Solutions · Fintech and lending
Four regulators. One set of records. Nobody accepts the others' answer.
The CBN wants your data in Nigeria. The NDPC wants to know who receives it. PCI DSS wants the card estate scoped. Your board wants one number. Asiri keeps one set of registers and answers all four from it.
Obligations, read from one place
- CBNCustomer data held in NigeriaSatisfied
- NDPCAudit return · 2026Assembling
- PCI DSSCard estate scoped and segmentedSatisfied
- NDPCTransfer to the US warehouseUnregistered
- GAIDCredit model · route to a humanNot started
- BoardOne number for the quarterReady
Who is asking, and for what
The same evidence, four different sentences
A lending business in Nigeria answers to more supervisors than almost anyone. What breaks is not the work — it is keeping four versions of the truth in step when only one of them is read from the systems.
Central Bank
CBN
Customer and transaction data held in Nigeria, and retained for seven years after the relationship ends.
Answered from the retention register
The law
NDPC
What you do with personal data, who receives it, and whether it left the country — filed annually through a licensed DPCO.
Answered from all eighteen registers
Card scheme
PCI DSS
Which systems touch card data, how they are segmented, and quarterly evidence that the scope has not crept.
Answered from the system inventory
Buyers
Your partners
A trust page they can read before signing, with the certificate, the scope and the exclusions on it.
Answered from the same registers
Where two rules pull opposite ways
Delete it, says one. Keep it seven years, says the other.
A customer asks you to erase their data. Financial regulation requires you to retain the transaction record. Both are correct, and the answer is neither refusal nor deletion.
What most teams do
Refuse, and cite the regulator
A flat no, with no explanation of what was kept, why, or for how long. Legally survivable, and the single most common trigger for a complaint that reaches the NDPC.
What Asiri answers
Erase what is not held by law
Marketing profile, support history and device records go. The transaction ledger stays for seven years under CBN rules, and the person is told exactly that — field by field, with the date it will finally be deleted.
This is why retention periods must record their source. Seven years is a fact you inherit; two years is a choice you made and will have to defend.
The credit model
A machine that refuses loans is the most regulated thing you own
Section 37 gives the applicant a route to a human. GAID treats the decision as high risk. ISO 42001 asks who checks it still works in month nine. All three land on the same assessment, and Asiri will not let the model go live until it clears.
DPIA-2026-0004 · credit scoring
High residual risk · filing blocked
A person reviews every decline
Live since May. A model refusing a loan is not the last word.
Applicants are told a model decided
Drafted, blocked behind this assessment.
Test the model for bias by region
Nobody assigned. The longest of the three and it has not begun.
Record what the model weighed
So a refused applicant gets an answer rather than a shrug.
A route to a human, published
Section 37 requires it. No owner, no date.
Where the data actually sits
Your analytics warehouse is a cross-border transfer
It is the finding that surprises fintech teams most. Product events land in a US warehouse, nobody registered it, and the privacy notice names four recipients when there are five. Naming four when there are five is worse than naming none, because it reads as precision.
Asiri reads the destination rather than asking you to remember it, and holds the mechanism against every one.
Connect one system and see which regulator you are short with
Usually it is the transfer nobody registered, and it takes an afternoon to find. Asiri returns the gaps with the read that produced each one.