KEY FACTS: The eCitizen Money Trail
Sh1.45 billion collected by Webmasters consortium in FY2024 alone. Sh700 million processed daily on eCitizen. Sh127.85 million transferred to private entities without documentation. Sh7.05 billion held in unsanctioned settlement accounts. Sh44.8 billion in total collections whose accuracy cannot be confirmed. Sh2.57 billion in receipts with no matching invoices. Sh195.7 million paid irregularly for gateway services. Zero Data Protection Impact Assessments conducted. Zero signed Service Level Agreements with payment providers.
It takes a particular kind of audacity to look the President of the Republic in the eye at State House, agree to surrender control of the country’s most critical digital infrastructure, and then, three years later, still be running that same infrastructure while billing the government hundreds of millions of shillings every month.
It takes an even rarer kind of impunity to respond to a major newspaper investigation exposing your firm’s collection of Sh1.45 billion in public fees by posting on Facebook that the figure is, in your own words, ‘very little money for what government is getting in return. We actually need more.’
That is James Ayugi Panaito in a sentence.
He is the founder and chief executive of Webmasters Kenya Limited, the private firm that built the eCitizen platform in 2014 and has, through a labyrinthine web of associated companies, managed to transform a World Bank-funded government project into what amounts to a private toll road through which every Kenyan must pass to access the most basic of state services.
From applying for a passport to registering a business, from paying university fees to renewing a driving licence, the platform that sits between you and your government is controlled not by the state, but by James Ayugi.
And he has made abundantly clear that he has no intention of giving it back.
“We’ve run eCitizen for 10 years. We are still young and will continue serving Kenyans.” — James Ayugi, CEO Webmasters Kenya, LinkedIn, March 2026
The Architecture of Capture
The eCitizen story begins in the early years of President Uhuru Kenyatta’s administration, when the World Bank’s International Finance Corporation bankrolled an ambitious initiative to digitise Kenya’s government services.
The contract for development and maintenance went to Webmasters Kenya Limited, a firm whose principal shareholder, director and chief executive was then better known publicly as James Panaito.
The name change would come later, once his foothold in government was secure enough that obscuring his identity was no longer necessary.
The platform launched in December 2014 with an initial roster of ten services.
In its original design, according to court documents filed by Treasury auditor Willis Odhiambo Okwacho, eCitizen was intended to be free to citizens, funded instead through budgetary allocations.
No documentation existed, Mr Okwacho told the court, to show that citizens would be charged any fee over and above the normal transaction costs. What followed was a departure from that founding principle that has cost Kenyan citizens billions of shillings.
Webmasters introduced a Sh50 ‘convenience fee’ on every eCitizen transaction without approval from the National Treasury, without gazettal as appropriation-in-aid, and without any enabling provision in the Appropriation Act.
It was, in the measured language of the audit, introduced outside the laid-down procedures. In less measured terms, it was a private tax levied on citizens accessing their own government, collected by a private firm into private accounts, for years before anyone in authority raised a formal objection.
By the time Auditor-General Nancy Gathungu’s latest special audit landed before Parliament, the numbers had grown to staggering proportions.
In the single financial year ending June 2024 alone, the Webmasters consortium collected Sh591.9 million in convenience fees and an additional Sh857.2 million in maintenance fees, a combined Sh1.45 billion extracted from public funds and citizen pockets.
The platform, by that point, was processing upwards of Sh700 million daily. At current transaction volumes, Ayugi’s consortium bills the government between Sh100 million and Sh200 million every month.
Three Companies, One Man
What makes the eCitizen arrangement so extraordinary, and so difficult to challenge, is the deliberate fragmentation of the enterprise into multiple legal entities that confuse accountability while consolidating control under a single beneficial ownership structure.
The platform is operated by a consortium formally constituted as Electronic Citizen Services, or ECS LLC, comprising three companies.
Webmasters Kenya Limited, Ayugi’s original vehicle, provides customer care and technical coordination. Pesaflow Limited handles all payment processing across the platform. Olive Tree Media Limited manages bulk messaging, security notifications and revenue mobilisation.
Together they touch every dimension of eCitizen’s operations. Together, they are all roads leading to James Ayugi.
The story of Pesaflow is particularly instructive. Between 2014 and 2017, the payment function on eCitizen was handled by Goldrock Capital Limited, a firm that Webmasters Africa, Ayugi’s other vehicle, had subcontracted to manage fund flows from citizens to the government’s consolidated fund account at KCB.
The National Treasury, when it eventually discovered the arrangement, declared it illegal on the grounds that it had never approved the subcontracting. Goldrock was ejected.
