An NCR auditor walks into your offices (or sends a formal request for records). The question they are asking, in various forms throughout the process, is a simple one: show me how you determined that this consumer could afford this loan. Not whether you believed they could. Not whether they signed a declaration. Show me the documented process, the numbers you used, and where those numbers came from.
For most of the several thousand micro-lenders on the NCR's register, that question does not have a clean answer. The affordability assessment exists; most lenders do complete one. The problem is that the trail from the affordability number back to verified source data is broken. A payslip, a signed declaration form, and a column on a spreadsheet are not an audit trail. They are inputs. The audit trail is the documented, step-by-step derivation that shows how those inputs produced that affordability conclusion, consistently, for every application.
That gap is what this article covers.
What Regulation 23A actually requires
Regulation 23A of the National Credit Act (published under the National Credit Regulations) sets out the minimum affordability assessment standard for all registered credit providers. It is not optional, and it does not scale by size: a micro-lender processing 50 applications per month has the same obligations as a major bank.
The regulation operates across three legs.
Income verification
Regulation 23A requires credit providers to take reasonable steps to verify a consumer's gross income. "Reasonable steps" has been interpreted by the NCR to mean documentary evidence, not just a consumer declaration. A payslip satisfies this for formally employed consumers. For informal workers, commission earners, or the self-employed, the bar is higher: bank statements showing consistent deposits over at least three months are the practical standard the NCR has applied in enforcement proceedings. (All references to Regulation 23A in this article are to the regulation as published under the NCA; verify against the current version before relying on them for compliance purposes.)
The regulation also requires that where the credit provider cannot verify income independently, they must at minimum document what verification steps they took and why those steps were sufficient. "Consumer said so" is not sufficient.
Expense assessment
Regulation 23A establishes the minimum expense assessment framework. The credit provider must assess necessary living expenses and must either use the consumer's declared figures or the NCR's Minimum Expense Norms (MEN), whichever is higher.
This is where many micro-lenders have a latent compliance problem. The MEN figures are published by the NCR and updated periodically. They represent an absolute floor. A credit provider who accepts a consumer declaration of R800 per month in food expenses for a family of four, without checking it against the MEN for that household composition, has not complied with the regulation's expense assessment requirements, even if the declaration is genuine.
The practical obligation is to document both the declared figures and the MEN check, and to record which was used in the calculation and why.
Existing obligations
Regulation 23A further requires that all existing debt obligations be identified and deducted before a disposable income figure is derived. The regulation specifies that this includes obligations that appear on the consumer's credit bureau profile, and obligations that the consumer declares but which may not yet appear on the bureau.
The practical challenge is that bureau data has a reporting lag. A consumer who took out three new micro-loans last month may not have those obligations reflected in a bureau enquiry today. The regulation's intent is clear: the credit provider is responsible for identifying existing obligations, not just the ones the bureau has caught up with.
Bank statement data addresses this directly. Debit orders on a bank statement reflect current obligations as at the statement date, without the monthly submission cycle lag that affects bureau data.
What an NCR audit actually examines
Understanding what the regulation requires is one thing. Understanding how the NCR operationalises that requirement during an audit is the practical issue for compliance officers.
Based on published enforcement findings and NCT decisions, NCR supervisory audits (whether routine supervisory visits, complaint-triggered investigations, or compliance notices) typically examine affordability processes across three dimensions.
A documented process
The auditor wants to see a written affordability assessment procedure, not just a form, but a process document that specifies the steps a credit officer must follow, the documents they must obtain, the checks they must apply, and the calculations they must perform. If this document does not exist, or if it exists but the records show it has not been followed consistently, the credit provider is exposed.
Process documentation does not need to be elaborate. What it must be is specific enough that any credit officer following it would produce the same affordability number from the same inputs.
Consistent application across applications
The auditor will sample a cross-section of application files (typically ranging from a handful to several dozen, weighted toward recently granted applications and applications that subsequently went into default). They are looking for variance. If three applicants with similar income profiles and obligation loads received materially different affordability outcomes, and the file records do not explain why, that is a finding.
Inconsistent application is one of the most common findings in NCR audits of micro-lenders. It is not usually the result of deliberate manipulation; it is the result of manual processes where different credit officers apply different judgement to ambiguous situations. Structured, automated affordability processes eliminate that variance by design.
Traceable numbers
This is the one that catches most micro-lenders. The auditor will pick a specific application, look at the affordability figure in the credit agreement, and then ask: where did that number come from? They want to be able to trace the disposable income figure back through the expense assessment, back through the obligation deductions, back through the income verification, back to the source documents.
If the file contains a payslip, a signed declaration, and a figure on a spreadsheet (but no documented link between them), the trail is broken. The lender can point to documents, but cannot demonstrate the derivation. That is a compliance gap, not a minor administrative oversight.
The enforcement direction
NCT decisions in recent years illustrate the enforcement direction on micro-lender affordability compliance. The Tribunal has confirmed in multiple matters that a credit provider's failure to retain adequate records of the affordability assessment (including the basis for the income and expense figures used) can constitute a contravention of the NCA's reckless lending provisions (Section 81) read with Regulation 23A. (Readers should verify current NCT case law with a qualified legal practitioner; the summary here is illustrative, not a legal opinion.)
