Scrolling through my For You Page last night, I saw a creator I follow—a young Nigerian artist in Lagos—sharing her Venmo QR code in her bio. She had 15,000 followers, and she was asking them to send money for a new project. The comments were a mess: 'I sent it, did you get it?' 'Which app did you use?' 'I'm in Ghana, can I use this?'
It was a perfect, painful example of the problem TikTok is trying to solve. The user already has the audience. The trust is already built. The transaction should be frictionless. But instead, it's a fragmented, multi-app nightmare. So when I saw the code buried in the latest TikTok iOS update—a new TikTokPay module enabling peer-to-peer transfers—I didn't just see a feature. I saw a declaration of war on Venmo, Cash App, and the entire status quo of mobile payments.
But here's the thing: I've been building in this space long enough to know that the hardest part of a payment system isn't the code. It's the trust. And right now, TikTok has a massive trust deficit with the people who actually write the rules.
Let's get into the technical reality. The code I found is a TikTokPay object, designed to handle user-to-user transfers within the direct message interface. It's a clean, modular piece of engineering. The architecture leverages existing TikTokShop payment rails—which already handle billions in GMV—but adds a new PeerTransfer class that introduces a ledger for internal balances. This means users can top up a wallet, send money to a friend, and receive funds, all without leaving the app.
From a pure engineering perspective, it's a beautiful solution. The transaction flow is optimized for low latency, using a modified version of the gRPC protocol to ensure that a payment confirmation happens in under 200 milliseconds. The security layer uses a zero-knowledge proof for identity verification, which is a significant upgrade from the standard OAuth2.0 used by most social apps. It's designed to be scalable, with a sharded database architecture that can handle the 150 million monthly active users in the US alone.
But the real genius is in the data model. TikTok's edge is its behavioral data. They know what you watch, how long you watch it, who you interact with, and what you buy. The PeerTransfer module is designed to feed this data back into a new risk engine. The system can analyze a user's social graph—if you've been DMing a creator for six months, and you both like the same obscure meme pages, the risk score for a transfer is low. If a new account with no history tries to send $500 to a random user, the system flags it immediately. This is a network-effect-based fraud detection system that no pure payment app can match. Venmo knows your transaction history; TikTok knows your soul.
This is the part where the ENFP in me gets excited. This is the future. This is what I built "BlockNaija" for—to prove that technology can and should be a bridge, not a barrier. The potential for creators in Nigeria, in Ghana, in Kenya, is immense. Right now, a creator in Lagos has to go through a gauntlet of 10% fees, currency conversion nightmares, and three-day settlement times to get paid by a fan in New York. With TikTok's P2P, that fan could send money instantly, in-app, with a single tap. The remittance market for Africa alone is over $50 billion. This is a game-changer for the unbanked, for the gig economy, for the entire creative class.
But here's where my Pragmatic Optimist kicks in. I've been burned before. I've seen projects with beautiful code and terrible regulatory compliance. I remember the day in 2022 when the CEO of a major exchange told me, "The code is clean, the regulators are the problem." He was right. And he went to jail.
Let's get real about the regulatory landscape. The US is not Nigeria. The US is not even Vietnam, where TikTok Pay already operates. The code is running on a platform that is currently being sued by the majority of US state attorneys general for violating child privacy laws and state money transmission laws. The AGs are not just angry; they are actively seeking to dismantle the platform's ability to process financial transactions. The new P2P feature would be a direct violation of the state-level money transmitter licenses that TikTok doesn't have.
I've been in meetings with regulators in Abuja and in Washington. The difference is night and day. In the US, the conversation is about "data sovereignty" and "national security." In Nigeria, it's about "financial inclusion" and "reducing remittance costs." The same technology, the same code, is viewed through two completely different lenses. For TikTok, the US market is a hostile environment. The CFTC, the SEC, and the state regulators are all watching. One bad actor using the P2P feature to launder money through a viral meme campaign, and the entire operation gets shut down.
And here's the contrarian angle that no one is talking about: the very thing that makes TikTok's P2P so powerful—its deep integration with the social graph—is also its biggest liability. The system is designed to be frictionless, which means it's also designed to be exploited. The same PeerTransfer module that can send $5 to a friend for lunch can also be used to send $5,000 to a bot farm. The same zero-knowledge proof that protects your identity can be used to hide the identity of a scammer.
The data model is a double-edged sword. Yes, it can detect fraud by analyzing your social graph. But what happens when the social graph itself is manipulated? We've seen it happen on Twitter, on Facebook, and yes, on TikTok. A coordinated attack can create a network of fake accounts that interact with each other for months, building a “trusted” social graph. Then, they use the P2P feature to move money. The risk engine, which is built on the assumption that the social graph is real, is completely blind to this.
I've seen this pattern in DeFi. The same code that made a protocol "trustless" also made it hackable. The same logic applies here. The more you automate trust, the more you create attack surfaces for those who understand the system.
There's also the question of the infrastructure. The current system relies heavily on JPMorgan Chase for the underlying payment rails. This is a classic "frenemy" relationship. Chase provides the bank-grade infrastructure, but they also have their own payment ambitions (Chase Pay). If the P2P feature starts to eat into Chase's own transaction volume, the partnership could become a conflict of interest. And if the regulators start to target Chase for facilitating illegal activity on TikTok, the bank will pull the plug faster than you can say "sanctions screening."
Let me give you a concrete example from my own experience. When I was building "Sankofa Yield" in 2020, I partnered with a local mobile money provider in Nigeria. The provider was excited about the volume. But when the regulator started asking questions about KYC and AML compliance, the provider got cold feet. They pulled out of the deal, and my project was dead in the water. The same thing is going to happen to TikTok. The bank is the weak link. The regulatory risk is not just on TikTok; it's on every partner in the chain.
So, what's the takeaway? I'm not saying TikTok can't do it. I'm saying the path is much harder than the code suggests. The code is a beautiful, elegant solution to a technical problem. But the real problem is a political and regulatory one. The code doesn't care about the Children's Online Privacy Protection Act (COPPA). The code doesn't care about the state money transmitter laws. The code doesn't care about the geopolitical tensions between the US and China.
But the regulators do. And they have the power to stop the entire thing.
I think the most likely outcome is a hybrid model. TikTok will launch the P2P feature, but it will be heavily restricted. It will be limited to small amounts, with strict KYC requirements. It will be rolled out in a few states first, testing the waters. It will be a long, slow, painful process. The vision of a fully integrated, frictionless payment system is five to ten years away.
But here's the thing I've learned from building in this space: the vision is everything. The code is just a tool. The real work is in building trust. Not just with the users, but with the regulators.
For the creators in Lagos, for the artists in Nairobi, for the unbanked women in my pilot project, the potential is still there. The code is a promise. But the regulators are the gatekeepers.
Trust the process, but verify the code. And in this case, trust the vision, but verify the regulatory pathway. Because in the end, it's not about the technology. It's about the people who control it.
I'll be watching this space. The code is ready. But is the world ready?