Suppliers must comply with the following provisions:

Suppliers will be required to comply with applicable antitrust or competition laws and will not engage in any restrictive trade practices. Suppliers will at all-times act in a manner that will uphold and encourage healthy competition.

The applicable anti-trust legislation regarding Kenya operations is the Restrictive Trade Practices, Monopolies and Price Control Act (Cap 504 Laws of Kenya).

2.2.1 Anti-Bribery and Anti-Corruption commitments

Suppliers shall not make or offer bribes or payments of money or anything of value to any Safaricom employee or any other person including officials, employees, or representatives of any government or public or international organization, or to any other third party for the purpose of obtaining or retaining business with Safaricom.

For the avoidance of doubt, Safaricom considers an act of bribery to include the giving of money, anything of value or advantage to anyone where It is known or believed that it will be passed on to a government official or Safaricom employee or any other person to improperly obtain or retain business or to influence the performance of a function.

Suppliers must comply with all applicable local anti-bribery legislation. Suppliers are expected to put in place organizational procedures appropriate to their size and scale and to the nature of their operation to ensure the prevention of bribery and corruption. Every person holding a position of authority in a Supplier company shall report to the Ethics and Anti -Corruption Commission within a period of twenty-four (24) hours any knowledge or suspicion of instances of bribery. Failure to report within the prescribed timeframe constitutes an offence under Kenyan law.

Safaricom maintains zero tolerance for bribery and corruption. Any breach of this clause may result in immediate contract termination, disqualification from future engagement, and reporting to relevant enforcement authorities

2.2.2 Gifts and other business courtesies

It is Safaricom’s policy that all staff should not accept gifts or favors from a customer, potential customer, supplier or potential supplier of goods or services to the company irrespective of the value of the gift. Suppliers shall ensure that any expenditure incurred in relation to any Safaricom employee or government official is in the ordinary and proper course of business and cannot reasonably be construed as a bribe or so as to secure unfair preferential treatment.

i. Gift

A valuable item offered without obligation to selected recipients by a firm's representative, as an expression of appreciation or goodwill. They do not include merchandising items.

ii. Valuable item

Includes but not limited to items such as cash, gift cards/vouchers, cash equivalents, tangible items (electronics, jewelry, etc.), experiential items (hospitality, spa or wellness package, tickets to events, travel or getaways, any forms of entertainment)

iii.Hospitality

Hospitality includes entertainment, meals, travel, accommodation, or events provided to initiate, develop, or maintain business relationships. It typically requires the host's presence (e.g., a business dinner).
Any queries on this can be made by sending an email to the Ethics Helpdesk ([email protected]). Reports on any irregularities noted can be made directly to the Ethics Helpdesk or anonymously via the Ethics hotline shown in section 3.0

2.2.3 Conflicts of Interest

No supplier shall enter into a financial or any other relationship with a Safaricom employee that creates a conflict of interest for Safaricom. A conflict of interest arises when the material personal interests of the Safaricom employees are inconsistent with the responsibilities of their position with the company. All such conflicts must be disclosed and approval to the transaction given. Conflicts of interest must be disclosed by completing the Conflict-of-Interest Questionnaire and by reporting any arising or existing conflicts via email to [email protected]

The Supplier will comply with all local laws relating to labour, employee health and safety and wages.

2.3.1 Child Labour Safaricom suppliers and their subcontractors will not hire children, a child being any person below the age of 16 years unless in the case of Kenya operations under apprenticeship and, in a technical institution, unless authorized under the Industrial Training Act (Cap 237 Laws of Kenya) and supervised by a public authority.

2.3.2 Forced Labour and Disciplinary Practices Suppliers will:
•;Not use forced labour nor require any worker whether local or foreign to remain in employment for any period of time against his or her will.
•;Treat workers with respect and dignity and ensure workers are not subjected to any form of physical, sexual, psychological, or other form of harassment or abuse.
•;Ensure that workers are free to express their views about their workplace conditions without fear of retribution or losing their jobs.

2.3.3 Freedom of Association Suppliers will allow and respect their employees’ right to form or join trade unions of their own choice and to bargain collectively.

