Ugandan fintechs should send one-time codes and payment receipts as transactional SMS on registered sender IDs on both MTN and Airtel, identify the licensed company in every message and keep customer data confidential, as the National Payment Systems Act, 2020 requires. App lenders supervised by UMRA have extra rules: a receipt for every transaction, no messages to borrowers' contacts and no threats in collection messages.
Last reviewed: 27 October 2026
This guide is for product, risk and engineering teams at wallets, payment apps, merchant aggregators and digital lenders in Uganda. It covers the rules that touch OTP and receipt SMS, a template set, design choices that improve OTP delivery on MTN and Airtel, and an integration example.
Who regulates what
- Bank of Uganda (BoU) licenses and supervises payment service providers and payment system operators under the National Payment Systems Act, 2020. MTN Mobile Money and Airtel Money were licensed under the Act in 2021, as reported by the Daily Monitor.
- Uganda Microfinance Regulatory Authority (UMRA) supervises Tier 4 microfinance institutions and money lenders, including app-based lenders, and issued Digital Lending Guidelines in 2024.
- Uganda Communications Commission (UCC) regulates SMS itself through the Uganda Communications (Text and Multimedia Messaging) Regulations, 2019.
- Personal Data Protection Office (PDPO) administers the Data Protection and Privacy Act, 2019.
What the National Payment Systems Act means for SMS
Two sections of the Act bear directly on customer messages:
- Section 64 (protection of customer information): a licensee must protect the privacy of customer information and not disclose it except in compliance with the law, a court order or the customer's express consent. For SMS, that means messages go only to the account holder's registered number and contain no more than the customer needs.
- Section 65 (consumer protection): payment service providers must comply with consumer protection requirements prescribed by the BoU, guided by principles including transparency, full disclosure of information about services, confidentiality and dispute resolution. A payment service provider must not mislead a consumer in any advertisement.
In practice, a receipt that shows the amount, counterparty, fee, reference and new balance meets the transparency and disclosure principles, and gives the customer what they need to raise a dispute. Check the BoU's consumer protection regulations for the detailed requirements that apply to your licence.
Extra rules for UMRA-supervised digital lenders
UMRA's Digital Lending Guidelines, 2024 contain several provisions that shape lender SMS:
- Guideline 9(3): a digital credit provider must not use software that accesses a customer's contact list, frequently dialled contacts or phone messages for e-KYC or delinquency management.
- Guideline 15.1: in debt collection, no threats, no obscene or profane language, no unauthorised or unsolicited calls, social media or messages to a customer's contacts who were not party to the loan, and no conduct that harasses or abuses. If a recovery agent is assigned, their particulars must be sent to the borrower by email or SMS before the agent makes contact.
- Guideline 16.1: issue an e-receipt or instant message to acknowledge every transaction.
- Guideline 18.2: the trade name must always reflect the licensed company name, which matters when you choose a sender ID.
- Guideline 19: disclose that you are regulated, and your licensed identity, in correspondence and promotional material.
- Guideline 20(3): ask for only one or two contact numbers as guarantors, with confirmation from those contacts processed electronically with evidence.
What the UCC rules and the data protection law add
The UCC regulations require every message to carry a recognised identifier that lets the recipient identify the originator, plus clear contact information and, for organisations, the organisation's name (regulation 10). Their consent, opt-out and time-of-day rules target commercial communications, so OTPs and receipts are not restricted to daytime hours, while promotions are: no commercial messages between 19:00 and 06:00 unless the recipient agreed (regulation 19), and an opt-out based on STOP honoured within 24 hours (regulation 12).
Under the Data Protection and Privacy Act, 2019, financial information is special personal data (section 9), personal data may not be sold (section 37), and customers can require you to stop using their data for direct marketing (section 26). Do not reuse transaction data to target offers without a clear legal basis and the customer's consent.
Template set
Kasuku Pay and Kasuku Credit are fictional. Amounts are in Uganda shillings without decimals, as customers see them in MoMo and Airtel Money.
| Purpose | Message |
|---|---|
| Login OTP | Kasuku Pay: Your login code is 482913. It expires in 5 minutes. Kasuku Pay will never call you to ask for this code. |
| Transaction approval | Kasuku Pay: Code 730214 to approve UGX 450,000 to Nakato J. Do not share this code. If this was not you call 0800000000 |
| Payment received | Kasuku Pay: You received UGX 120,000 from Okello P (MTN MoMo) on 03/12 14:05. Ref KP7781203. New balance UGX 365,500. |
| Payment sent | Kasuku Pay: UGX 85,000 paid to Kyengera Hardware on 03/12 16:40. Fee UGX 1,000. Ref KP7781299. Queries 0800000000 |
| Failed payment | Kasuku Pay: Your payment of UGX 85,000 to Kyengera Hardware failed and was not charged. Ref KP7781300. Please try again. |
| Loan due (Tier 4 lender) | Kasuku Credit: Hi Apio, UGX 230,000 is due on 15/12. Pay by MTN MoMo or Airtel Money, ref 0772xxxxxx. Licensed by UMRA. Queries 0800000000 |
| New device alert | Kasuku Pay: Your account was accessed from a new phone on 03/12 at 21:12. Not you? Call 0800000000 now to block it. |
Notice the security wording in the OTP and approval messages. Telling customers in the code message itself that you will never ask for it costs nothing and helps against callers who pose as support staff to obtain codes.
