Overview:
Issued by FITSPA, the Code applies to member digital credit providers licensed by the Microfinance Regulation Department, the Bank of Uganda, or other relevant authorities. FITSPA will act as both custodian and enforcer, requiring compliance, conducting audits, and imposing sanctions on providers that breach the rules.
After years of explosive growth—and mounting complaints—Uganda’s digital credit industry has taken a decisive step to police itself.
Digital lenders operating under the Financial Technology Service Providers Association of Uganda (FITSPA) have adopted a binding Industry Code of Conduct aimed at curbing abusive lending practices, strengthening consumer protection, and realigning fintech credit with the country’s financial inclusion goals.
Issued by FITSPA, the Code applies to member digital credit providers licensed by the Microfinance Regulation Department, the Bank of Uganda, or other relevant authorities. FITSPA will act as both custodian and enforcer, requiring compliance, conducting audits, and imposing sanctions on providers that breach the rules.
The move comes as mobile and app-based loans continue to expand access to fast credit—particularly for micro, small, and medium enterprises—but also fuel rising concerns over over-indebtedness, aggressive collections, and widespread misuse of personal data.
From growth-at-all-costs to “consumer protection first”
At the heart of the new Code is a clear shift in philosophy: consumer protection now takes precedence over rapid loan growth.
While acknowledging the role of digital credit in closing financing gaps, the Code warns that unchecked expansion risks trapping borrowers in debt cycles, undermining trust in financial innovation, and ultimately derailing inclusion objectives.
To address this, the rules now govern the entire digital lending lifecycle—from product design and advertising to data use, credit reporting, and debt recovery.
No loan without ability to repay
One of the most significant changes is the requirement for lenders to assess affordability before approving any loan.
Under the Code, digital lenders must conduct creditworthiness checks based on a borrower’s income, existing obligations, and repayment capacity, using regulator-approved debt-to-income thresholds. Credit limits must align with demonstrated ability to repay, ending the practice of rapidly escalating loan limits without evidence of affordability.
Automatic limit increases are now permitted only where affordability is proven and the borrower gives explicit consent. Lenders must also submit credit data to licensed credit reference bureaus and clearly inform consumers that their borrowing will be reported.
Transparency in plain language
The Code strengthens borrowers’ right to clear information, requiring lenders to disclose—in plain, accessible language—the principal amount, net disbursement, all fees and interest, total cost of credit, repayment schedules, penalties, cooling-off periods, and grievance channels.
Marketing rules have also been tightened. Lenders are barred from misleading campaigns or promotions that encourage reckless borrowing and must provide consumers with a clear option to opt out of promotional messages.
Data privacy: drawing the line
Few issues have generated more public anger than privacy violations by some digital lenders, including accessing phone contacts and calling friends or family members of borrowers in default.
The new Code draws firm boundaries. Data privacy is declared non-negotiable.
Lenders are now limited to collecting only information strictly necessary for credit decisions and must obtain specific, informed consent for each use—effectively banning blanket or “umbrella” consent.
Access to phonebooks, contact lists, photo galleries, and unrelated files is prohibited unless directly required and separately consented to. Sharing borrower data with third parties is also banned.
Ending harassment and public shaming
Debt collection practices have undergone a major overhaul.
Under the Code, recovery must follow board-approved policies, rely on reputable agents, and respect borrower dignity. Harassment, threats, obscene language, deception, impersonation of authorities, and calls at unreasonable hours are explicitly prohibited.
Public shaming tactics—such as contacting relatives, friends, or employers, or posting defaulters on social media—are banned outright.
Before taking legal action, lenders must issue a written demand notice clearly explaining the default and the steps they intend to take.
A credibility test for digital finance
The adoption of the Code marks a critical moment for Uganda’s digital credit industry. It signals an attempt to restore trust in fintech lending by drawing clear red lines between innovation and exploitation.
Whether the reforms succeed will depend not only on the strength of the rules, but on enforcement. For borrowers, the promise is simple: faster credit should no longer come at the cost of dignity, privacy, or financial ruin.