Pulling account data out of Equity Mobile in Kenya

Per its store listing, Equity Mobile carries an account holder's whole banking picture: balances across every account, a filterable mini-statement of the last 20 transactions, downloadable PDF statements and receipts, loan balances, and outbound payment rails that reach other banks, mobile money, M-PESA tills and PayPal card links. It speaks five languages — English, French, Kinyarwanda, Swahili and Chinese — because Equity Group banks customers from Nairobi to Kinshasa. For an integrator, that breadth is the point: one consented login exposes a dense, structured record most aggregators in the region cannot reach directly.

The bottom line: the data worth integrating is all behind the authenticated session, and there is no in-force open-banking mandate in Kenya yet to route around it. So the working path is a consented interface integration — we operate the app's own client traffic on a customer's behalf, with their authorization on record — and we keep it forward-compatible with the Central Bank of Kenya's emerging open-banking standard so the same integration can switch to a sanctioned consent channel when one lands.

What Equity Mobile holds for each customer

Every row below maps to a surface the app actually exposes once a customer is signed in. Granularity reflects what the screen shows, not an idealized schema.

Authorized ways into the data

Two routes carry real weight for this app, plus a fallback. We set up the access for whichever you choose — credentials, a consenting test account, or a sandbox arranged with you during onboarding.

Consented interface integration

We analyse the app's own client-to-server traffic and reproduce the authenticated session under a customer's explicit authorization. This reaches everything in the table above, including the document downloads, because it uses the same calls the app uses. It is the most complete route and the one we would build on. Effort is moderate; durability depends on the app's release cadence, which we account for with re-validation (see build considerations).

Open-banking consent (forward path)

The Central Bank of Kenya has set out API-driven data access and portability in its National Payments Strategy, including OAuth 2.0-style authentication and ISO 20022 messaging, but the framework is still being staged and is not yet a mandated scheme banks must expose. We design the integration so that when a sanctioned consent channel goes live, account-information access can move onto it with minimal rework.

Native export (fallback)

Where a customer only needs documents, the app's own statement and receipt downloads give clean, date-ranged PDFs. It is the narrowest route — no live sync, no transfer status — but it is the lightest to stand up and useful as a backstop. We would not lead with it for anything needing freshness.

A statement pull, sketched

This is illustrative — the real auth chain and field names are confirmed during the build, per market. It shows the shape: authenticate, hold a short-lived token, page the transaction history with locale pinned, then request the document.

POST /auth/session            # device-bound login, biometric/PIN step-up
  -> { access_token, expires_in: 600, refresh_token }

GET  /accounts                # all accounts visible to the consented user
  -> [{ account_id, masked_no, currency: "KES", balance }]

GET  /accounts/{id}/transactions?from=2026-05-01&to=2026-05-31
     Accept-Language: en-KE   # pin locale so labels stay stable
  -> { items: [{ ref, posted_at, amount, dr_cr, channel, narrative }],
       next_cursor }

POST /statements             # request the date-ranged PDF
     { account_id, from, to, format: "pdf" }
  -> { document_url, expires_in: 120 }

# token nears expiry -> refresh before the next page, never mid-document
if token.ttl < 60: token = refresh(refresh_token)

Two things the sketch encodes on purpose: the access token is short-lived, so the sync refreshes on a clock rather than on a 401; and an M-PESA-bound transfer returns a channel marker that we reconcile against the downstream rail before calling it settled.

What lands in your repo

Each deliverable is tied to the surfaces above, not a generic kit.

• OpenAPI specification covering accounts, transactions, statement requests and transfer status as they behave for Equity Mobile.
• Auth-flow and protocol report — the session login, token lifetime, refresh and step-up behaviour, written up as observed during the build.
• Runnable source in Python or Node.js for the core endpoints: list accounts, page transactions, pull a statement, read loan balances.
• Automated tests against a consenting account or sandbox, including the token-refresh and two-leg M-PESA confirmation paths.
• Interface documentation mapping each field back to where it appears in the app, with locale handling noted.
• Data-retention and consent guidance aligned with the Kenya Data Protection Act, including what to log and what not to store.

Consent and the Kenyan rulebook

Kenya does not yet have a live, mandated open-banking scheme. The Central Bank of Kenya laid out the direction — standardised APIs, customer data access and portability — in its National Payments Strategy 2022–2025, and work continues, but a bank is not today obliged to expose a consent API. That makes the dependable legal basis the customer's own documented authorization, handled under the Kenya Data Protection Act 2019 and overseen by the Office of the Data Protection Commissioner.

In practice we record consent scope at the field level, set an expiry, and honour revocation by stopping access and purging cached records on request. Access is data-minimised — we pull only the domains a project needs — and every session is logged. Because Equity Group operates across several jurisdictions, a multi-market build also respects each country's own data law, not just Kenya's. NDAs are in place where a client needs them.

