A branch manager at a Capitec in Mahikeng told me last March that her best F&I referral partner, a used-car dealer across the road, was closing deals at 19:00 on Fridays. Car on the forecourt at seven, signed credit agreement by twelve past. The Capitec approval had come back at 18:57, courtesy of a scorecard that chewed through three months of FNB statements, a soft TransUnion pull, and the applicant's prior Mr Price Money and DirectAxis history. Clean, fast, popular on the showroom floor.

The next morning the branch's compliance lead asked a different question. Could the affordability assessment behind that approval survive an NCR audit?

The honest answer was: probably not. Not because the tool was wrong, but because the Act does not ask whether the decision was right. It asks whether the process was recorded, defensible, and reviewable by a human with authority to disagree.

That gap between a clever model and a defensible process is where every AI-powered credit provider in South Africa stumbles. The NCA was written for a paper-based industry in 2005, amended in 2014, and has never been meaningfully updated to deal with automated decision-making. The National Credit Regulator interprets it literally. If you are using AI anywhere in your credit workflow, that gap is where the trouble lives.

What the NCA actually controls

Most dealerships and originators I speak to over-estimate what the NCA cares about, and under-estimate where it bites. The Act regulates credit agreements, not credit itself. If you are lending money, deferring payment, or structuring any transaction where a consumer pays you back over time plus a cost, you are inside the Act. This covers retail credit at Lewis, Russells and Mr Price Money; microlenders like Capfin, DirectAxis and Finbond; car finance through WesBank, MFC and Bidvest; bond originators arranging on behalf of the banks (Ooba, BetterBond, MortgageMax); and plenty of smaller gym contracts and furniture-on-terms deals that owners forget are regulated credit at all.

What the Act does not care about: your marketing list, your lead-nurturing sequence before any credit is offered, or your chatbot answering FAQs about product price. Those live under POPIA and the Consumer Protection Act. The NCA wakes up at the point a quote is issued, an affordability assessment is run, or a credit agreement is concluded. Everything before that is noise to the NCR. Everything after is a potential investigation.

Affordability assessments are the highest-risk AI touchpoint

Section 81 of the NCA says a credit provider must take reasonable steps to assess the consumer's existing financial means, prospects and obligations, their debt-repayment history, and their understanding of the proposed agreement. In practice the "reasonable steps" are prescribed by the 2015 Affordability Assessment Regulations: three months of bank statements, three months of payslips, and a credit bureau check at a minimum.

AI shows up everywhere here. OCR tools parsing line items from Standard Bank and Absa PDFs. Classifier models deciding which transactions are income, which are debit orders already running, which are lifestyle. Scorecards blending the TransUnion or XDS bureau score with the parsed bank data to produce an internal risk number. None of this is prohibited.

What is prohibited is relying solely on an algorithmic score to make the decision. The Regulations require the credit provider to actually assess, in a human sense, the information gathered. In practice this means a scorecard output must be reviewed by a person with authority to approve or decline, and that review must leave a record. An F&I clerk ticking "approve" because the system went green, with no annotation, no cross-check against the bank statements, no comment on anything unusual, is the pattern the NCR flags on inspection.

The workable version we see in SA credit providers is a two-track system. The AI does the OCR, the categorisation, the first-pass affordability maths and the risk score. A human reviewer looks at the summary, confirms three or four anchors (actual take-home, actual existing debit orders, the expense assumption), writes two sentences explaining their decision, and signs off. The AI accelerates the clerical half. The person owns the Section 81 half.

Reckless credit, and where AI quietly makes it worse

Section 80 defines reckless credit. If a credit agreement is entered into without the assessment required by Section 81, or if the assessment was done but the consumer was already over-indebted at the moment of entry, the agreement is reckless. The remedies are severe. A court may suspend the agreement, set aside rights under it, or declare the entire debt uncollectible. In practice the Regulator does not often take an individual case to court. But a pattern of reckless lending surfaced during an inspection is the surest way to lose your NCRCP registration, which ends the business.

