Africa deep-dive appendix — Kenya, South Africa, Nigeria, Ghana, Uganda, Tanzania

Companion to country-gaps.md. That document was written before these five country-research passes finished, so it carries only summary lines for these markets. Everything below is the load-bearing detail: the findings that change what the product must DO, not background colour.

Each claim is tagged as its researcher tagged it. VERIFIED means the source text was read directly. UNVERIFIED means it could not be confirmed and must not be relied on without checking. That distinction is the point — a research document that guesses would poison the honesty the whole product is sold on.

The five findings that change the code

1. South Africa: the platform must auto-disconnect an unlicensed driver. NLTA s66A(6) (in force 12 Sep 2025): a platform "may not permit an operator to use that application for a vehicle for which the operator does not hold a valid operating licence… or whose licence has lapsed or been cancelled" and "must disconnect the e-hailing application forthwith". Penalty: R100,000 or two years' imprisonment (s90(1)(lA)). We have no licence-expiry enforcement at all. VERIFIED — Act 23 of 2023, GG 50800.

2. Tanzania: the platform must integrate with the regulator's system, and failing to transmit is a fined offence. GN 6 of 2026 makes "non-integration of the platform operator with the Authority's system" and "integration without transmitting the required information" compoundable offences at TZS 3,000,000 each. Also mandatory: e-receipts (TZS 100,000 fine), a fare engine constrained to published min/max bands, a 0.5–1% LATRA levy computed per trip, and commission inside a 10–25% band. VERIFIED — LATRA primary PDFs.

3. Kenya: cash rides carry a commission debt the driver owes back. Platforms charge commission on cash trips; the driver owes it; unpaid debt disables cash trips only, leaving digital trips enabled so the platform can keep recovering. This needs a driver wallet that can go negative, a debt threshold gating the cash-trip toggle specifically, and an M-Pesa repayment flow. We have none of it. VERIFIED — Bolt Kenya driver guide.

4. Fare VAT is exempt in both Kenya and South Africa — VAT applies to the platform's commission, not the ride. Kenya: VAT Act First Schedule item 7 exempts passenger transport; Bolt charges 16% on the commission line. South Africa: VAT Act s12(g) exempts road passenger transport, and SARS's VAT 404 guide says so explicitly, "includes taxis". Our tax engine taxes the fare in both. A ZA passenger receipt must therefore not be a tax invoice showing 15% on the fare. VERIFIED — Kenya Law, SARS VAT 404, Bolt driver guide.

5. Regulated deactivation, in two markets independently. South Africa reg 21: notice of intention + reasons + show-cause before suspension, and the regulator notified within 48 hours. Kenya LN 120 r.15: written notice, right to challenge, written reasons, NTSA notified within 7 days, and NTSA publishes deactivated drivers. Both stack with a data-protection right (POPIA s71 / Kenya DPA s35) against decisions made solely by automation. A silent algorithmic ban is unlawful in both. VERIFIED.

Kenya

Regulator: NTSA, under Legal Notice 120 of 2022 (in force 1 Jul 2022). Licence KSh 100,000/year, renewal requires an NTSA audit; applicant must be a Kenyan body corporate, tax compliant, registered with the Data Commissioner, with a registered office in Kenya.

⚠️ Live change, 3 September 2026: the High Court blocked enforcement of the 18% commission cap and struck the 3-year data-retention rule as unconstitutional surveillance, with the declaration of invalidity suspended 12 months for fresh public participation. Do not hard-code either. Retention must be configurable; commission rate, commission base and every surcharge's inclusion must be config-driven and audit-logged — a regulator has already litigated the "booking fee" workaround. (Court ruling VERIFIED via two outlets; judgment text UNVERIFIED.)

Product obligations that were NOT struck and still apply: panic button for driver and passenger connected to a response centre manned at all times; pre-trip display of vehicle, plate, driver name and photo with the fare estimate before acceptance; a receipt carrying rates, date/time, pickup and drop-off, driver name, vehicle and plate, duration and distance; passenger identity verification at enrolment; forced logout for 4 hours after 8 hours continuous service; 24-hour support SLA; lost-and-found; accessibility with no surcharge; accident reporting to NTSA within 24 hours; information on demand within 72 hours.

