By any measure, M-Pesa is a success story. It is one of Africa’s most consequential financial innovations in the last two decades. The mobile money platform, launched by Safaricom in 2007, now processes over 21 million transactions per day and touches nearly every facet of Kenyan life, from taxi fares to school fees to utility bills to small business payrolls.
But scale comes with its challenges. With M-Pesa’s core infrastructure under increased pressure from high transaction volumes, growing cyber threats, and high expectations from users, the mobile money platform has entered maturity, one that demands more than tweaks. It requires reinvention.
Safaricom’s decision in March to invest over $309.6 million (KES 40 billion) annually into M-Pesa’s overhaul is not merely a technical upgrade. It is a strategic repositioning — a recognition that M-Pesa is no longer just a product but a crucial payments infrastructure. And in the digital age, infrastructure must be invisible, resilient, and ruthlessly efficient.
“This year we will be going to what we are calling M-Pesa 2.0 which is the next phase of the M-Pesa platform,” Safaricom CEO Peter Ndegwa told . “It’s about investing for capacity, for functionality, for stability and also for resilience which is about ensuring that customers can always rely on our ecosystem.”
Ndegwa said that at the heart of the investment is an ambitious goal to reduce downtime to zero, boost stability, enhance security, and have the capacity to scale beyond its current ceiling.
In some respects, Safaricom is facing the same existential tension that other tech giants confront — the burden of ubiquity. As more people and institutions come to rely on M-Pesa, the cost of failure rises exponentially. Today, a one-hour M-Pesa outage is no longer an inconvenience; it’s an economic disruption.
Warding off competition
M-Pesa 2.0 is expected to move the mobile money platform from legacy systems into a cloud-native, API-first architecture, a systems engineer with knowledge of the upgrade told . The shift could have implications for speed, security, stability, and interoperability, which have recently become a focus for regulators like the Central Bank of Kenya (CBK).
CBK is pushing for greater integrations across commercial banks, mobile money operators, fintechs, microfinance financial institutions, and Savings and Credit Co-Operative Societies (SACCOs). In October 2024, the regulator announced plans to roll out a new fast payment system (FPS), allowing users to send and receive money across all digital payment systems.
If M-Pesa 2.0 delivers on its technical promise, it could become a critical pillar of the interoperability push. Unlike in the early years when Safaricom resisted integration efforts to shield M-Pesa from competition, it appears to align itself with the regulators, to comply and remain indispensable. The more seamlessly it connects with other players, the harder it becomes to bypass — a strategic play that could preserve its dominance in a more open and contested market.
The size of Safaricom’s annual investment in M-Pesa points to a defensive and offensive posture. For years, the mobile money platform held a commanding lead in the market, enjoying first-mover advantage and network effects. But today, its dominance is under pressure.
Banks, fintech startups, and even global tech players are encroaching on its territory, offering slicker apps, lower fees, and cross-border capabilities, which is weakening its historical lock-in. M-Pesa’s mobile money market share fell to 91% in 2024 Q4, down 2.3 percentage points from the previous quarter, as rivals continued to gain ground. Airtel Money, its closest competitor, rose 8.9% from 7.6% — its fifth consecutive quarter of growth.
Securing trust
While cyberattacks on Kenya’s financial institutions go unreported, reports by the Communications Authority of Kenya (CA) indicate that digital payments are becoming targets of such attacks. In Q1 2025, the CA detected over 2.5 billion cyber threats, a 201.85% increase from the previous quarter.
With digital fraud rising in Kenya, M-Pesa’s scale makes it a high-value target for hackers. Ndegwa said the company is addressing the threat by deploying ethical hackers to test the system, beefing up system audits, and embedding fraud prevention into every layer of the platform.
But the stakes go beyond technology. M-Pesa holds more than just user data; it holds livelihoods. The reputational damage from a major breach could be devastating, not just for Safaricom but also for digital payments.
“Our customers trust us, and for us to actually secure that trust, we have to continue to keep ahead of the crooks,” Ndegwa said. “For you to have reliable, always-on, safe, secure, commitment to customers, it takes a lot of investment.”
With over 34 million customers, M-PESA handled over 30 billion transactions in 2024 valued at an estimated $309.4 billion (KES40 trillion). It has over 160,000 agents spread across Kenya, exposing it to cyber fraud at many levels.
“It’s not that we don’t normally have cyber threats. They are usually there, but we have enough guard rails that allow us to continue to build resilience,” Ndegwa said.
Quiet upgrades
M-Pesa’s last major system overhaul was in 2021 when Safaricom upgraded the platform from Release 4 to Release 6, which enhanced its handling of growing volumes of transactions and improved the platform’s performance. It was an extensive upgrade that took over 10 hours, with some service disruptions.
Ndegwa said that because of the high investments the company has made since the last upgrade, Safaricom can do upgrades in under 10 minutes today. In contrast, most Kenyan banks shut services for close to 48 hours over the weekends to undertake upgrades.
“We want, in six to 12 months, by the time we are done with M-PESA 2.0, there will be zero-customer downtime. We will be able to upgrade in the backend without customers realising that we are upgrading, which is the future of technology,” Ndegwa said.
Safaricom may be setting the standard for what modern fintech infrastructure must look like— reliable, secure, and resilient. Its $309.6 million annual bet on M-Pesa 2.0 could be a strategic reset and not just a technical upgrade as it appears.
