Solutions · Fintech and lending
Bring your fintech privacy work into one place.
Organise processing records, supplier information and audit evidence across your payment or lending business. Review the requirements that apply to your services with your advisers. The scenarios below illustrate the workflow.
Obligations, read from one place
- CBNCustomer data held in NigeriaSatisfied
- NDPCAudit return · 2026Assembling
- PCI DSSCard estate scoped and segmentedSatisfied
- NDPCTransfer to the US warehouseUnregistered
- GAIDCredit model · route to a humanNot started
- BoardOne number for the quarterReady
Who is asking, and for what
The same evidence, four different sentences
A lending business in Nigeria answers to more supervisors than almost anyone. What breaks is not the work — it is keeping four versions of the truth in step when only one of them is read from the systems.
Central Bank
CBN
Customer and transaction data held in Nigeria, and retained for seven years after the relationship ends.
Answered from the retention register
The law
NDPC
What you do with personal data, who receives it, and whether it left the country — filed annually through a licensed DPCO.
Answered from all twenty-three registers
Card scheme
PCI DSS
Which systems touch card data, how they are segmented, and quarterly evidence that the scope has not crept.
Answered from the system inventory
Buyers
Your partners
A trust page they can read before signing, with the certificate, the scope and the exclusions on it.
Answered from the same registers
Where two rules pull opposite ways
Delete it, says one. Keep it seven years, says the other.
A customer asks you to erase their data. Financial regulation requires you to retain the transaction record. Both are correct, and the answer is neither refusal nor deletion.
What most teams do
Refuse, and cite the regulator
A flat no, with no explanation of what was kept, why, or for how long. Legally survivable, and the single most common trigger for a complaint that reaches the NDPC.
What Asiri answers
Erase what is not held by law
Marketing profile, support history and device records go. The transaction ledger stays for seven years under CBN rules, and the person is told exactly that — field by field, with the date it will finally be deleted.
This is why retention periods must record their source. Seven years is the period used in this example. Verify the applicable requirement for each record category before adopting a retention rule.
The credit model
A machine that refuses loans is the most regulated thing you own
Section 37 gives the applicant a route to a human. GAID treats the decision as high risk. ISO 42001 asks who checks it still works in month nine. All three land on the same assessment, and Asiri will not let the model go live until it clears.
DPIA-2026-0004 · credit scoring
High residual risk · filing blocked
A person reviews every decline
Live since May. A model refusing a loan is not the last word.
Applicants are told a model decided
Drafted, blocked behind this assessment.
Test the model for bias by region
Nobody assigned. The longest of the three and it has not begun.
Record what the model weighed
So a refused applicant gets an answer rather than a shrug.
A route to a human, published
Section 37 requires it. No owner, no date.
Where the data actually sits
Your analytics warehouse is a cross-border transfer
It is the finding that surprises fintech teams most. Product events land in a US warehouse, nobody registered it, and the privacy notice names four recipients when there are five. Naming four when there are five is worse than naming none, because it reads as precision.
Asiri reads the destination rather than asking you to remember it, and holds the mechanism against every one.
Connect one system and see which regulator you are short with
Usually it is the transfer nobody registered, and it takes an afternoon to find. Asiri returns the gaps with the read that produced each one.
A clear starting point for security and supplier reviews
Bring together the information your bank, payment business or prospective partner needs to review. In Asiri, a Trust Center can present your chosen declarations while the underlying records remain part of your internal work. Confirm the recipient’s evidence and access requirements before sharing.
Explore Asiri Trust Centers →