Every transaction you make on M-PESA generates a data trail that banks and mobile money providers have guarded closely for years. Kenya’s central bank and National Treasury want to change that, and they have put a sweeping new bill on the table to do it.
The proposal is open for public comment until October 9, 2026, and compliance would be due just one year after passage. Here is what the bill proposes and what it could mean for the millions of Kenyans who rely on mobile money daily.
Kenya’s payment bill forces banks to share data with licensed fintechs
The draft National Payment System Bill introduces two new categories of financial operators that do not exist in Kenya’s current regulatory framework. Payment Initiation Service Providers (PISPs) would be authorized to execute payments from a customer’s account on their behalf, while Account Information Service Providers (AISPs) could aggregate data across multiple accounts and present a unified financial picture to the customer.
Neither category would need to hold customer funds, which sets them apart from electronic money issuers and wallet providers under the bill. The draft requires the latter group to keep all customer money in trust accounts held at commercial banks, a provision designed to ring-fence deposits from operational risk.
The Central Bank of Kenya (CBK) would gain broad authority to compel providers to enable data sharing once a customer has given consent. However, the bill leaves the specific mechanics of access, including what data qualifies, under what conditions, and at what cost, to future CBK regulations, TechCabal reported.
Professor Fredrick Ogola, who challenged the government’s sale of Safaricom shares in court, has previously described M-PESA as a platform holding the “personal financial data of tens of millions of Kenyans” and serving as “critical infrastructure for democratic governance,” Tech Times reported.
That framing underscores how significant any bill that unlocks that data to third parties would be for Kenyan consumers.
M-PESA’s $300 billion data vault is the real battleground
Safaricom’s M-PESA is not just a payment app in Kenya; it is the financial system for most of the country’s adult population. The platform processes over $300 billion annually in transaction value and has been credited with helping push Kenya’s financial inclusion rate to roughly 85%, The Fintech Times reported.
M-PESA’s market share has slipped from a peak of 97% to around 89% as of late 2025, with Airtel Money gaining ground as a lower-cost alternative. The platform still dominates, but the shift suggests that competition for customers is already intensifying even before any open banking law arrives, Semafor reported.
Mugambi Munuyua, CEO of technology firm Quoxient Ltd, has flagged concerns about the security risks involved in granting access to customer transactional information in Kenya’s digital payments ecosystem, law firm Hogan Lovells noted in its analysis of open banking across Africa.
Safaricom has recently been moving in a different direction on consumer data. The company rolled out phone number masking for person-to-person M-PESA transactions in March 2026, limiting the personal information visible to recipients.
Safaricom CEO Peter Ndegwa described the rollout as part of an effort to embed “privacy by design across our financial ecosystem,” Business Daily Africa reported.
The tension between that privacy push and the bill’s open data mandate will likely define how this legislation evolves.
What Kenya’s open finance push could mean for consumers
The bill would also compel all payment providers to build interoperable systems, meaning your M-PESA account could eventually communicate seamlessly with bank accounts and rival wallets. Treasury has argued that fragmentation across banks, mobile money providers, and government payment platforms continues to create inefficiencies and higher transaction costs for consumers, the Kenya Times reported.
If Parliament passes the law, every payment service provider in Kenya would have exactly one year from the date of commencement to comply with the new requirements. That timeline is aggressive by any standard, particularly for a market with over 100 fintech startups, S&P Global estimated, and deeply entrenched legacy infrastructure. The CBK would gain powers to inspect payment firms, issue directives, intervene in management, and impose administrative penalties on those that fail to comply.
Key provisions in Kenya’s National Payment System Bill, 2026
- Payment providers must build systems capable of securely sharing customer data for open finance purposes (CBK)
- Two new license categories created: Payment Initiation Service Providers and Account Information Service Providers (TechCabal)
- All payment providers must use interoperable systems compatible with competitors’ platforms (Kenya Times)
- Electronic money issuers must hold customer funds in trust accounts at commercial banks (CBK)
- One-year compliance deadline after passage; public comments accepted until October 9, 2026 (Kenya Times)
- CBK gains power to inspect firms, intervene in management, and impose penalties for noncompliance (Kenya Times)
The bill replaces Kenya’s existing National Payment System Act, which has governed digital payments since 2011. That law was drafted before M-PESA’s transaction volumes reached their current scale and before open finance gained regulatory traction in markets like the United Kingdom, Brazil, and Nigeria.
Whether the bill survives public consultation and Parliament unchanged remains to be seen. What is clear is that the Central Bank of Kenya and the National Treasury have signaled that the era of closed payment ecosystems in East Africa’s largest digital economy may be drawing to a close. The data your M-PESA account generates could soon be worth as much to a licensed fintech startup as it has been to Safaricom.
