My fellow Kenyans,
Today, I want to talk about eCitizen, having spent a lot of time looking at it.
eCitizen was supposed to be one of Kenya's great public-sector reforms: a single digital gateway through which citizens and businesses could access and pay for government services. It was intended to replace fragmented, manual and cash-based systems with something faster, more transparent and more accountable - while closing the revenue leakages that had long plagued government collections.
The platform was initially developed by Webmasters Kenya Ltd (“Webmasters”), contracted by the World Bank's International Finance Corporation (IFC) in 2013.
The original pilot covered just 10 government services and reportedly cost only US$76,000 - about KSh7.6 million at the time. What began as a modest digital project has since grown into critical national infrastructure handling thousands of government services and enormous volumes of public money.
But the costs have grown dramatically as well. Based on the figures assembled from audit records, historical commissions and subsequent vendor payments amount to approximately KSh 4.1 billion actually paid or recorded through June 2025. Including approximately KSh1.188 billion in outstanding vendor bills, the amount rises to roughly KSh 5.3 billion.
These amounts should not all be characterized as payments directly to Webmasters - the arrangements involved other entities and consortium members - but they illustrate the enormous financial ecosystem that has developed around a platform whose original development reportedly cost about KSh7.6 million.
And that is where the story becomes deeply troubling.
Before I go into the findings, I want to introduce you to Webmasters.
Webmasters' World Bank debarment
In the last month, Webmasters has been in the news for the worst of reasons.
In the last few weeks, the World Bank Sanctions Board debarred Webmasters Kenya and James Ayugi (founder) for a minimum of five years after finding fraudulent and obstructive practices.
The fraudulent-practice finding concerned a separate World Bank-financed contract. Webmasters presented two individuals as key experts, submitted their CVs and represented that they were available for an assignment. When investigators contacted them, however, both said they had not authorized Webmasters to use their CVs, did not know they had been designated as key personnel and did not participate in the contract.
The Sanctions Board concluded that Ayugi had acted at least recklessly in making the representations. The positions concerned carried US$98,000 in allocated remuneration.
The second finding concerned obstruction. World Bank investigators requested documents to determine, among other things, whether personnel had actually performed the work and how project funds had been used. Despite repeated requests, extensions and discussions with Ayugi, Webmasters provided only limited documentation and failed to provide much of what investigators sought.
The Sanctions Board concluded that this materially impeded the World Bank's inspection and audit rights and constituted an obstructive practice.
That history cannot simply be dismissed as irrelevant to Kenya.
That is the entity that is trusted to not only collect much of the government’s revenue in Kenya, but, also, to audit itself.
I am not joking when I say this. Let me introduce you to my findings.
Finding 1: Government does not fully control its own platform
The Auditor-General found that although eCitizen was handed over to the Government in August 2017, the Government Digital Payments Unit "did not have full control of the system and significantly relied on the vendor for some critical functions."
That dependence makes it difficult for government personnel to perform critical configurations or make changes necessary to support the platform's growth, creating what the Auditor-General describes as a "single point of failure."
In other words, after years of operation and billions of shillings in associated costs, the Government remains substantially dependent upon a private vendor to perform critical functions on infrastructure through which public revenue flows.
My point here is that, if Webmasters tells us that it only collected KSH 1.5 trillion, there is nobody outside of Webmasters who can dispute it. Nobody other than perhaps Mr. Ayugi can tell us for certain how much the government raised.
Yes – the same person who the World Bank has banned for fraud or obstruction.
Finding 2: The Auditor-General could not get the access needed to fully audit the system
The special audit found that the National Treasury refused or was unable to facilitate the level of system access required for auditors to assess security and privacy controls at the application, database and network levels.
Consequently, the effectiveness of important security controls could not be fully verified. The audit material also notes that there was no evidence of independent third-party assurance sufficient to fill that gap.
This is extraordinary on so many levels: a system entrusted with enormous amounts of public money should be more - not less - open to rigorous independent audit.
Finding 3: Billions in reported collections lacked supporting bank statements
For FY2023/24, the eCitizen Revenue Accountability Statement reported collections of approximately KSh100.84 billion, but bank statements provided to the Auditor-General supported only approximately KSh64.30 billion.
The audit material therefore identifies a gap of roughly KSh36.5 billion in supporting bank statements.
That finding says that auditors did not receive the banking evidence necessary to verify a huge portion of the reported collections, KSh 36.5 billion!
In just one year!
