M-PESA’s Next Test Is Whether Kenya Can Build Competition Around the Rail It Cannot Afford to Lose.

In May 2023 a small Kenyan fintech called PrivPay stopped working. The company had built a service on top of M-PESA's free developer APIs, claimed 30,000 users, and, by its own account, held talks with Safaricom before launch. Then Safaricom cut its access. The letter, seen by TechCabal, was one line of substance: "Your business model is not permitted by Safaricom." Safaricom said the service, which it noted claimed 30,000 users, contravened Kenya's anti-money-laundering regulations and required a payment service provider licence; a former executive told Silicon Africa the startup had not pursued that licence "due to the resources required. " PrivPay had no rails of its own. When the rails were withdrawn, the business ended.

The PrivPay episode is the clearest published illustration of a structural fact that shapes almost every conversation about M-PESA in Kenya: the people who understand the platform best are the people who cannot afford to criticize it. A fintech founder who depends on Daraja API approvals, a merchant waiting on a till number, a bank reselling Fuliza, and a payment service provider whose settlement runs through Safaricom's systems each have detailed, specific, well-evidenced views about what should change. Almost none will put their name to those views, because integration approvals, shortcode issuance, commercial terms, and settlement all sit on the other side of the table. The asymmetry of dependency silences the best-informed critics.

This is not an argument that M-PESA has failed. By any measure, it is the most consequential financial platform in Africa. In the year to March 2026, M-PESA generated KSh182.7bn in revenue, up 13.4 percent, and 45.6 percent of Safaricom's Kenya service revenue, according to the company's FY2026 results. It processed 46.41 billion transactions worth KSh41.68 trillion, served 40.99 million active monthly customers, and enabled 17.1 billion free micro-transactions under its Kadogo programme, 36.8 percent of total volume. These are company-reported figures, audited at group level but not independently verified line by line. The Central Bank of Kenya told a joint sitting of Parliament's finance and public debt committees, in a presentation by Governor Kamau Thugge, that M-PESA is now a system whose failure would "significantly impair the real economy." A platform of that weight has earned the right to be judged by adult standards.

What follows is a wishlist, organized by the constituencies that depend on M-PESA. Each ask is meant to be specific and achievable. Each names who must act. And each distinguishes what Safaricom could do on its own from what requires the Central Bank of Kenya, the Communications Authority, the Competition Authority, or Parliament. A wishlist is not an entitlement. Safaricom is a listed company with obligations to the shareholders who received a KSh80.13bn dividend this year, up 66.7 percent. It built infrastructure the state did not. The strongest version of this argument is one a Safaricom executive could read without being able to dismiss it.

The developer layer: the deepest asks

The Daraja API is the front door for every business that wants to move money through M-PESA without a human keying it in. It is free to use, which Safaricom rightly emphasises. But free access to an unreliable door is not the same as good access, and it is at the developer layer that the documented complaints are most specific.

Start with the sandbox. Daraja's test environment does not mirror production. As one Nairobi developer documented on DEV Community after the Daraja 3.0 release, the sandbox "runs almost exclusively in success mode," where "STK Pushes succeed, callbacks arrive, ResultCode is 0." The failure states a real payment system must handle, insufficient funds, wrong PIN exhaustion, USSD timeout, cancellation by the user, cannot be reliably simulated. The consequence, in the developer's words: "Developers who only test against the official sandbox ship code that has never encountered a real failure mode. Production is where they find out." A Kenyan developer built an open-source alternative, Pesa Playground, released in December 2025, specifically to test the failure states the official sandbox cannot. When the community has to build the test harness the platform owner should provide, that is a documented gap.

Then callbacks. The callback is how a merchant's system learns that a customer paid. Developer guides across the Kenyan web converge on the same warning. As one integration guide puts it, "the callback can fail to arrive if Safaricom's servers are under load or if your server was briefly unreachable," and the fallback query API "can return pending for extended periods during system congestion." Every production integration, therefore, has to build its own reconciliation loop, polling the transaction-status endpoint for payments stuck in limbo. This is normal defensive engineering. What is not normal is the absence of a published service-level agreement. Precursor could not locate any public Daraja SLA specifying callback delivery targets, uptime commitments, or credits for failure. For a payment rail on which the national economy runs, the absence of a published developer SLA is a legitimate ask in itself.

