La respuesta corta
M-Pesa integration for a SACCO is a gateway between Safaricom's APIs and the core system, not a feature inside the core. The core books the money. The gateway receives the callback, authenticates the member and passes the transaction on safely, once.
The moving parts
| Part | Job |
|---|---|
| Safaricom Daraja APIs | Paybill and till receipts (C2B), STK push, payouts (B2C), transaction status and reversals |
| Channels gateway | Receives callbacks, authenticates members, applies limits and one-time codes, and calls the core |
| Core system | Books the receipt or the payment to the member's account and the ledger |
| Worker jobs | Process callbacks, resolve unknown transactions and reconcile against statements |
| Channels | Mobile app, member portal and USSD or SMS for members |
What SaccoFlow 365 does today
- The Business Central app exposes a mobile banking web service with 46 operations, covering member information, balances, statements, loan applications with guarantor requests, standing orders, transfers and loan repayment.
- Paybill (C2B) confirmations from Safaricom are booked into Business Central by receipt, by keyword or as unallocated funds, and the receipt is committed first so a booking failure does not lose a payment M-Pesa has confirmed.
- Members can top up from M-Pesa with an STK push prompt, and withdraw to M-Pesa. For a withdrawal, Business Central is debited first, an explicit failure is credited back, and a timeout is never reversed automatically: it is flagged for a person to settle.
- Worker jobs process callbacks, resolve transactions whose outcome is unknown and run an hourly reconciliation that flags anomalies to the audit trail.
- Money operations are idempotent, so a repeated call does not move money twice.
- The gateway signs members in with a PIN, issues one-time codes for larger or first-time payments, binds members to devices, and offers the same M-Pesa options on USSD.
What is switched on, and what is in testing
The M-Pesa deposit and withdrawal switches are off by default and are turned on for a SACCO after testing with Safaricom, because M-Pesa money moves quickly and a SACCO should be sure of each flow before members use it. The M-Pesa flows are built and tested with simulated services, and are being taken through Safaricom's sandbox. A transaction-status query, a three-way statement reconciliation and a balance check before payout are not built yet. A member web portal (internet banking) and a mobile app for Android and iOS are built on the same gateway, with sign-in, balances, statements, transfers, M-Pesa deposits and withdrawals, loan applications, standing orders, guarantor requests, joining the app and PIN reset. Both are in testing and are switched on for a SACCO after a pilot.
Design rules that keep M-Pesa safe
- Record the request before you call the core, and settle unknown outcomes by repeating the same reference.
- Never trust a member number from the request body. Take it from the authenticated token.
- Rate-limit logins and money requests, and lock out after repeated wrong PINs.
- Reconcile the M-Pesa statement to the ledger every day.
- Keep the audit log append-only.
SaccoFlow 365 is in preview and is introduced through a pilot with your data. To scope one, book a consultation.
Preguntas frecuentes
Does SaccoFlow 365 integrate with M-Pesa?
Yes. The gateway has paybill confirmations, STK push deposits and withdrawals to M-Pesa, with callbacks, worker jobs and reconciliation. They are switched on for a SACCO after testing with Safaricom, and they are being taken through Safaricom's sandbox.
Can members pay loans by paybill?
Yes. A paybill receipt is booked to a loan by keyword, or held as unallocated funds for a person to allocate.
How is a double posting prevented?
Money operations are idempotent on a caller reference, so a repeated call returns the first result.