M-Pesa, Machankura, and Transaction Privacy in Kenya

M-Pesa records transactions inside a regulated mobile-money system. Machankura lets a basic phone reach Bitcoin through USSD, but it replaces one operator with several others. Neither system is anonymous.

M-Pesa is national payment infrastructure

M-Pesa launched in Kenya in 2007 and made phone-number payments available without a conventional bank account. Users can hold electronic money, send it to another user, pay merchants, and move cash through agents.

Safaricom's 2025 annual report recorded 35.82 million one-month active M-Pesa customers in Kenya. It reported KSh 38.29 trillion in transaction value and 37.15 billion transactions for the year ended 31 March 2025. Those figures show why privacy questions about M-Pesa affect more than a small group of users.

The Central Bank of Kenya reported $4.945 billion in remittance inflows during 2024. M-Pesa is one way money reaches recipients, but the remittance total covers formal channels more broadly and should not be presented as M-Pesa volume.

What Safaricom says it collects

Safaricom's data privacy statement says it collects identity and SIM-registration information, M-Pesa transaction information, mobile-money transactions, call records, data-session logs, and approximate location. The statement does not say every M-Pesa transfer includes an agent location, so that claim should not be assumed.

The same statement says Safaricom may disclose information to law-enforcement agencies, regulators, courts, and statutory authorities when a demand has the appropriate lawful mandate and complies with the law. It also says Safaricom assesses each request and may decline it. That is more precise than saying state access has no legal threshold.

Machankura changes the route, not the trust problem

Machankura provides a custodial Bitcoin account through USSD. Its official site says registered users can send and receive Bitcoin by phone number or Lightning address. Its FAQ says the service creates a Lightning address from the registered phone number. A user can choose a username so recipients do not need to see that number.

USSD works on feature phones and does not require an app or mobile-data plan. This matters in Kenya. The Communications Authority counted 29.48 million feature phones connected to mobile networks at the end of June 2025, alongside 43.75 million smartphones. Device counts are not unique users, but they confirm that basic phones remain common.

Machankura is not self-custody. The service controls the wallet infrastructure and must process account instructions. The account starts with a phone number, while the carrier and USSD provider handle the session. Users should assume those parties can retain operational metadata unless a current policy says otherwise.

The comparison does not support the claim that Safaricom cannot obtain any information about a Machankura user. A Safaricom line can initiate the USSD session. Nor does it support the claim that Machankura keeps no transaction log. A custodial operator needs account records to maintain balances and process transfers.

Kenya now has a VASP law

Kenya's Virtual Asset Service Providers Act commenced on 4 November 2025. It applies to virtual asset service providers offering services in Kenya. The Act says a person may not carry on virtual asset services in or from Kenya without a licence from the relevant regulator.

The Act names the Central Bank of Kenya and Capital Markets Authority as regulators. Its schedules divide regulated activities between them. The law also covers custody, transfers, exchanges, payment processing, stablecoin issuance, and services intended to conceal transaction information.

An official CBK and CMA notice said licensing would begin after implementing regulations were issued. It also said that, at the date of the notice, neither regulator had licensed a VASP under the new Act. Users should not treat the absence of a published action against one service as proof that the service falls outside the law.

Practical privacy choices

Choose between these tools based on the threat you face. M-Pesa is widely accepted and denominated in shillings, but Safaricom identifies the account and stores transaction data. Machankura reaches basic phones and can receive Lightning payments, but the wallet is custodial and tied to telecom infrastructure.

• Keep only a small working balance in any custodial wallet.
• Use a unique Machankura username if you do not want to publish your phone number as a Lightning address.
• Do not describe Bitcoin or Lightning payments as anonymous. Payment timing, counterparties, phone records, exchange accounts, and later on-chain settlement can create links.
• For larger Bitcoin holdings, use a self-custodial wallet after you have tested backup and recovery.
• Check fees, withdrawal paths, and legal status before using a wallet for remittances.

Machankura solves an access problem. It does not solve custody, phone-number linkage, or regulatory exposure. M-Pesa solves a domestic payments problem at a scale few systems match. That scale also concentrates detailed financial records with one operator.

Sources

• Safaricom Data Privacy Statement
• Safaricom 2025 Kenya Performance Review
• Central Bank of Kenya bulletin reporting 2024 remittances
• Communications Authority of Kenya sector statistics, April to June 2025
• Machankura FAQ
• Kenya Virtual Asset Service Providers Act, 2025
• CBK and CMA public notice on the VASP Act

Reviewed 13 July 2026. Information is provided for educational purposes. Check current Kenyan law, provider terms, fees, and service availability before acting.