The half of M-Pesa most businesses ignore
Almost everyone integrates collection - taking money in. Far fewer automate the other direction. Yet paying money out is where the manual effort and the errors pile up: an accountant sending salaries one phone number at a time, refunds handled by WhatsApp, commissions calculated in a spreadsheet and paid by hand.
The B2C (Business to Customer) API automates all of it. Your system sends money directly to a phone number - a salary, a refund, a supplier payment, a commission - as a normal part of a workflow, no manual sending required.
How B2C is different from collection
Collection APIs (STK Push, C2B) bring money in and are relatively forgiving - a failed collection just means no sale. B2C sends money out, and a mistake means money gone.
That difference drives everything. B2C needs stronger credentials: an initiator user and a security credential built by encrypting the initiator password with Safaricom's certificate. It draws from a separate float. And it demands controls that collection never needs, because the failure mode is not 'we lost a sale' but 'we paid the wrong person the wrong amount, automatically, at scale.'
What you can automate with it
Once B2C is wired into your systems, a lot of manual money movement disappears.
- Payroll and casual wages, paid straight from your HR or payroll system on payday.
- Supplier and contractor settlements, triggered when an invoice is approved.
- Sales commissions and agent payouts, calculated and disbursed automatically.
- Customer refunds and cancellations, without an accountant sending each one by hand.
- Loan disbursements, savings withdrawals and insurance payouts for financial services.
- Promotions, rebates and winnings, paid instantly instead of by manual list.
The controls that make payout automation safe
Automating outbound payments without controls is how businesses get drained - by a compromised credential, a bug in a loop, or a malicious insider. The controls are not optional.
Set per-transaction and daily ceilings so no single payout or day can exceed a sane amount. Require maker-checker approval for batches, so one person prepares a run and another releases it. Keep the initiator credential in a secrets manager, never in code or a shared file. Whitelist the server IPs Safaricom will accept requests from. And alert a human on every payout, or at least every batch, so anomalies are seen within minutes rather than at month-end.
Handling results, failures and retries
B2C is asynchronous, and the outcome you care about arrives on a callback after the request, not in the immediate response. A payout can fail because the number is unregistered, the recipient's account has limits, the float is empty, or the network hiccuped.
Your system must hold each payout as pending, apply the result callback to mark it paid or failed, and store the M-Pesa receipt on success as proof. Retries are where double-payments happen: build them to retry only genuine failures, keyed so the same payout can never be sent twice. This idempotency discipline is the difference between a reliable payout system and one that occasionally pays a supplier twice.
Float, limits and reconciliation
Two operational realities trip up new B2C users. First, float: payouts draw from a separate balance you must keep topped up, or payday fails while your collection account is full. Automate a low-float alert at minimum. Second, limits: B2C has rate and value ceilings, so bulk runs must be throttled and large single payouts checked against caps.
Then reconcile. Every payout should tie back to its source - the payslip, the invoice, the refund request - and be confirmed landed. A B2C system that pays money out but does not reconcile is just a faster way to lose track of your cash.
How Upeosoft builds B2C payout systems
We build payout automation with the controls first, not bolted on later: approval workflows, per-transaction and daily limits, secure credential handling, IP whitelisting, and alerting on every disbursement. We wire result callbacks so nothing is ever assumed paid, add idempotent retries so failures never double-pay, and reconcile each payout back to your payroll, ERP or refund records.
Whether you want to automate payday, supplier settlements or refunds, talk to Upeosoft and we will build a payout system you can trust to move money without you watching it.