The go-live process is the third documented friction. Production credentials are not issued to individuals, only to registered businesses, and approval times reported across developer guides range from 24 to 72 hours at best to two to three weeks during busy periods. B2C and B2B are not enabled automatically on a shortcode; they require separate whitelisting, a step one developer described spending hours debugging as a 404 error before discovering "the problem is Safaricom whitelisting, not your integration." Daraja 3.0 did introduce self-service onboarding, which removes the manual review bottleneck, a genuine improvement Safaricom should be credited for. It also introduced mandatory two-factor authentication to read the documentation and an AI support chatbot that the same developer community describes as of mixed usefulness.

For most small businesses, the friction is enough that they do not integrate directly at all. They go through an aggregator, and the aggregator takes a margin. Published comparisons of the Kenyan gateway market show aggregators charging between 0.5 percent and 2.5 percent on top of the underlying Safaricom transaction cost, with some hosted-checkout providers such as Pesapal, DPO and Flutterwave charging 3.0 to 3.5 percent all-in on M-PESA transactions and settling on T+1 to T+3 rather than instantly. Kopo Kopo, acquired by Moniepoint in August 2023, built its business on exactly this reconciliation-and-settlement layer. The existence of a healthy aggregator market is a good thing. But when the friction of direct integration is high enough that a small merchant rationally pays a middleman two to three percent, some of that margin is a tax on the difficulty of dealing with the platform directly.

The developer wishlist, then, is concrete. Safaricom could, unilaterally and without waiting for any regulator: publish a Daraja SLA with callback-delivery and uptime targets; ship a sandbox that simulates every production failure code; publish a changelog and deprecation policy; make B2C and B2B whitelisting timelines transparent and fast; and publish median and 95th-percentile go-live approval times so applicants can plan. None of these requires legislation. All of them would narrow the gap between what Safaricom's developer relations say and what developers experience.

The merchant layer: price, settlement and the till you do not own

The merchant story is, on price, better than its reputation. Lipa na M-PESA Buy Goods is free to the customer at the point of sale. The merchant pays a collection fee of 0.55 per cent, capped at KSh200 per transaction, on payments above the free threshold. In a set of tariff changes Safaricom said were intended to lower the cost of doing business, the free collection band for Buy Goods was raised from KSh200 to KSh500, and Pochi la Biashara, the micro-trader product that drove the merchant base up 71 per cent to 3.1 million, saw its own free band adjusted. On 7 August 2026 Safaricom cut charges on transfers from business tills to wallets and paybills by up to 50 percent, a move The Standard reported as aligning with the Central Bank of Kenya's "pricing principles on customer-centricity, transparency, and affordability." " That 0.55 percent capped merchant rate compares favourably with card interchange and merchant discount rates in most comparable markets, where two to three percent is common. On headline price, M-PESA merchant acceptance is cheap.

The merchant asks are therefore not mainly about price. They are about settlement, reconciliation and control. Settlement timing to a merchant's own bank account, reconciliation tooling and statement access are the areas where merchants most often report friction, though Precursor notes that much of this evidence is anecdotal and forum-based rather than documented in published surveys, and says so plainly. The one area with a documented, recurring dispute is till ownership. Complaints about till-number transfer and control, where the person who registered a till and the person who runs the business are not the same, appear widely in Kenyan merchant forums but have not, to Precursor's knowledge, been quantified in any published study. That absence is itself worth stating: a platform that serves 3.1 million merchants should be able to publish, and should be asked to publish, its own data on till-dispute resolution times.

The achievable merchant asks: Safaricom could publish standard settlement timelines for paybill and Buy Goods collections to external bank accounts, publish a machine-readable statement API so merchants and their accountants can reconcile without scraping SMS messages, and publish a clear till-ownership and transfer policy with a defined dispute-resolution window. The Central Bank of Kenya, which is already developing a consumer-protection framework under its National Payments Strategy, could make statement access and settlement-time disclosure a minimum standard for all payment service providers, not a favour.

The interoperability and competition layer: what only the regulators can do

Here the asks move beyond anything Safaricom can or should be expected to grant voluntarily, because they concern the structure of the market rather than the conduct of one firm.

