Equity Bank’s Sh1.49bn payroll fraud case exposes the challenge of tracing money across banks and crypto platforms
The High Court has authorised Equity Bank to freeze accounts holding Sh303.2 million in connection with an alleged Sh1.49 billion salary-processing fraud, while ordering the conversion of cryptocurrency holdings linked to the dispute into ordinary currency. The Equity Bank salary fraud proceedings centre on transactions allegedly carried out between November 2023 and June 2024, involving the bank’s internal payroll operations, several recipient businesses and accounts held at other financial institutions.
The orders extend across UBA, Absa, NCBA, Stanbic and Co-operative Bank. They also cover cryptocurrency holdings associated with three defendants on Binance or other digital asset platforms. The court directed that identifiable digital assets be converted within 10 days, with the proceeds placed in an account at a Central Bank of Kenya-licensed tier-one bank under the CBK’s appointment as escrow agent.
The proceedings put the movement of money after the alleged transfers at the centre of Equity’s recovery effort. The bank says funds were routed through third-party accounts, with some subsequently converted into cryptocurrency. The preservation orders are intended to keep identifiable assets available while the court considers the lender’s claim against the individuals and businesses named in the case.
The recovery effort reaches five banks and crypto platforms
The court’s restrictions cover accounts associated with six companies and the individual defendants. The largest listed amount is Sh156.2 million in accounts held by Axteron Technologies at UBA and Absa. Other restrictions include Sh30.8 million in a KT Owen Group account at NCBA and Sh14 million in Mac and Gray Trading accounts at Stanbic and Co-operative Bank.
The orders also cover Sh32.8 million in a Blue Kenfresh account, Sh24.2 million in a Goodmans Fresh account and Sh8.7 million in a Muda Ventures account at UBA. A further Sh36 million is covered in accounts associated with Ruth Muthoni Kamau at NCBA and Co-operative Bank. The restrictions extend to the cryptocurrency holdings identified in the proceedings.
The conversion order gives the digital assets a defined route into conventional banking. If the defendants do not facilitate conversion within 10 days, the relevant platform operators may identify and convert the holdings. The proceeds are then to be placed in the designated banking arrangement, with the CBK acting as escrow agent pending determination of the recovery suit.
That arrangement matters because the bank is seeking to preserve value across different parts of the financial system. Funds held in commercial bank accounts can be restricted through the institutions maintaining those accounts, while cryptocurrency holdings require cooperation from the platforms where the assets are held. The court’s directions bring both categories within the preservation process.
How salary-processing access allegedly enabled the transfers
Equity traces the disputed transactions to its salary-processing general ledger, accusing its former Manager-Salary Processing, David Machiri Kimani, of using authorised access to move money to third-party accounts. The bank says the transfers were disguised as salary payments despite being unrelated to genuine payroll obligations.
The transactions allegedly took place over eight months, from November 2023 to June 2024. In its case, Equity said Kimani used his assigned computer and user credentials to initiate the transfers, drawing money from the bank’s general ledger.
The bank relied on SWIFT messages identifying Equity’s institutional code, EQBLKENAXXX, as the sender and the general ledger as the source of the payments. It presented the messages alongside transaction records linking the activity to Kimani’s assigned computer and user ID.
Salary-processing operations involve payment instructions, employee details and employer funds moving through systems designed to handle large numbers of transactions. Equity alleges that the access available to the former manager was used to initiate transfers outside that purpose, with recipient accounts providing the next stage of the alleged movement.
The bank also told the court that some of the money was converted into cryptocurrency after passing through third-party accounts. It argued that the movement of funds, relationships among the recipients and the possibility of further transfers justified urgent restrictions on the assets.
Businesses named in the alleged money trail
The recovery proceedings name Kimani, Owen Karanja Kuguru and Ruth Muthoni Kamau alongside KT Owen Group Limited, Axteron Technologies Ltd, Mac and Gray Trading Ltd, Blue Kenfresh Ltd, Goodmans Fresh Ltd and Muda Ventures Limited.
Equity accused the businesses of receiving or handling funds diverted through the salary-processing transactions. It argued that some companies were incorporated specifically to facilitate the scheme, while the links between the named recipients pointed to coordinated activity.