AI makes two things worse here when the provider is not careful. First, automated pre-approvals that bypass the full assessment because the model said yes. This is what happens when integration teams optimise for speed on the showroom floor and nobody on the compliance side is in the room when the thresholds are set. Second, AI-written marketing that nudges already-struggling consumers toward further credit. A WhatsApp sequence that says "you qualify for R50,000 more" to someone whose bureau score has dropped three times in two months is not, on its own, a reckless-credit violation. Combined with a thin affordability assessment at point of sale, it builds the exact pattern an inspector will see.

The question I ask credit-provider clients is simple. Does your AI system exist to speed up assessment, or to generate more approved agreements? Those are not the same thing. The first is a legitimate automation goal. The second is an incentive misalignment that ends in NCRCP trouble.

Pre-agreement quotes and disclosure, where AI pays off cleanly

Section 92 requires the credit provider to deliver a pre-agreement statement and quotation in the prescribed form before any agreement is concluded. The quote must include the principal debt, the proposed instalment, the total of repayments, every charge and fee, the interest rate and the prescribed credit life premium. For bond origination, instalment-sale agreements and larger retail credit, generating this document manually is where most dealerships still lose an hour per deal.

This is the cleanest AI win in the NCA space. A pre-agreement quote generator that pulls from the affordability data, applies your scorecard's approved product, and produces the Section 92 document in the required format cuts a predictable hour out of F&I. There is no judgement step. The regulated output is a template filled correctly. The risk is low because the person still signs.

We have built this for a Cape Town multi-brand dealer group and watched their deal-to-signing time drop from 90 minutes to under 20, without anyone touching the compliance steps.

One caveat. The quote has to be in a form the consumer "has the opportunity to study and consider at leisure". A WhatsApp-only quote flow fails that test. Email the PDF, make it printable, and give the consumer a real window, even a short one, to read it before they sign. The NCR has made this point in several public enforcement actions against microlenders over the last five years.

Debt collection is where the NCA, POPIA and the DCA pile up

If you are an originator or a credit provider with a receivables book, collections is the AI use case that generates the most WhatsApp traffic and the most compliance risk at the same time. Section 129 governs the notice before legal action. The Debt Collectors Act layers registration, fee caps and conduct rules on top. POPIA layers consent and purpose limitation on top of that. And the Information Regulator has started sending letters to debt collectors who run AI-driven WhatsApp campaigns that slide across the service-versus-marketing line.

The practical rules for AI-driven collections communication, if you are a credit provider operating under the NCA, come down to four things.

Most debt collectors I have worked with want the AI to be more aggressive than this allows. The honest answer: the conservative version is also the version that keeps your NCRCP certificate and your Debt Collectors Council registration intact. Lose either and your business is over. There is no appeal that gets you back onto the collections list inside six months.

What belongs on paper before you buy any AI tool for credit

If you are evaluating a vendor for a credit-provider workflow, three documents should exist before the contract is signed.

A written data-flow diagram showing where personal information is collected, where it is processed, where it rests, and who in the vendor's team can see it. An audit-log specification that includes, at a minimum, every decision the AI participates in, the inputs, the output, and the human sign-off. A model-governance note describing how the model was trained, whether it was tested for disparate impact across demographic groups (the NCA has anti-discrimination clauses in Section 61), and how it is monitored over time for drift.

A vendor that cannot produce these is not ready to sell into an SA credit provider. In our experience across audit reviews, the inability to produce an audit trail for algorithmic affordability decisions is the single most common NCR finding against smaller lenders. The regulatory direction is clear even where the explicit rule set is not yet written.

The honest summary

The NCA does not ban AI in credit. It does not endorse it either. What it demands is a defensible, recorded, human-accountable process behind every credit decision. An AI tool that fits inside that process accelerates the clerical work and leaves the Section 81 judgement with a person. An AI tool sold as "fully automated credit decisioning" is, for an NCR-registered provider in South Africa, a liability dressed as an asset.

Pick the ones that make your clerks faster.

Avoid the ones that promise to replace them.