Safaricom M-PESA, an 18 year old mobile money system, has evolved far beyond its original intent. What began as a simple peer-to-peer transfer tool has become the de facto financial backbone of the nation, with over 90% market share and nearly half of Kenya’s GDP moving through its systems annually. M-PESA, with its 34 million customers, handled over 30 billion transactions in 2024 valued at an estimated $309.4 billion (Ksh. 40 trillion).
The structural reality is clear: M-PESA has become a critical piece of Digital Public Infrastructure (DPI), yet it is regulated primarily as a telecommunications service. The company that runs it, Safaricom, never set out to be a bank, but its operations prove it performs the core functions of one. It’s why Techcabal’s Kenn Abuya refers to M-PESA as an accidental bank. To safeguard this national utility and ensure its long-term resilience, M-PESA must be officially converted to a full fledged bank.
The unavoidable responsibility of a Digital Public Infrastructure (DPI)
Digital Public Infrastructure refers to the shared digital systems, for identity, payments, and data exchange, that are essential for the functioning of a modern economy and society. M-PESA, by facilitating transactions for millions, enabling e-commerce, tax payments, and the flow of remittances, fits this definition perfectly.
A failure of M-PESA would be a systemic national crisis, not just a business disruption. Recent data, like the 2025 Safaricom sustainability report, inadvertently makes the case for this structural change by highlighting the immense and complex security burdens M-PESA now carries.
The report details M-PESA’s use of advanced AI and data analysis to flag patterns of money laundering. The telecom is forced to implement stringent controls, checking beneficial owners, screening transactions against global sanctions lists, and tightening due diligence. This is standard procedure for international banks. A banking license would formalize these requirements under the supervision of the Central Bank of Kenya (CBK), ensuring the financial integrity and sovereign security of the DPI is not left to the discretion of a private telecom firm.
The disclosure of dismissing 113 employees for fraud demonstrates the scale of internal risk. While transparency is commendable, a regulated bank is required to have layers of capital adequacy, risk management frameworks, and governance protocols specifically designed to absorb and mitigate such shocks without compromising the entire financial system. By operating outside the main banking regulatory framework, M-PESA lacks the mandated safety buffers designed for systemically important institutions.
Securing the digital public good
The paradox is that the features that made M-PESA indispensable, its simplicity and reach, also make it a massive target for misuse. Converting M-PESA into a regulated bank is the necessary step to align its regulatory reality with its functional importance, thereby securing it as digital public infrastructure
1. Systemic stability and enhanced consumer protection
While customer funds are currently held in a secure Trust Account, full banking status would impose a clear, comprehensive prudential regulatory framework. This would mandate higher standards for capital adequacy, liquidity reserves, and risk management, providing the ultimate regulatory backstop.
This move would also open the door for deposit insurance, offering an additional, formal layer of assurance for the millions who rely on it for their life savings.
2. Deepening financial intermediation and lowering costs
As a bank, M-PESA could directly mobilize customer deposits and use this lower-cost base for lending, independent of commercial bank partnerships. The immediate public benefit would be:
- A cheaper funding source could lead to lower interest rates on popular microloan products like Fuliza, significantly reducing the financial burden on low-income users.
- It could offer more competitive interest rates on savings, truly rewarding the millions of small-scale savers.
3. Regulatory clarity and full service offering
A bank license would end the regulatory anomaly of a telco running an essential financial system. It would provide CBK with a clear mandate and legal framework to govern this critical infrastructure, ensuring clear Anti-Money Laundering (AML) and Counter-Terrorist Financing (CFT) oversight. This formal oversight enhances public trust in the stability and longevity of the system.
Addressing the DPI challenges and risks
The move is not without risks, and the regulatory design must be cautious to preserve the elements that made M-PESA successful.
| Challenge | Mitigation Strategy (The DPI Mandate) |
| Risk of Stifled Innovation | The Central Bank of Kenya (CBK) must create a Tiered Regulatory Framework that is risk-based and proportional. It must avoid imposing heavy, outdated prudential requirements designed for traditional banks, recognizing M-PESA’s low-cost, branchless model. |
| Entrenching a Monopoly | Conversion must be strictly tied to a non-negotiable mandate for True Interoperability. This means seamless, low-cost integration with all competing payment systems and fintechs, ensuring M-PESA’s power is used to foster competition, not suppress it. |
| Mission Drift | Regulation must enforce a Public Service Obligation, ensuring the M-PESA agent network remains accessible and low-cost services for the base of the pyramid are maintained, preventing a focus solely on high-value, high-profit clients. |