A Network of Shell Firms, Binance Wallets and USDT: What the Sh115 Million Freeze Reveals About Kenya's New Anti-Money Laundering Strategy

A network of shell companies, international remittance services, intermediary bank accounts and cryptocurrency wallets has placed two Kenyans at the centre of one of the country’s most detailed digital financial crime investigations, after authorities secured court orders freezing Sh115 million they believe is linked to a sophisticated money-laundering operation involving more than Sh300 million.

The case stretches well beyond frozen bank accounts. Court documents describe alleged fund flows through international remittance platforms, multiple intermediaries, shell companies and stablecoin wallets on Binance, offering a rare look at how investigators are tracing suspected illicit financial flows across both the traditional banking system and cryptocurrency networks.

The investigation also comes as Kenya steps up efforts to strengthen its anti-money laundering framework ahead of its target of exiting the Financial Action Task Force (FATF) grey list, with regulators introducing new legal powers, blockchain analytics capabilities and tighter oversight of digital assets.

The frozen assets include 751,853.70 USDT (about Sh97.2 million) linked to Glory Kithure and 896 USDT (about Sh115,852) linked to Michael Machimbo.

Authorities also froze Sh17.6 million held across nine accounts at Equity Bank, Stanbic Bank, NCBA, KCB and Absa.

Investigators Allege Two Parallel Money Flows

The Assets Recovery Agency (ARA) believes the respondents received millions of shillings through two separate but interconnected channels.

The first relied on international remittance services, shell companies and intermediary bank accounts.

Investigators say six individuals and two companies participated in moving funds into Kenya.

Justice Gaturu and Richard Mwangi allegedly received money from overseas alongside DigitalMall Global Ltd and Bitflux Fintech Ltd before routing it through Patrick Mwendwa and Purity Michael. The funds ultimately landed in accounts controlled by Michael and Glory.

Between October 2022 and January 2024, Michael allegedly received Sh80.7 million into Equity Bank accounts from Purity Michael and another intermediary identified as Kevin Kipngeno.

Another Sh17 million was allegedly transferred into his Stanbic Bank account from Bitflux Fintech Ltd during the same period.

Glory, meanwhile, allegedly received Sh53.6 million between July 2022 and May 2025 through 57 separate bank transfers, each ranging between Sh10,000 and Sh550,000.

According to investigators, the transfer sizes were deliberately structured.

Under Kenya’s anti-money laundering framework, cash transactions worth US$15,000 (about Sh1.9 million) or more must be reported to the Financial Reporting Centre (FRC), while cross-border transfers of US$10,000 (about Sh1.3 million) or more are also subject to reporting requirements.

“The repeated use of amounts just below the reporting threshold is consistent with the structuring of transactions to avoid regulatory reporting requirements,” the ARA says in court filings.

“When considered together with the subsequent movement of the funds through additional intermediary accounts before reaching the respondents, it constitutes a recognised indicator of the layering stage of money laundering.”

A Trail of Bank Transfers

Investigators reconstruct one transaction chain beginning with two payments from US payments platform Chime Inc. into Justice Gaturu’s Equity Bank account.

Justice allegedly transferred Sh1.1 million to Patrick Mwendwa in three instalments.

Patrick then sent the funds to Purity Michael, who subsequently transferred Sh500,000 twice into Glory’s Equity Bank account.

Investigators say Glory later withdrew Sh100,000 through M-Pesa before transferring portions of the remaining funds to other bank accounts, including Michael’s.

Court records further allege that Sh5.25 million was later paid to Aristocars Ltd in what investigators believe was the purchase of a motor vehicle.

In another example, funds originating from Sendwave and another individual allegedly moved through the same chain before enough money accumulated to make a Sh9.38 million payment to Ace Prestige Auto Ltd for another vehicle.

Detectives say they have already dispatched a Mutual Legal Assistance (MLA) request to the United States seeking transaction records linked to international remittance providers.

The Crypto Trail Led Investigators to Binance

The second channel centred on cryptocurrency.

According to investigators, the alleged laundering scheme relied on USD Tether (USDT), the dollar-backed stablecoin, moving funds through multiple crypto accounts before converting them into Kenyan shillings.

Court documents identify Michael, Glory, Kevin Kipngeno, Samuel Simiyu, Wanza Mutuku and Eliud Korir as part of the crypto transaction chain under investigation.

