The eCitizen platform, often presented as the centerpiece of the government’s drive to modernize revenue collection, has been exposed in a special audit as a fertile bed for fund diversions, massive overcharges, and systemic governance failures.
- •A review by the Auditor General paints a picture of a government platform that suffers from weak internal controls, vendor dependency, and legal gaps that leave state finances exposed to mismanagement and potential abuse.
- •At the heart of the audit is the irregular diversion of KSh 127.85 million from the official government Paybill ‘222222’ to private entities, with no documentation or approvals to explain the transfers.
- •Furthermore, KSh 68.7 million and USD 48.1 million was funneled through an unapproved “Pesaflow2” account, underscoring serious lapses in financial oversight.
Even when funds were not siphoned off, the audit found KSh 7.05 billion sitting in eCitizen’s collection and settlement accounts as of June 2024. Within that amount, KSh 2.57 billion could not be matched to any invoices.
These findings point to direct breaches of public finance principles, creating a scenario where funds collected from citizens for essential services were exposed to misuse before even reaching government accounts.
The platform’s reliance on manual settlement processes resulted in an average eight-day delay before revenue reached ministries, departments, and agencies. These lags left a number of public entities underfunded, even as commercial banks and intermediaries held significant public money without clear service-level agreements.
Making Services Costly
The audit also found that KSh 1.8 billion and USD 3.3 million were improperly collected as convenience fees. Rather than applying the pro‑rated charges required by government notices, the platform levied a flat KSh 50 fee per transaction. This approach led to overcharges totaling KSh 30.73 million on the old payment gateway and KSh 319.03 million on the new one.
The structure punished low-value transactions, making some services up to 250% more expensive. A 20-shilling product like Kerio Valley Development Authority’s honey became effectively unaffordable under the fee regime. Healthcare services were hit even harder, with patients paying the fee repeatedly at multiple touchpoints during a single visit.
“The cumulative effect of this fee, for each service a patient requires in a day, becomes costly and may disproportionately affect low-income patients or those requiring regular healthcare services. This is contrary to government agenda to improve healthcare quality and affordability as per the Bottom-Up Economic Transformation Agenda (BETA),” the audit report said.
Government-Owned…But Who is in Control?
The audit also paints a troubling picture of nominal government ownership over eCitizen, with actual control still resting in the hands of the private vendor. The platform originated in 2013 as a World Bank–IFC–backed initiative, with Webmasters Kenya Ltd contracted to develop and maintain the system.
In 2017, the IFC formally handed over the source code, contracts, and business documentation to the National Treasury, transferring ownership of the platform to the Government of Kenya. By law, the platform and its intellectual property became a public asset.
However, by 2023, the government still lacked full administrative control. A new handover agreement was signed in January that year between the Ministry of Information, Communications and Digital Economy and Webmasters Kenya Ltd, under which the private vendor agreed to unconditionally transfer the platform to the state. This included the source code for the government’s configured version of the platform and system documentation such as technical manuals, maintenance processes, and security architecture.
Despite these commitments, the audit found that as of July 2024, the vendor had not fully complied with the handover. Key instruments such as the source code and admin rights remained with Webmasters, leaving the government dependent on the vendor for critical operations such as service onboarding, user management, and system reporting.
This dependency effectively creates a single point of failure for the nation’s primary digital revenue platform. If the vendor were to experience technical or financial issues, many government services could face immediate disruption.
“The National Treasury did not facilitate access needed to assess security at application, database and network level. This significantly limited the ability to evaluate the effectiveness of security controls and identify potential vulnerabilities,” the eCitizen audit stated.
The audit also highlights that Webmasters was engaged without a valid contract for years after the original IFC arrangement ended in 2015, with revenue collections continuing under informal arrangements. The lack of a robust vendor management framework or formalized oversight exposes the state to legal risk, operational vulnerability, and potential data privacy breaches.
The Auditor General found that no Data Protection Impact Assessment (DPIA) had been conducted, despite the platform handling identity data, payment details, and service records for millions of citizens.
Notably in July 2023, the eCitizen platform experienced a DDoS attack from a hacker group, disrupting access to government services. The report warns that without stronger IT governance, real-time monitoring, and security protocols, the platform could become prone to cyber attacks.
The Auditor General recommends sweeping reforms such as the immediate recovery of diverted funds and overcharged fees. She has also proposed a formal investigation into the irregular transfers, unapproved accounts, and unauthorized payments that threaten the integrity of the platform.
