Vendor Risk at LendFast Microfinance Bank
LendFast Microfinance Bank is a tier-2 Nigerian MFB with 14 branches, 220 staff and a ₦6.8 billion loan book. In 2024 it outsourced customer onboarding and credit scoring to a Lagos fintech, CrediCore, which hosts the application on servers in Ireland and South Africa. The vendor-risk assessment consisted of a one-page checklist; the vendor's self-declared ISO 27001 certificate was accepted without verification, and the contract has no audit right, no breach-notification clause and no data-residency commitment. Thirty-eight per cent of new loans now originate through the channel. In May a security researcher found 4,300 customer records, including BVN and bank details, on a public code repository. CrediCore says the data was test data and refuses an on-site review. The bank's chief compliance officer has not notified the CBN or the Nigeria Data Protection Commission. The board asks its risk adviser for an urgent assessment.
1. Critique the risk assessment that rated this outsourcing as low risk and identify the principal risks that were missed. Recommend a re-assessment method.
Read the worked answer
The checklist measured whether documents existed, not whether risk was acceptable. A self-declared ISO 27001 certificate is an assertion, not verification; scope, validity and certification body were not checked. There were no likelihood or impact scales, no data-sensitivity rating, no concentration analysis and no scenario work, so a low rating was almost inevitable.
Missed risks: data protection and privacy, because BVN and bank details are sensitive personal data under the Nigeria Data Protection Act 2023; cyber and third-party access risk; concentration risk, since 38% of originations depend on one vendor; contract risk, with no audit right, breach notification, data residency or termination assistance; regulatory risk under CBN outsourcing and cybersecurity expectations; model risk, because the credit-scoring model was not validated; country and legal risk from hosting in Ireland and South Africa; reputational risk; and exit and continuity risk if the vendor fails.
Re-assessment: map the data flows and complete a data protection impact assessment; tier the vendor as critical; score inherent and residual risk using defined likelihood and impact scales; run scenarios such as public exposure of 100,000 records, a five-day API outage, or vendor insolvency; use a bow-tie for the top three risks; set board risk appetite for outsourcing concentration; commission an independent security assessment; and report the re-scored register to the board. The assessment should be repeated annually and on any material change.
2. Set out the due-diligence and contract controls that should have been in place and the monitoring metrics that should now be implemented.
Read the worked answer
Pre-contract due diligence should have verified the ISO certificate with the certification body, including scope; obtained a SOC 2 Type II report or independent penetration test; reviewed financial statements, beneficial ownership, subprocessors, data residency and incident history; tested business continuity and insurance; and taken references. The contract should include a right to audit, breach notification within 24 hours, a data-processing agreement aligned to the NDPA, security schedules, service levels with remedies, subcontracting approval, data return and deletion, termination assistance, step-in rights and liability cover.
Ongoing monitoring should use a monthly vendor dashboard: uptime, failed login rate, security incidents, patch compliance, data-subject requests, complaint volumes and loan delinquency by channel. Add quarterly service reviews, annual on-site audits or independent assurance, continuous monitoring of public breach news, a subprocessor register and a concentration limit, for example no more than 25% of originations through one vendor without board approval. Require the vendor to notify any change of control or hosting location. Assign a relationship owner in the business and an independent oversight contact in compliance. Escalate amber and red indicators to the risk committee with a remediation plan. The bank should also test its exit plan before renewal.
3. Advise on immediate incident response and regulatory notification, and explain the board's reporting obligations.
Read the worked answer
Contain first: revoke the vendor's API keys, disable compromised accounts, preserve logs and engage an independent forensic firm. The vendor's claim that the records are test data must be verified, not accepted. Assess whether the data is real, how it was exposed and whether BVN or bank details could be misused.
Notify the Nigeria Data Protection Commission within 72 hours of awareness where the breach is likely to result in risk to data subjects; with BVN and bank details, the risk is high, so notify affected individuals without undue delay. Notify the CBN under its cybersecurity and outsourcing expectations and consider NIBSS implications for BVN misuse. Consider the police or EFCC for criminal investigation. Prepare a holding statement and call-centre scripts, and avoid speculation.
Remediate: rotate credentials, enforce multi-factor authentication, minimise data shared with the vendor, and suspend new onboarding through the channel until assurance is obtained. The board should receive a report within 48 hours covering the incident, regulatory exposure, customer impact, accountable executive, remediation plan and timeline. The CIO's suggestion to wait three weeks is wrong: the 72-hour clock runs from awareness, not from completion of forensics. An initial notification can state known facts and be updated later. Delay risks fines, regulatory sanction and loss of trust, and looks like concealment.