2.3.4 Wages and benefits Suppliers will meet minimum wage requirements and will ensure that all statutory deductions as required under any local laws from time to time are complied with. Suppliers will ensure that working hours as provided for in any employment legislations or regulations in force from time to time to time or in any collective bargaining agreement entered with the employee’s trade union are observed. Suppliers will furthermore ensure that workers are provided with at least one day off during any seven-day working period.

 

2.3.5 Health and Safety Suppliers, including all approved subcontractors, shall establish, implement, and maintain a comprehensive Occupational Safety and Health (OSH) management system compliant with ISO 45001 or its equivalent for all activities undertaken on behalf of Safaricom, aligned to Safaricom’s Zero Harm commitment. The Supplier shall ensure that risks to workers, visitors, customers, communities, and any other affected parties are proactively identified, assessed, eliminated or controlled so far as is reasonably practicable, with the objective of preventing injuries, occupational illnesses, environmental harm, and asset loss.


The Supplier shall conduct documented hazard identification and risk assessments covering all operational activities, equipment, worksites, transportation, interfaces, and subcontracted services. Appropriate control measures shall be implemented in accordance with the hierarchy of controls, prioritizing elimination, substitution, and engineering controls over administrative controls and personal protective equipment. Risk assessments shall be regularly reviewed and updated to reflect changes in scope, environment, or operational conditions.

The Supplier shall comply with all applicable national Occupational Safety and Health legislation (OSH Act 2007) and regulatory requirements in the jurisdictions where services are performed. Where local statutory requirements are less stringent than recognized international best practice, the higher standard shall apply, including alignment with management system principles consistent with ISO 45001 as published by the International Organization for Standardization. The Supplier shall ensure that equivalent standards are effectively cascaded and enforced across its entire supply chain, including subcontractors and third parties.


The Supplier shall ensure the provision of competent supervision, appropriate training, adequate welfare facilities, suitable personal protective equipment, and effective emergency preparedness and response arrangements. All incidents, near misses, unsafe conditions, and statutory reportable events shall be promptly reported in accordance with Safaricom requirements and applicable law. The Supplier shall cooperate fully with audits, inspections, and performance reviews, implement corrective and preventive actions within agreed timelines, and demonstrate measurable and sustained continuous improvement in safety performance as a condition.

At Safaricom PLC, environmental responsibility is an issue that continues to grow in importance as the size of our network continues to expand. We remain committed to operating in an environmentally sound and sustainable way, managing, and reporting our environmental performance openly and transparently and we have established structures and functions responsible for driving environmental management. Integrating the United Nations Sustainable Development Goals (UN SDGs) and proactively implementing various green initiatives across the business, further affirms Safaricom’s commitment to address climate change and the preservation of natural resources. To support our commitment to responsible sourcing, environmental stewardship, and sustainable business practices, all suppliers are required to meet the following environmental requirements:


2.4.1 Compliance with Environmental Laws and Standards
Suppliers must Comply with all applicable national and local environmental laws, regulations, and permits governing their operations, meet international environmental standards, including those related to waste management, pollution control, and sustainable resource use and maintain all required environmental certifications where applicable (e.g., ISO 14001).


2.4.2 Pollution Prevention and Emissions Control
Suppliers are required to identify and manage sources of air, water, and soil pollution, implement measures to reduce greenhouse gas emissions and other harmful pollutants, treat wastewater and manage effluents according to regulatory requirements and avoid the release of hazardous substances and maintain emergency response plans.


2.4.3 Waste Management Suppliers should minimize waste generation through reduction, reuse, and recycling practices, manage and dispose of hazardous and non-hazardous waste responsibly and keep documentation of waste handling and disposal in compliance with legal requirements.


2.4.4 Sustainable Resource Use Suppliers should use energy, water, and raw materials efficiently, implement conservation practices that reduce environmental impact and prioritize renewable energy and materials where feasible.


2.4.5 Biodiversity and Land Use Protection Suppliers must prevent activities that degrade ecosystems, forests, or protected natural habitats, conduct environmental impact assessments for major projects and implement measures to restore sites affected by their operations


2.4.6 Climate Change and Carbon Reduction
Suppliers are encouraged to measure, report, and reduce their carbon footprint, adopt low‑carbon technologies and practices and support our organization’s broader climate goals through innovation and collaboration.


