Key Takeaways from FITSPA and BDO's FinTalk on Compliance for Fintechs

In fintech, where innovation often outpaces regulation, the recent FinTalk co-hosted by FITSPA and BDO East Africa brought into sharp focus a critical, yet often underestimated, aspect of sustainable growth: Robust #Compliance. Under the theme "Compliance for #Fintechs: What Fintechs Get Wrong and How to Fix It," the session provided invaluable insights into the intricacies of regulatory adherence under the National Payment Systems (#NPS) Act, offering a roadmap for fintechs to not only avoid pitfalls but to build resilient and trustworthy operations.

A central theme that resonated throughout the discussion was the interconnectedness of #cybersecurity and #governance, highlighting their foundational role in the fintech ecosystem. BDO experts pointed to pervasive issues such as weak cybersecurity governance, insufficient access management, ineffective data protection practices, inadequate incident response mechanisms, and a concerning lack of regular security awareness training. The message was clear: cybersecurity isn't just an IT function but a strategic imperative that must be deeply embedded within the #corporate governance framework. Recommendations emphasized the immediate need for robust security management frameworks, continuous vulnerability assessments, enhanced access controls, and the development of comprehensive incident response capabilities to safeguard sensitive financial data and maintain customer trust.

The FinTalk began with impactful opening remarks from Mr. Moses Tibamwenda, Partner and Head of Audit and Assurance at BDO East Africa. He set a definitive tone, emphasizing the undeniable link between compliance and sustainable business growth with his poignant remark: "It is important to do the right thing, and it is costly not to."

Following this impactful opening, the floor was handed over to Mr. Aryatuha Morgan Internal Auditor at BDO in Uganda, who provided a detailed breakdown of common audit pitfalls observed within fintechs. Mr. Ariyatuha's session shed light on recurring operational shortcomings, particularly those related to cybersecurity weaknesses such as insufficient access management, ineffective #data #protection practices, and inadequate incident response. He underscored how these often surface during audits, and presented actionable recommendations like elevating cybersecurity and incorporating it into corporate strategy, implementing robust security management frameworks, conducting continuous vulnerability assessments, and enhancing access management controls.

After Mr. Ariyatuha's presentation, Mr. Tibamwenda returned to lead an insightful session specifically on Financial #Audit issues and recommendations. He demystified the external audit process, explaining its focus on financial statements and highlighting the critical role of #IT systems and #infrastructure in these audits. He further delved into regulation and financial reporting requirements, guided attendees on the appointment of external auditors, and outlined key audit issues for fintechs to look out for, concluding with essential recommendations and takeaways for navigating the audit landscape effectively.

Following these comprehensive audit discussions, Mr. Michael Gashumba, Director Advisory Services at BDO, expertly guided the session on Governance, Risk, and Compliance (GRC). He extended the concept of governance beyond the boardroom to encompass all levels of decision-making and accountability within an organization. A recurring observation was the concerning absence of documented frameworks, such as operational manuals and clear board charters, leading to ambiguities in compliance oversight. Many fintechs, he noted, also struggled with adequately prepared risk assessments and registers, making it challenging to pinpoint high-priority areas for audit.

A significant concern raised was the limited awareness among fintechs regarding their detailed reporting obligations to the regulator, often resulting in inefficient follow-ups on audit issues and a perpetuation of repeat findings. To rectify these shortcomings, Mr. Gashumba advocated for the adoption of governance structures that intrinsically link #regulatory compliance to business strategy. Developing internal policies aligned with regulatory obligations, conducting regular risk assessments, and performing internal compliance audits at least annually were strongly advised. For fintechs with limited in-house capacity, the option of outsourcing aspects of internal audit, compliance, and risk functions to an external consultant, or engaging independent consultants to verify governance controls, was presented as a pragmatic solution.

A particularly pertinent discussion revolved around the burgeoning landscape of #partnerships between licensed and unlicensed entities. Recognizing that not all fintechs are immediately poised for direct licensing, the FinTalk explored the potential for collaboration with already licensed players, enabling innovation and value creation even while awaiting regulatory approvals. However, a significant hurdle identified was the current absence of clear guidelines to govern such partnerships. In a proactive move, BDO in Uganda , FITSPA Uganda , Financial Sector Deepening Uganda (FSD Uganda), and AF Mpanga Advocates are actively collaborating to create these much-needed guidelines. The objective of this crucial project is multi-faceted: to provide alternative avenues for innovators and smaller fintechs to operate in compliance through collaboration, to establish a robust risk mitigation framework for managing risks in the #payments ecosystem, and to develop a tiered compliance framework that judiciously balances innovation with the imperative of regulatory adherence, ensuring the safety and integrity of the financial system.

The session culminated in a highly engaging Q&A session, where attendees had the opportunity to directly address their specific concerns and seek clarifications from the BDO experts, further enriching the interactive and informative nature of the FinTalk.

In essence, FinTalk served as a powerful reminder that in the fast-paced world of fintech, compliance is not a burden but a strategic enabler. By addressing common pitfalls in cybersecurity, strengthening governance structures, and proactively navigating the evolving regulatory landscape through collaborative efforts, fintechs can not only mitigate risks but also build the foundational pillars of trust, sustainability, and long-term growth. The insights shared by BDO underscore the importance of a proactive and integrated approach to compliance, transforming it from a mere obligation into a competitive advantage.

FITSPA extends its sincere gratitude to our esteemed partners at BDO East Africa for co-hosting this vital FinTalk. A special thank you to our expert facilitators, Mr. Moses Tibamwenda, Mr. Michael Gashumba, and Mr. Morgan Ariyatuha, for their invaluable insights and guidance. Finally, we deeply appreciate the active participation of all our FITSPA members who attended, demonstrating their commitment to building a compliant, resilient, and trustworthy fintech ecosystem.