TOBOA market rulebook

Version 2026 10 28 1 | Effective for the pooled demo from deployment on or after 28 October 2026

This rulebook sets the commercial model, participation terms, accounting rules, outcome procedures and safeguards for TOBOA pooled prediction markets. The pooled product uses pari-mutuel payouts and a commission of 10 percent of positive net profit in each market. It is a free simulation. Demo credits have no cash value and cannot be exchanged for money.

Scope and existing predictions

Existing fixed-price demo predictions retain their accepted prices, fees and settlement terms. Their balances are separate from the pooled demo and the Paystack test wallet. No migration, conversion or cash entitlement is created by this rulebook. The pooled demo is not a central limit order book. CLOB trading is a future product requiring separate rules and validation.

Participation agreement

Participants must affirm that they are at least 18, understand the risk of losing their stake and accept this version before receiving pool demo credits. This affirmation is not identity or age verification. Verified identity and age checks are required before a proposed cash pilot. Administrators cannot stake in the pooled product. Use one account and one side per market; coordinated accounts must not circumvent limits.

Non negotiable protections

TOBOA does not guarantee returns, immediate withdrawals or perfect security. It must not invent liquidity, imply regulatory endorsement, alter accepted terms, use private customer funds for operations, or market participation as dependable income. Limits, evidence, fees and complaints must be accessible on mobile. No leverage, credit betting, cash bonuses, early cash-out or house-funded counterparty positions are included in this pilot.

Current delivery boundary

The release adds pooled demo accounting, participation controls, audit records, manual resolution with independent approval, and a scheduled resolution engine. Real-money execution stays disabled. Independent result feeds, financial-crime screening, payment-destination ownership checks, bank reconciliation, staffed operations and external assurance remain launch dependencies. An adapter or written policy is not evidence that its external service is connected.

Fees and transparent quotations

Proposed cash fees

For a KES1,000 deposit, the proposed fee is KES20 and wallet credit KES980. At the currently published 1.5% M-Pesa collection rate, KES15 is gateway cost and KES5 is contribution before operating expenses. This is a commercial illustration, not a live deposit offer.

For a withdrawal delivering KES1,000, the illustrative provider cost is KES20 and the TOBOA charge KES5. Wallet deduction is KES1,025. For KES10,000 received, the respective costs are KES40 and KES50, giving a KES10,090 deduction. All amounts must be displayed before confirmation.

The demo calculator models M-Pesa wallet transfer bands as up to KES1,500, over KES1,500 through KES20,000, and over KES20,000, at KES20, KES40 and KES60. Paystack’s published wording has a boundary ambiguity around KES20,001. Obtain the contractual tier definition, tax treatment and complete fee schedule before cash use. Cards and other destinations are outside this model.

Fee acceptance and changes

Store the complete quote, fee version, expiry, destination and user acceptance with each cash request when that integration is built. Changed amounts or destinations require fresh approval. Provider price changes apply to newly accepted requests; TOBOA absorbs a difference on an already accepted quote unless it cancels and obtains fresh consent. Never silently add a fee to an existing position.

The current Paystack test wallet remains a separate legacy test facility; this release does not retrofit its transactions with the proposed fee schedule. The public calculator demonstrates the new schedule without moving funds. Cash-wallet implementation and reconciliation are explicit prelaunch work.

Source: Paystack Kenya pricing, https://paystack.com/ke/pricing, checked 28 October 2026.

Pool payouts and financial conservation

Payout calculation

At closure, total accepted stakes form the pool. Divide each winner’s stake by all winning-side stakes and multiply by the total pool to calculate their gross share. Aggregate each customer’s positions in that market. Profit is gross payout less that customer’s total stakes. The commission is 10% of positive profit, rounded to the nearest minor unit with half units rounded up. Net payout is gross payout less commission.

Example: YES contains 60,000 credits and NO contains 40,000. A participant stakes 1,000 on YES. If YES wins, the indicative gross payout is 1,666.67, profit 666.67, commission 66.67 and net credit 1,600.00. Exact allocation of the final hundredth depends on the pool-wide rounding rule. A correct prediction does not promise a fixed return while the pool remains open.

