The head of a microfinance institution spends most of their steering time on credit risk. That is logical: it is the trade, it is measurable, and it fills the committees.
Available work on the sector's crises in the CEMAC zone points elsewhere. It identifies as the principal cause regulatory shortcomings and poor governance practices within the structures themselves. Institutions placed under provisional administration by COBAC were placed there because of irregularities observed in their management — irregularities orchestrated by their directors.
This is not a moral reading, it is a mechanical one. And the mechanism has a property that makes the subject hard to address from inside: whoever commits the irregularity also controls what the indicators display.
Why no ratio sees it
Credit risk shows in the figures before it shows in the facts: portfolio at risk rises, provisioning follows, the result deteriorates. The chain is visible because the debtors are external to the institution and do not control its accounting.
Internal risk works the other way. The irregular commitment is booked as a regular one. The receivable on a related party is classified as an ordinary receivable. The override is not logged, so it does not exist. The control that would have caught it was not performed, and its absence was not flagged since nobody follows whether controls are performed.
The result: by the time the figure moves, the loss is old. That lag explains the apparent suddenness of failures in the sector — an institution presenting acceptable returns finds itself under provisional administration, and the gap between the two images seems inexplicable. It is not: the returns were not measuring what was happening.
The four configurations that recur
The literature and the sector's public files describe situations that look very much alike.
Concentration of decision-making. A founding director who commits alone, with no threshold above which a second pair of eyes becomes mandatory. This is not an initial anomaly — it is often the very organisation that allowed the institution to exist. It becomes a risk on the day the balance sheet grows without governance following.
The undeclared related party. A loan granted to a company in which a director or a relative holds an interest, without that link being identified. This case is particularly treacherous because it degrades two norms at once: risk division, if linked beneficiaries are not grouped, and governance.
Theoretical internal control. A procedures manual exists, a control function is appointed, an audit plan is written — and nothing is executed, or execution is not evidenced. This is the most frequent case, and the easiest to correct, because it presupposes no bad faith: it presupposes only that nobody checks that the checks take place.
Dependence on a single person. In smaller structures, data entry, reconciliation and control often rest on one trusted individual. Trust is not the problem; the absence of an alternative is. An arrangement that does not survive one person's absence is not an arrangement, it is a habit.
What the regulator has been looking at since 2021
The 2015 prudential reform extended supervision beyond ratios alone, introducing requirements on operational control, compliance, risk management and internal audit. After a transition period running to 2020, COBAC intensified its inspections from 2021.
That change targets exactly the mechanism described above. The question is no longer only "are your figures good?" but "who can do what, and who verifies it?".
In practice, an inspection now examines things that appear in no return: the existence of written and quantified delegations, the traceability of overrides, actual execution of the internal audit plan, segregation of duties, treatment of related parties.
An institution can therefore present four compliant ratios and leave an inspection with heavy observations. The reverse is also true, and it matters: an institution that has breached a norm but presents a documented arrangement, an identified gap and a dated plan is not treated like one that discovers the problem at the same time as the inspector.
Five controls that cost almost nothing
None of the five requires budget. All require a decision.
- Write the delegations, with amounts. Who commits how much, alone. Above what threshold a second pair of eyes is mandatory. An implicit delegation cannot be defended.
- Log the overrides. An arrangement that admits no exception is one that gets circumvented. An arrangement that admits evidenced exceptions holds — and the evidence protects the director as much as the institution.
- Keep a related-party register, and reconcile it against the portfolio. Directors, board members, their relatives, the companies in which they hold an interest. That reconciliation must be automatic, not from memory.
- Execute the internal audit plan and date the reports. The existence of a function is worth nothing without a completed programme. An unexecuted plan is more damaging than no plan: it documents an intention not honoured.
- Test segregation of duties by absence. Take the most central person in the arrangement and ask concretely what stops, and what is no longer controlled, during three weeks of leave.
Why this is also worth money
The subject is usually treated as a regulatory constraint. It has become a financing criterion.
Since the BEAC suspended, on 2 April 2026, refinancing for medium-term credit — the Governor having confirmed on 29 June that the request came from the International Monetary Fund and sought the mechanism's progressive extinction — long resource has become scarce and banks ration starting with counterparties expensive to assess.
An institution whose delegations are written, whose overrides are evidenced and whose internal audit produces dated reports is cheaper to analyse. International refinancing vehicles, for their part, make governance an explicit selection criterion, on a par with portfolio at risk or operational self-sufficiency.
Governance is no longer the price of being in order. It is what determines your access to resource.
Published 14 August 2026. The regulatory facts cited are verified as at that date. This article describes mechanisms documented at sector level and targets no institution in particular.