Safaricom's dominance is not disputed. The Communications Authority has classified it as a dominant player; the 2017 Analysys Mason study it commissioned found Safaricom dominant in both retail mobile communications and mobile money, with shares exceeding 80 per cent in key metrics, and attributed that dominance to "high barriers to entry and strong network effects" rather than superior efficiency. M-PESA's share of mobile money, long above 98 per cent, has declined for six consecutive quarters to roughly 89 to 90 per cent by late 2025, according to Communications Authority data, as Airtel Money has grown. That decline is real but it does not change the structural picture.

The competition question has two documented threads. The first is agent exclusivity, and here the outcome favours the market. Following a Competition Authority of Kenya investigation, Safaricom agreed in a Kenya Gazette settlement to expunge restrictive clauses in its agent agreements, leaving M-PESA agents "at liberty to transact the mobile money transfer businesses of any other mobile money transfer service providers." Agent non-exclusivity is settled law. The second thread is live. In May 2025 a complaint lodged through I.C. Law by Edwin Dande, chief executive of Cytonn, alleged that Safaricom's zero-rating of its own Ziidi money market fund on M-PESA, while rival funds such as Cytonn and Etica pass transaction costs to customers, "applies dissimilar conditions to equivalent transactions" and breaches sections 21 and 24 of the Competition Act. The complaint asks the Competition Authority to investigate and, if warranted, terminate the arrangement. Its resolution will test whether the Authority treats M-PESA as an essential facility whose owner may not self-preference.

The most important interpretive point on competition belongs to the Authority itself. Its former director-general, Wang'ombe Kariuki, stated the principle plainly: "Dominance is not an illegality. What is an illegality is the abuse of dominance position." That is the correct frame. The wishlist here is not that Safaricom be punished for winning. It is that the essential-facility question, can the owner of rails used by 90 per cent of the market self-preference its own downstream products, be answered clearly rather than left to accrete case by case.

The structural-separation debate has run since 2017, when Analysys Mason first proposed hiving off M-PESA, a recommendation later watered down. Kenyan senators revived it in 2020; Central Bank Governor Patrick Njoroge suggested in 2022 that a split could happen "as soon as January 2023"; a majority of MPs then rejected it. The Kenya Information and Communications (Amendment) Bill to force separation, originally sponsored by then-Gem MP Elisha Odhiambo, stalled in 2021 and was revived in 2024. Safaricom has consistently opposed separation, arguing the intertwined model keeps M-PESA cheap, and has warned of a tax liability on the order of KSh75bn from any restructuring, a figure that reflects capital gains and VAT exposure on transferring the business. Peter Ndegwa's rebuttal is worth quoting because it is the honest counter-argument: pointing to rivals that separated their mobile money arms, he asked whether they "gotten better valuations? Probably not."

Precursor's position is that structural separation is the wrong instrument for the right problem. The problem is that a private, listed company owns rails of national-utility importance. The remedy is not to expropriate or forcibly break up a lawfully built asset, an act with consequences for every investor in the Nairobi Securities Exchange, but to build genuinely competitive public rails alongside it. That is what the Central Bank of Kenya's Fast Payment System is meant to be.

The FPS is the single most important item on this list, and it is the one where the least has been published. Announced in October 2024 with a CBK-Industry Technical Working Group drawn from the Kenya Bankers Association, payment service providers, and banks, it is intended to give Kenya a centralized switch for instant payments across banks, fintechs and mobile money, replacing the "costly bilateral arrangements" the CBK itself criticized. As of this writing, the CBK has published no launch date, no procurement decision, no governance model and no participation rules; its October 2024 statement said only that it would "provide further updates on the timeframe." Existing interoperability delivers unevenly. Person-to-person interoperability arrived in 2018 and merchant interoperability in 2022, the latter two years behind schedule. The KE-QR Code Standard 2023, built on the EMVCo specification, gives merchants a single interoperable QR code across providers, a real achievement, though adoption remains the test. PesaLink, the banks' real-time rail run by Integrated Payment Services Limited, transfers up to KSh999,999 arriving within a maximum of 30 seconds; its own materials cite over 80 direct participants, while its chief executive, Gituku Kirika says roughly 190 institutions are connected directly or indirectly. It settles in deferred net cycles rather than true real time, and, crucially, non-bank fintechs cannot join directly. They need a sponsor bank, holding a trust account, to reach the switch at all.

