bits.

FREE HISTORY OF COMPUTING COMPANIES LESSON

2007: Build for the infrastructure people have

M-PESA, WeChat, UPI, and three paths to digital rails

M-PESA launched in Kenya in 2007 around phones, electronic balances, and an agent network that connected digital records with cash. WeChat's later services connected payments and applications to a messaging platform. UPI's2016 launch introduced an interoperable payment interface across participating institutions. These are different timelines and governance structures. The comparison should identify which local problem each arrangement addresses, rather than rank them as successive versions of one inevitable product.

A digital payment record does not by itself solve cash access. Suppose an agent starts with 1000 units of physical cash and 1000 units of electronic float. A customer deposits 200 cash and receives 200 electronic value. The agent's cash rises to 1200 while its electronic float falls to 800 in a simplified transfer model. A later 300 cash withdrawal reverses the direction: cash falls to 900 and float rises to 1100. The agent needs enough of both resources to meet demand.

If many customers withdraw at once, an agent can run out of cash while remaining solvent in total value. If many deposit, it can run out of electronic float. Rebalancing is an operational and liquidity problem, not a missing mobile-screen feature. Distance, transport, trust, staffing, and fraud controls determine whether the advertised service is available in practice. The digital ledger and the physical conversion network must be analyzed together.

Interoperability addresses another boundary. A shared payment interface can let users of different participating applications or banks transact without joining the same private front end. But a common interface still needs identity rules, authorization, message routing, settlement arrangements, dispute handling, and responsibility when an operation is ambiguous. “Interoperable” does not mean every actor has equal governance power or that every user has the required device, account, or connectivity.

A messaging platform can reduce discovery and coordination costs because people already communicate there. Mini-programs can reuse identity and distribution, while the platform owner controls important entry and interface decisions. An agent-based service locates access in physical outlets; a bank-based interoperable rail relies on participating financial institutions; a super-app concentrates several functions behind one product. Each arrangement has different exclusion and failure modes.

The Safaricom annual report and NPCI launch statement provide dated institutional evidence. Tencent's product description explains its own service boundary. Do not infer present fees, protections, or regulatory duties from these historical sources. The lesson's numerical ledger is an explanatory model, not a description of every operational accounting detail.

Design begins with the actual environment: existing cash habits, identity documents, phone capabilities, accessibility, connectivity, and available support. Test a complete journey including reversal or dispute, a lost phone, an unavailable agent, and a delayed notification. A successful message is not the same as final settlement, and a convenient interface is not the same as universal access.

Reconstruction exercise

An agent begins with 600 cash and 900 electronic float. Process a 250 cash deposit followed by a 500 cash withdrawal using the simplified model. Show both balances after each step and determine whether another 400 cash withdrawal can be served. Then distinguish a liquidity shortage from a ledger inconsistency, and propose one interoperability test and one inclusion test for a new payment application.

Worked solution

After the deposit, cash is 850 and float 650. After the 500 withdrawal, cash is 350 and float 1150. Another 400 cash withdrawal cannot be served from the stated cash stock even though total value remains 1500; this is a liquidity imbalance, not evidence that the ledger is inconsistent. A ledger inconsistency would involve unmatched or incorrect recorded transfers, violating the accounting model. An interoperability test sends a payment between different participating apps or institutions and verifies identifiers, amounts, status transitions, and reconciliation. An inclusion test checks whether a user with the actual target device, connectivity, language, and support access can complete and recover the journey. Neither test is satisfied merely by a successful demonstration on a developer’s phone.

Test the limits and transfer the idea

1. Ledger and logistics calculation · allow 25 minutes

Move liquidity without inventing value

In a fictional agent network, A has 100 cash and 900 electronic float; B has 900 cash and 100 float. A expects 500 of withdrawals and B expects 500 of deposits, with no fees. Find a balanced exchange before customers arrive that lets both serve demand. Trace all balances and verify conservation of cash and float. Explain why the exchange requires both a physical and a ledger operation.

Get a starting hint

A needs cash while B needs electronic float; transferring only one creates a mismatch in the agents' total holdings.

Compare your reasoning with the worked solution

B can transfer 400 physical cash to A, while A transfers 400 electronic float to B. Both then hold 500 cash and 500 float. A serves 500 of withdrawals, ending with 0 cash and 1000 float; B accepts 500 of deposits, ending with 1000 cash and 0 float. Across agents, total cash and total float each remain 1000 before and after this symmetric customer flow. The pre-exchange preserves each agent's combined holdings; shipping only cash without the balancing electronic claim changes their positions. Transport time and risk can make rebalancing fail even when the ledger arithmetic is valid. Safaricom's annual report is a primary corporate report about its period; the numerical model is original and omits real settlement and fee details.

Check your reasoning

  • Finds the balanced 400-unit exchange.
  • Traces post-exchange and post-customer balances.
  • Separates physical liquidity from electronic value and states model limits.

2. Protocol and user-journey analysis · allow 25 minutes

An interoperable message can reach the wrong intended payee

A fictional payment app routes correctly by account identifier. A user enters identifier 742 instead of 724; the displayed name is generic and the app sends an authenticated transfer. Explain why routing, encryption and payer authentication can all succeed while the user's intention fails. Design a confirmation contract and a dispute trace that distinguish an incorrect identifier from a duplicate retry or a forged instruction. Avoid assuming that a historical UPI launch statement specifies current dispute rules.

Get a starting hint

Separate intended recipient, authenticated instruction and actual ledger effect.

Compare your reasoning with the worked solution

The system can faithfully execute the authenticated instruction to account 742 even though the user meant 724. A confirmation screen should expose a trustworthy recipient representation, amount and currency, while preserving the exact identifier approved by the user. A durable record should bind that confirmation to a unique request identifier, authenticated payer, submitted payload and settlement result. A duplicate retry shares the same intended request identity and payload; a forged instruction lacks valid authorization under the relevant contract; a mistyped but confirmed instruction can be authorized yet mistaken. Dispute handling requires a defined responsible institution and evidence trail, not a claim that encryption reverses a transfer. NPCI's launch document is primary evidence of the announced interface initiative, while Tencent's product page is its current self-description. Neither supplies universal protections for this invented service.

Check your reasoning

  • Shows how valid technical operations can mismatch intention.
  • Binds confirmation, identity and durable effect in the evidence trail.
  • Distinguishes three failure classes and avoids inventing financial protections.

Check your understanding

An agent holds 350 cash and 1150 electronic float. Can it serve a 400 cash withdrawal in the stated model?

  • Yes; total value exceeds400.
  • No; the ledger is necessarily corrupt.
  • No; cash liquidity is insufficient despite positive total value.
  • Yes; electronic float is physical cash.
Explanation

The relevant conversion requires enough physical cash at that location; solvency and local liquidity differ.

Two payment apps share an interface, but users cannot resolve a delayed transfer. What contract remains incomplete?

  • Interoperability removes every institutional responsibility.
  • Status, reconciliation, dispute ownership, and recovery behavior.
  • Only the visual color scheme.
  • The existence of a shared message field proves settlement.
Explanation

A successful message or shared format does not by itself establish final outcome or accountability.

Sources and further reading