Where your money sits, and who is checking

Three places, three sets of rules, none of them a Pepea Technologies account. Every status below says who is reviewing it and since when.

How money is kept

RWF · savings and shares

With the SACCO, under SASRA rules

Pepea Sacco Society Ltd holds member deposits and share capital. Lent only under the by-laws, from Phase 1.

RWF · wallet float

Trust accounts at [sponsor bank]

Money in transit to and from M-Pesa sits in segregated trust accounts under the e-money application.

USD · live

BacBon custody, CBK VASP licence

Dollars are held by BacBon in segregated accounts under its licence. Pepea does not custody dollars. Conversion runs at one published spread; nothing in local currency depends on the dollar layer.

Licences and registrations

Licence rows for Rwanda are published here when counsel confirms the instruments, regulators, references and dates — [licence rows from counsel].

Deposit protection

Until a statutory Deposit Guarantee Fund covers SACCO members, Pepea holds private deposit cover with [provider] up to RWF [limit] per member. The policy document and its exclusions are published here. Share capital is not covered — it is ownership, not a deposit.

If something goes wrong

Fraud or an unauthorised transaction: ack 1 h · resolve 5 bd
Credit-decision review: 10 bd
Circle dispute: Circle vote → Pepea mediation
Monthly dispute statistics: /own › Governance

Fraud rules we publish

A 24-hour hold on the first withdrawal to a new destination above a threshold; device, velocity and SIM-swap checks on every login and transaction; Circle-level rules on sudden order changes and payouts to new numbers. Thresholds are withheld (see the redactions list on /own).

Your data

DPIA summary: what we collect (phone, ID for KYC, device, transactions), why, for how long (seven years for ledger records), who processes it (Smile ID, Africa’s Talking, Meta, [sponsor bank]). Every automated decision stores its model version and a plain-language reason.

Security disclosure: [security@pepea.xyz], response within 3 business days.