Running LLMs inside a Zimbabwean bank: what has to be true first

A Zimbabwean bank in 2026 sits inside a regulatory frame that is unusually explicit about AI for a market of its size. The Reserve Bank’s Risk Management standard names artificial intelligence as “a critical component of operational resilience management” (Prudential Standard 01-2024, para 7.2.7). Its Model Risk Management standard defines a model broadly enough to catch every language model, scorecard and vendor “smart” feature, and requires a register and independent validation (Prudential Standard 02-2023). Its Cybersecurity and Resilience Guideline of August 2025 lists AI and machine learning among emerging technologies and requires prior written approval before a new technology platform goes live (para 6.4). On the other side of town, POTRAZ administers the Cyber and Data Protection Act and its 2024 licensing regulations.

None of this prohibits a bank from running a large language model. All of it sets conditions. This briefing lists the seven that must be true before the first production prompt touches a customer record, then works through an illustrative cost calculation that explains why most banks end up with two hosting patterns rather than one.

The sector this lands in

As at 30 September 2025 the Reserve Bank supervised 19 banking institutions (14 commercial banks, four building societies and the POSB) plus 8 deposit-taking and 312 credit-only microfinance institutions and four development finance institutions. Five domestic systemically important banks held 65.73% of deposits. Total deposits were ZiG116.95 billion, foreign currency deposits made up 46.70% of sector liabilities, and the sector’s capital adequacy ratio was 31.71% against a 12% minimum. Concentration and dollarisation both matter for AI: a D-SIB’s model decisions reach most of the market, and a large share of the balance sheet is denominated in the currency that hosted models are billed in.

Seven preconditions

#	Precondition	Whose requirement	Evidence the regulator will ask for
1	The Reserve Bank has been informed early about any cloud outsourcing of a critical function, and prior written approval has been obtained before the platform is implemented	RBZ Guideline paras 5.12, 6.4(a)	Correspondence; approval letter; risk assessment and vendor due diligence file (6.4(c))
2	The model is in the model register with an owner, a materiality rating and a validation record; validation was independent and happened before production	RBZ PS 02-2023 (register; paras 2.4.5, 2.4.17)	Register extract; validation report; board committee minute for material models (2.1.3–2.1.5)
3	The bank holds a data controller licence in the correct tier (a bank with more than 500,000 customers is Tier 4), has a certified DPO notified on Form DP2, and has notified the AI processing to the Authority	SI 155 s.4–6, s.10(2)(a), s.12–13	Licence; Form DP2; notification record
4	Personal data is classified before it reaches a model, and personal classes are routed only to in-country models unless a s.28 adequacy assessment and s.29 basis are documented and the Authority has been notified of the transfer	Act s.28–29; SI 155 s.10(2)(c)	Classification policy; gateway routing table; adequacy memo; notification
5	The 3-hour cyber-incident path to the Reserve Bank and the 24-hour breach path to the Authority have been drilled, and the logs exist to reconstruct what a model saw	RBZ Guideline 4.30; Act s.19; SI 155 s.17	Drill record; log samples; breach register
6	Three identities are enforced: the requester’s entitlements at retrieval, the agent’s allow-list at the tool gateway, the approver’s identity on any write	RBZ Guideline privileged-access requirements; Act s.24	Architecture; access review; audit trail sample
7	A foreign-currency budget for hosted-model usage is approved and enforced per identity at the gateway	Internal; PS 01-2024 operational risk	Budget line; monthly usage report in the model risk pack

Two of these (6 and 7) are not regulatory at all. They are the engineering and finance decisions that make the other five sustainable. A bank that skips them usually passes the first review and fails the second, when usage has grown and nobody can say who asked the model what.

Why the register is the hard part

Banks already run models: scorecards, IFRS 9 provisioning, liquidity forecasts. The Model Risk standard’s definition, “any quantitative methodology, system or approach that applies theoretical and expert judgement based on statistical, economic, financial or mathematical theories, technique and assumptions to generate a quantitative estimate through the processing of input”, was written with those in mind. A language model qualifies on its face, and so does the vendor’s fraud-scoring feature embedded in the card platform, which the standard’s definition of an “external model” captures.

The practical difficulty is versioning. A hosted model provider changes the underlying model on its own schedule. Under the standard, that is a model change, and material models must be re-validated. The only way to make that tractable is to pin versions where the provider allows it, keep an evaluation set that the validation function can re-run, and treat any provider-forced change as a validation trigger in the model log. Open-weight models run in-country avoid the problem entirely because the bank chooses when the weights change.

The transfer question, in one paragraph

Section 28(1) of the Act prohibits transferring personal information to a third party in a foreign country unless an adequate level of protection is ensured there. A prompt that contains a customer’s name, account number and transaction history sent to a hosted model in another country is such a transfer. Section 28(2) lists what the adequacy assessment must consider; s.29 lists the derogations, including unambiguous consent and contractual necessity; SI 155 s.10(2)(c) requires the Authority to be notified of the intention. The Reserve Bank adds its own layer for cloud outsourcing of critical functions (5.12–5.13). The engineering answer that satisfies all of this at once is a gateway that classifies data and routes personal classes to models inside Zimbabwe, with redaction before anything else leaves.

An illustrative cost calculation

The following is a worked example with assumed figures. It is illustrative and not a quote; replace every input with your own.

Assume 400 staff each make 30 model calls on each of 250 working days, averaging 2,000 input and 400 output tokens per call.

Calls per year: 400 × 30 × 250 = 3,000,000
Tokens per year: 3,000,000 × 2,400 = 7.2 billion

Assume, for illustration only, a blended hosted price of US$3 per million tokens. Annual hosted cost is then 7.2 billion ÷ 1 million × US$3 = US$21,600, entirely in foreign currency and rising linearly with adoption. If usage triples as staff discover the tool, so does the bill.

Now assume an in-country platform: two GPU servers and storage at an illustrative US$60,000 capital cost depreciated over three years (US$20,000 a year), colocation or power at an illustrative US$12,000 a year, and one additional platform engineer. The recurring foreign-currency exposure is the colocation line and spares; the marginal cost of the millionth extra query is near zero.

At these illustrative numbers the hosted route is cheaper in year one and the in-country route is cheaper by the time usage has tripled or the workload includes anything that cannot leave the country. That crossover, not the absolute numbers, is the finding. The Reserve Bank governor reported foreign currency receipts of about US$16 billion in 2025 and a functioning willing-buyer willing-seller market, so the hosted bill is payable; the point is that it is variable, foreign-denominated and coupled to an international link that carried 545,123 Mbps of used incoming capacity for the whole country in Q3 2025.

The pattern most banks converge on

An in-country platform for anything touching personal data, plant systems or core banking, and a hosted frontier model behind the same gateway for non-personal, redacted work with a budget. The gateway is what makes the pair governable: one place for policy, one place for logs, one place the validation function can point at. Sequence the first use case as an internal knowledge assistant over policies and procedures; it builds the platform with the least regulatory friction and gives the Reserve Bank a low-risk first approval to grant.

Score your bank against the forty controls on the governance checklist; the deployment trade-offs are laid out on the model strategy page.