from; what risks, including discriminatory or disproportionate outcomes, could the system create for customers; how will a customer challenge a decision; who can intervene when the system is wrong and what records will be kept. These are governance questions with legal consequences not a technical checklist to be completed after the fact.

The NDPC’s General Application and Implementation Directive 2025 (“GAID”) which has since replaced the earlier Nigeria Data Protection Regulation reinforces this risk-based approach to compliance and introduces the Standard Notice to Address Grievance (“SNAG”), a mechanism through which a data subject who reasonably believes their privacy rights have been violated including through automated processing can seek direct redress from a data controller before escalating the matter to the NDPC.

THE CBN’S CONSUMER-PROTECTION FRAMEWORK STILL APPLIES

Data protection is only one layer. A bank, fintech or other CBN-regulated institution also remains bound by the CBN’s Consumer Protection Framework, built around principles including responsible business conduct, disclosure and transparency, fair treatment and by the Consumer Protection Regulations 2019 which require institutions to maintain complaints mechanisms that are free, fair, timely, transparent, accessible and independent.

Take a legitimate transaction wrongly flagged by a fraud-monitoring system, a real risk, given how widely fraud-detection AI is now used in Nigerian fintech. The institution may have good reason to run that system, but the customer’s problem does not end with the automated alert. There must be a way for the customer to reach a competent human being and have the decision reviewed within a reasonable time not to negotiate indefinitely with an automated response system.

A NIGERIAN REGULATORY EXAMPLE: ROBO-ADVISORY SERVICES

The SEC’s Rules on Robo-Advisory Services, in force since August 2021, show what algorithmic accountability can look like in a more specific Nigerian context. The Rules recognise “Fully Automated Robo Advisers” those with no human adviser intervention in the advisory process and do not prohibit them. Instead, they require board and senior-management oversight of the algorithm; governance arrangements to mitigate fault or bias; testing before launch and after any material change; controls to detect and suspend faulty or biased advice; periodic review by an independent, qualified human adviser; and disclosure of the algorithm’s assumptions, limitations and risks. This is a useful template even outside the capital markets: automation is made to operate within a framework of governance, testing, disclosure and oversight, it is not banned.

THE BLACK BOX, THIRD-PARTY SYSTEMS AND BIAS

Some AI systems are complex enough that even technical staff cannot fully explain every step between an input and an output; the “black box” problem. Complexity, however, is not a substitute for governance. An institution relying on such a system for a consequential decision should be able to show that it was properly selected, tested, monitored and governed even if it cannot hand over the underlying source code.

This extends to third-party providers. Many institutions rely on external credit bureaux, identity-verification services or AI vendors. Section 29 of the NDPA requires a data controller engaging a processor to do so under a written agreement ensuring the processor complies with the Act and assists with data-subject rights. A generic technology services agreement is not enough: the contract should address data access and permitted processing, security obligations, data-subject rights and assistance, audit rights, incident reporting, model changes and version control, testing, subcontracting and data return or deletion upon termination. The contract cannot transfer the institution’s regulatory responsibility to the vendor but it determines whether the institution has real protection and operational control when something goes wrong.

Bias is the same governance problem in a different guise. A model trained on historical lending decisions, fraud pattern or onboarding data can reproduce or amplify the biases already present in that data. Section 24’s fairness requirement, and the SEC Rules’ explicit requirement to test for and mitigate bias, both point to the same conclusion.

Model performance should not be measured only by how often the system gets an answer right. Institutions should also understand who bears the cost when it gets an answer wrong.

WHAT FINANCIAL INSTITUTIONS SHOULD BE DOING NOW

The legal risk in AI-driven decisions is best managed before deployment, not after a customer has complained.

The exposure is not theoretical. Where the NDPC finds a breach, a non-major data controller or processor faces the higher of ₦2,000,000 or 2% of its annual gross revenue for the preceding year; a major data controller or processor faces the higher of ₦10,000,000 or 2% of annual gross revenue. Beyond the fine itself, the NDPC can issue compliance orders requiring remediation or compensation, breach of which carries potential imprisonment and affected customers retain a separate right to pursue civil damages. For an institution running AI across credit, fraud detection and onboarding at scale, that is not a rounding error on the compliance budget,  it is a board-level risk.

At minimum, institutions must consider the following vital practices:

  1. Maintaining an inventory of where automated systems, scoring, profiling and decision engines are used across the business.
  2. Classifying decisions by impact. A chatbot answering a branch-address query does not carry the same legal risk as a system deciding who receives credit.
  3. Conducting DPIAs under section 28 wherever high-risk processing is likely before the system goes live and not after.
  4. Building genuine human oversight where section 37 A review that simply repeats the algorithm’s conclusion without independent consideration is not a safeguard.
  5. Testing for accuracy and bias before deployment and on an ongoing basis taking a cue from the SEC’s Robo-Advisory Rules.
  6. Keeping adequate records sufficient to reconstruct a decision, the data used, the model and version applied and any human intervention.
  7. Subjecting AI vendors to real due diligence with contracts that clearly allocate responsibility for data protection, security, incidents and model changes.
  8. Making complaints channels reachable for digital customers consistent with the CBN’s consumer-protection framework.

 

CONCLUSION: THE ALGORITHM MAY DECIDE BUT THE INSTITUTION REMAINS ACCOUNTABLE

AI will keep evolving Nigerian financial services; faster fraud detection, sharper risk assessment, lower costs and more accessible digital finance. None of that need be treated as undesirable but innovation cannot be separated from accountability. The task is not to stop algorithms from making decisions; it is to keep consequential decisions, however they are reached, subject to law, oversight and meaningful redress.

The direction of Nigerian regulation already reflects this balance and it continues to move. The NDPA provides for fairness, transparency, data accuracy, limits on automated decision-making and human intervention. The CBN’s consumer-protection framework requires fair treatment and accessible redress. The SEC’s Robo-Advisory Rules show how board oversight, testing and disclosure can sit alongside genuine automation. And in June 2026, marking three years since the NDPA was signed into law, the NDPC announced that it is reviewing the Act itself to address artificial intelligence, robotics and other emerging technologies directly rather than through the broad references the Act currently makes to “emerging technologies.”

The message for financial institutions is not “do not use Artificial Intelligence and other emerging technologies.” It is more exacting than that: know where it is used, know what data it relies on, know what decisions it shapes, test it, monitor it, document it and give affected customers a genuine avenue for review. Above all, know who answers for it when it fails.

The customer sees an algorithm. The regulator sees an institution. That gap does not excuse the institution from responsibility, it defines it. The law holds the institution to account not the algorithm.

SOURCES

 

Picture of Joshua

Joshua

Let us help you