Safaricom PLC

Kenya · www.safaricom.co.ke · 4 vendors

Safaricom PLC is a leading Kenyan mobile network operator and the largest telecommunications provider in East Africa. The company offers a comprehensive range of integrated telecommunication services, including mobile telephony, mobile money transfer (M-PESA), data, and fiber optic services. It also provides consumer electronics, e-commerce, and cloud computing solutions.

Resilience scores

Technology vendors

Services catalogue

5 services in catalogue across 2 categories; runs on 4 sub-vendors.

Insights

Last updated 2026-07-30 · revision 6

4 direct vendors, 126 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 6/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Safaricom PLC shows a medium-to-high level of migration readiness, scoring 60. The company has made significant strides in adopting modern, cloud-native technologies, including Kubernetes for container orchestration, Docker for containerisation, Apache Kafka for event streaming, and a microservices architecture. Its existing presence on Microsoft Azure and Google Cloud Platform indicates a strategic move towards hybrid cloud environments and a technical capability for further cloud adoption. With a reported revenue of KES 308.0B in 2024, Safaricom possesses the financial stability to fund complex and large-scale migration initiatives. However, several factors present significant challenges. The company relies on extensive legacy systems such as Oracle Database, IBM Middleware, SAP ERP, and Amdocs BSS/OSS, which are typically complex, highly customised, and deeply integrated, making their migration a substantial undertaking. Furthermore, Safaricom operates under stringent regulatory and data residency requirements, particularly from the Kenya Data Protection Act 2019, Communications Authority of Kenya, and Central Bank of Kenya. These regulations mandate local data storage and processing for personal and financial data, significantly constraining options for migrating to global public cloud platforms and necessitating complex hybrid or in-country cloud solutions. While the diverse vendor base reduces overall lock-in, managing migration across numerous critical vendors (Huawei, Ericsson, Nokia, Oracle, IBM, SAP, Amdocs, etc.) introduces considerable coordination challenges, contract complexities, and potential lock-in for specific legacy components. The 'Unknown' vendor lock-in risk for overall vendor relationships is a concern, especially for deeply embedded legacy systems.

Compliance

7 in-scope frameworks identified; showing 3.

SOC 2 (source) — Assessment Required

As a major telecommunications provider offering digital services including M-Pesa mobile money and cloud-based services, Safaricom likely handles sensitive customer data that would benefit from SOC2 compliance. Risk is medium because while not legally required, SOC2 is increasingly expected by enterprise customers and partners for service providers handling sensitive data.

GDPR (source) — Assessment Required

While Safaricom is primarily Kenya-based, the company may process personal data of EU/EEA residents through international services, roaming partnerships, or business relationships. The risk is medium because GDPR fines can be severe (up to 4% of global turnover), but enforcement against non-EU telecommunications companies with limited EU presence is less common. However, any processing of EU personal data would trigger GDPR obligations.

Evidence: https://www.safaricom.co.ke/personal/more/legal/privacy-policy

ISO 27001 (source) — Assessment Required

ISO 27001 is critical for telecommunications companies handling vast amounts of customer data and providing essential infrastructure services. Risk is medium because lack of ISO 27001 certification could impact customer trust, regulatory compliance, and business partnerships, though it's not always legally mandated.

Financials

Three-year financials

Financial Resilience Score: 6/10

Safaricom PLC is the dominant telecommunications and mobile money operator in Kenya, holding a commanding market position through its M-Pesa platform and mobile network services. The company benefits from strong brand recognition, a large and loyal subscriber base, and a diversified revenue stream spanning voice, data, and fintech services. These structural advantages provide a degree of resilience against competitive and macroeconomic pressures. However, the research process was unable to retrieve verified, up-to-date financial statements from official sources, limiting the ability to conduct a full quantitative assessment of profitability, leverage, liquidity, and equity trends. The absence of confirmed EBIT, net income, and balance sheet data introduces meaningful uncertainty into any resilience scoring. Safaricom operates in an emerging market environment subject to currency volatility (Kenyan Shilling depreciation risk), regulatory intervention, and political risk. Its recent expansion into Ethiopia represents both a growth opportunity and a significant capital and operational risk, as the Ethiopian market is at an early and loss-making stage. These factors temper the overall resilience score. On balance, Safaricom's market leadership, recurring revenue model, and M-Pesa ecosystem provide a solid foundation, but incomplete financial disclosure in this analysis and material expansion risks in Ethiopia prevent a higher confidence score.

Key strengths: Dominant market position in Kenya across mobile voice, data, and M-Pesa mobile money, Diversified revenue streams across telecom and fintech reducing single-segment dependency, Large and growing subscriber base providing recurring revenue visibility, M-Pesa ecosystem creates high switching costs and network effects, Listed on Nairobi Securities Exchange with institutional investor oversight

Risk factors: Ethiopian market expansion is capital-intensive and currently loss-making, Kenyan Shilling currency depreciation risk on USD/EUR-denominated costs, Regulatory and political risk in both Kenya and Ethiopia, Inability to verify full financial statements limits quantitative resilience assessment, Competitive pressure from emerging fintech players and potential new telecom entrants

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report