By Jameson
Safaricom PLC has announced a major data privacy enhancement within the M-PESA platform, set to take effect on March 24, 2026, following regulatory approval from the Central Bank of Kenya.
The update introduces data minimization in person-to-person (P2P) transactions, where recipients will only see two names and a masked phone number instead of full personal details.
It also extends to Till, PayBill, and peer-to-peer payments, limiting personal data exposure across the platform. As a result, M-PESA transaction notifications to merchants will no longer display a customer’s full phone number, showing only partial digits instead.
According to Safaricom CEO Dr. Peter Ndegwa, the feature will ensure that only two names of the sender are visible, while the middle digits of the mobile number are masked.
Customers who wish to access full sender details will have a 24-hour window to request the information.
Speaking to journalists, Ndegwa said the move is part of Safaricom’s broader strategy to strengthen customer privacy amid the rapid growth of digital financial transactions.
“M-PESA has become a critical part of our daily social and economic lives. Protecting customer information is therefore extremely important for us,” he said.
Ndegwa outlined Safaricom’s journey toward enhanced data protection, which began in 2020 with the introduction of data minimization in Pochi la Biashara, limiting the customer information visible to merchants.
Subsequent measures included restricting internal access to customer data in 2021, masking phone numbers on M-PESA statements in 2022, and implementing API-level data controls in 2024 to ensure third-party partners access only essential information.
The latest P2P update marks a significant milestone in embedding privacy-by-design principles across the M-PESA ecosystem.
The announcement builds on Safaricom’s recent upgrade to its mobile money platform under the Fintech 2.0 framework, the largest overhaul since M-PESA’s inception.
According to Ndegwa, the upgraded system leverages artificial intelligence and a microservices architecture to improve efficiency, scalability, and security.
The platform currently processes over 37 million P2P transactions daily, valued at more than KSh 2 billion.
New features introduced under Fintech 2.0 include wallet sharing through Shiriki Pay, enhanced anti-fraud systems, and improved integration capabilities via Daraja 3.0 APIs.
Safaricom has also deployed AI-powered tools to monitor and mitigate fraud, alongside strengthened authentication measures to address SIM swap risks. The company records approximately one million SIM swap requests monthly, with only a negligible fraction reported as fraudulent.
Ndegwa emphasized that data privacy extends beyond corporate responsibility, calling for collaboration among industry players, regulators, and government agencies to safeguard Kenya’s digital ecosystem.
“Data protection is bigger than one organization. It is a nationwide conversation that requires collective action,” he said.
He also urged individuals to remain mindful of their digital footprint in everyday interactions, from residential access logs to service provider engagements.
