CinetPay, an Ivorian payment processor serving over 25,000 businesses, was reportedly targeted by a cyberattack in September 2025, resulting in financial losses and leaving the company owing customers more than $1 million.
“CinetPay has recently been the victim of significant cyber fraud incidents, notably in Côte d’Ivoire, Togo, and Burkina Faso. Bailiff reports, as well as official complaints filed in each of these countries, attest to the reality of these incidents,” reads an October 3, 2025, letter signed by Daniel Dindji, the company’s chief executive officer.
The document, sighted by , added, “These events, which had a direct and substantial impact on our cash flow, explain the delays observed in the execution of our commitments.”
The fintech, which claims to process over six million transactions monthly, is now in a legal dispute with one of its users, DPay, a Nigerian payment processor, after reportedly failing to remit the funds it processed for DPay from September 2025.
CinetPay has yet to respond to repeated requests from sent between December 2025 and January 2026.
“Merchants depend on the timely settlement of funds to run their operations,” John Schubbe, an operations manager at DPay, speaking on behalf of the company, told in a telephone interview in January 2026. “By withholding customer funds for months, this situation has restricted our access to working capital and affected our ability to serve our clients.”
DPay and CinetPay agreed in December 2024 to have the Ivorian fintech process payments for DPay in Francophone West Africa. By early August 2025, CinetPay began delaying settlements and reportedly owed DPay CFA 250 million ($455,000), according to documents obtained by .
By September 2025, CinetPay had acknowledged outstanding obligations of more than CFA 655 million ($1.2 million) and proposed a repayment plan.
The documents revealed that DPay issued legal notices in November 2025, but as of the time of filing this report, CinetPay has yet to honour the proposed repayment terms.
Another legal notice sent to CinetPay on December 18, 2025, and obtained by in January 2026, reads: “CinetPay is hereby required to pay immediately to the requesting party (DPay Limited) […] the sum of 655,209,302.95 FCFA ($1.2 million), representing amounts collected via CinetPay.”
Liquidity problems at a payment processor can quickly cascade to the businesses that rely on it, as merchants depend on predictable settlement cycles to access revenue.
In CinetPay’s case, some merchants allege that funds remained unsettled for months, limiting their ability to access cash collected on their behalf.
CinetPay’s cyberattack occurred in the same month it was licensed as one of a small group of payment fintechs authorised to operate within the West African Monetary Union (WAEMU) by the Central Bank of West African States (BCEAO).
The license, granted to only 30 fintechs, allows holders to process payments across member countries such as Senegal, Côte d’Ivoire, Benin, and Togo. The licence also requires a minimum capital of 100 million CFA, robust governance, strong anti-fraud and AML controls, and resilient technical infrastructure, standards designed to prevent operational and security lapses.
Given the recency of CinetPay’s licence, the cyberattack tested how effectively these standards were implemented in practice.
The cyberattack and inability to settle customer funds occurred 20 days after Senegalese authorities placed CinetPay under investigation for allegedly “facilitating money laundering, organised fraud, and illegal online gambling.”
While CinetPay has denied any involvement in illegal activity in Senegal, saying a third-party merchant misused its platform to commit fraud, it remains unclear whether the allegations in the regulatory probe are connected to the cyberattack.
Since 2016, CinetPay has provided payment collection and settlement services, enabling businesses to accept mobile money, card, and other online payment methods across five French-speaking West African countries.
After opening a merchant account, businesses can accept customer payments online, with CinetPay charging transaction fees that typically range from 2.5% to 3.5%, depending on the country and payment method.
When a customer pays a business using CinetPay, the fintech briefly holds the funds in the business’s CinetPay account before sending them to the business’s bank account or mobile money account within two days, after deducting a set of fees that typically range from 1.2% to 2%.
CinetPay’s cyber attack
In September 2025, CinetPay suffered multiple “cyber fraud incidents” simultaneously in Côte d’Ivoire, Togo, and Burkina Faso that allowed intruders to withdraw money by exploiting internal limits and sending it to mobile money accounts in these countries, according to the letter from Dindji, which references police reports from the same month.
Routing money to many wallets simultaneously, experts have noted, is a ‘textbook laundering tactic,’ allowing fraudsters to evade detection quickly and withdraw cash before security systems can react.
CinetPay only detected the breach after large sums across four countries had vanished. By then, customers had begun asking why settlements were no longer arriving.
Where it all began
Founded by Idriss Monthe and Daniel Dindji in 2016, CinetPay raised $2.4 million in a 2021 seed funding round from 4DX Ventures and Flutterwave, leading the round. The company launched at a time when Francophone African payments were not connected across mobile money schemes and banking rails, and CinetPay offered merchants a single interface to accept them.
The fintech also reduced the need to integrate with multiple financial institutions such as Orange Money, MTN MoMo, and Wave.
The fintech later expanded beyond checkout to include payment links, school fee collection, and bulk payouts and transfers by creating products that make payment providers important to institutions and platforms.
That importance enabled the fintech to build a customer base and status to join an exclusive list of financial institutions that received regulatory approval from the BCEAO ahead of a September 2025 deadline that would have shut it out of the formal cross-border payment system.
The approval also allows CinetPay access to the BCEAO’s long-awaited regional instant payment system (PI-SPI), which enables interoperability with all payment methods and allows smaller payment service providers without access to rely on the few fintechs with the licence.
As of the time of filing this report, CinetPay’s partners said they have yet to receive the money owed to them.
Documents made available to in the course of this investigation revealed that the company acknowledged its inability to repay funds belonging to merchants and payment companies, noting, “CinetPay expressly acknowledges the above amounts are due and payable […] arising from processed transactions.”
CinetPay’s crisis comes at a delicate moment for the region. BCEAO has spent the past two years tightening supervision of cross-border payment providers, rolling out PI-SPI, and picking the few licence holders.
The fintech’s liquidity troubles now raise questions about the safeguards required of regulated payment institutions, as it has left CinetPay’s customers—many of them small and mid-sized African businesses—carrying the cost.