2.4.7 Environmental Reporting and Transparency
Suppliers must provide environmental data or documentation upon request, report environmental incidents immediately and propose corrective measures and disclose any legal sanctions or violations related to environmental matters.

2.5.1 Licenses and Returns The Supplier will be required to obtain and renew, in accordance with any law or regulations all permits, licenses and authorizations required for it to carry out its business. In addition, the Supplier will be required to prepare and file any returns that it may be required to file under its incorporation statute, the Companies Act (Cap 486 Laws of Kenya) or applicable local or Kenyan revenue legislation.


2.5.2 Taxation, Financial Integrity, and Retention of Records
2.5.2.1 The Supplier will comply with all revenue laws and will not evade tax.


2.5.2.2 Suppliers will be required to maintain accurate and reliable financial and business records and shall not have any false or inaccurate accounting books or records related to Safaricom for any reason. Suppliers shall maintain all business records at the minimum in compliance with the provisions outlined by the Kenya Revenue Authority or local revenue authorities from time to time.


2.5.2.3 When any government investigation or audit is pending or ongoing then Suppliers will not destroy any relevant records until the matter has been investigated and closed.

Safaricom is committed to delivering sustained, consistent, and exceptional services to its customers and meeting the expectations of all stakeholders even in the event of any disruptions. In view of this, Safaricom has implemented a Business Continuity Management System (BCMS) according to the requirements of ISO 22301:2019. Safaricom recognizes the fact that our suppliers play critical roles in the success of our business continuity program.
Safaricom therefore requires its suppliers to develop and establish a robust framework for documenting, maintaining, and testing business continuity and disaster recovery procedures. Specifically, the Supplier shall:

 

• Have its own business continuity management system, based on an accepted standard (e.g., ISO 22301).
  
• Establish and maintain business continuity strategies and plans which ensure that the Supplier can continue to deliver its services to Safaricom in the event of any major incident or crisis, and which are compliant with the agreed business continuity requirements and objectives of Safaricom.
  
• Provide Safaricom with a copy of Supplier's top level business continuity policy.
  
• Review business continuity strategies and plans in the event Safaricom identifies a weakness or noncompliance and implements the agreed improvements within a reasonable timeframe.
  
• Directly support Safaricom’s incident management and Crisis Management Team upon request by Safaricom.
  
• Promptly and accurately complete and return any Safaricom business continuity questionnaires and reviews whenever requested by Safaricom.
  
• Participate in Safaricom's managed business continuity exercises or audits as requested by Safaricom.
  
• Notify Safaricom in case of any incident that could disrupt provision of goods or services to Safaricom.
  
   If the Supplier breaches the obligations in this policy or Safaricom identifies a weakness in the Supplier's business continuity management system, Safaricom has the right to audit the Supplier.

Despite the value delivered by suppliers in delivering crucial skills, services, products and resources, assets that are accessible by suppliers need to be protected.

 

In this regard, Safaricom has implemented an information security management system that mandates Safaricom to comply with ISO 27001:2022 information security requirements. This entails maintaining an agreed level of information security and service delivery in line with supplier agreements.

 

Information security incidents such as inappropriate access to or disclosure of sensitive information, Loss of intellectual property or inability of the supplier to maintain the agreed level of information security and service delivery in line with the supplier agreement would potentially diminish the benefits obtained and negatively impact on the Information security position of the company.

In this regard, all Safaricom suppliers shall:

 

• Promptly and accurately complete and return any Safaricom Information Security Questionnaire whenever requested by Safaricom.
  
• Safeguard the security of all Safaricom Confidential Information using appropriate security systems and processes reasonably acceptable to Safaricom.
  
• ICT product suppliers shall propagate appropriate security practices throughout the supply chain if these products include components purchased or acquired from other suppliers (e.g. subcontracted software developers and hardware component providers)
  
• Implement specific processes for managing ICT component lifecycle and availability and associated security risks. This includes managing the risks of components no longer being available due to suppliers no longer being in business or suppliers no longer providing these components due to technological advancements. Identification of an alternative supplier and the process to transfer software and competence to the alternative supplier should be in place.
  
• Perform regular and full testing procedures on such security systems and processes.
  
• Permit Safaricom, upon reasonable notice to Supplier, to conduct security audits against such security systems and processes (including the right to test the security of any hardware and software used by the supplier in the performance of its obligations under the contract).
  
