PrivPay shutdown after Safaricom cut API access over compliance violations

PrivPay, a Kenyan fintech that allowed customers to make M-PESA transactions without revealing their personal details, shut down in May 2023 after Safaricom cut its access to M-PESA APIs. Safaricom’s action was connected to a worry that the fintech’s offering violated several compliance issues, two people with direct knowledge of the matter said.

Names and phone numbers shared with merchants in transactions are often used for marketing, and PrivPay, which launched in 2022, sold the notion of privacy to users. Its solution was powered by  Daraja—M-PESA’s free payment APIs.

The startup claimed it held talks with Safaricom about its business model and got the company’s buy-in before launch. It also said the telco backtracked after PrivPay began attracting media attention.

“Your business model is not permitted by Safaricom,” Safaricom wrote to PrivPay in May 2023 in a letter seen by TechCabal. M-PESA prohibits third-party transactions.

Safaricom did not respond to a request for comments.

In May 2023, Safaricom suspended the fintech’s pay bill account—a cash collection number built on M-PESA that allowed the startup to process transactions. The telco said PrivPay—which claimed to have 30,000 users—contravened Kenya’s Anti-Money Laundering Safaricom and asked that it obtain a payment service provider (PSP) licence from the Central Bank of Kenya (CBK). Obtaining the payment licence takes up to six months.

“PrivPay keeps a record of every transaction and ensures that the manner in which the records are collected and stored for at least seven years can pick out any suspicious patterns,” PrivPay said in a response to Safaricom seen by TechCabal.

For Safaricom, in the absence of a licence, only a letter of no objection from the Central Bank of Kenya would suffice.

“We did not explore a PSP licence at the time due to the resources required. Also, it was going to take time,” a former PrivPay executive told TechCabal.

While PrivPay hopes to stage a comeback, it must remember that good intentions alone will not help it meet regulatory requirements.