World Bank bans Webmasters. Kenya still has questions about who controls eCitizen.

The World Bank has barred Webmasters Kenya and its CEO, James Ayugi, from participating in World Bank-financed projects for at least five years.

The Sanctions Board found that Webmasters and Ayugi used two experts' CVs, without their consent, to bid for World Bank-financed projects in Somalia. The proposed contract was worth about US$98,000, roughly KSh12.7 million. Both experts told investigators they had never agreed to the work.

When the Bank asked Webmasters for supporting documents, the company did not provide them. The Board ruled that conduct fraudulent and obstructive, and barred the firm and Ayugi from its financed projects until at least June 7, 2031. Other development banks that recognise World Bank debarments can extend the ban further.

Webmasters and Ayugi are familiar names in Kenya for a different reason. This is the company that built eCitizen, the platform behind almost every digital government service in the country. And the vendor's exit from that platform has never been fully explained.

The handover that raises another question

eCitizen began in 2013 as a government digital services project backed by the World Bank. The International Finance Corporation contracted Webmasters Kenya to develop and maintain the platform.

Then, on August 7, 2017, IFC handed the platform's materials to the National Treasury. The handover included the contracts, source code, business case and other documents relating to the system.

If that transfer settled the government's ownership of eCitizen, there should have been little ambiguity about who controlled the platform.

Six years later, there was another handover. On January 13, 2023, Webmasters signed an agreement with the government to "unconditionally hand over" the eCitizen platform to the state.

That leaves a simple question: if Treasury had already received the platform from IFC in 2017, what was Webmasters handing over in 2023?

The Auditor-General could not find a satisfactory explanation for what happened between those two dates. The audit also found that even after the 2023 agreement, government agencies did not have full administrative control of the platform and remained dependent on the vendor.

That matters because eCitizen is now the government's main digital gateway for public services, and handles enormous amounts of public money. If the state owns the platform but does not have complete control over the infrastructure behind it, the distinction between ownership and control becomes important.

And the ownership question was only one part of the audit.

Then auditors followed the money

The Auditor-General's special audit found problems across several parts of eCitizen's payment system:

• An unauthorised Equity Bank account. The account, associated with PesaFlow, was not among the collection accounts authorised by the National Treasury. Auditors found eCitizen receipts of KSh68.7 million and US$48.1 million had passed through it between the 2020/21 and 2023/24 financial years. They could not fully trace the account because the relevant bank statements were not provided. National Treasury Principal Secretary Chris Kiptoo told Parliament the account had been opened without his authority, and that Treasury froze it once the arrangement was discovered.

• Payments to a company outside the original contract. Electronic Citizen Solutions Ltd received KSh492.2 million and US$414,299.60, despite not being part of the original eCitizen contract. Treasury said a later contract novation brought the company into the arrangement after the Directorate of eCitizen Services took over platform operations in July 2024. The Auditor-General still flagged the payments as a legal risk, since the company had not been party to the original agreement.

• Money moved to private entities. Another KSh127.85 million moved from the eCitizen M-Pesa Paybill 222222 to private entities. Treasury linked the payments to an out-of-court settlement involving Goldrock, while auditors questioned the documentation and approvals behind the transfers.

• Years of flat convenience fees. eCitizen users were charged flat fees, such as KSh50 or US$1, regardless of the value of the service they were paying for. The Auditor-General found the prescribed fee structure required a proportional charge instead. The resulting overcharges amounted to KSh1.8 billion and US$3.3 million before January 2023, with additional amounts accruing afterward.

By then, the story had shifted from software contracts to something more basic: who was collecting the money, and who actually controlled the platform moving it.

Parliament started asking questions

In March 2026, the National Assembly's Public Accounts Committee, chaired by Butere MP Tindi Mwale, began examining the eCitizen audit findings. The committee summoned Kiptoo and the Principal Secretaries responsible for ICT and Immigration to explain the government's arrangements.

Kiptoo was not accused by the committee of personally taking the money; his role was to respond to the audit findings and explain the government's position. His explanation was that the government owned eCitizen under the 2023 handover agreement, and that the PesaFlow account had been opened without his authority. He said Treasury froze the account once it became aware of it.

The committee then planned to hear from the companies and institutions connected to the platform and its payment flows: Webmasters, PesaFlow, Olive Tree Media, Goldrock, Electronic Citizen Solutions and Equity Bank.

Then the hearings stalled. A June 2026 sitting involving several of those witnesses was postponed after they requested more time to prepare. The result is that some of the key actors connected to the audit have yet to answer Parliament's questions.

What the World Bank decision changes

The World Bank case is about Webmasters' conduct in Somalia, not Kenya. But an international development institution has now formally found Webmasters and Ayugi liable for fraudulent and obstructive practices on a World Bank-financed project. That finding sits alongside a Kenyan audit that already raised questions about Webmasters' role in eCitizen: who controlled the platform, and where the money moving through it actually went. And it comes while Parliament's own investigation remains unfinished.

The questions around eCitizen have therefore not changed:

• If Treasury received eCitizen's source code, contracts and other materials from IFC in 2017, what happened between that handover and Webmasters' second handover in 2023?
• Who allowed control of the platform to remain with, or return to, the vendor?
• Why did the government still lack full administrative control after the 2023 agreement?
• How did an account that Treasury says it had not authorised end up receiving millions of shillings and more than US$48 million in eCitizen receipts?
• And will Parliament resume the hearings it postponed in June?

The World Bank has answered questions about its own investigation in Somalia. Kenya still has to answer its own questions about eCitizen.