An NCR audit does not start with the question “did you conduct affordability assessments?” It starts with a sample of credit files. The inspector pulls a sample of credit files from your origination records, examines each one, and checks whether the file shows how income was verified, which obligations were counted, what expense norm was applied, and when the assessment was completed. If any of those elements are missing, you have a finding.
What follows is a gap analysis framework drawn from the Reg 23A documentation standard, the NCT enforcement record, and the August 2025 draft amendments. The three failure modes below are not edge cases. They are the recurring patterns in NCT findings and registration cancellations.
What the NCR is actually looking for when it audits
Regulation 23A has been in force since 13 March 2015. Its core requirement is that a credit provider must take practicable steps to verify a consumer's discretionary income before extending credit. The calculation has a defined structure: gross income, minus statutory deductions, minus existing monthly obligations, minus living expenses, equals available discretionary income. Every term in that equation must be documentable.
The Reg 23A affordability framework also specifies which documents are acceptable for income verification under sub-regulation 23A(4): the consumer's latest three payslips, three months of bank statements, or income statements. These are alternatives, not a menu from which you select the most convenient. For self-employed or informally employed consumers, three months of bank statements or the latest financial statements are the primary instrument.
Regulations 18 and 19 govern the retention of consumer credit information. NCA Section 92 requires a pre-agreement statement and quotation to be provided and retained. When inspectors arrive, they are checking for a complete file: application, income verification documents, affordability calculation, and assessment record. An incomplete file is a non-compliant assessment, regardless of the outcome of the credit decision.
Sign #1: You accept stated income without verification
The most common single failure in NCT findings is also the simplest: the credit file contains a consumer income declaration but no supporting document. The consumer wrote “R18,500” on the application form, the credit provider accepted it, and no payslip or bank statement was obtained or retained.
This presents a material compliance risk under Reg 23A(4). The regulation explicitly requires the credit provider to verify gross income using the consumer's payslips, bank statements, or income statements, not to accept the consumer's self-reported figure. A consumer declaration alone fails the verification test. In NCR v Ndebele t/a Isidingo Loans [2024] ZANCT 9, the tribunal found that no affordability assessments had been conducted at all: consumers received small short-term loans without any financial means assessment, obligation calculation, or repayment history review.
The practical implication is operational, not just documentary. Bank statements do more than confirm the income figure. They reveal income that is inconsistent with the declaration, obligations the consumer did not disclose, and behavioural signals that bear on the affordability assessment. A credit provider who relies on stated income without obtaining a bank statement is also missing the obligation picture. The Reg 23A requirement and the risk management requirement point in the same direction.
For self-employed consumers and informal-sector workers, payslips simply do not exist. Three months of bank statements are the primary verification instrument for this segment, which accounts for roughly one in five employed South Africans according to Statistics South Africa. Accepting a verbal income figure or a self-drafted letter for this borrower profile is a verification gap that no NCR auditor will overlook.
Sign #2: Your expense norms don't vary by income band
Fewer lenders are aware of this failure mode than the income verification gap, but it has become increasingly significant as the August 2025 draft amendments to Regulation 23A propose codifying expense norm methodology into regulation.
Using a flat living expense figure (the same R1,500 or R2,000 for every applicant regardless of income, household size, or circumstances) produces a discretionary income calculation that is structurally incorrect. A consumer earning R8,000 a month does not have the same living expense profile as one earning R35,000. Applying a single floor across both overstates the lower-income consumer's available discretionary income and understates the higher-income consumer's real cost of living.
The August 2025 draft amendments to Regulation 23A propose mandatory minimum household expense norms by income band. Under the proposed sub-regulation 23A(10), a credit provider would be prohibited from using an expense figure below the relevant band minimum, even if the consumer declares lower actual expenses. The comment deadline was September 2025; promulgation is expected in 2026. The direction is clear: expense methodology is moving from practitioner discretion to prescribed minimums. Section 82 gives credit providers latitude in determining their assessment methodology, but that latitude does not override Reg 23A's prescribed inputs or the incoming minimum norms.
The test to apply before an audit arrives: pull five random credit files from different income ranges. Does the living expense figure vary between them? If every file shows the same number, your methodology is exposed to a challenge that the incoming regulation is designed to address.
Sign #3: You can't retrieve the original assessment for a 12-month-old application
NCR inspections are not announced. They can be triggered by a random compliance audit, a consumer complaint, or a competitor tip-off. There is no preparation window. The test of your record retention is whether the file is retrievable right now, for every agreement currently within the retention period.
This creates a specific operational requirement that smaller lenders often fail: the affordability assessment must be stored in a retrievable, searchable format, linked to the credit agreement, and accessible to compliance staff who were not involved in the original origination. Paper files in an unlabelled box do not satisfy this standard. An Excel spreadsheet with no link to the originating application number does not satisfy this standard.
The broader audit trail framework for micro-lenders covers the full record retention obligation. The specific failure mode here is temporal: the ability to retrieve the assessment from 12 months ago, match it to the relevant agreement, and show a dated, complete record. This is where small lenders with paper-based or ad-hoc digital records most frequently fail in practice.
Section 92's pre-agreement statement and quotation requirement adds another retrievable document to the file. If an inspector asks to see the pre-agreement statement for a specific agreement number and your system cannot produce it, that constitutes a finding in addition to any affordability documentation gaps.
The 2023 enforcement precedent: what cancellation looks like
In NCR v Tsoelli (Pty) Ltd t/a Tswelopele Cash Loans [2023] ZANCT 26, the NCT found systematic regulatory contraventions including lending to SASSA beneficiaries and charging interest rates exceeding statutory limits. The outcome was cancellation of the credit provider's registration. Not a fine. Not a remediation order. Cancellation.
The Tsoelli case is the relevant benchmark for what happens when the three failure modes above are systemic rather than isolated. The case is discussed in more detail in the analysis of what 2025 court cases are establishing. For audit readiness purposes, the takeaway is straightforward: an NCR inspector who finds the same three gaps across every sampled file (unverified income, flat expense norms, unretrievable records) is looking at a pattern that the enforcement record shows ends registration, not just a remediation notice.
The NCR Consumer Credit Market Report Q1 2025 recorded 18.08 million credit applications in the first quarter alone. At that volume, the NCR cannot inspect every lender regularly. But it does inspect, and the trigger for an inspection does not require the lender to have already failed consumers. A complaint from a single consumer, correctly framed as an affordability assessment failure, initiates an inspection that samples your entire book.
How to close the gap before the auditors arrive
Three practical steps before anything else:
Income verification test: Pull ten random credit files from the last 12 months. For each one, identify the income verification document in the file. If any file has a consumer declaration with no supporting payslip, bank statement, or income statement, that is a gap that exists in your live book right now. Address the process, not just the individual file.
Expense norm review: Identify the living expense figure applied to the last 20 applications. If it is a single flat number or varies only by a narrow band, review the methodology against income band differentiation. The incoming Reg 23A amendment will mandate this; getting ahead of promulgation is both a compliance and a risk management step.
Retrieval test: Ask a compliance officer who was not involved in origination to retrieve the complete affordability assessment file for five agreements from 12 months ago. If they cannot locate it quickly using your current system, your retention architecture has gaps that an NCR inspector will identify during an audit.
AffyScore addresses all three gaps directly. Income is extracted from the bank statement at the point of analysis, not declared by the consumer. Expense norms are applied per Reg 23A income band as an AffyScore default. Every assessment is stored with a timestamp and designed to be retrievable by agreement reference. The output is structured to satisfy Reg 23A evidence requirements: a complete, dated decision pack that documents what was assessed and how the discretionary income figure was reached.