Finding 4: KSh2.57 billion in the settlement account could not be matched to invoices
The audit identified approximately KSh2.575 billion of receipts in the settlement account at 30 June 2024 that could not be matched to invoices in the Pesaflow system. The discrepancies were associated with partial, erroneous and duplicate payments.
In street parlance, we would say that KSh 2.6 billion “zilikunywa maji”. KSh 2.6 billion collected through a platform whose central purpose is to make government revenue traceable could not be readily matched back to the underlying transactions.
And here, it makes sense to explain how this entire system works.
Believe it or not, eCitizen is only “digital” as far as collecting money” from you and I.
Once the money is collected, “being digital” ends.
Money is manually transferred to various government units, effectively in bags or boxes, in a process that takes up to 8 days.
But the key is that, it is done manually.
How the heck does that make sense to anybody?
What is the value of the KSH 5.3 billion invested in this?
Finding 5: KSh127.85 million left the government paybill for private entities
The Auditor-General found that collections through Paybill 222222 were supposed to sweep automatically into the government's KCB settlement account. Yet on 25 January 2024, four transactions totaling KSh127,850,950 were instead transferred from the paybill to private entities.
Private bank accounts. Unknown bank accounts.
According to the audit material, supporting approval and documentation for those transfers were not provided.
That demands a simple answer from government: Who received the KSh127.85 million, why was it transferred to them, who authorized it, and where is the documentation?
Finding 6: An undisclosed account appeared in the collection chain
The Auditor-General found approximately KSh 6.33 billion entering Equity Bank eCitizen collection accounts from an account that was not among the collection accounts approved by the National Treasury.
Critically, the bank statement for the underlying account was not provided for audit upon request, meaning auditors could not establish the full value of transactions passing through it.
A public-revenue system should not contain financial pathways that the country's supreme audit institution cannot completely examine.
Finding 7: Government paid private vendors to provide a gateway on a platform government owns
Under the ICT Authority's support-and-maintenance framework involving Webmasters Kenya, Pesaflow and Olive Tree Media, payments had reached KSh492.16 million plus US$414,299.60 by 30 June 2024. Of that amount, approximately KSh142.16 million plus US$414,299.60 related to payment-gateway services.
The Auditor-General considered these payments irregular and illegal because the Government owns the platform and recommended that such payments be stopped and recovered.
In other words, KSH 530 million paid during this period, are illegal payments – that the government paid to use its own platform.
As incredulous as that sounds.
This is a country that is spending over 80% of every single shilling it earns on debt service. And, apparently, it can afford to pay an illegal KSH 530 million for a platform is supposedly owns!
Finding 8: Payments were made to an entity that was not a party to the agreement
There is another disturbing feature of those payments. The framework agreement was with a consortium involving Webmasters Kenya, Pesaflow and Olive Tree Media, yet the approximately KSh492.16 million plus US$414,299.60 was paid to Electronic Citizen Solutions Ltd, which the special audit identified as not being a party to that agreement at the time.
At a minimum, Kenyans deserve a complete explanation of the legal and contractual basis upon which public money was paid to that entity.
Finding 9: Kenyans were irregularly charged billions in convenience fees
The Auditor-General found that the prescribed prorating mechanism for convenience fees was not followed. Instead, citizens were charged a flat KSh50 or US$1 per transaction, resulting in approximately KSh1.808 billion plus US$3.334 million being irregularly and illegally collected before January 2023.
Further irregular and illegal charges between December 2023 and June 2024 added approximately KSh349.8 million, bringing the shilling component identified in the source to roughly KSh2.16 billion, before the dollar amounts.
These were not abstract accounting entries. They were charges imposed directly upon citizens attempting to obtain government services, illegally.
Finding 10: The system still relies on manual settlement
A central justification for eCitizen was automation. Yet the Auditor-General reported that while collections were automated, transfers to Ministries, Departments and Agencies were still conducted through a process involving manual preparation and approval of payment records.
The Auditor-General said this creates delays, operational inefficiencies and greater risk of errors - even though the necessary MDA accounts and services were already mapped within eCitizen to permit automated transfers.
Think about that. The accounts needed to automate disbursements are mapped, and are alive in the platform.
But somehow, those in charge insist on a manual “disbursement”.
Why?
Note that the special audit calculated an average delay of approximately eight days between collection and remittance to government entities.
Finding 11: Even the platform's basic service records were unreliable
The audit identified duplicated services, services without MDA names, missing linked bank accounts and settlement reports containing services for which no account number was mapped. This forced officials to manually enter account numbers using physical correspondence. In some instances, revenue could not be settled because the necessary account information was missing.