Significantly, the NCT has found that the contravention does not always require proof that the loans were reckless or that consumers were harmed. The contravention can be the absence of defensible records: the inability to demonstrate, from documented evidence, how the affordability conclusion was reached.
This reasoning is instructive for any micro-lender reviewing their process. The obligation under the NCA is not just to perform an affordability assessment; it is to be able to demonstrate that you performed a compliant one. The difference between performing an assessment and demonstrating a compliant one is documentation.
Remedies available to the NCT under section 150 of the NCA include administrative fines, remediation orders, and compliance plans. In repeated or egregious cases, deregistration is available as a Tribunal remedy, though this sits at the extreme end of the enforcement spectrum. The NCR has indicated that inadequate affordability documentation is an area of focus in supervisory visits to micro-lenders. For a practical checklist of the warning signs that precede this kind of finding, see three signs your affordability process will fail an NCR audit.
Why most micro-lenders cannot close this gap manually
The affordability audit trail problem is not a question of effort or intent. Most micro-lenders are trying to comply. The gap exists because the manual affordability process has structural limits that make a complete, traceable audit trail difficult to sustain consistently at any meaningful application volume.
Consider what a compliant manual process requires. The credit officer must obtain the payslip or bank statements. They must verify income figures from those documents. They must check declared expenses against the NCR's MEN. They must identify existing obligations from the bureau report and the bank statements. They must perform the derivation arithmetic. And they must document each of those steps in a format that creates a traceable link from the affordability conclusion back to the source documents.
Based on the steps involved, a compliant manual derivation for a single application typically requires between 30 and 60 minutes. At 20 applications per day (a modest volume for an established micro-lender) that is 10 to 20 staff-hours per day, just on affordability documentation. In practice, the process gets compressed. Steps get skipped. Documentation becomes a post-hoc summary rather than a step-by-step record. The trail is not deliberately destroyed; it is never properly created.
The NCR auditor does not distinguish between a trail that was destroyed and a trail that was never created. Both produce the same finding.
What "structured statement output" means in practice
The shift from manual to structured bank statement output does not just make affordability faster. It changes the nature of the record that is created.
When a bank statement is processed through a structured affordability engine, every step of the derivation is captured in the output. The income figure is not a number someone typed into a form; it is a calculated result derived from identified salary deposits in the transaction data, with the underlying transactions listed and summed. The obligations figure is not a declared number; it is a count of identified debit orders, with each one named, dated, and valued. The expense assessment shows whether the MEN floor was applied and what the declared figures were.
The output is not a summary. It is a derivation record, structured to satisfy Reg 23A evidence requirements. Every number traces to a transaction.
That is the kind of audit trail the regulation envisions. Not a file with documents in it, but a structured output that shows the regulator exactly how each number was produced: from which source transactions, through which calculation steps, to which conclusion. The credit officer's role is to review the output and make the credit decision. The documentation of how the affordability figure was derived is generated automatically, in a standardised format, for every application.
When the NCR auditor asks "show me how you determined this consumer could afford this loan," the answer is not "here is their payslip and here is the figure we used." The answer is a decision pack that contains the income derivation, the obligation mapping, the expense assessment, the MEN check, and the disposable income calculation, all traceable to the source transactions in the bank statement.
Consistency by design
Structured output also addresses the consistency problem. When affordability is derived algorithmically from the same input documents using the same rules, the variance problem disappears. Two credit officers reviewing the same applicant's bank statements through the same engine will see the same affordability number, because the number is produced by the data and the rules, not by individual judgement.
That consistency is precisely what Regulation 23A requires. The regulation does not allow for situational affordability assessments. The MEN check applies to every application. The obligation identification requirement applies to every application. The income verification requirement applies to every application. A structured process enforces those requirements consistently, in a way that a manual process (no matter how well-intentioned) struggles to replicate consistently at volume.
For the NCR auditor sampling 30 application files, consistent outputs that follow the same structure, contain the same categories of information, and trace to the same types of source data are the evidence of a functioning compliance programme. Variable, incomplete, or inconsistent records are the evidence of a programme that exists on paper but not in practice.
The decision pack as compliance infrastructure
For micro-lenders thinking about audit readiness, the question is not whether to perform affordability assessments; they are already doing that. The question is whether the records they are creating would satisfy an NCR auditor asking to trace a specific affordability figure back to its source data.
A structured decision pack from an automated bank statement process is designed to serve as compliance infrastructure, not just a credit tool. The decision pack is the file record. It contains the regulatory affordability calculation in a structured, reference-able format. It identifies the source documents, the transactions used, and the derivation steps. It creates a consistent record for every application, in a format that travels with the credit agreement.
When the NCR requests records (whether in a routine supervisory visit or a complaint investigation), the response is not a folder of documents to be manually reviewed. It is a set of structured decision packs, each one a self-contained audit trail for the application it represents.
The enforcement direction is clear: the NCR is not just checking that affordability assessments were performed. It is checking that they can be demonstrated, to a standard that traces numbers to source data, documents the derivation, and shows consistent application across the book.
Most micro-lenders are not failing that test because they are not trying. They are failing it because the manual process cannot produce that standard of record at the volume and speed their business requires. Structured statement output is designed to close that gap, not as a regulatory workaround, but as a practical mechanism for producing the documented derivation the NCA requires. As Cliffe Dekker Hofmeyr's analysis of reckless lending obligations makes clear, the duty to conduct proper affordability checks requires documented evidence, not just good intentions.