That sponsor-bank requirement is the quiet structural barrier the FPS must remove. The wishlist for the CBK is therefore specific: publish the FPS governance model and participation rules; guarantee direct, non-sponsored access for licensed non-bank payment service providers; publish a launch timeline with milestones; and mandate participation for institutions above a size threshold, as Brazil did with Pix.

Learning from Pix and UPI without romanticising them

The two systems most often held up to Kenya are India's UPI and Brazil's Pix, and both must be read carefully because both are publicly owned infrastructure and M-PESA is not.

Pix, launched by Banco Central do Brasil in November 2020, is owned and operated by the central bank, mandates participation for large institutions, and is free for individuals. It processed 79.8 billion transactions in 2025, worth R$35.36 trillion and up 33.6 percent year on year, and represented 54.7 percent of all retail payment transactions in the second half of that year, per the central bank's semiannual statistics published on 7 April 2026. Pix now reaches over 175 million users, roughly 93 percent of Brazil's adult population, and its recurring-payments layer, Pix Automático, launched in 2025 to serve the roughly 60 percent of Brazilians without credit cards. Its cost model is the instructive part: free to individuals, low cost to businesses. Brazil chose to charge merchants a modest fee rather than nobody, which is why analysts contrast it favorably with India.

UPI is the cautionary tale. India's zero merchant-discount-rate policy, introduced in January 2020, made UPI free for merchants and consumers alike, and volumes are staggering, 23.66 billion transactions worth ₹29.88 lakh crore in July 2026 alone, per NPCI data, its highest-ever monthly total. But the sustainability critique is now mainstream in India. As the Takshashila Institution argued in April 2026, PhonePe and Google Pay together control 83 percent of UPI transaction volume, and zero MDR "makes it impossible for any challenger to build a viable business," so that "perversely, the policy designed to democratize payments has entrenched a duopoly." India is now amending its Payment and Settlement Systems Act to allow MDR on large-merchant transactions. The lesson for Kenya is that mandating zero-price access to payment rails does not make the cost of running them disappear; it relocates the cost, and often the market power.

The transfer to Kenya has one hard limit that must be stated without euphemism. UPI and Pix are public assets built by the state. M-PESA is a private asset built by a listed company. Kenya can build public rails and require M-PESA to interoperate with them on fair, published terms. It cannot, without expropriation and its attendant costs to investor confidence, simply declare that M-PESA must carry competitors' traffic at zero price. The Fast Payment System is the legitimate route to the outcomes Pix delivers. Structural separation and mandated zero-pricing are not.

Open finance: whose data is it

One ask sits between the developer and the consumer and requires nobody to build anything new, only to enforce a right that already exists. Kenya's Data Protection Act 2019 grants, under its data-subject rights, a right to data portability for data processed on the basis of consent or contract. In principle a customer can already require that their own M-PESA transaction history be provided in a structured, machine-readable form for transfer to another provider. In practice no mechanism exists to exercise that right against Safaricom, and the Office of the Data Protection Commissioner has not, to Precursor's knowledge, issued guidance operationalizing portability for payment data.

Nigeria shows the more ambitious path. The Central Bank of Nigeria issued Africa's first Open Banking Regulatory Framework in 2021, followed by operational guidelines in 2023, with NIBSS operating a central Open Banking Registry and consent-management system; go-live, targeted for August 2025, slipped as the regulator prioritized consumer protection, but the architecture is built. Kenya has no equivalent open-banking framework and no CBK open-banking consultation on the public record. The wishlist is twofold: the ODPC should issue guidance making the existing portability right usable for financial data, and the CBK should open an open-banking consultation with a view to a consent-based API standard. A customer's transaction history is the raw material of credit scoring and product competition. Whoever controls it controls the downstream market.