Investigators allege USDT originated from a NoOnes account controlled by Samuel Simiyu but registered using Wanza Mutuku’s identification details before being transferred into Binance wallets allegedly controlled by Michael and Glory.

Most of those stablecoins were then transferred to Kevin Kipngeno’s Binance wallet, where investigators say they were converted into Kenyan shillings before being remitted into local bank accounts.

Between June and September 2024 alone, Michael’s Binance wallet allegedly received 220,508 USDT in ten transactions.

Court records further indicate that between February 2023 and November 2025, the same wallet transferred or withdrew about 899,130 USDT, equivalent to roughly Sh116.3 million.

Glory’s Binance wallet allegedly received 930,597 USDT between January 2023 and November 2025 before transferring out 178,491 USDT.

Samuel Simiyu reportedly told investigators he operated accounts on NoOnes, OKX and Paxful and admitted Michael approached him about using those accounts to transfer cryptocurrency into Binance wallets.

However, according to the affidavit, he denied knowing where the digital assets originated.

Neither Michael nor Glory offered investigators any explanation for the transactions.

“Both exercised their right to remain silent, declining to offer any explanation, innocent or otherwise, for the funds they received,” the ARA states.

A Case That Mirrors Kenya’s Broader AML Reforms

Beyond the courtroom, the investigation reflects the direction Kenya’s financial crime enforcement is taking.

After being placed on the FATF grey list in February 2024 over weaknesses in combating money laundering and terrorism financing, Kenya committed to strengthening customer due diligence, beneficial ownership verification, suspicious transaction reporting and inter-agency coordination.

Authorities have also brought together institutions including the Assets Recovery Agency, Financial Reporting Centre, Directorate of Criminal Investigations, Office of the Attorney General and Business Registration Service as part of a coordinated response to financial crime.

The Financial Reporting Centre has reported suspicious transaction reports covering nearly Sh6.976 trillion over the three years to 2023, with banks accounting for about 91 percent of reported activity. The agency has identified sectors such as real estate, legal services and accounting among areas vulnerable to money laundering, illustrating the scale of illicit financial flows that enforcement agencies are attempting to disrupt.

The Central Bank of Kenya has also partnered with the United Kingdom’s Treasury to strengthen risk-based supervision of non-bank financial institutions, one of the commitments tied to Kenya’s FATF action plan.

Crypto Regulation Is Catching Up With Crypto Crime

The allegations involving Binance and USDT also arrive as Kenya builds a regulatory framework specifically for digital assets.

The Virtual Asset Service Providers (VASP) Act, 2025 requires cryptocurrency businesses to obtain licences, conduct Know Your Customer (KYC) checks, report suspicious transactions and cooperate with agencies including the Financial Reporting Centre and the Directorate of Criminal Investigations.

At the same time, the Capital Markets Authority is procuring a blockchain analytics platform capable of tracing wallet activity, mapping fund movements, attributing wallet ownership and supporting forensic investigations involving cryptocurrencies.

Separately, proposed amendments to the Tax Procedures Act would require licensed virtual asset service providers to submit customer identities and transaction records to the Kenya Revenue Authority, making it more difficult to conceal crypto-related income or evade taxes through digital assets.

Those reforms are particularly relevant because the ARA alleges Michael and Glory transacted more than Sh300 million while consistently filing nil tax returns with the Kenya Revenue Authority.

More Than One Court Case

The preservation orders granted on July 3 cover about Sh115 million, but investigators estimate property traceable to the respondents exceeds Sh300 million.

Whether the allegations are ultimately proven remains for the courts to determine.

What is already evident, however, is that Kenya’s anti-money laundering investigations are no longer confined to conventional bank accounts.

Investigators are combining banking records, international legal cooperation, blockchain transaction tracing, tax intelligence and asset recovery powers to follow money across both fiat and digital financial systems.

For a country seeking removal from the FATF grey list, cases like this demonstrate how enforcement is evolving to match the complexity of modern financial crime, where suspected illicit funds can move from overseas remittance platforms to shell companies, through intermediary accounts and into stablecoin wallets before being converted back into local currency.

Download the free Kaspersky SMB Cybersecurity Guide here to learn how businesses can move beyond traditional antivirus and build a more resilient approach to cybersecurity.