Madagascar microfinance and mobile money: AI and rural customer data

In a microfinance branch in Antsirabe or at an MVola point in Fianarantsoa, the day often starts the same way: farmers come in to repay a seasonal loan, a shopkeeper deposits her weekly savings, a parent sends money to a child studying in Antananarivo. Behind every transaction there is a name, a phone number, sometimes a photo of an ID card and a repayment history.

At head office, this data is used to analyse portfolios, prepare credit committees and handle complaints. More and more, teams turn to ChatGPT, Copilot or Gemini to work faster. That is where a new risk appears for a sector that mostly serves low-income customers who often know little about their rights.

The phone has become the rural bank

Bank account ownership in Madagascar remains low. According to Banky Foiben'i Madagasikara statistics cited by L'Express de Madagascar in October 2026, about 18% of the population holds a traditional bank account. Mobile money has filled part of the gap. The International Finance Corporation counts more than 10 million active accounts, and the value of mobile transactions doubled between 2021 and 2023.

The three operators, MVola, Orange Money and Airtel Money, no longer work alone. They have partnered with banks and microfinance institutions. Since 2018, Orange Money and PAMF have offered M-Kajy, a mobile microcredit and savings service that claims more than 700,000 users, with amounts starting at 500 ariary. In July 2026, Airtel Money and Baobab Banque signed an agreement for instant transfers between bank accounts and mobile wallets.

Revealing data about vulnerable customers

These services generate very rich files. A mobile money transaction history shows where a person lives, who they support, how regularly they earn money and when they are struggling. A microloan file adds farm income, household size, collateral and sometimes the reasons for a late payment.

For an analyst, this is perfect material for an AI tool: "rank these 2,000 customers by risk", "summarise arrears in the Vakinankaratra region", "draft a reminder letter". For the customer, it means their whole financial life is sent to a server abroad without their knowledge.

What Law 2014-038 requires from financial players

Law No. 2014-038 on the protection of personal data fully applies to microfinance institutions and electronic money issuers. It requires a defined purpose, proportionate processing, a security obligation and controls on transfers to countries without an adequate level of protection. We covered the law in detail in our article on Law 2014-038 and offshoring.

Taking a customer's payment history and pasting it into a consumer AI assistant falls outside the purpose for which it was collected. The Malagasy Commission on Informatics and Liberties (CMIL), which entered its operational phase in 2026, can issue warnings and administrative fines.

Financial regulation adds another layer. Law No. 2016-056 governs electronic money and the institutions that issue it, under the supervision of the Banking and Financial Supervision Commission (CSBF). Professional secrecy and operational risk management are basic expectations of any banking supervisor, and a customer data leak through an unapproved tool clearly falls into that risk.

Where leaks actually happen

In a microfinance institution or an e-money issuer, risky uses are rarely malicious. They are shortcuts:

• an Excel export of repayments, with names and phone numbers, uploaded to get a summary table;

• a customer complaint pasted into a chatbot to write a reply in proper French;

• a screenshot of the mobile money back office shared to understand an anomaly;

• a credit file translated from Malagasy to French for a donor or an auditor.

None of these actions shows up in traditional network security tools, which do not read the content of prompts. We explain why in our anatomy of an AI data leak.

Protecting data without slowing financial inclusion

Banning AI in a microfinance institution would be a mistake. Teams are often small, and these tools help them process more files and better serve remote customers. The goal is to keep that gain without exposing data. A realistic approach:

1. list the AI tools used at head office, in branches and on work phones;

2. define the data that must never leave: identity, mobile money number, balance, credit history, ID documents;

3. detect this data when the employee types a prompt or attaches a file, then anonymise it, warn or block;

4. keep an incident log, useful with the CMIL as well as the CSBF or funders;

5. train teams with examples taken from their daily work.

Format preserving anonymization fits well here: a phone number stays a valid but fictitious number, an amount keeps its order of magnitude, and the AI can still produce a useful analysis without knowing the real customer. For a regional view, see our analysis of AI and data protection in West Africa.

Key takeaways

Mobile money and microfinance have brought millions of Malagasy people closer to financial services. These services produce highly sensitive data about vulnerable customers. Law 2014-038, the CMIL and CSBF supervision require that data to be protected, including when teams use generative AI. The answer is not a ban, but control over what goes into every prompt.

ZeusLock spots names, mobile numbers and credit data before they reach ChatGPT, Copilot or Gemini, anonymises or blocks them, and records every incident. Book a demo to see how it fits your institution.