The consumer and rural layer, and the credit question

Safaricom's consumer record includes genuine, creditable progress that any fair account must record. The Kadogo programme's 17.1 billion free micro-transactions materially lower the cost of being poor. The free peer-to-peer band up to KSh100, Pochi la Biashara for micro-traders, M-PESA Go for minors, and a falling reliance on withdrawal revenue, down 1.3 percent to KSh36.8bn even as the business grew, all point the same way: away from extracting cash-out fees and towards payments. The September 2025 migration to a cloud-native core running at 6,000 transactions per second, with headroom to 12,000, is real infrastructure investment. On several of these fronts Safaricom has moved ahead of its regulator.

Two consumer-layer facts complicate the picture. The first is reliability. M-PESA outages recur, and their systemic cost is documented: a 2019 outage lasting around five hours was estimated to have cost the economy heavily, and the Communications Authority has summoned Safaricom to explain disruptions. Neither Safaricom nor the regulators publish routine uptime statistics or a consumer-facing SLA. The My OneApp launch of 2026 compounded the reliability question at the interface layer: the unified app onboarded three million customers but locked out diaspora and roaming users through a SIM-binding requirement, prompting a public apology from Peter Ndegwa, who said "we owe you a sincere apology" and conceded the experience "fell short." The ask is modest and achievable: Safaricom should publish monthly uptime, and the CBK or Communications Authority should require outage reporting and publish it, as payment regulators elsewhere do.

The second fact is credit, and it is the one the growth figures obscure. Fuliza, the overdraft offered with NCBA and KCB, who carry the credit risk, disbursed KSh1.46 trillion in FY2026, up 49.3 percent, across 17.7 million distinct customers, more than double the prior year. Safaricom earned KSh6bn from it. The revealing number is the average loan: KSh217.90, down from KSh241.20, and down some 65 per cent from KSh622.70 in FY2020. NCBA's own managing director, John Gachora, drew the conclusion: "We are seeing more borrowing just for survival. People are borrowing to spend on short-term needs as opposed to long-term investments." A platform whose fastest-growing credit line is shrinking in ticket size while doubling in users is reading a macroeconomic distress signal in its own data. That is not a reason to withdraw Fuliza. It is a reason for Safaricom, its bank partners and the CBK to publish transparent, effective-cost disclosure on overdraft lending, so the price of survival borrowing is visible.

On tax, the state has been the aggressor, not Safaricom. Excise duty on mobile-money transfer fees stands at 15 percent, having risen from 12 percent under the Finance Act 2023, not fallen from 20 percent as is often loosely reported; the 20-to-15 cut applied to banks and money-transfer agencies, with all categories harmonized at 15 percent. The Finance Bill 2026 then proposed adding 16 percent VAT to payment-service fees. Parliament dropped the VAT on person-to-person mobile transfers, though it retained VAT on companies providing mobile money services, a partial rejection rather than a total one. The Kenya Bankers Association chief executive, Raimond Molenje, put the stakes bluntly in public participation: "You tax digital payment platforms, you drive consumers to the mattress and to the informal economy." On the tax question, Safaricom and its critics are on the same side.

What an adult M-PESA looks like

The concrete asks, and who must act:

• Safaricom, unilaterally: publish a Daraja SLA, a failure-complete sandbox, an API changelog, transparent go-live and whitelisting times, a machine-readable statement API, a published till-ownership policy, monthly uptime figures, and effective-cost disclosure on Fuliza.
• The Central Bank of Kenya: publish the Fast Payment System's governance, timeline, and participation rules; guarantee direct non-sponsored access for non-bank PSPs; make settlement-time and statement disclosure minimum standards; open an open-banking consultation.
• The Competition Authority of Kenya: resolve the essential facility and self-preferencing question raised by the Ziidi complaint.
• The Office of the Data Protection Commissioner: make the existing data-portability right usable for payment data.
• Parliament: Legislate the open-finance framework and resist taxing the rails into the informal economy.

An adult M-PESA is not a smaller M-PESA, or a broken-up one, or one forced to carry rivals for free. It is a platform confident enough to publish its own service levels, open enough that a customer can take their data elsewhere, and embedded in a market where the fast payment system gives every other provider a fair rail to compete on. Most of this list Safaricom could begin tomorrow, without a regulator compelling it, and be stronger for it. The rest is the state's job, and the state has been slower than the company it is meant to regulate. The businesses that know all this will mostly keep quiet, because their till numbers and their API keys depend on the goodwill of the firm they would be criticizing. That silence is the best evidence that the asks are real.