This is precisely the sort of manual intervention that a national digital payment platform was supposed to eliminate.
Finding 12: There was no proper helpdesk for a platform serving the entire country
The Auditor-General found that eCitizen lacked an established and structured helpdesk system for managing incidents. Consequently, reported problems could not be systematically tracked to determine whether they had been resolved. The Auditor-General warned that unresolved incidents could delay service delivery and, because payments occur throughout the service process, could result in citizens being denied services altogether.
Finding 13: Government could not clearly demonstrate who was ultimately in charge
The Auditor-General also found a lack of clarity in eCitizen's governance structure. Operations were spread across several government institutions and committees, yet records establishing committee composition, tenure and terms of reference were unavailable.
Isn’t “unavailable” an interesting phrase here?
Remember the World Bank’s complaint?
When the World Bank’s investigators requested documents from Webmasters, they were taken on a goose chase that had no end.
Told what they were asking for was "unavailable".
And that is precisely what happened here as well.
The earlier special audit had similarly found no oversight body mandated to coordinate the participating government departments and provide strategic leadership.
The Auditor-General warned that this exposes eCitizen to system failures, data breaches and compliance risks.
The questions our government must now answer:
Put these findings together:
(1) We have critical national infrastructure handling enormous amounts of public revenue.
(2) Government does not have full control of it.
(3) Government remains significantly dependent upon a private vendor for critical functions.
(4) Auditors were unable to obtain sufficient system access.
(5) Billions in reported collections lacked supporting bank statements.
(6) Billions more could not be matched to invoices.
(7) Money was transferred from a government paybill to private entities without supporting documentation being provided to auditors.
(8) An undisclosed account appeared in the collection chain.
(9) Government paid for gateway services on a platform it owns.
(10) Citizens were irregularly charged convenience fees. And some of the very processes that were supposed to be automated remain manual.
And at the center of this game of musical chairs, is an entity that has now become synonymous with fraud and dishonesty.
These are the musings of Bonnie Mwangi. Not innuendo or conjecture.
They are findings of the Auditor-General.
Again:
The private company at the centre of the platform's development has now been debarred by the World Bank for fraudulent and obstructive practices arising from separate World Bank-financed contracts.
That should change the conversation, if our government has any decency.
If the World Bank will not trust Webmasters with its money, why should Kenya do so without answers?
This is not an allegation that Webmasters stole Kenya's eCitizen revenue. Let me make that clear.
But it is absolutely a reason for Kenya to demand a level of scrutiny commensurate with the importance of the system.
If an institution such as the World Bank concludes that a contractor engaged in fraudulent practices and materially impeded its audit rights, Kenya cannot behave as though that finding is irrelevant while the same company remains associated with infrastructure through which vast amounts of Kenyan public revenue pass.
Webmasters must answer.
It should explain its role in the platform, what functions it continues to control, what it and related entities have been paid, the basis for those payments, and what safeguards exist to ensure that the Government can independently operate and audit eCitizen.
The Government must answer.
(1) Why, years after the platform was supposedly handed over, does government still lack full control?
(2) Why were auditors denied the access necessary to examine critical controls?
(3) Why were billions of shillings of reported collections unsupported by bank statements provided for audit?
(4) Who received the KSh127.85 million transferred to private entities?
(5) What was the other transfer of KSH 2.6 billion for, and to whom?
(6) Why wasn't its bank statement produced? Why was government paying gateway fees to use infrastructure it owns?
I think these are legitimate questions. Don’t you think?
And then there is Parliament.
Parliament receives these Auditor-General reports. Parliament appropriates the money. Parliament summons accounting officers. Parliament has the constitutional machinery to demand documents, interrogate witnesses and establish where public money went.
So where are the consequences?
Folks, oversight without consequence is theatre.
Parliament should demand the contracts, bank statements, system-access records, vendor-payment schedules and beneficial ownership information associated with the entities operating around eCitizen.
It should require a complete reconciliation of the questioned transactions.
And it should demand a credible plan for transferring the technical knowledge and administrative control necessary for government to operate its own critical infrastructure.
Kenyans must demand answers
eCitizen was created, in part, because Kenya needed to stop revenue leakage and make government collections transparent. It would be a bitter irony if the system designed to bring accountability to government revenue itself became a system that citizens could not fully hold accountable.
Kenyans should therefore demand something very simple:
Show us the money. Show us the accounts. Show us the contracts. Show us who controls the system.
