Vodacom denies Safaricom kept a copy of Kenya's citizen register

Vodacom has denied that Safaricom, the Kenyan operator it now controls, kept a parallel copy of Kenya’s national citizen register to keep serving customers when the government database goes offline.

As MyBroadband reported on 15 September, the allegation surfaced recently and Vodacom referred questions to Safaricom. A Safaricom spokesperson denied it outright.

Safaricom’s account is that the Government of Kenya gives authorised companies secure access to the national citizen database through an Application Programming Interface, or API. That arrangement lets an authorised party confirm a citizen’s identity in real time without accessing, storing or keeping a copy of the database, and it keeps sensitive personal information such as biometric data out of company systems.

“In line with these requirements, Safaricom uses the government-provided API to authenticate customer identities directly against the national database whenever verification is required,” the company said. It said the check runs in real time and supports SIM swaps and other identity-sensitive transactions, and that it holds no copies of the register. The company said the arrangement complies with Kenyan regulatory and data protection requirements.

Why the Kenyan register matters here

A national identity database is the single record a state uses to decide who is a citizen. Mobile operators touch it every day because a SIM card has to be tied to a verified person, and because a SIM swap is the step a fraudster needs to take over a victim’s phone number, and from there a bank account.

That is why the design of the access matters more than the access itself. A system that answers one question at a time, in real time, leaves nothing behind. A system that hands over a copy creates a second register that no data protection authority supervises and no citizen can inspect. Safaricom says it operates the first kind.

South African readers will recognise the stakes. This country is in the middle of its own identity overhaul, with Home Affairs pushing citizens off the green ID book and onto a smart card, and with banks and mobile operators relying on Home Affairs verification to open accounts and issue SIMs. The same question applies to every one of those integrations, and it is worth asking of the department and of the operators here.

What M-Pesa is worth to Vodacom

The denial lands at an awkward moment for the group, because Safaricom has just become a much bigger part of Vodacom’s balance sheet.

M-Pesa, the mobile money platform Safaricom runs, traces its origins to 2004, when Vodafone staff worked up the concept and architecture. Vodafone filed the patent in August 2006, and the British government put £1 million into the project through its Department for International Development, an amount Vodafone matched. M-Pesa reached its first million registered customers in November 2007, nine months after launch. Safaricom reported 35,82 million M-Pesa customers in its 2025 financial results.

In Vodacom’s latest annual report, M-Pesa contributed 29,4% of international service revenue, or R9,9 billion of R33,7 billion. For the quarter ended 30 June 2026, that share rose to 30,9%.

Vodacom acquired an additional 20% of Safaricom in June 2026, buying 15% from the Government of Kenya and 5% from Vodafone Group at R4,32 per share. That took Vodacom’s holding to 55% and gave it majority control for the first time since Safaricom listed on the Nairobi Securities Exchange in 2008. Safaricom is Kenya’s largest company by market capitalisation, at R177,18 billion in mid-September 2026.

A second copy of a national register is not a technical detail. It is a second register, and nobody outside the company that holds it can audit what is in it.

The South African read on all of this is straightforward. A South African group now controls the operator that sits closest to Kenya’s identity infrastructure and runs the mobile money rails that a large share of East African commerce depends on. That is a vote of confidence in South African telecoms management, and it is also a concentration of responsibility. When a regulator in Nairobi asks who holds Kenyan identity data, the answer now runs through a Johannesburg head office.

Safaricom’s denial is on the record and specific. It says the verification is real time, that the data is not retained, and that the framework was set by the Kenyan government rather than by the company. That is a checkable claim, and the Kenyan data protection authority is the body that can check it.

Source: MyBroadband, Vodacom denies accusations of flouting regulations in Kenya