Cutover
Cutover is the operational moment a Kenyan SACCO or microlender becomes a live MFI Suite tenant. It produces a Go/No-Go report, captures the executive sign-offs, freezes the legacy system as a checklist item, and enables iBANK, USSD and Daraja for member traffic.
At a glance — Path: MFI Suite -> Migration -> Cutover. Group: MFI / Migration Lead + Finance Reviewer + Tenant CEO (or delegate). Cutover happens once per tenant. After confirmation, the workspace is read-only for that tenant.
What Cutover is and is not
Cutover is a coordinated checklist, a signed Go/No-Go report, and a switch that flips three things: (1) the migration workspace becomes read-only for the tenant, (2) the opening journal is posted permanently (no more draft), (3) the member-facing channels iBANK / USSD / Daraja are unlocked. It is not a technical 'data import' step — Commit already moved the data — it is the governance event that turns the imported data into the production system of record.
- Cutover is one model record per tenant per go-live event (mfi.migration.cutover).
- It carries the Go/No-Go report, all required sign-offs, the legacy-freeze checklist, and the channel-enable toggles.
- Once confirmed, it is immutable. A second Cutover for the same tenant is not possible without an administrator unlock.
The Go/No-Go report
The report is generated by the workspace and reviewed by the project team. It has 12 sections; each is either GREEN, AMBER or RED. A single RED blocks confirmation. AMBER requires a written acknowledgement from both Migration Lead and Finance Reviewer.
| Section | Green criterion | Common amber/red causes |
|---|---|---|
| Member counts | Production count = sum of committed Run counts; legacy count delta <= 0.1% | Members archived in legacy but not flagged in Source |
| Savings balances | Total liability = legacy print, delta <= KES 100 | Accrued interest mismatch |
| Loan portfolio | Total outstanding = legacy print, delta <= KES 100 | Capitalisation timing differences |
| Schedule integrity | Sum of schedule.principal_due per loan = loan.outstanding for every active loan | Stale schedules from partial payments |
| Trial balance reconciliation | Migration clearing = 0, debits = credits | Missing GL opening line |
| IFRS 9 ECL initial | Stage 1/2/3 distribution within expected band | Outliers if historical days-past-due not migrated |
| KYC completeness | % with ID document on file >= 95% (tenant target) | Legacy did not store digitised IDs |
| KRA PIN coverage | % with KRA PIN >= 90% for taxable savings accounts | PINs never collected in legacy |
| GOAML retro-filing | Historical CTRs above threshold logged for retrospective filing | Reg Warnings acknowledged without follow-up plan |
| Legacy freeze | Operator confirms legacy logins disabled, dataset snapshot taken | Operator forgot to disable ATM/USSD on legacy |
| Channel readiness | iBANK, USSD, Daraja health checks all green | M-Pesa Lipa Na till test fails |
| Comms readiness | SMS templates loaded, branch staff briefed, call centre primed | Branches did not get training pack |
Required signatories
Cutover cannot be confirmed without four signatures captured in the workspace (BridgeERP password retype). All four must be from different humans.
- Migration Lead — confirms data integrity and that all Runs are committed.
- Data Steward — confirms business rules acknowledgements are documented.
- Finance Reviewer — confirms trial balance reconciles, opening journal is correct, GOAML retro-filing plan exists.
- Tenant CEO (or board-delegated signatory) — confirms operational readiness, branch and call-centre briefing, comms plan.
Warning — If any signatory delegates to a colleague, the delegation must be recorded in writing and uploaded as an attachment to the Cutover record before signing.
Legacy freeze — the checklist nobody can skip
MFI Suite cannot physically shut down a third-party system. The legacy freeze section is a checklist that the operator must tick item-by-item, and the system records timestamps for each tick.
| Item | Owner | Verification |
|---|---|---|
| All legacy user logins disabled | Tenant IT | Operator attaches a screenshot of the user list with all rows showing 'disabled'. |
| Legacy ATM / USSD interfaces shut down | Tenant IT + Switch vendor | Operator attaches the switch vendor's confirmation email. |
| Legacy database snapshot taken and stored | Tenant IT | Operator records snapshot location and retention period (minimum 7 years per CBK Prudential Guideline). |
| Legacy server marked read-only at the OS level | Tenant IT | Operator confirms mount is ro or filesystem flag set. |
| Legacy SMS gateway credentials rotated | Tenant IT | Prevents accidental SMS sends from the dead system. |
| Legacy M-Pesa till diverted to MFI Suite endpoint | Operator + Safaricom Daraja Ops | Confirmation message from Safaricom included in attachment. |
| Branch staff briefed on no-touch policy | Branch Managers | Acknowledgement form scanned and attached. |
Channel go-live
Confirm Cutover flips three channel toggles. Each is independently failable — if iBANK is not ready, the operator can leave it off and bring it up later.
- iBANK — member web/mobile login. Enables when the tenant has loaded the iBANK theme and configured the SMS OTP provider.
- USSD — typically *483*
#. Enables when the Africa's Talking or Safaricom USSD shortcode is provisioned and the channel webhook is registered. - Daraja (M-Pesa) — Lipa Na M-Pesa, Buy Goods, B2C disbursements. Enables when paybill is registered, callback URL is set, and a test transaction has succeeded.
