Senegal Banks and Fintechs: Generative AI and Banking Secrecy

In a bank branch in Dakar, an adviser has to answer a complaint from an unhappy customer. He opens ChatGPT, pastes the account history, the customer's name and the details of the disputed transactions, then asks for a polite reply. The trouble is that information protected by professional secrecy has just left the bank.

Banks, microfinance institutions, electronic money issuers and fintechs: across Senegal, the whole financial sector is discovering generative AI. It does so under a constraint few other sectors face, since it must comply both with WAMU banking rules and with Law No. 2008-12 on personal data.

A sector where confidentiality is a legal duty

In the WAMU zone, banking secrecy is more than good practice. The uniform law on banking regulation, adopted by the Union's Council of Ministers in June 2023 and taken up by each member state in its own legislation, devotes a full article to it. It covers directors, employees and anyone with access to the institution's information. The text even states that the duty continues after a person leaves their post.

Secrecy can only be lifted in limited cases: for the Banking Commission, the BCEAO, criminal courts or certain partners listed in the law. A consumer AI assistant is obviously not on that list.

Law 2008-12 adds a second layer

On top of these rules comes Law No. 2008-12 on the protection of personal data, enforced by the Commission de protection des Données Personnelles (CDP). A bank or fintech that sends customer data to an AI service is carrying out processing and, in most cases, a transfer outside Senegal. Both operations must follow the formalities and safeguards set by the law.

The CDP keeps a close eye on the sector. In July 2023, it publicly asked several local banks to declare their processing linked to the connection between bank accounts and mobile money services. For the full list of obligations, see our guide to Law 2008-12 and generative AI.

Mobile money and fintech: huge volumes of data

Senegal is one of the most active mobile payment markets in the region. Electronic money issuers, governed by BCEAO Instruction No. 008-05-2015, handle a very large number of phone numbers, balances and transaction histories every day. Product, fraud and customer service teams are also the ones adopting AI tools the fastest.

These are exactly the data that end up in prompts: a transaction export to understand an anomaly, a list of agents to prepare a report, a customer conversation to draft a standard reply.

The most common risky uses

In a bank, a microfinance institution or a fintech, the riskiest situations are often ordinary ones:

• Customer service: pasting a full complaint with name, account number and amounts.

• Lending: asking for a summary of a loan file that contains income, collateral and ID documents.

• Compliance and anti money laundering: asking an AI to analyze a list of suspicious transactions.

• IT: submitting a database extract or a configuration file to fix a bug.

• Management and finance: having an internal report rewritten before a committee or a Banking Commission review.

None of these actions is malicious. Yet each one can be both a breach of professional secrecy and an uncontrolled data transfer. We explain how this happens in Anatomy of an AI data leak.

Why blocking solves nothing

Many institutions reacted by blocking AI websites on their internal network. The outcome is well known: staff switch to their personal phones, with the same file and even less control. The bank then loses all visibility. This Shadow AI has a real cost, which we estimated in The real cost of Shadow AI in 2026.

Teams will use AI anyway. What remains is to set the conditions.

An approach built for financial players

1. List the tools actually in use, team by team, including on mobile.

2. Define the data that must never go into a prompt: account numbers, bank details, balances, ID documents, credit data, suspicious activity reports.

3. Update your CDP formalities for AI uses that involve customer data.

4. Bring in compliance and internal control, since banking secrecy is also their responsibility.

5. Anonymize at the source: automatically replace sensitive data before it is sent, without breaking the meaning of the request.

6. Keep evidence for the CDP, the Banking Commission and auditors.

What ZeusLock brings to banks and fintechs

ZeusLock runs directly on employees' devices and browsers. It detects sensitive data in real time in prompts and files sent to ChatGPT, Copilot, Gemini or Claude. Depending on your rules, it anonymizes them while preserving their format, shows a warning or blocks the upload. The adviser gets an answer, but the real account number never leaves the bank. To see how it works, read our article on format preserving anonymization.

Every prevented incident is logged, so you have concrete evidence to show during an inspection.

Summary

In Senegal, a financial player using generative AI has to meet two requirements: the professional secrecy set by WAMU banking regulation and Law 2008-12 enforced by the CDP. Banning AI does not work. The right answer is to know what leaves the company, protect data before it is sent and keep a record of every decision.

Do you run a bank, a microfinance institution or a fintech in Senegal? Book a ZeusLock demo and see how your teams can use AI without exposing your customers.