And where the Auditor-General has identified irregularities, investigate them. Where money is recoverable, recover it. Where laws were broken, prosecute those responsible. Where vendors cannot satisfy the standards expected of companies entrusted with critical national infrastructure, reconsider whether they should continue to occupy that position.
This is not about politics. It is about whether Kenyans control Kenya's public infrastructure and can account for Kenya's public money.
The World Bank has already decided that Webmasters' conduct on the contracts it examined warranted a minimum five-year debarment.
Kenya should at least be willing to ask the harder question:
If the World Bank does not trust Webmasters with World Bank-financed business, why should Kenyans entrust a company carrying that sanction with critical functions surrounding one of the most important public-revenue platforms in the country without a comprehensive, independent investigation?
The Auditor-General has done the country a service by putting the warning signs on paper.
Now it is Parliament's job to act.
@Senate_KE@NAssemblyKE@FlavNasmbu@MoGAbdi@Paul_Muite@JohnMbadiN@webmasterske_@WorldBankGroup@IFC_org
The Chairman of IEBC and his Vice Chair are determined to force the discredited MIRU Systems Technology from South Korea into the 2027 General Elections for financial gain and to bungle the elections.
After they suspected that the scheme would face exposure and public scrutiny showing how they tailor-made the specifications and sneaked them into the tender to have a predetermined outcome, IEBC commissioners tried to force officials in the Directorate of Supply Chain Management and the Directorate of Electoral Management to own the specifications in defence of the Commission in the case filed before the Public Procurement Administrative Review Board challenging the skewed procurement in favour of MIRU Systems.
The officials have firmly refused to give false testimony to facilitate corruption and electoral fraud.
Consequently, the Chairman and his Vice Chair have victimized officials in the two departments and transferred all of them, except the compromised head of department, to far-flung counties and replaced them with cronies.
Patriotic IEBC officials have sought me out from my short holiday and requested me to inform Kenyans of the rot, the intimidation, and the plans to bungle the 2027 General Elections.
It is my belief that the Public Procurement Administrative Review Board will also show patriotism to the country and cancel this tender in its ruling later today.
It is my considered opinion, following advice from procurement experts and IEBC insiders, that it is not technically possible to procure a new election management system given that the elections are 11 months away, and there is practically no time to facilitate digital migration from the current system and address whatever inadequacies are anticipated.
Again, there is real and genuine fear that the change of the election management system at this late hour is a scheme to interfere with the voters' register, mostly in areas where Mr. William Ruto has been openly rejected.
I call upon the IEBC to call off this tender and instead upgrade the current system to address the few shortcomings identified so far.
Lastly, I call upon the IEBC Chairperson and Vice Chairperson to stop the harassment and victimization of staff who have chosen professionalism and patriotism over manipulation and corruption.
Mr. Chairman, do not throw Kenya into chaos and anarchy. Do not subvert the will of the people of Kenya. Leave Kenyans to make their decision at the ballot. You live in Kenya, you have access to the people, and you can hear what they are saying about sending this regime home come 10th August 2027.
Be patriotic, Mr. Chairman!
The Empire State Building shines red and white tonight in celebration of @Arsenal’s Premier League Title and trophy celebration.
See the lights live: https://t.co/iavtXSm3Fx
Raila Odinga steps back & the whole system shakes. ODM kinda confused, opposition scattered, even the gov’t looks lost.
Turns out many weren’t leaders, they were just echoing Baba for tribal applause & fake validation. Now the script is gone, politics feels like survival mode till 2027. No direction. No conviction. Just noise.
This is the moment for young, fearless leaders to rise, not followers in designer suits pretending to be brave. Kenya deserves integrity, courage & delivery, #Creative leadership not recycled politics.
We don’t need more politicians.
We need LEADERS uncompromising, unbought, unafraid.
It starts NOW!!
#DON 🐐
I state this plainly: Kenya’s assets belong to the people. Any privatization process must meet the highest standards of legality, transparency, and accountability. The story of our assets belongs to the public, not to boardrooms.
We are going to put on a dirty fight. This is a war we are going to fight upto the Supreme Court of Kenya, and anyone who thinks he can sale @kenyapipeline is day dreaming. We will not allow that to happen. Our national assets are not for sale. #DefendKPC
Affordable houses are being built on public land and therefore it is ILLEGAL to sell them to private individuals. When power changes, we will RECOVER those houses and give them back to the public. No Kenyan should waste his money buying those houses.