Rounding and conservation

Store amounts as integer hundredths. Compute proportional entitlements with integer arithmetic. Allocate leftover hundredths by descending fractional remainder, breaking ties by stable account identifier. Calculate commission after gross allocation. The sum of customer net payouts and house commission must equal all stakes exactly. Refund original stake amounts without commission when voiding.

Unsupported and exceptional pools

A total below 100 credits, an empty side, no stake on the eventual winning outcome, a cancelled event under its terms, or an unresolved evidence deadline results in VOID and stake refunds. TOBOA does not take unclaimed pools. Suspended or disputed markets require review; they must not be automatically decided merely because a timer expires.

Balances and irreversible records

A stake immediately transfers available credits to reserved pool credits. No participant can spend those credits again. Settlement transfers the reserved pool to winners and the house commission account in one database transaction. Journal entries are balanced and immutable; corrections use new entries. Repeated requests return the original result and cannot create additional value. Demo issuance is explicitly recorded against a demo issuer account.

No early stake cancellation or sale is offered. In a future CLOB, shares may change owners and voiding cannot simply refund everyone’s purchase cost. Its funded cancellation convention, matching priority, trading fees and commission treatment must be approved separately.

Binding market terms and outcome resolution

Terms fixed before participation

Each pool records its question, category, event identifier, YES and NO conditions, units and threshold, primary and secondary sources, closing time, expected evidence time and evidence deadline. Source documents must state first-publication versus revised-data treatment, tie rules, postponement and cancellation handling. Dates are stored in UTC and displayed in East Africa Time. Published terms cannot be edited.

The initial pooled catalogue is restricted to Economy, Finance and Climate. Two distinct source organisations are required, but different domains alone do not prove independence. A reviewer must check shared upstream dependencies, availability, redistribution rights and exact interpretation. Public evidence URLs are references; the application does not fetch arbitrary user-supplied URLs.

Normal process

Staking closes at the server deadline. After the expected evidence time, an authorised administrator can propose YES, NO or VOID with an explanation and evidence link. A second administrator, different from both proposer and market creator and without a position, must approve. The proposal remains challengeable for 48 hours. Settlement is permitted only after that window and required approvals. A revised proposal restarts the full window.

Automated process

A scheduled worker can process a configured HTTPS adapter response authenticated with HMAC SHA256. Each observation must match the locked event and source URLs, contain matching final outcomes from both sources, have a unique identifier and be fresh within 15 minutes with at most 30 seconds of future clock skew. The adapter is responsible for obtaining, interpreting and preserving the actual independent source evidence. It is not connected by default.

Valid observations may propose a result. Contradictory authenticated evidence pauses it for review. Missing, invalid, stale or unavailable data never means NO. An open pool without evidence at its deadline receives a provisional VOID and the same challenge window. No AI-generated assertion is sufficient authority to release money.

Challenges and finality

Participants may object within the review window with reasons. A challenge stops automatic settlement. A reviewer independent of the complainant, proposer and creator records a response; a fresh proposal and challenge window are then required. Evidence corrections before finalisation follow this process. After finalisation, the journal is not rewritten. Proven operational errors require independent review and company-funded remediation, not unannounced recovery from unrelated users.

Participation safeguards and fraud response

Limits apply server-side before a stake is committed. Lower limits take effect immediately and cannot be increased online in this release. Cooling-off prevents new stakes while preserving settlement credits. Account closure and cash withdrawal processes must be implemented before cash testing; exclusion must never force continued participation.

Implemented review triggers

Five accepted stake submissions in one minute cause the next attempt to create a review hold and refuse the new stake. The participant may send an appeal to the review queue. A hold prevents new stakes, not lawful settlement credits. Case responses and reviewer identities are recorded. This narrow rule is a starting control, not a general fraud detector.

Required controls before cash

Verify identity, age and payment-source ownership through appropriate services. Screen and monitor financial-crime risk using a documented risk-based process. Detect linked accounts using multiple proportionate signals such as shared destinations, devices, funding patterns and coordinated positions. A shared IP address alone must not establish wrongdoing. Do not automatically confiscate balances based on a score.