The Directorate of Criminal Investigations launched an inquiry, writing to Webmasters Africa seeking information on suspected fraud and embezzlement of funds flowing through the eCitizen payment system. Government ministries and departments, the DCI letter noted, had lost funds paid through the platform.
That investigation, remarkably, appears to have gone nowhere.
Instead, in August 2017, at the precise moment Goldrock was locked in court battles with the government and Webmasters over the Sh127.8 million frozen in eCitizen wallets, a new company was quietly incorporated to take over the payment function. That company was Pesaflow Limited.
At first glance, Pesaflow appeared to be an entirely new entity. Its largest shareholders were listed as Evid Araka Sibi and Frank Lawrence Ochieng Weya, with 3,000 shares each, and Charles Wambani Sewe and Larry Ochieng Agoro holding 2,000 shares apiece. Closer examination revealed that all four individuals had previously worked for Webmasters Africa.
Evid Sibi, who became Pesaflow’s managing director, had in fact been a director at Webmasters Kenya before departing to co-found the payment firm.
The individuals who had been operating an illegal payment arrangement had, through a new corporate vehicle, simply resumed the same function. The DCI probe that never materialised had cleared the path.
Mr Ayugi, when pressed on his connections to Pesaflow by Business Daily Africa, declined to explain the links. He acknowledged being the principal shareholder, director and chief executive of both Webmasters Kenya and Webmasters Africa but insisted the companies were separate legal entities.
The individuals who had been operating an illegal payment arrangement had, through a new corporate vehicle, simply resumed the same function. The DCI probe that never was had cleared the path.
The Billion-Shilling Handover That Never Happened
When President William Ruto swept to power in September 2022, there was, briefly, reason to believe the Webmasters arrangement might finally be unwound.
His administration moved quickly. Within weeks of being sworn in, Ruto summoned Ayugi and the Webmasters team to State House and delivered a blunt message: hand over the platform and abandon all financial claims, because the firm had paid itself enough from convenience fees across nearly eight years of operations.
A follow-up meeting was convened on November 30, 2022, at 7:15 in the morning in the National Treasury’s 14th-floor boardroom.
Treasury Cabinet Secretary Njuguna Ndung’u and his ICT counterpart Eliud Owalo led the government’s delegation.
The resolution was unambiguous. Webmasters was to transfer everything, including front-end and back-end rights, source code, system architecture, user manuals, and all associated materials, and then train government staff to take over. The deadline for full completion, including staff capacity building, was July 13, 2023.
On January 13, 2023, the Ministry of ICT and Webmasters formalised a handover agreement. Goldrock and Webmasters dropped their outstanding financial claims and withdrew their court suits.
The government sent sixty-two officials to an eight-day workshop at the PrideInn Paradise Beach Resort in Mombasa, at a cost of at least Sh11.9 million in accommodation alone, to be trained by Webmasters on platform onboarding.
Jambopay and Safaricom staff participated as trainers. The government paid. The training happened. The deadline passed.
Three years later, Webmasters and its consortium are still running eCitizen.
More troubling than the failure to hand over is what the January 2023 agreement reveals when examined against the platform’s earlier history. In 2017, the World Bank’s IFC had handed over the eCitizen platform to the National Treasury in its entirety, transferring all source code, contracts and documentation with a formal handover letter dated August 7, 2017.
In legal terms, the government had owned eCitizen since that date. By 2022, however, the government found itself negotiating with Webmasters as though the platform still belonged to the vendor.
MPs on the Public Accounts Committee, reviewing the matter in 2025, put the question directly: it was not explained, they noted in their report, how ownership and control of eCitizen ended up back in the hands of the vendor after having already been handed over to the National Treasury by IFC in 2017.
No answer has been provided. The mystery of the double transfer, in which a platform that legally belonged to the state somehow reverted to private hands without any documented legal or administrative justification, sits at the heart of the scandal.
The Kill Switch
If the story of the convenience fee represents an act of prolonged financial extraction, the contract signed on May 25, 2023, between the ICT Authority and the ECS consortium represents something potentially far graver: the formalisation of a private veto over the functioning of the Kenyan state.
The agreement, reviewed by multiple media organisations, contains a clause whose implications should alarm any serious constitutionalist or national security analyst.
In the event of termination, it states, ‘the suppliers shall be entitled to rescind, withdraw or otherwise uninstall all their proprietary infrastructure and resources, including all technical infrastructure whether software or otherwise, that may have been deployed in order to enable them to provide their services under this agreement.’
Put plainly: if the government falls out with James Ayugi, Webmasters and its consortium have a contractual right to switch off eCitizen.