• Not reduce the security levels associated with such security systems and processes as defined within the Information Security Questionnaire without Safaricom's prior written consent.
  
• Advise Safaricom of changes to the security implementation via an update to the Information Security Questionnaire on an annual basis; and
  
• Notify Safaricom’s ‘Security Operations Centre’ by email at [email protected] immediately after becoming aware of an incident where any Safaricom Confidential Information is at risk of unauthorized or unlawful disclosure, loss, or damage.
  
• Provide external independent assessment report upon request e.g., SOC reports, independent audit reports, Security ISO certificates where applicable.

To increase business efficiency and customer satisfaction, Safaricom has embedded a Quality Management System (QMS) aligned with ISO 9001:2015. In this regard, Safaricom requires all Suppliers to:

 

• Explicitly review and understand all requirements provided by Safaricom in relation to the product or service being offered.
  
• Ensure resources are available to participate in product quality planning, as requested, and establish a change control system that reacts to changes in a timely and accurate fashion.
  
• In all cases, acquire written approval from Safaricom prior to implementing any change that may impact form, fit, function, quality, reliability, safety, delivery, service or its compliance with regulatory and statutory requirements. This shall include, but not limited to, manufacturing processes, quality standards for acceptance, and testing requirements.
  
• Have a documented process for managing quality including continual quality system development.
  
• Measure own performance against all given Key Performance Indicators (KPI´s) from Safaricom.
  
• Maintain process, product, and service capabilities to fulfil Safaricom requirements and controls throughout the Supplier’s entire supply chain for the respective Products.
  
• Possess expertise and resources to perform effective root cause analysis, and to take corrective and preventive actions.
  
• Notify Safaricom of any potential or actual non-conformance in Products supplied to Safaricom that may affect its form, fitness, function, quality, reliability, safety, delivery, service, or its compliance with regulatory and statutory requirements.
  
• Be responsible and accountable for the impact of poor Supplier Product quality on Safaricom, and Safaricom customers.
  
• Comply with all its obligations towards Safaricom, including, but not limited to:
  
  1. Recognized and certified Quality Management System (QMS)
  2. Safaricom’ s Customer Specific Requirements (CSR)
  3. Warranties
  

Any exception or deviation to the requirements, terms, and conditions of this Supplier Quality policy, including, but not limited to exceptions or deviations to Safaricom expectations, requires Safaricom prior written approval.

Safaricom requires all its suppliers to sign up to the Code of Ethics for Business in Kenya at contract award.

•  Code_of_Ethics_for_Business.pdf.
•  Code of Ethics for Business Commitment Letter

If a supplier becomes aware of unethical acts either by Safaricom, its staff or other suppliers they should report all pertinent details via one of the following channels;

• Toll free number; 0800 720 009
• Email; [email protected]
• Website: https://www.safaricomethicsline.com
  

The channel allows for anonymous reporting. Safaricom will investigate the matter in confidence.

Suppliers shall ensure that all reporting channels are clearly communicated and regularly promoted within their organization. These channels must also be made easily accessible to any contractors or sub‑contractors engaged in delivering services on the Supplier’s behalf for Safaricom

Suppliers must comply with the Data Protection Act of Kenya, 2019 and the attendant Regulations. This section applies to all Suppliers who process personal information (information that can identify a person either directly or indirectly such as name, identification number, date of birth, gender, transaction data, location data, call data records, MPESA transactions, an online identifier or to one or more factors specific to the physical, psychological, genetic, mental, economic, cultural or social identity of that Personal.)

In respect of Personal Information supplied by Safaricom to you as a Supplier, you are required as a data processor to comply with the provisions of the Data Protection Act.