Require stronger authentication for new devices, recovery and destination changes. Bind withdrawal approval to amount and destination, apply risk-based holds and separate initiation from approval. Monitor rapid deposit-to-withdrawal cycles, circular transfers, unusual success patterns, source manipulation, repeated failed payments and promotional abuse. Commission-generating activity is not exempt from scrutiny.

Use minimal necessary personal data, access controls and a documented retention schedule. Keep passwords, OTPs and full payment credentials out of logs. Obtain independent privacy and security review, and provide explanations and appeal routes consistent with lawful investigative confidentiality.

Operating controls and economic sustainability

Revenue and stress testing

House revenue is earned fees, not deposits or reserved stakes. In a one-side-per-customer pool, the 10% profit commission equals 10% of losing stakes. In a 100,000-credit pool split 90/10, it earns 1,000 when the majority wins and 9,000 when the minority wins. This conflict requires outcome independence. Neither scenario guarantees an operating profit.

Illustrative monthly model: KES10 million deposits at 0.5% collection contribution yields KES50,000. With KES20 million settled stakes and positive customer market profits of KES2 million, KES5 million or KES10 million, commissions are KES200,000, KES500,000 or KES1 million. After assumed fixed costs of KES300,000 and variable costs and expected losses of KES200,000, results are minus KES250,000, plus KES50,000 or plus KES550,000. These are assumptions, excluding tax; replace them with actual costs and behaviour.

Capital and reconciliation

Before cash launch, hold liquid assets covering all customer liabilities and additional company-funded reversal, remediation and operating buffers. Do not count an accounting reserve as available cash. Reconcile internal journals, gateway records and bank balances daily with independent exception review. Payment settlement delays and simultaneous withdrawal demand must be stress-tested. Size buffers from measured risks and approved pilot exposure, not an invented universal percentage.

Incident response and accountability

Name accountable owners for security, financial reconciliation, market resolution, complaints and privacy. Preserve a separation between revenue decisions and result approval. Use protected deployment branches, administrator MFA, least privilege, managed secrets, tested backups and independent monitoring. A designated responder must handle alerts and communicate material incidents under the approved reporting plan.

Pause new activity on unexplained reconciliation breaks, evidence compromise or critical security incidents. Preserve logs, contain access, assess customer impact and use compensating entries where necessary. Keep a documented recovery target and prove it by a restore exercise. Do not resume merely because a technical alert disappears.

Reference frameworks: OWASP ASVS 5.0 for application verification; NIST Cybersecurity Framework 2.0 for governance through recovery; FATF Recommendations for risk-based financial-crime controls. These are implementation targets, not certifications or a claim of universal compliance.

Release evidence and launch conditions

Release conditions

A cash pilot requires written authority for its scope, provider acceptance, corporate and financial readiness, verified identity and age, source adapters tested against real events, independent reviewers, reconciled funding, tested payout controls, customer disclosures and incident arrangements. Approval in one domain must not be represented as approval in another. No automated setting in this release enables real-money pools.

Customer notices and complaints

Show gross stake, changing estimated payout, commission and net return before acceptance. Show the evidence and review deadline after proposal. The pool account review form records appeals for staff; participants can challenge market results through each proposed pool. A named, staffed external support contact and response timetable must be published before cash testing. Proposed service targets are acknowledgement within two working days and a reasoned response within ten working days, with updates on delays.

Change control and wind down

Publish a new version for material changes and obtain fresh acceptance. Existing positions retain accepted terms. On wind-down, stop new activity, reconcile balances, resolve or void outstanding pools under their terms, return available customer funds through verified destinations and continue complaints handling. Company-funded remediation covers documented platform error under the agreed plan; it does not reimburse ordinary prediction losses.

Reference links: https://owasp.org/projects/asvs ; https://www.nist.gov/cyberframework ; https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html . Rulebook owner: TOBOA management. Named officers and external support details must be supplied before a cash pilot.