The alleged use of commercial businesses is central to the bank’s account of how the money moved beyond its original ledger. The recipient companies are associated with different bank accounts, which is why the preservation orders extend across five financial institutions rather than remaining within Equity’s own banking network.
The case also brings together conventional banking records and digital-asset holdings. Equity’s position is that the transaction trail can be followed from its general ledger through recipient accounts and into cryptocurrency. The court’s orders are intended to preserve assets identified along that trail as the parties contest the bank’s claims.
Defendants challenge the bank’s account of the transactions
The defendants have disputed the allegations and offered different explanations for the transactions and assets covered by the proceedings.
Kuguru told the court that Axteron Technologies and Mac and Gray Trading provided trade-finance, import and shipping services. He maintained that the payments received by the companies arose from legitimate client transactions and that they were unaware the money allegedly originated from Equity. He also said the companies charged commissions of five per cent.
Joseph Kimani Machiri, who described himself as the guardian of his son David Machiri Kimani, denied that the former manager owned cryptocurrency accounts or authorised the transactions. He also challenged the bank’s calculations of the alleged loss.
Kamau, identified as the owner of Blue Kenfresh and Goodmans Fresh, challenged Equity’s use of confidential banking and personal information. She argued that the information had been obtained unlawfully and in breach of an earlier court order.
The court dismissed her application after finding that her lawyer had sworn an affidavit addressing contested matters. The judge held that an advocate should not act as both counsel and witness and treated the affidavit as hearsay. The legality of the information itself was left for consideration at the full trial.
Court preserves assets as the recovery case proceeds
The judge granted the preservation orders after finding that Equity had presented a sufficiently strong preliminary case to require an explanation or rebuttal from the defendants.
“The plaintiff has demonstrated a right that strongly appears to have been infringed by the defendants so as to call for an explanation or rebuttal,” the judge said.
The ruling also drew a boundary between preserving assets and determining responsibility for the alleged diversion. The judge said the preliminary assessment did not mean Equity would necessarily succeed when the full case was heard, stating: “I am not saying that the plaintiff will obviously succeed at the full trial.”
The court declined to issue further tracing and accounting directions sought by the bank, reasoning that such measures risked presuming liability before the evidence had been fully considered. The current orders therefore preserve the identified assets while the defendants retain the opportunity to challenge the bank’s case.
The proceedings follow an internal review by Equity that identified suspicious transactions through staff bank and mobile-money accounts. The bank initially dismissed about 195 employees after the review. The figure relates to that wider internal exercise and is separate from any finding of individual responsibility in the current recovery proceedings.
Kenya’s banking fraud recovery challenge
The case comes against a difficult recovery environment for Kenyan banks. CBK figures reported by TechTrendsKE show that lenders lost Sh1.9 billion to fraud in 2025, a 19.4 per cent increase from the previous year. The amount exposed to fraudulent activity reached Sh2.03 billion, while banks recovered Sh127.43 million, representing approximately 6.25 per cent of the exposed funds.
The figures cover the wider banking sector and a different reporting period from the transactions under dispute at Equity. They nevertheless illustrate why preserving assets early can matter when a bank is pursuing money that has passed through several accounts or been converted into digital holdings.
A separate Assets Recovery Agency investigation reported by TechTrendsKE in July 2026 involved alleged money laundering through intermediary accounts, companies and Binance wallets. That case included cryptocurrency holdings and bank accounts subject to preservation measures, illustrating the practical demands of tracing funds across conventional financial institutions and digital-asset platforms.
Kenya’s 2026 virtual-asset regulatory framework also provides a wider backdrop for the growing intersection between digital assets and financial services. The framework sets out licensing, governance, consumer protection, cybersecurity and anti-money-laundering requirements for virtual asset service providers, with supervisory roles assigned to the CBK and the Capital Markets Authority.
For Equity, the immediate proceedings concern the preservation of funds it says were diverted through its salary-processing operations. The bank’s recovery claim will turn on the evidence connecting the original transactions, the recipient accounts and the assets now subject to court restrictions.
Go to TECHTRENDSKE.co.ke for more tech and business news from the African continent and across the world.
Follow us on WhatsApp, Telegram, Twitter, and Facebook, or subscribe to our weekly newsletter to ensure you don’t miss out on any future updates. Send tips to info@techtrendsmedia.co.ke