Tax — three separate mechanisms, all ours to build:

• eTIMS reverse invoicing. KRA's own published example is literally a taxi-hailing platform: the platform issues the trip invoice on the driver's behalf, plus a commission invoice to the driver. Requires KRA KYC approval, system-to-system integration (OSCU/VSCU + Reverse Invoicing API), per-driver consent with records retained, a unique secondary device per seller, real-time transmission, 5-year retention, KES only, and all cost borne by the platform. Uber Kenya went live with this in August 2025.
• VAT on commission at 16%, fare exempt (above).
• 5% withholding on resident-driver payouts (Income Tax Act s10(4), s35(3)(n); 20% for non-residents) — needs a WHT engine and certificates. (Whether it is a final tax for resident drivers is UNVERIFIED.)

Data protection: ODPC registration is mandatory regardless of size for "online passenger hailing applications" (Third Schedule item 11 disapplies the small-business exemption) — KSh 4,000, renewed every 2 years for a small operator — and lapse is express grounds for NTSA to cancel the TNC licence. Breach notification to the Commissioner within 72 hours. Fines to KSh 5m or 1% of turnover, whichever is lower; real fines have been issued (Oppo, Whitepath, Regus at KSh 5m each). A draft transport-sector guidance would require a Kenyan-resident serving replica of Kenyan personal data — not yet published, but architect the residency boundary as a deployment parameter.

Payments — the one-line change worth making: collect on an M-Pesa Business Till, not a Paybill. Safaricom's own pages: a Till has no customer charge; a Paybill charges the customer per the consumer tariff. A Paybill silently taxes your rider for choosing to pay you. Reconcile on the STK CheckoutRequestID rather than a typed account number. B2C payout fees are flat per transaction (KSh 5–13), so per-trip instant payouts cost ~3× a daily sweep — make payout cadence configurable and default to batched. Never treat a ResponseCode: 0 as paid: STK, C2B, B2C and B2B return an acknowledgement, not an outcome.

South Africa

Regulator: NPTR under the NLTA as amended (in force 12 Sep 2025) and the Second National Land Transport Regulations (GN 3487, GG 53335). Platform registration Form 9A, R5,000 for 7 years; the provider must be a South African citizen/resident or an SA-incorporated company with physical premises in the Republic. Without a registered platform, no driver on it can get an operating licence (reg 28(3)). The 180-day driver conversion window expired 11 March 2026; at the deadline only 3 of 12 platforms were registered.

The regulations are a product spec. These are legal requirements, not features:

• Rider side (reg 16(1)): upfront fare before confirming and live fare during the trip; live driver location from acceptance to trip end; push notifications for status, ETA, driver and vehicle details; in-app messaging; book on behalf of another person; automatic post-trip charge for card payers; rate the driver; panic buttons for BOTH passenger and driver, connected to private security or a vehicle-tracking provider, tested at least monthly.
• Driver side (reg 16(2)): profile photo no older than 12 months, licence and PrDP details with expiry, vehicle make/model/first-registration/ plate/colour; daily, weekly and monthly earnings reports; waiting-time charging; and a heat map of high-demand areas — legally mandatory.
• Back office (reg 17): a customer service centre for passenger complaints.
• Rider KYC is mandated (reg 20): ID or passport number and residential address. A phone number is not enough.
• Receipt (reg 25) must carry owner name and business address, the operating licence number, the platform used, origin/destination/amount, date and time, driver name, and vehicle make/model/plate. Failure to issue is an offence.
• Agreement (reg 18): governing law must be South Africa — a white-label EULA with foreign choice-of-law is non-compliant. Click-wrap is expressly permitted as a "data message" under ECTA.
• Multi-homing is legally protected (reg 22) — build no exclusivity assumptions.
• Drivers must stay within their designated provincial jurisdiction — geofenced dispatch is a regulatory constraint.

Data protection (POPIA): Information Officer registration is mandatory and is a precondition to acting; a foreign-based entity must authorise an IO inside South Africa. (The Regulator's online portal is currently down — manual form by email.) Breach notification has no risk threshold: ALL security compromises must be reported, and you report before confirming. Direct marketing needs written consent on Form 4 or substantially similar, specifying the goods and the channel — and you may use only that channel. Administrative fines cap at R10 million; the only fines issued so far are R5m each against two government departments.

