Kenyan court freezes Sh303.2 million, including crypto, over Equity Bank fraud claims

Kenya’s High Court has frozen up to Sh303.2 million ($2.3 million) in bank accounts and crypto linked to the alleged theft of Sh1.5 billion ($11.5 million) from Equity Bank, and ordered identifiable crypto holdings converted to cash within 10 days.

Equity Bank alleges a former salary-processing manager diverted the money through transfers disguised as salary payments between November 2023 and June 2024. The defendants dispute the claims, and the court said it was not ruling on liability.

How the Equity Bank heist allegedly moved Sh1.49 billion

According to court filings reported by Kenya’s Daily Nation and Business Daily Africa, the alleged fraud involved David Machiri Kimani, Equity Bank’s former manager responsible for salary processing.

The bank alleges that Kimani used his authorised access to the salary-processing general ledger to execute transactions unrelated to genuine employee salary payments. The transactions allegedly diverted approximately Sh1.49 billion between November 2023 and June 2024.

Equity Bank processes salaries for corporate clients using employee information, salary schedules and funds provided by employers. The bank’s case is that the former manager exploited this system to initiate transfers that appeared within its financial infrastructure but were not supported by legitimate salary oblobligations.

Investigators reportedly identified more than 40 transactions executed using Kimani’s credentials. SWIFT messages presented in court identified Equity Bank as the sending institution and its general ledger as the source of the transfers.

The transactions were also reportedly linked to the manager’s assigned computer and user identification, forming part of the evidence presented by the lender.

Equity alleged that the money was subsequently transferred to accounts belonging to third parties and companies associated with the other defendants. Some of the funds were allegedly converted into cryptocurrency, adding another layer to the recovery effort.

The bank argued that the relationships between the recipient companies and the movement of funds suggested coordinated activity. It further maintained that the involvement of digital assets created a risk that the money could quickly be moved beyond the reach of conventional financial institutions.

Court freezes bank accounts and cryptocurrency holdings

The court’s orders cover accounts held across five financial institutions: UBA, Absa Bank, NCBA, Stanbic Bank and Co-operative Bank of Kenya. Cryptocurrency holdings associated with Kimani, Owen Karanja Kuguru and Ruth Muthoni Kamau were also included.

Five companies named in the proceedings are KT Owen Group Limited, Axteron Technologies Limited, Mac and Gray Trading Limited, Blue Kenfresh Limited, Goodmans Fresh Limited and Muda Ventures Limited. The bank alleges that these businesses were connected to the movement or receipt of the diverted funds.

The individual freezing limits include:

• Sh156.2 million: Axteron Technologies accounts at UBA and Absa.
• Sh30.8 million: KT Owen Group’s NCBA account.
• Sh14 million: Mac and Gray Trading accounts at Stanbic and Co-operative Bank.
• Sh32.8 million: Blue Kenfresh’s Co-operative Bank account.
• Sh24.2 million: Goodmans Fresh’s Co-operative Bank account.
• Sh36 million: Ruth Muthoni Kamau’s accounts at NCBA and Co-operative Bank.
• Sh8.7 million: Muda Ventures’ UBA account.

The combined limits amount to Sh303.2 million, significantly below the Sh1.49 billion the bank says was diverted.

The court also directed that identifiable cryptocurrency holdings be converted into ordinary currency within 10 days. If the defendants fail to comply, the relevant cryptocurrency platforms may be required to identify and convert the assets.

The proceeds must be deposited in a tier-one bank licensed by the Central Bank of Kenya (CBK), which has been appointed as escrow agent to safeguard the funds while the recovery proceedings continue.

The judge explained the basis for granting the preservation orders while making clear that the bank’s allegations had not been conclusively established.

“The plaintiff has demonstrated a right that strongly appears to have been infringed by the defendants so as to call for an explanation or rebuttal,” the judge said.

He added: “I am not saying that the plaintiff will obviously succeed at the full trial.”

The distinction is important. The ruling allows Equity to preserve assets while pursuing its claim, but it does not establish that every individual or company named in the case committed fraud.

Defendants challenge allegations as recovery battle continues

The Equity Bank heist proceedings have also exposed disagreements over the origin of the funds, the ownership of cryptocurrency holdings and the business activities of the companies involved.

Kimani’s father, Joseph Kimani Machiri, filed an affidavit describing himself as his son’s guardian. He disputed the bank’s account, denying that his son owned cryptocurrency accounts or authorised the transactions. He also challenged Equity’s calculations of the alleged losses.

Kuguru maintained that companies associated with him, Axteron Technologies and Mac and Gray Trading, provided legitimate trade-finance, import and shipping services.

He argued that the payments received by the businesses represented genuine client transactions and that the companies were unaware that the funds allegedly originated from Equity Bank. He also said the businesses charged a five per cent commission for their services.

Kamau, who was identified as the owner of Blue Kenfresh and Goodmans Fresh, challenged the bank’s use of confidential banking and personal information in its application for the freezing orders.

She argued that the information had been obtained unlawfully and in violation of an earlier court order.

The High Court dismissed her application after finding that her lawyer had sworn an affidavit addressing contested matters. The judge maintained that an advocate should not simultaneously act as legal counsel and a witness, describing the affidavit as hearsay.

However, the court did not conclusively determine whether the disputed personal and banking information had been lawfully obtained. It left that question open for consideration during the full trial.

The judge also declined to issue additional tracing and accounting orders requested by the bank, reasoning that doing so could amount to presuming the defendants’ liability before the case had been heard.

These disputes are likely to remain central to the recovery proceedings as the parties attempt to establish how the money moved, who ultimately controlled the proceeds and whether the transactions were legitimate.

Missing manager and wider banking security concerns

The investigation has also attracted attention because of the internal control failures that allegedly enabled the transactions.

Following the discovery of the suspected fraud, Equity Bank initially dismissed approximately 195 employees after an internal review identified suspicious transactions involving staff bank accounts and mobile-money accounts.

More than 40 transactions were reportedly executed using Kimani’s credentials, raising questions about how the transfers passed through the bank’s internal monitoring and approval processes.

The former manager’s disappearance has further complicated the investigation. According to earlier reporting by The Standard, Kimani was arrested and arraigned in July 2024. However, on August 11, 2024, he was reportedly taken from his home in Thogoto, Kiambu County, by armed individuals believed to be security agents. He has not been seen since.

His disappearance has left investigators pursuing the alleged money trail without the central figure identified by the bank as having facilitated the transtransfers.

Source for further reading

Daily Nation – Court freezes accounts, crypto assets over Sh1.5bn Equity Bank heist