Cyber attacks and bad debts weigh down Unaitas rise in financial sector

A group of tea farmers from Murang’a came together in 1993 to start what promised to be the next big thing after Equity Bank.

Their dream grew like a whirlwind. From the tea farms of Murang’a, they grew to become an enviable Savings and Credit Cooperative Society among its peers.

But it was not just satisfied being one of those small Sacco’s serving several villages. From Murang’a Tea Growers, the Sacco dreamt big. It cast its eyes on becoming a commercial bank by September 2016.

As soon as it hit its first milestone of expanding its operation beyond Murang’a in 2007, the Sacco knew that it had to change its name. It rebranded to Muramati Sacco and would go by this name for another five years.

Though its principal goal of ‘pooling resources to create a financial basket, where they could save and advance loans at affordable rates’ remained intact, the Sacco also went through another transformation.

Immediately it changed its name to Muramati, it decided to open its doors beyond its initial tea growing customer base. This saw it open its purse strings to also serve medium size enterprises and salaried employees.

The shift saw it recruit new members faster than most financial institutions were doing at the time.

Prospects of expanding

As its vision of getting a banking license became clearer, it became necessary to drop the Muramati name that could hurt its prospects of expanding beyond Central Kenya. It became Unaitas in 2012.

After its second name change, it immediately went into a fresh charm offensive and launched a massive recruitment drive that saw it sell shares to hundreds of thousands of new members, as it sought to have a strong financial muscle to travel the remaining part of its journey.

The sacco seemed to be making all the right decisions and it was rewarded with new members. In the last decade, it has been growing in double digits and in some good years expanding by up to 30 per cent.

By this year, the sacco had about 300,000 members who had bought the minimum 100 shares at Sh10 each. Its capital base is now near Sh5 billion and boasts of Sh14 billion in assets.

It has also spread its wings to the rest of the country after opening its 25th branch in Kisumu in September, which came in quick succession after Kisii and Eldoret.

But behind the rosy success story, the sacco has been fighting a new battle that is eating it up from within, a battle that is now threatening to hurt its march to becoming a fully-fledged bank.   

Besides governance issues and falling victim to two cyber-attacks that saw it lose an undisclosed amount of money, it is also dealing with a growing infighting from within its management team that has split its board and key staff.

Loss of funds

A report by the Directorate of Criminal Investigations (DCI) seen by Sunday Standard says the first cyber-attack happened between February and March last year. Its server was hacked and data manipulated in over 256 accounts leading to a loss of an unknown amount of money.

The report written by Hannington Chumba, a forensic examiner from the Cyber Crimes Unit at the DCI, says the attack was initiated remotely and was carried out through masked IPs.

After going through 682 gigabytes of data mined from the servers in Murang’a, DCI noted that the fraudulent activities had been made to appear as having been initiated by users who last genuinely updated their accounts, however a close scrutiny revealed that some of the users had long left the organisation.

“It is noted that the attacker manipulated the date and time spreading the attack period to six years, that is 2012 to 2017 purposely to misdirect investigations,” the report seen by Sunday Standard reads in part.

The attacker was able to navigate through flagged accounts, unflag and transfer funds, it adds. There were also a number of logs generated from mobile transaction and deleted successfully.

This attack stunned the top management and now is on the shoulders of the board to resolve it. Tired of inaction, the board’s chairman has moved to the High Court to seek some answers, but there are fears that it may be too late given that most of the records may have been deleted or tampered with.

The other puzzle was that the DCI also failed to tell just how much money was siphoned out of the sacco by the hackers. The 2017 hacking should have been a wake-up call to Unaitasto seal all the loopholes.

Last month, it had its second attack.

Unaitas’ chief executive officer Martin Muhoho explains that the attack was not isolated and that at least eight other saccos suffered similar attacks. “The intrusion did not happen on our core banking system and it was not our fault,” Muhoho said, adding that their sacco has since invested in the latest technology in the T24 core banking system.

He said Unaitas has recovered part of the money in the second attack and is pushing the service provider to refund the money. He however refused to reveal just how much has been lost.

However, the chairman Joseph Kabugu admitted that the cyber-attacks are a thorn in their flesh and that he is doing everything in his powers to ensure members’ money is recovered.