- Cards / KCB pull payments — optional, enables when KCB Buni / iPay integration tested.
- Bria AI assistant (member-facing chat) — optional; recommend leaving off for the first 30 days post-cutover until baseline support volume is known.
Post-cutover watch — 30-day window
Confirm Cutover does not end the project. The workspace generates a Watch List dashboard for the 30 days after go-live, surfacing any record that touches migration lineage.
- New transactions on migrated savings accounts — counted and totalled daily.
- First payments received against migrated loan schedules — checked for amount match.
- Members who log into iBANK for the first time — KYC document upload prompted.
- Bria first-call resolution rate on members vs new members — proxy for migration quality.
- Migration clearing account — must remain at KES 0 for 30 days. Any movement is investigated.
Note — Daily Watch List email to Migration Lead, Data Steward and Finance Reviewer for the full 30 days. Auto-archives on day 31.
Worked scenarios
Scenario — Tujikomboe goes live at 06:00 on Monday 15 January 2026
| Character | Role |
|---|---|
| Jane Wambui | Migration Lead |
| Peter Otieno | Data Steward |
| Florence Achieng | Finance Reviewer |
| Samuel Kibet | Tujikomboe CEO |
| Kimani Mwangi | Tenant IT |
Timeline
- Sun 14:00: Jane opens the Cutover record and generates the Go/No-Go report. (12 sections, 10 green, 2 amber (KYC at 92% vs 95% target; KRA PIN at 87% vs 90% target).)
- Sun 14:30: Florence and Peter document acknowledgements for the two ambers: 'Bria-led KYC capture plan for first 30 days, target 96% by day 30.' (Ambers acknowledged.)
- Sun 15:00: Kimani ticks all 7 legacy-freeze items with screenshots and attachments. (Legacy freeze section flips green.)
- Sun 16:00: Test transactions: iBANK login by Jane as a sample member, USSD *483*4# from a Safaricom test SIM, M-Pesa Lipa Na test of KES 10. (All three channels green.)
- Sun 17:00: Jane signs as Migration Lead. Peter signs as Data Steward. Florence signs as Finance Reviewer. (3 of 4 signatures captured.)
- Sun 19:00: Samuel signs as CEO after a final all-hands call with branch managers. (4 of 4 signatures captured. Confirm Cutover button enables.)
- Mon 05:45: Jane clicks Confirm Cutover. (Opening journal posts permanently. Channels flip on. Migration workspace becomes read-only. Watch List dashboard appears.)
- Mon 06:00: Branches open. First member transaction at Eldoret branch: KES 5,000 cash deposit by Mary Mutua to savings A/C 2-001-0042. (Transaction lands on migrated account with x_migration_source_key still readable. Watch List counter: 1.)
- Mon 10:00: Watch List shows 412 successful transactions, 3 anomalies (member balances mismatched by KES 1 due to rounding). (Jane opens the 3 anomalies in Mapping Audit, posts KES 3 rounding journal.)
Outcome — Cutover confirmed at 05:45. First-day transactions land cleanly. Three KES rounding anomalies caught and resolved before lunch. Watch List runs for 30 days; KYC coverage reaches 97% by day 28 via Bria-driven prompts.
Reference
Fields on mfi.migration.cutover
Every field is recorded permanently and surfaces on the Mapping Audit page.
| Field | Type | Description |
|---|---|---|
| tenant_id | Many2one res.company | The tenant going live. |
| planned_at | Datetime | Planned go-live moment. |
| confirmed_at | Datetime | When Confirm Cutover was clicked. |
| go_no_go_pdf | Binary | Snapshot PDF of the report at confirmation. |
| signature_lead | Char + datetime | Migration Lead signature. |
| signature_steward | Char + datetime | Data Steward signature. |
| signature_finance | Char + datetime | Finance Reviewer signature. |
| signature_ceo | Char + datetime | CEO signature. |
| channel_ibank | Boolean | iBANK enabled at confirmation. |
| channel_ussd | Boolean | USSD enabled at confirmation. |
| channel_daraja | Boolean | Daraja enabled at confirmation. |
| legacy_freeze_checklist | One2many checklist lines | All 7 items with timestamp and attachment. |
| watch_list_end_date | Date | confirmed_at + 30 days. |
| amber_acknowledgements | Text | Written justification for every amber on the report. |
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
| Confirm Cutover button stays disabled. | One of the four signatures is missing, or the Go/No-Go report has at least one red section. | Open the report and look for the red. Common: legacy freeze checklist incomplete. |
| iBANK toggle flips on but members cannot log in. | OTP SMS provider not configured, or member phone numbers not validated. | Settings -> MFI -> Channels -> iBANK -> SMS provider; test by triggering a password reset for a known member. |
| Daraja test transaction fails with timeout. | Callback URL points to staging or to a paused worker. | Settings -> MFI -> Mobile Money Providers -> open Safaricom -> callback_url should be the public tenant URL; restart the long-polling worker if needed. |
| Watch List shows movement on the migration clearing account on day 3. | A late-arriving legacy transaction was posted manually as a journal entry rather than via a Migration Run. | Investigate the journal entry, reverse if posted in error, or document and post offsetting entry. Never let migration clearing drift. |
See also
Was this page helpful?