Language — the definitive answer: English-only is lawful. The Constitution's language duties bind government, not private parties; the Use of Official Languages Act applies only to national departments, public entities and public enterprises; the CPA requires plain language, not any particular language. No major platform ships any South African language: Uber ships 50 languages and Bolt 44, neither includes one SA indigenous language or Afrikaans. The real legal exposure is the opposite direction — Wanatu's Afrikaans-only driver requirement engages EEA s6(1) and PEPUDA. So: ship English, make SA languages optional, and never gate onboarding on language proficiency.

Load-shedding is largely solved — 300 consecutive days without it as at 13 Mar 2026. Do not over-engineer for it.

Safety adoption data worth designing around: on Bolt SA only 1 in 5 trips are shared, and SOS and audio recording are used in roughly 1 in 200. Build for features that go unused. 70% of ZA ride-hailing users are women.

Ghana

Driver- and vehicle-side regulation at DVLA, no platform operator licence found (UNVERIFIED as a negative). Ride-hailing vehicles need DVLA registration, a windscreen sticker, and roadworthy examination every 6 months; change of use from private to commercial means surrendering plates. A GH¢1-per-trip Digital Transport Fee was introduced Apr 2023 and "paused" days later — its 2026 status is UNVERIFIED. Okada (commercial motorcycles) was legalised in Dec 2025 and is now regulated under the Road Traffic Regulations 2026 (L.I. 2519), regs 164–177: DVLA commercial rider's licence, minimum age 21, union membership, helmets for rider and pillion, 2-year renewal.

Tax: effective VAT 20% (15% VAT + 2.5% NHIL + 2.5% GETFund) under the VAT Act 2025, in force 1 Jan 2026. E-VAT e-invoicing carries a QR code, tamper-proof receipt signature, timestamp and machine registration code, with up to 24 hours of offline generation. Applicability to ride-hailing specifically is UNVERIFIED — a local operator over the threshold falls in scope by default.

Data protection: DPC registration mandatory, valid 2 years; a non-Ghanaian controller must register as an external company. Fees GH¢156 (small) to GH¢5,000 (specialised). Large controllers (turnover ≥ GH¢5m or ≥250 staff) must have a certified data protection supervisor trained by the Commission. Renewal requires a gap analysis, DPIA, retention policy, incident response plan and a breach report covering all breaches.

Payments: the E-Levy is abolished (assented April 2025), though reintroduction is under public debate as of Sep 2026. Mobile money ran GH¢447.4bn in February 2026 alone. Flutterwave covers MTN, Telecel and Airtel in GHS, and Paystack supports Ghana — both already in our codebase.

Uganda

Lightest transport regime of the three — no dedicated ride-hailing operator licence, commission cap or platform regulation found (UNVERIFIED as a negative). Uber exited Uganda on 2 September 2026 after a decade, leaving Bolt, SafeBoda, Faras and Yango.

The real burden is ancillary: ITMS digital number plates. Every vehicle and motorcycle must carry a tracker embedded in the plate under a 10-year agreement with a Russian contractor. UGX 714,300 for a new/imported vehicle plate, UGX 150,000 to replace an existing plate, UGX 50,000 for motorcycles. Rollout is badly broken: up to five-month waits after payment, vehicles stuck in bond, a parliamentary probe opened Sep 2026 citing ~UGX 4bn/week in losses. What data flows to government is UNVERIFIED.

Data protection: registration mandatory and extraterritorial — it binds any entity handling Ugandan citizens' data, wherever established, as the PDPO held against Google in July 2025. Renewed annually, UGX 100,000, plus an annual compliance report filed between 1 July and 30 September. Cross-border transfer needs no per-transfer approval but does need a Form 3 undertaking and records of the legal basis. Penalties reach 2% of annual gross turnover.

Payments: the 0.5% excise on mobile money withdrawals is still in force and the government declined to reduce it for 2026-27. It bites at cash-out — i.e. on driver payouts, not on rider payments; batch accordingly. Flutterwave covers Airtel and MTN in UGX. Paystack does not support Uganda.

Tanzania

The most machine-readable regulatory contract of any market researched, and the one needing a dedicated integration module.