Prepayments shot up

“It is a complex matter. When I ask I am told the hackers were from Yemen and Jordan. However, such an amount of money cannot have been withdrawn through an agent,” Mr Kabugu said, adding that the attack did not just affect Unaitas but several others that run on the M-Sacco platform provided by Coretec Systems, an IT company.

Kabugu, who has remained a lone ranger in the fight to get to the bottom of the theft, said he was not a technical person and would not fully understand how the theft happened or the answers coming from the companies involved given that it has now become a blame game. 

He has promised to pursue the matter if he receives the data from Safaricom and Coretec, which he has petitioned through the High Court.

But the biggest challenge for Unaitas at the moment is the growing bad debts which are threatening to wipe away all its profits. In the first 10 months of the year, its total income was Sh1.3 billion, which is 43 per cent off target.

Total surplus before tax, provisions and dividend is also way below last year’s figure. By October, it was 86 per cent down from the Sh241 million to Sh33.9 million.

“What is ailing us is the provision of bad debts. We are required to provide 100 per cent for the bad debts,” Kabugu said.

He estimates the bad debts to be at about Sh800 million at the moment. However, an insider says the number could be much higher.

Its financial numbers shown to the Sunday Standard indicate that its debtors and prepayments shot up by 751 per cent in the last one year, a sign of trouble ahead. The figure grew from Sh115 million in 2017 to Sh985 million this year.

Should Unaitas be unable to collect these debts, then it will be forced to book big provisions to cover them at the end of the financial year.

Curiously, its intangible assets went up by a staggering 2,632 per cent in one year.

Its return on assets has also dipped from 2.1 per cent to less than one per cent. Its return on equity ratio has also more than halved from the nine per cent it posted in 2017 to about three per cent by October this year.

An insider raised questions on the sacco’s book keeping, claiming there could be more than one set of accounting books.

The sacco is also undergoing one of its highest staff turnovers in its 25 year history.

Its boardroom and head office on the second floor of the Cardinal Otunga Plaza in Nairobi’s central business district has been busy.

“The talk is about slaying the Mugumo trees which means dealing with some of the staff seen as too entrenched or allied to the wrong camp. Several of these Mugumo trees have been felled,” the source said.

In the last two years, the sacco has seen at least three of its senior managers exit, some of who resigned in unclear circumstances.

Another group of employees has been transferred to various departments, causing some friction.

Depending on who you talk to, some see the transfers as punishment while others see it as a necessary tool being used by the management to steady the ship.

Late last year, its former chief executive, Tony Mwangi, who has been at the institution for over 10 years, announced that he will retire this year.

His exit came with its share of succession politics that saw front runners turn the boardroom into a theatre for mudslinging.

Some of the issues include spying and leaking crucial information to competitors among them a local tier one bank.

But it is the cyber fraud that has caused the biggest discomfort and is shaping up to claim more careers at the sacco. An insider said at first the loss was estimated to be over Sh100 million, but this figure has become a moving target.

“It has been revised to about Sh28 million but it is not clear how this figure was reached. It is not clear to date what transpired and there was no official communication on how the money was lost,” a manager at the sacco, who is familiar with the state of affairs said. The manager requested not to be named to protect his job.

Some of the managers pushed out left on grounds of nonperformance especially after Unaitas experienced some challenges from the new core banking system.

Losing their positions

The process of applying for a banking licence has however been the biggest hurdle. An insider says some of the managers have been inciting members not to support the idea on grounds that they will end up losing their positions in management.

“It is self-preservation. Some of the board members are afraid of the stringent conditions and scrutiny that comes with a banking licence,” the source said, adding that it will be a miracle for a number of them to pass the proper and fit test that comes with integrity searches and compliance requirements from the Kenya Revenue Authority, the Higher Educations Loans Board, Central Bank and the DCI.

The other issue bogging down Unaitas is representation. One camp has been pushing for it to adopt the spirit of the Cooperative Societies Act that requires delegates to be drawn from all the selected areas of its operation. 

“It is not yet too late to save Unaitas,” the source said.

But Mr Muhoho maintains that Unaitas is on course, and despite some ‘normal’ resistance from certain quarters, he said its vision to have a banking license is still on course and as soon as the CBK moratorium is lifted, it will be the next on line.

He said the sacco will have its banking license next year and its branch at Cardinal Otunga Plaza will be its first commercial bank.    

pwafula@standardmedia.co.ke