On July 10, the Equity Bank Ltd Internal Control Department detected a flurry of suspect transactions at the salaries account.
There were 47 withdrawals from the payroll account.
Whenever money is sent from one bank account to another, systems on each side communicate details of the transaction, including names of the individuals or entities exchanging the funds and the amount, indicating everything is above board.
In the case of the 47 transactions, there were no corresponding credits from the Equity Bank side, making it appear like the huge sums had appeared out of nowhere miraculously.
That raised suspicion from the internal controls team, which quickly reviewed the transactions for confirmation details.
The review indicated that Kenya’s second largest financial institution by asset base had just suffered a heist, with the masterminds making away with Sh1.5 billion meant for employees’ salaries and other emoluments.
Equity Bank’s head of security, Kevin Mwangi, reported the matter to the Banking Fraud Investigation Unit of the Directorate of Criminal Investigations (DCI) the following day.
Preliminary investigations by the DCI, according to court papers, established that the credentials of Mr David Machiri Kimani – Equity Bank’s manager at the Group Processing Centre, Salary Processing Unit – were used to process the transactions totalling Sh1,545, 887, 140.49.
That his credentials were used when he was on leave and the fact that he has a valid passport made Mr Kimani the top person of interest in the fraud investigations.
He was picked up from his Thogoto home, Kiambu County, on Sunday as the rest of the family members were in church.
Witnesses said about 10 armed men knocked on Mr Kimani’s gate around 11am and left with him in a convoy of several vehicles.
Another group of hooded armed men stormed the Mathioya residence of Mr Kimani’s father, Peter Kimani Machiri 12 hours later.
Abduction caught on CCTV: Relatives of Equity Bank heist suspects speak out
Security camera footage released by the Machiri family showed the men who abducted the former politician had their faces covered and were carrying guns.
Some were carrying battering rams believed to have been used to break the gate and doors to the house.
The gunmen disconnected electricity to the Mr Machiri’s home, stormed in and forced him in a vehicle before speeding away.
Kikuyu Police Commander, Ronald Kirui, on Wednesday said no report had been filed on the abduction of the Equity Bank employee or his wife.
“We don’t have a report at any police station in Kiambu County,” Mr Kirui said.
Mr Ndegwa Njiru, the lawyer representing the family, said on Wednesday that the banker’s wife is still missing.
Mr Njiru said he and the family are worried as she has not been seen at their Thogoto home or anywhere else.
According to court papers, investigations have revealed that the scheme was hatched at Britam Towers, with more than one unit at the bank involved.
Mr Machiri, according to detectives, took sick leave in early June when there was communication between the Salary Processing Unit, the Finance Department and Reconciliation Unit requiring them to align to the bank’s policy and guidelines in regularising accounts.
When the money was credited, it was again transferred to other accounts and later withdrawn to avoid detection.
Investigations also found that most, if not all, of the accounts into which the money was paid into were operated by businesses that were newly registered.
The DCI detectives believe the businesses were opened solely for the purpose of receiving the money obtained fraudulently.
At the time of the filing of the report with the DCI on July 11, some accounts that had received the funds without corresponding source entities were flagged as investigators began pursuing the main beneficiaries and the beneficial owners of the said companies.
The detectives believe the businesses were opened specifically for receiving the fraudulently obtained funds, and giving the operators a platform for withdrawing their loot.
These disclosures were made by the DCI’s Banking Fraud Investigation Unit in an application to the Chief Magistrate’s Court in Milimani, Nairobi, on July 12.
The application sought the permission of the court to detain the banker for 21 days as investigations were concluded.
DCI investigators told the magistrate that an urgent operation to arrest and prosecute the suspects is necessary “to safeguard the savings of investors and depositors”.
“The applicant (the Banking Fraud Investigation Unit) avers that the fraudulent debiting of the General ledger account with Sh1,545,887,140.49 leads to an economic sabotage to Equity Bank of Kenya Limited as a financial service provider, which puts risk of loss to local, international and government entities,” the application reads.
In a support affidavit, Mr Bonface Maina – a police officer attached to Banking Fraud Investigation Unit – said the investigation is focusing on the offences of money laundering and stealing by servant.
To support the detention of Mr Kimani, the officer told the magistrate that the banker is a flight risk as he has a passport.
He said investigations indicate that Mr Kimani has homes in Thogoto , Kiambu County, and Kairi sub-location in Murang’a County where detectives intend to carry out searches and conduct forensic analyses.
Mr Maina told the court that preliminary investigations revealed that Mr Kimani’s associates include his father, “who is involved in tenders with the Murang’a County and the national governments and his homes are among the places to be searched”.
The court did not grant the request but instead released Mr Kimani on bond, according Mr Niru.
Ms Nancy Wambui, the wife of Mr Machiri, told journalists that hours before the night raid, the couple had spent the day in church.
“The dogs began barking soon after we had retired to bed,” she said.