 

As the data controller we are obligated to set out the following requirements. You will be required to:

a. Retain the Personal Information for as long as is reasonably required to achieve your obligation under this agreement and in accordance with applicable laws and regulations;

b. Take all appropriate technical and organisational measures against unauthorised or unlawful processing of Personal Information and against accidental loss or destruction of, or damage to, Personal Information;

c. Not publish, transfer, distribute, sell, sub-license, disclose or otherwise part with the Personal Information, or permit any third party, including its Affiliates, to use or exploit the Personal Information without the express written consent of Safaricom;

d. Not create copies or duplicates of the data without the knowledge of Safaricom;

e. Not transfer any Personal Information outside Kenya without Safaricom’s prior written consent or where provided for in the contract with us;

f. Immediately inform Safaricom of any inspections and measures conducted by any supervisory authority, insofar as they relate to Personal Information shared by Safaricom. In such a case, please contact the Data Protection Office through [email protected];

g. Respond to queries, complaints and other correspondence with any Regulatory Body in relation to the processing of Personal Information only after consultation with, and in accordance with the instructions of, Safaricom;

h. Without undue delay, assist Safaricom, where requested, in investigating queries or complaints about the Personal Information and the processing of the Personal Information or where Safaricom needs your cooperation in complying with any of the obligations under the Data Protection Regulations such as impact assessments;

i. Permit Safaricom access on reasonable notice to its premises, Systems, books and records and all information in relation to the processing of Personal Information as Safaricom may reasonably require to ensure compliance with data protection regulation and with the requirements outlined herein;

j. Within twenty-four (24) hours, notify Safaricom of any breach of this clause on Data Protection and provide Safaricom with such details regarding: the nature of the Personal Data Breach, any investigations into such Personal Data Breach and any measures taken, or that the Partner recommends, to address the Personal Data Breach.

All suppliers, their employees, agents, and sub-contractors must comply with Safaricom PLC internal policies and procedures which makes reference to local and international Anti-Money Laundering (AML), Combating Financing of Terrorism (CFT) and Combating Proliferation Financing (CPF) Regulations. This involves complying with the AML/CFT (Amendment) Act 2023, the Proceeds of Crime and Anti-Money Laundering Act and its Regulations, Prevention of Terrorism (Implementation of the United Nations Security Council Resolutions on the Prevention and Suppression of Terrorism) Regulations 2023, The Prevention of Terrorism (Implementation of the United Nations Security Council Resolutions on Prevention and Suppression and Disruption of Proliferation Financing) Regulations, 2023 and any other relevant laws and regulations applicable in the different jurisdictions of incorporation.

 

Suppliers shall, in the context of the Agreement:

a) Comply with all Anti-Money Laundering, Combating the Financing of Terrorism and Countering Proliferation Financing laws and regulations enacted or enforced by Regulatory Authorities and other Supervisory bodies and any other AML/ CFT/ CPF regulations applicable in other jurisdictions, where the Suppliers are incorporated or have operations;

b) Not knowingly do anything which may cause a breach in Anti-Money Laundering, Combating the Financing of Terrorism and Countering Proliferation Financing laws;

c) Cease from entering into arrangements or transactions, directly or indirectly, (i) in violation of any Kenyan, international, or other Anti-Money Laundering and Combating the Financing of Terrorism and Countering Proliferation Financing law or (ii) with persons or entities whose names appear on international sanctions lists of designated entities, Kenyan sanctions list or any other state list, restricting or prohibiting transactions with such persons or entities;

d) Not finance terrorists or those engaged in illicit activities including money launderers, international narcotics traffickers, and those engaged in activities related to the proliferation of weapons of mass destruction.

e) Train its employees, agents and sub-contractors in all applicable laws against inadequate internal controls, money-laundering, financing of terrorism and proliferation financing;

f) Provide such assistance, documentation and information to Safaricom as it may reasonably request, including but not limited to, written policies and procedures relating to relevant compliance laws including but not limited to enforcing the laws relating to detection and prevention of money laundering, Financing of Terrorism and Proliferation Financing law;

g) Notify Safaricom PLC in writing as soon as it becomes aware of an actual or potential suspicious activity/investigation/breach in relation to the Applicable Laws or any material change in status, in relation to this agreement, in respect to money laundering, financing of terrorism or proliferation financing;

h) Be advised that Safaricom shall terminate this agreement if any of the provisions of these clauses are breached;

i) Safaricom shall seek indemnities from the Supplier which has breached the relevant provisions for any direct losses incurred.

Safaricom reserves the right at its discretion to terminate the contract where there is breach of the provisions of the code of conduct. In other instances, Safaricom may require that corrective action is carried out before it continues partnership with the supplier.

Safaricom reserves the right to vary this Code at any time.

1st April 2026