LATRA licence fees (GN 6 of 2026, in force 1 Jul 2026): platform operator TZS 3,000,000/year; driver/vehicle TZS 50,000–65,000; motorcycles TZS 20,000. Every operator on LATRA's published register is a Tanzanian-registered entity — a local-entity requirement is strongly implied (UNVERIFIED at statute level).

Fare and commission bands (Public Notice, GG 7284, 30 Dec 2022) — this supersedes the March 2022 flat 15% cap, which answers the "15% or 25%" confusion: both were true, in sequence.

(Whether these bands are still literally operative in Sept 2026 is UNVERIFIED — LATRA opened a fare review consultation for 8 Apr 2026.)

Compoundable offences that are product requirements: non-integration with LATRA's system TZS 3,000,000; integrating but not transmitting TZS 3,000,000; failure to issue e-tickets/receipts TZS 100,000; cancelling a trip without valid reason TZS 100,000; no fare meter or equivalent movement-recording system TZS 50,000. Contracts with drivers must be deposited with the regulator before implementation.

Data protection: PDPC registration is a precondition to processing, valid 5 years (TZS 100,000–1,000,000), and renewal must be applied for within the 3 months before expiry — miss it and you start over. Cross-border transfer requires a PERMIT per transfer (Form 7, decided in 14 days) — a hosting and architecture constraint, not paperwork. PDPC began on-site compliance inspections on 28 August 2026. Company penalties reach TZS 5,000,000,000.

Payments: ClickPesa is the only aggregator verified to cover all four wallets including Vodacom M-Pesa; Flutterwave's Tanzania coverage excludes Vodacom M-Pesa — a significant gap given its share. Paystack does not support Tanzania.

Nigeria

⚠️ Uber exited Nigeria and Uganda on 2 September 2026, twelve years after launching in Lagos, alongside a 3,300-person global staff cut. Bolt and inDrive now dominate. For a white-label product this materially enlarges the opportunity. VERIFIED.

Lagos licence and levy. Guidelines for Online Hailing Business Operation of Taxi in Lagos State, 2020. Two categories: Service Entity (app only) and Taxi & App Operator. The gazetted text says ₦10m/₦25m plus 10% of every ride — but a negotiated August 2020 revision cut the licence to ₦8m (<1,000 cars) / ₦20m (>1,000) and replaced the 10% with a flat ₦20 per trip (the Road Improvement Fund). Law firms were still republishing the original table in 2024, so expect the document and the practice to disagree. The levy may since have risen to ₦30 and been renamed the Road Development Fund (UNVERIFIED, single source) — build the levy as a configurable per-trip flat amount, never a hardcoded number or a percentage.

There is an API, and it is how the levy is collected. Operators integrate with a Lagos State Digital Transport Service Platform (DTSP, branded Drive IQ), each holding their own account, letting the state monitor trip counts and collect the RDF. Before it, operators were sending trip logs and coordinates as Excel sheets on Google Drive — which they themselves flagged as a data-protection problem. As of May 2024 Bolt, inDrive, LagRide and Rida had integrated and Uber had not; Lagos impounded Uber drivers' vehicles over it. Assume other states copy this: the product needs a state-reportable trip counter and an outbound integration hook. VERIFIED.

Driver and vehicle verification is the OPERATOR's legal duty, not the driver's. Lagos requires, before registration: a literate driver, a valid licence, a LASDRI certificate and card, a LASRRA card, and a Ministry driver's badge. Vehicle side: taxicab licence, special plate, roadworthiness, comprehensive insurance covering driver and passengers, hackney permit, a government-approved taximeter, a passenger-facing laminated ID card, and the vehicle must be within 3 years of manufacture. NIN is not required for Lagos drivers (LASDRI/LASRRA are) but is required in the FCT. Passenger NIN verification is not mandatory anywhere yet — Bolt refuses to do it unilaterally because it would push riders to other platforms. QoreID covers LASRRA, driver's licence, plate and vehicle verification in one vendor, which maps 1:1 onto this checklist. VERIFIED.