Things we plan around on this build

Concrete points specific to Equity Mobile that shape how we engineer the integration.

• One brand, several backends. Equity Group runs separate country subsidiaries, and the DRC sits on a distinct Equity BCDC app with its own package. We scope per market because endpoints, currencies and KYC differ by subsidiary rather than assuming a single shared API.
• The mobile-money hop. Transfers to M-PESA tills and paybills cross from Equity's ledger onto Safaricom's rail. We design the status model around both confirmation points so a queued instruction is never reported as final too early.
• Locale-sensitive parsing. With five display languages and dark mode, transaction narratives render differently per user. We pin the request locale so parsed statement fields stay deterministic.
• Short token, step-up auth. Sign-in uses fingerprint or facial recognition with short-lived sessions. We build the sync around the refresh window and the step-up prompt so it does not silently drop mid-run, and we wire a re-check into maintenance for when a release shifts the front end.

Where teams take this

• A lender in Nairobi consents borrowers to share Equity statements for affordability checks, replacing emailed PDFs with a structured feed.
• An SME accounting tool syncs balances and categorised transactions nightly so a shopkeeper's books match the bank without manual entry.
• A payments dashboard tracks outbound transfer and M-PESA status end to end, surfacing the settled-versus-sent distinction the app itself blurs.
• A personal-finance app aggregates an Equity account alongside other Kenyan banks under one consented view.

Screens we mapped

Store screenshots we reviewed while tracing which data each view exposes. Tap to enlarge.

The wider Kenyan banking-app set

Same-category apps an aggregator would meet when building a unified Kenyan view. Listed for context, not ranked.

• KCB App — KCB's retail app; accounts, KCB M-PESA loans and bill payments, a frequent counterpart in any multi-bank sync.
• MCo-op Cash — Co-operative Bank's app for accounts, transfers and loans on a mobile platform.
• Equitel — Equity's SIM-overlay channel, with banking and mobile-money flows tied to the same group.
• M-PESA (Safaricom) — the dominant mobile-money wallet; statements and till/paybill activity many bank flows settle against.
• Airtel Money — the other large wallet, holding wallet balances and transfer history.
• Family Bank Pesa Pap — balance checks, transfers, bill pay and airtime for Family Bank customers.
• NCBA NOW — NCBA's app covering accounts, statements and transfers.
• Absa Mobile Banking Kenya — Absa's retail banking app with accounts and card controls.

What we checked

This mapping draws on the app's Google Play and App Store listings for its feature set and package id, Equity Group's own download page, and the Central Bank of Kenya's National Payments Strategy for the regulatory direction. Checked early June 2026; the app's release cadence means surfaces are re-confirmed at build time.

• Equity Mobile — Google Play listing
• Equity Mobile — Apple App Store (Kenya)
• Equity Group — Download Equity Mobile
• Central Bank of Kenya — National Payments Strategy 2022–2025 (PDF)

OpenBanking Studio · integration desk mapping, June 2026.

Questions Equity Mobile integrators ask

Which Equity market does an integration cover — Kenya only, or the wider group?

Equity Group runs separate country subsidiaries — Kenya, Uganda, Rwanda, Tanzania, South Sudan and the DRC, where a distinct Equity BCDC app exists. Each sits on its own backend with its own KYC. We scope the build to the markets you name and treat each as a separate target rather than assuming one shared endpoint.

Can the integration tell a sent M-PESA transfer apart from a settled one?

Yes. A pay-to-M-PESA instruction leaves the Equity ledger and lands on Safaricom's rail, so there are two confirmation points. We model both legs, so a record marked sent in the app is not reported as settled until the downstream confirmation comes back.

How is statement data kept stable when the app supports five languages?

The app ships English, French, Kinyarwanda, Swahili and Chinese, per its store listing, and transaction labels render in the active locale. We pin the locale on each request so parsed statement fields stay consistent regardless of the customer's display language.

What is the legal basis for pulling a customer's Equity data?

The customer's own authorization. Kenya's open-banking framework under the Central Bank of Kenya is still being staged through the National Payments Strategy and is not yet a mandated scheme, so the dependable basis today is documented, user-consented access aligned with the Kenya Data Protection Act 2019. Consent scope, expiry and revocation are recorded and honoured.

Most teams start with a single market and a couple of data domains, and we turn the integration around in one to two weeks. You bring the app name and what you want out of its data; we handle the access, the protocol work and the compliance posture with you. Delivery comes as runnable source plus documentation from $300, settled only after we hand it over and you are satisfied — or, if you would rather not run anything, as hosted endpoints you call and pay for per use, with nothing upfront. Tell us the market and the domains at /contact.html and we will scope it.