Whose advantage is built from your customers' data?

Every week, a commercial bank, SACCO or licensed microfinance lender in East Africa signs a strategic partnership with an agile technology vendor or credit-scoring fintech. The pitch sounds irresistible: the bank brings the regulated balance sheet and customer base, the vendor plugs in its cloud-hosted artificial-intelligence engine to score borrowers or manage sub-ledgers at zero upfront capital cost, and the two parties split the revenue. Two years in, when the vendor triples its per-transaction fees or runs into financial trouble, the board discovers an uncomfortable truth. The customers legally belong to the bank, but every derived behavioural feature, risk-score history and reconciled sub-ledger needed to run the accounts sits locked inside the vendor's proprietary black box. In a world where governments now treat data location and data control as matters of sovereignty, it is remarkable how many banks sign away the commercial equivalent without a second reading.

The cautionary tale has a date and a docket number. US fintech middleware provider Synapse Financial Technologies filed for Chapter 11 bankruptcy in April 2024 and triggered a regulatory reckoning across global banking. Synapse was not a bank; it sat as a technology and ledger layer between consumer apps and FDIC-insured partner banks. When it collapsed, the partner banks discovered they did not hold clean, daily reconciled sub-ledgers on their own servers showing which retail customer owned which dollar inside the pooled custodial accounts. Tens of thousands of ordinary savers were frozen out of millions of dollars for months while trustees and banks argued over unreconciled spreadsheets displaying phantom balances. In response, on 17 September 2024 the US Federal Deposit Insurance Corporation proposed strict custodial recordkeeping rules requiring banks to maintain direct, daily reconciled records of beneficial owners on their own infrastructure. Outsourcing the ledger interface had blinded the banks to their own deposit liabilities.

Untangling raw customer files from the intelligence built on top.

When a Kenyan bank plugs into an external AI underwriting, fraud or conversational-banking vendor, the data splits into four layers that standard procurement contracts routinely fail to separate.

At the bottom sits raw input data: the customer's national ID number, KYC form and raw M-PESA or core-banking transaction rows. Above that sits the engineered feature layer, hundreds of derived behavioural ratios, night-time spending velocity, merchant till consistency, repayment-network clusters, calculated by the vendor's ingestion pipeline. The third layer holds the model architecture, weights and version history that convert those features into a credit limit or fraud flag. The fourth holds the operational decision log: why an applicant was approved or rejected, what the chatbot promised on WhatsApp, whether the loan subsequently defaulted.

When a lazy contract states in one sentence that the bank owns all customer data and the vendor owns all intellectual property, a commercial trap springs shut. The bank needs the engineered features, model version tags and decision logs to answer Central Bank of Kenya supervisory audits, resolve customer disputes under Section 35 of the Data Protection Act, 2019 and retrain a replacement system if the vendor leaves; the vendor claims all three layers as trade secrets. And stripping a customer's name and phone number off a table before handing it over does not make the dataset anonymous, because a unique sequence of timestamped mobile-money transactions and location tags remains re-identifiable personal data in law.

Separating statutory portability from commercial switching power.

Executives sometimes assume the Data Protection Act will rescue them if a vendor holds their records hostage. Section 38 grants an individual data subject the right to receive her personal data in a structured, machine-readable format and transmit it to another controller. That clause protects a citizen moving her profile between companies. It does not compel a B2B software vendor to hand over proprietary feature-engineering pipelines, score calibrations or enterprise audit logs to a bank during a contract dispute. The statute solves the citizen's problem; only the contract can solve the bank's.

Value also compounds unevenly across a multi-tenant vendor. When a scoring vendor processes applications and repayment outcomes across twelve competing Kenyan banks and SACCOs, and the master agreement quietly permits the vendor to use de-identified telemetry to improve its models, your institution's historical credit losses directly subsidise the algorithm your fiercest competitor rents next quarter. And if the vendor chains four undeclared cloud sub-processors across Europe and Asia, your bank bears the statutory liability as primary data controller when one of those fourth-party links suffers a breach.

Compare those dependencies against a transparent, rules-based scorecard running inside the bank's own database on five verified ratios, which keeps all institutional learning in-house at minimal cost. An external predictive model can genuinely lift approval accuracy on thin-file borrowers, but only when the contract mandates that every feature vector, score component and model version is written back to the bank's warehouse in real time, just as third-party chat assistants and automated ledger scripts require synchronous, independent mirrors on the bank's own servers, so a vendor outage never reproduces the Synapse collapse in Nairobi.

Running the blind reconstruction drill before signing the renewal.

A contractual right to export your data at the end of a partnership is worthless when the vendor hands over a 50-gigabyte CSV dump filled with undocumented hexadecimal column headers, proprietary reason codes and no mapping dictionaries. Technically the vendor returned your data; commercially your engineering team faces an eighteen-month, multi-million-shilling rebuild while your lending engine sits paralysed.

Every vendor contract should prohibit training shared cross-market models on the bank's proprietary default outcomes without an explicit equity or royalty offset, mandate daily automated syncing of all engineered features and plain-language decision logs into the bank's own warehouse, and price a full 90-day parallel-run exit budget into the initial business case. Ninety days before any major vendor contract comes up for renewal in 2027, the chief technology officer and chief risk officer should execute a live blind reconstruction test: pull 100 historical customer decisions solely from the exported records on the bank's own servers, and task an internal team to reconstruct the exact risk rationale, account balance and audit trail within 48 hours without calling the supplier. If your own team cannot read the ledger without the vendor's decoder ring, you are no longer the bank. You are renting your licence to your software supplier.