From fraud to audit obstruction: Why eCitizen empire is under scrutiny

World Bank bans Webmasters Kenya for five years.[Courtesy]

For a decade, James Ayugi was the face of Kenya’s digital revolution, the man whose company, Webmasters Kenya Ltd, built the eCitizen platform that brought government services to millions of Kenyans.

But last week, the World Bank published a decision that has shattered the company’s international ambitions and laid bare what investigators described as a pattern of deception that reached far beyond Kenya’s borders.

Ayugi and his firm have been banned from all World Bank-financed projects for five years after the multilateral lender found they misrepresented the availability of key experts and obstructed an audit for contracts worth hundreds of millions of shillings in Somalia.

The sanction, detailed in Sanctions Board Decision No. 147, documents a case of alleged fraud involving two World Bank-financed projects in Somalia between 2018 and 2020.

But the World Bank decision is only the latest act in a saga that has seen the Auditor General’s office and Parliament raise red flags over billions of shillings routed through the eCitizen platform and the government struggling to defend payments to companies linked to Ayugi’s empire.

The World Bank’s Integrity Vice Presidency (INT) investigation found that Ayugi, acting as CEO of Webmasters Kenya, submitted proposals for the Somalia Capacity Advancement, Livelihoods and Entrepreneurship through Digital Uplift (Scaled-Up) Project in July and August 2020.

The proposals included the CVs of two experts accompanied by certifications stating “I am available to undertake the assignment in case of an award”. There was just one problem, the said experts had no knowledge of their inclusion.

When the World Bank investigators reached out to the two individuals, both confirmed they were unaware of their designation as key personnel, had never authorised the use of their CVs, and did not participate in the contract.

Ayugi had signed the certifications of availability on their behalf. The contract was valued at $330,000 (approximately Sh43 million).

INT argued that the misrepresentations allowed Webmasters to improperly claim a financial benefit totalling $98,000  (Sh12.7 million) in remuneration allocated to the two experts.

When the World Bank attempted to audit the contracts, which also included the Score Project for automating business activities in Somalia, Ayugi and his firm failed to produce the vast majority of requested documents, ignoring multiple reminders and deadline extensions.

“The Respondents also materially impeded the exercise of the Bank’s inspection and audit rights by failing to meaningfully comply with the Bank’s documentary requests in the context of an audit,” the Sanctions Board said.

While the World Bank sanctions are just the latest setback by Ayugi, his company Webmasters has been no stranger to controversy.

The company, which Ayugi founded in November 2008 after graduating from Jomo Kenyatta University of Agriculture and Technology, rose to prominence through its work on the eCitizen platform.

From a handful of services in 2014, eCitizen has grown to host thousands of government services, including visa applications, driving licence renewals, and business registration, collecting billions of shillings in government revenue annually.

But alongside the success has come a trail of auditor queries and parliamentary scrutiny.

In March 2026, the National Assembly Public Accounts Committee chaired by Butere MP Tindi Mwale raised alarm over how Sh6.3 billion was irregularly channelled into private accounts in a local bank without government approval.

The Auditor General’s special audit, covering the period from 2014 to 2025, uncovered massive discrepancies involving two separate streams of funds.

The audit revealed that payments totalling Sh492.1 million and USD414,299.60 were made to a company outside the original e-Citizen consortium. Treasury PS Chris Kiptoo argued the payments were lawful under a contract novation, but the audit warned this arrangement exposes the government to potential legal disputes.

Perhaps the most alarming finding involves Pesaflow Limited. The Auditor General’s report revealed that an undisclosed account named “Pesaflow” received Sh68.7 million and USD48.1 million despite not being listed among the Treasury’s approved collection accounts.

“This account was not listed among the approved collection accounts by the National Treasury. In this regard, it was used to irregularly collect money,” states the audit.

When auditors requested bank statements, the local bank reportedly failed to provide them, meaning no one could establish the total amount irregularly collected or identify the beneficiaries.

Treasury PS Chris Kiptoo told the Public Accounts Committee that when he learnt of the diversion, “I gave directions and that was stopped. The accounts were frozen”, Kiptoo said.

The Standard investigations recently revealed private firms running e-Citizen earned Sh1.45 billion in the year to June 2024 alone, detailing Sh591.9 million from convenience fees and Sh857 million for system maintenance.

The investigations further revealed that the beneficial owners of the consortium firms, including Pesaflow, Webmasters Kenya, and Olivetree Limited, remain largely unknown.

 The ownership question has proven equally controversial. Webmasters developed e-Citizen in 2014, and the government adopted it under President Uhuru Kenyatta’s digitisation drive.

The system was financed by the World Bank through its International Finance Corporation (IFC), which contracted Webmasters Kenya to provide software development and maintenance support services.

In 2017, the IFC handed over the instruments, including contracts, source code, and handover notes to the National Treasury via an August 7, 2017, handover letter.

Yet investigations established that on January 13, 2023, the Ministry of Information, Communications and Digital Economy entered into a second handover agreement with Webmasters Kenya Ltd, in which Webmasters agreed to unconditionally hand over the platform to the government.

The Auditor General raised a question: “It was not explained how the ownership and control of the eCitizen platform ended up in the hands of the vendor after having been handed over to the National Treasury by IFC in 2017”.

The audit also determined that even after the January 2023 transfer, the government did not obtain full control of the systems, resulting in continued over-reliance on the vendor.

Noting that the majority of government services are provided through the platform, the audit warned that “...the vendor’s control creates a single point of failure and poses significant risks to operational independence, data security, and service continuity”.

On March 24, 2026, the Public Accounts Committee formally invited seven entities to appear before it to explain the Sh9.4 billion irregularities.

Those summoned were Pesa Flow Limited, Goldrock Limited, Olive Media Limited, Webmasters Kenya, Electronic Citizen Solutions, and the Office of the Attorney-General.

“We expect the entities to give their side of the story and explain how they were licensed to collect funds from Kenyans, how approvals were granted, the amounts they are holding, and any possible diversion,” said Mwale.

In her recommendations, Auditor General Nancy Gathungu called for reforms. Key among them was that Webmasters Kenya Ltd should unconditionally hand over control of the eCitizen platform to the government.

Gathungu also urged the government to build internal technical capacity by training staff in system administration, operations and maintenance to reduce reliance on external vendors.

The auditor further recommended the establishment of a robust change management process requiring all system modifications to be documented, reviewed and approved by authorised personnel, as well as the creation of an oversight body to coordinate the various institutions managing the platform.

The report also calls for periodic independent audits of the platform to assess operational constraints and provide assurance on system integrity.

The Webmasters saga has exposed significant vulnerabilities in Kenya’s digital public infrastructure, as the platform that now serves over 22,000 government services, collecting up to Sh1 billion daily, but operates with limited government oversight.