Held separately
Customer balances will be safeguarded in designated accounts, separate from company operating funds, and never used as working capital.
Security & regulation
Boring where it counts.
A payment service earns trust by being predictable, supervised and honest about limits. Here is how your money is held, how your account is protected, and what happens when something goes wrong.
Where we stand
Regulatory status
Reserve Bank of Zimbabwe
Payment Service Provider (PSP)
National Payment Systems Act [Chapter 24:23]
Reserve Bank of Zimbabwe
Electronic Money Issuer (EMI)
National Payment Systems Act [Chapter 24:23]
Reserve Bank of Zimbabwe
Microfinance licence
Microfinance Act [Chapter 24:29]
IPEC
Insurance agent registration
Insurance Act [Chapter 24:07]
Reserve Bank of Zimbabwe
Deposit-Taking Microfinance (DTMFI)
Microfinance Act [Chapter 24:29]
ThumaPay Zimbabwe (Pvt) Limited does not currently hold customer funds and does not offer regulated financial services. Each service described on this site will be made available only after the relevant authorisation has been granted. Licence references will be published here as they are issued.
Your money
How customer funds are held
Reconciled daily
The total of customer balances will be reconciled against safeguarded funds every business day, with breaks investigated before the next cycle.
Supervised
Once licensed, we will report to the Reserve Bank of Zimbabwe and be subject to its supervision and audit requirements.
Your account
What protects it
PIN and biometrics
Every payment requires authentication. A PIN change re-verifies your identity and temporarily limits high-value sends.
Device binding
Your wallet is tied to a known device. Moving to a new phone triggers a fresh verification step rather than a silent transfer of access.
Name confirmation
Before a transfer leaves, the app shows the recipient name registered against the destination, so a mistyped digit is caught before the money is gone.
Velocity checks
Unusual patterns — sudden high-value sends, rapid repeats, new destinations — trigger review rather than proceeding quietly.
Instant freeze
You can freeze the wallet from the app. Pending instructions stop and the balance is locked until you unfreeze it.
Session visibility
See where your account is signed in and end any session you do not recognise.
When something goes wrong
The escalation path
A published process matters more than a promise. This is the order things happen in, and roughly how long each stage takes.
01
Report it
Freeze the wallet in the app if the account is compromised, then contact support. We acknowledge within one business day and give you a reference.
02
We investigate
We review the transaction record, device and session data. Where funds are recoverable we attempt recovery immediately rather than waiting for the investigation to close.
03
We give you an outcome
You get a written decision explaining what happened and what we found — including when the answer is that we cannot recover the money, and why.
04
You can escalate
If you disagree, you can take the matter to the Reserve Bank of Zimbabwe. We will give you the file reference and the contact route rather than making you find it.
Responsible disclosure
Found a vulnerability?
Tell us before you tell anyone else and we will work with you. We do not pursue researchers who act in good faith, stay within scope, and give us reasonable time to fix an issue before disclosing it.
Read security.txtIn scope
thumapay.com, the ThumaPay API, and the mobile apps.
Out of scope
Denial of service, social engineering of staff or customers, physical attacks, and findings from automated scanners without a demonstrated impact.
Questions
Security, plainly
Customer funds are safeguarded rather than insured in the deposit-protection sense. Safeguarding means balances are held separately from company money and are not available to creditors of the business in the ordinary course.
Amounts, counterparties, timestamps, fees and the device used. Financial services law requires us to retain these records for a set period, which is longer than the life of your account.
No. Nobody at ThumaPay will ever ask for your PIN, your password, or a one-time code — not by phone, message or email. Anyone who does is committing fraud, and you should report it to us.
Freeze the wallet from any browser or by contacting support. Your balance is not stored on the device, and a new device cannot be bound to your account without re-verification.
No. We share data with regulators and law enforcement where legally required, and with providers who process it under contract on our instructions. It is not sold or used for third-party advertising.
Questions we have not answered?
Ask directly. Security questions get a real answer from someone who understands the system.