Getting OTPs delivered on MTN and Airtel
- Register the sender ID on both networks. Registration is per network, so a fintech whose ID is approved on MTN only may see Airtel users receive codes from a generic sender or not at all. Our guide to MTN and Airtel sender ID costs explains the trade-offs.
- Keep codes short and the message GSM-7. Six digits, no emoji, under 160 characters.
- Set a sensible expiry and resend rule. Five minutes, with a resend button that becomes available after 30 to 60 seconds, avoids a flood of codes when the network is slow.
- Validate numbers before sending. Normalise to +256 format and reject numbers that are not mobile prefixes.
- Watch delivery reports by network. If one network's delivery rate drops, you see it in minutes rather than in support tickets.
Integration
eSMS Verify handles the OTP lifecycle: it generates the code, sends it, rate-limits attempts and checks the answer, so you do not store codes yourself. Receipts go out through the send endpoint from your mobile money collection callback:
# Start an OTP: eSMS generates, sends and rate-limits the code
curl -X POST https://sms.esmsafrica.io/v1/verify/start \
-H "Authorization: Bearer esms_live_your_key" \
-H "Content-Type: application/json" \
-d '{"to": "+256772000001", "app_id": "vera_kasuku"}'
# Check what the user typed
curl -X POST https://sms.esmsafrica.io/v1/verify/check \
-H "Authorization: Bearer esms_live_your_key" \
-H "Content-Type: application/json" \
-d '{"verification_id": "ver_123", "code": "482913"}'
# Send a receipt from your mobile money callback
curl -X POST https://sms.esmsafrica.io/api/messages/send \
-H "Authorization: Bearer esms_live_your_key" \
-H "Content-Type: application/json" \
-d '{"to": "+256772000001", "sender_id": "KASUKUPAY", "text": "Kasuku Pay: You received UGX 120,000 from Okello P (MTN MoMo) on 03/12 14:05. Ref KP7781203."}'
Use an esms_test_... key while building; test sends are simulated and free. Delivery reports come back by webhook and in the dashboard. See the HTTP API docs, the OTP for Uganda page and the OTP guide.
What it costs
SMS to MTN and Airtel Uganda starts from UGX 35 (about $0.0083) per message on the basic tier. High-volume OTP and receipt traffic usually qualifies for business (UGX 30) or enterprise (UGX 25) rates. There is no monthly minimum and no setup fee for the SMS API, and you can top up by MTN MoMo, Airtel Money or card. Sender ID fees are listed on the Uganda sender ID page.
Checklist
- Use a sender ID that reflects your licensed company name, registered on MTN and Airtel.
- Name the company in every message and include a support contact.
- Send codes and receipts only to the account holder's registered number.
- Show amount, counterparty, fee, reference and balance in receipts.
- Warn customers in OTP messages never to share the code.
- Keep promotions on a separate sender ID, with consent, a STOP opt-out and daytime sending.
- Lenders: no contact-list access, no messages to contacts, no threats, and a receipt for every repayment.
- Store delivery reports as evidence for disputes.
Frequently asked questions
Do OTPs and receipts count as spam under the UCC rules?
No. The consent, opt-out and 19:00 to 06:00 rules in regulations 11, 19 and 20 are aimed at commercial communications. A code the customer requested and a receipt for their own transaction are service messages. They must still identify the sender and organisation under regulation 10.
Can we send OTPs at night?
Yes. Customers log in and pay at all hours, and the 19:00 to 06:00 restriction in regulation 19 applies to commercial communications. Keep marketing to daytime hours and never attach an offer to an OTP or a receipt.
Do we need separate sender IDs on MTN and Airtel?
Yes. Sender IDs are registered with each network separately, and the costs differ by network. Our guide to MTN and Airtel sender ID costs in Uganda explains when a registered ID pays for itself.
Can a digital lender in Uganda message a borrower's contacts?
Not for collection. UMRA's 2024 Digital Lending Guidelines bar apps that access contact lists for delinquency management and prohibit unsolicited calls or messages to a customer's contacts who were not party to the loan.
Sources
- Parliament of Uganda - National Payment Systems Act, 2020 (PDF)
- UMRA - Digital Lending Guidelines for Tier 4 Microfinance Institutions and Money Lenders, 2024 (PDF)
- UCC - Text and Multimedia Messaging Regulations, 2019 (PDF)
- ULII - Data Protection and Privacy Act, 2019
- Daily Monitor - Bank of Uganda issues licences to Airtel and MTN (2021)
- eSMS Africa - Verify (managed OTP) documentation
See wallet, payment and lender message flows on our mobile money and fintech SMS page for Uganda, read the UCC 2019 rules in plain English and SACCO SMS in Uganda, and check pricing. Then create a free eSMS Africa account and send your first test OTP.
