Safaricom dismissed 118 employees in connection with fraud cases during the financial year ended March 2026, while its M-PESA platform processed 46.4 billion transactions worth KSh41.7 trillion, highlighting the scale of the mobile money business the telecommunications operator is seeking to protect.
The company disclosed the dismissals in its 2026 Sustainable Business Report, which details progress in financial inclusion, cybersecurity, customer privacy, digital investment services and environmental performance.
Dismissals recorded following fraud investigations increased from 113 in the previous financial year. Safaricom also reported three disciplinary warnings, compared with none a year earlier, while cases referred to law enforcement agencies doubled to 14 from seven.
The report separately records 118 fraud cases investigated during FY2026. It does not establish that each investigated case resulted in a dismissal, and the company does not provide a breakdown of the employees’ departments or the circumstances of individual cases.
Fraud remained the most common category of concern reported through Safaricom’s ethics hotline. The company said it investigated reported concerns under established procedures and took corrective or disciplinary action where appropriate.
M-PESA expands as digital finance deepens
M-PESA’s 30-day active customer base grew to 41.7 million in FY2026, from 35.8 million a year earlier, according to the report. The platform processed 46.4 billion transactions worth KSh41.7 trillion during the year, underlining its central role in Kenya’s payments ecosystem.
The growth places greater emphasis on the reliability and security of the platform, as customers increasingly use mobile money for payments, transfers, savings and investment rather than cash transfers alone.
Safaricom reported progress in expanding financial services through its Ziidi investment ecosystem. Ziidi Trader, launched with the Nairobi Securities Exchange in February 2026, enabled customers to buy and sell NSE-listed shares through their mobile phones. By the end of the financial year, it had attracted 511,000 opt-ins and 84,000 trading subscribers.
The company’s Auto Invest service recorded KSh987.6 million in investments, with 108,000 daily active subscribers in a single month. Ziidi Pochi, which extends savings and investment tools to informal traders through business wallets, reached approximately 1.46 million opt-ins.
These products extend M-PESA’s role beyond payments, positioning the platform as an entry point to savings and capital-market participation for customers who might otherwise have limited access to formal financial services.
Fraud reduction falls short of target
Despite the increase in fraud-related dismissals, Safaricom reported an 82% reduction in fraud incidents against a target of 90%. It recovered 46% of reported fraud losses during FY2026.
Proactive monitoring and analytics also helped the company recover KSh953 million linked to inflated agent commissions. The report does not say that the entire amount was attributable to employee misconduct or directly connected to the dismissals.
Safaricom identified social engineering as the leading fraud threat to customers during the year, with in-person social engineering emerging as the most significant contributor. Such schemes rely on manipulating people into disclosing sensitive information or authorising transactions.
The company said it strengthened transaction monitoring, identity safeguards, fraud reporting and customer and agent awareness. Its ethics programme reached 98% of employees, matching the previous year’s level.
Business partners also received compliance training. Safaricom reported training 972 M-PESA agents in know-your-customer and ethics requirements, up from 925, while awareness broadcasts covering agents increased to 37 from 11.
Cybersecurity and privacy safeguards
Safaricom detected and monitored approximately 1.25 billion intrusion attempts and investigated more than 130,000 security events during FY2026. It reported no confirmed material cybersecurity breaches affecting customer data or business operations, and said distributed denial-of-service attacks were mitigated without material customer impact.
The company continued modernising its 24-hour Cyber Defence Centre, including the use of AI-powered defence, automation and enhanced threat intelligence. Its security and privacy management systems are certified against standards including ISO 27001 for information security, ISO 27701 for privacy, PCI DSS and GSMA Mobile Money certification.
Safaricom also completed M-PESA peer-to-peer data minimisation, extending enhanced privacy protection to more than 40 million subscribers, according to the report.
Customer trust indicators improved during the year. M-PESA’s privacy trust score rose to 70% from a low of 63% in FY2025, while Safaricom’s privacy trust score increased to 61% from 56%. The company’s data protection maturity score remained at 3.9 out of five; the independent assessment was not repeated in FY2026.
The report said an audit by the Office of the Data Protection Commissioner, conducted in December 2025, concluded that Safaricom was predominantly compliant with Kenya’s Data Protection Act. The company recorded no ODPC sanctions in FY2026, compared with two fines in the previous year, although ongoing privacy court cases increased to nine from six.
Sustainability and operational performance
Safaricom’s report also tracks its environmental performance as energy demand grows alongside its telecommunications network and digital services.
The company reported progress in strengthening climate-related disclosures and measuring emissions across its value chain. It has been expanding renewable-energy and energy-efficiency initiatives while improving the measurement of emissions associated with suppliers and other activities outside its direct operations.
The report’s Ethiopia section provides a separate illustration of that effort. Safaricom Ethiopia sourced 98.67% of its energy consumption from renewable sources in FY2026, up from 96% a year earlier. Solar installations at 98.67% of its 338 sites helped avoid approximately 359,306 litres of diesel and an estimated 945 tonnes of greenhouse gas emissions. Its Scope 1 emissions fell 31.5% to 9,029 tonnes of carbon dioxide equivalent.
Those figures relate specifically to Safaricom Ethiopia and should not be interpreted as the performance of the Kenyan operation.
Governance becomes more important as services expand
Safaricom’s Board Risk and ESG Committee oversees technology-related risks, including cybersecurity threats, privacy incidents and the adequacy of controls intended to prevent and detect fraud, bribery and financial crime.
The report describes an approach that combines technology controls with staff training, investigations, customer education and compliance requirements for third parties. It also identifies AI-enabled fraud and increasingly sophisticated cyber threats as challenges that will require continued investment in detection and response.
For Safaricom, the FY2026 disclosures show a business expanding the reach of mobile money while broadening its financial services and investment products. The growth in transactions and digital participation makes the protection of customer funds, data and confidence an increasingly important part of its operating model.