Data protection is a real budget line, not a form. NDPA 2023 + GAID 2025. You are a controller "of major importance" at >200 data subjects in six months, and >5,000 makes you Ultra-High Level — every real operator is UHL on day one. Registration ₦250,000 one-off, plus ₦5,000 per data processor engaged per year. The recurring cost is the annual Compliance Audit Return: ₦1,000,000/year at ≥50,000 data subjects. UHL/EHL cannot self-file — it must go through a licensed DPCO. A DPO is mandatory and must file a semi-annual internal report. Breach notification is 72 hours to NDPC. The deadline is 31 March (not the old NDPR 15 March), and filing late costs 50% of the fee on top. Enforcement is real: Fidelity Bank ₦555.8m (2024), MultiChoice ₦766.24m (2025), ₦16.2bn contributed to federal revenue by Jan 2026. One genuinely odd rule: a cookie notice must obstruct the middle or a side of the page — a bottom bar is expressly non-compliant. VERIFIED from NDPC primary PDFs.

Payments — the finding that changes the design. Bank transfer, not card, is the de facto default: NIP moved ₦1.07 quadrillion in 2024 against ₦18 trillion on POS — roughly 59× the value. And Paystack's Transfer, USSD and Bank channels all explicitly do NOT support recurring payments; only cards can be tokenised. So "pay by transfer" in a ride-hailing app can only be a prepaid wallet top-up or a post-trip push-to-pay — never a saved instrument. USSD is narrower than people assume: GTBank *737# only. Pay-with-Bank is GTBank and Kuda only. VERIFIED from Paystack's own docs.

Drivers actively dislike card trips — not because of the card, but because of payout lag against same-day fuel costs: "if you want them to do app wallet payments… I don't know when I am going to get my money." Payout speed is a competitive feature here, not a nicety. VERIFIED.

Two taxes to model, both new on 1 January 2026: the ₦50 EMTL became a ₦50 stamp duty paid by the SENDER on transfers ≥₦10,000 — most single fares fall below it, but driver payouts above ₦10,000 attract it and the operator now bears it; and 7.5% VAT now applies to e-hailing trips while street and park transport stays exempt. inDrive was reported charging it twice — on the fare and again on its own commission. VERIFIED as reported; statutory basis UNVERIFIED.

No commission cap exists in Nigeria, and no regulator has one — Bolt 20%, Uber ~25%, inDrive raised 9.99%→12.5%; drivers demand 5%. The Public Complaints Commission is formally investigating all three over arbitrary deactivation and commission. Drivers in Abuja circulate their own fare schedule (₦450/km vs Uber's ~₦150/km) and enforce it with decoy bookings — off-app renegotiation must be assumed in any Nigerian design, which is also why inDrive's bidding model fits. A union-backed competitor, SimpliRide, charges no commission at all — a flat ₦1,500/day driver subscription, which is a direct monetisation comparator for a white-label product. VERIFIED.

Two obligations nobody expects: the NHIA has directed that all e-hailing operators provide health insurance for their drivers, backed by the NHIA Act 2022 and a presidential directive — Uber, Bolt and inDrive have all failed to comply and are being petitioned over it. And FAAN suspended Bolt from every federal airport in Aug 2026 pending a concession agreement; airport pickup needs a concession, a ₦45,000 driver parking fee, a crested uniform, biometric and police clearance, and an AVSEC ID. VERIFIED.

Do not ship an okada/bike product for Lagos. The ban is legally live across six LGAs and their LCDAs (total, indefinite, since 1 June 2022), passengers are liable too, and the bike-hailing generation died with it — Gokada filed Chapter 11, MAX pivoted out entirely, ORide was folded into OPay's fintech. Enforcement has collapsed in practice since 2024, but the law has not changed, and Ogun State has no ban, which is why the border areas defeat enforcement. VERIFIED.

Regional note

Uber is retreating from this region — gone from Tanzania (Jan/Feb 2026), Uganda and Nigeria (both 2 Sep 2026), Côte d'Ivoire (Sep 2025), still present in Ghana, Kenya, Egypt and South Africa. The competitive set in UG and TZ is now Bolt, inDrive, Yango and local apps, which is favourable for a white-label operator entering those markets.

Data-protection registration is mandatory in all five markets, at very different cadences — Ghana every 2 years, Uganda annually with a fixed reporting window, Tanzania every 5 years with a per-transfer cross-border permit, Kenya every 2 years and gating the transport licence itself. A buyer onboarding checklist should carry the right one per market rather than a generic "register with your data protection authority".