In a country where over 22,000 government services, from passport applications and immigration control to university fee payments, business registrations, national identification, tax compliance and NHIF contributions, flow exclusively through this single platform, that is not a commercial contract clause. It is a weapon.
MP Dido Raso, serving as vice-chair of the National Assembly Committee on Security and National Administration, questioned the legality of the contract’s execution, noting the conspicuous absence of a signature from the Principal Secretary for ICT.
Rarieda MP Otiende Amollo described the situation as a monumental scandal.
Mathioya’s Edwin Mugo warned that Kenya was staring at a monumental monster it would be unable to deal with in future. Turkana MP Joseph Namwar was more direct, calling the platform itself a scam.
In July 2023, a distributed denial-of-service attack on eCitizen disrupted access to government services nationwide for several days. No government entity controlled the response.
The Auditor-General has since formally warned that the absence of a state-controlled backup system means a sustained cyberattack could bring the economy to its knees. The Communications Authority and relevant security ministries have been tasked with oversight. They have yet to act.
If the government falls out with James Ayugi, the consortium has a contractual right to switch off eCitizen. That is not a commercial clause. It is a weapon.
The Missing Billions
The financial irregularities documented in Gathungu’s audits read less like the failures of an imperfect system and more like the methodical exploitation of one deliberately kept opaque.
The special audit for the financial year ending June 30, 2024, flagged over Sh9.6 billion in questionable transactions.
At the centre of the figure is Sh7.05 billion sitting in eCitizen collection and settlement accounts as of that date, the product of an absence of any signed Service Level Agreements between the National Treasury and the platform’s financial service providers.
Without SLAs, the Auditor-General warned, nothing prevents service providers from utilising that float for their own benefit.
Four payments totalling Sh127.85 million were transferred from the official government M-Pesa Paybill 222222 directly to private entities on January 25, 2024, without a single document to justify or authorise the transfers.
An undisclosed Equity Bank account named ‘Pesaflow,’ which had not been approved by the National Treasury, received Sh68.7 million and an additional Sh6.2 million. A separate ‘Pesaflow2’ account processed Sh68.7 million and USD 48.1 million through what the audit termed unapproved channels.
Furthermore, Sh549.69 million was paid to a company called Electronic Citizens Solutions Limited, which was not party to the ICT Authority contract, meaning public money flowed to an entity with no legal standing in the arrangement.
A further Sh195.7 million was paid for ‘payment gateway services,’ a charge the audit deemed irregular on the grounds that the government should not pay external parties to use its own platform.
Discrepancies in revenue reporting mean the accuracy of Sh44.8 billion in total collections through eCitizen cannot be confirmed. The government’s own departments, including the State Law Office, were found unable to access financial reports on revenues generated from their own services on the platform.
No Data Protection Impact Assessment has ever been conducted for a platform that holds the identity, payment and service records of virtually every adult Kenyan. Government agencies resolved technical problems by contacting the vendor via WhatsApp.
The Impunity of the Indispensable
What has shielded Webmasters from the consequences that would, in any functional accountability environment, have long since followed is the impunity of the indispensable.
The firm and its associated entities have, over eleven years, made themselves so deeply embedded in the architecture of government that removing them now carries genuine risk of service disruption. That condition was not an accident.
It was the product of a conscious strategy to expand eCitizen’s footprint, to onboard thousands of services beyond the original ten, and to resist every attempt to transfer technical knowledge to government officials.
Ayugi has been remarkably candid about the logic.
In a February 2025 interview following the Business Daily investigation, he acknowledged that his group bills the government between Sh100 million and Sh200 million every month, and suggested those figures should be higher. When the government attempted the 2023 handover, he told another interviewer, no team in government possessed the capacity to handle the platform’s complexity. He used the word ‘primitive’ to describe the idea that the public sector, rather than his firm, should earn revenue from running public digital infrastructure.
His vision extends well beyond Kenya.
Having built what he describes as the world’s most advanced integrated government services platform, Ayugi has been explicit that eCitizen Kenya is merely a proof of concept for a global commercial enterprise.
Webmasters has delivered related services to Rwanda, Somalia and Iraq.
He has spoken publicly of making ‘real money’ when the model is exported internationally. The question Kenyans should be asking is whether their compulsory participation in his platform, their data, their transactions, their government services, is the capital investment funding his global expansion.
Consumer advocate Stephen Mutoro has alleged that Ayugi’s grip on the platform is protected by a cartel with interests spanning the National Treasury, the Central Bank of Kenya and State House, with ethnic affiliations providing additional insulation for the beneficial owners who remain, in Mutoro’s characterisation, hidden from public view.
A State That Cannot Govern Itself
What the eCitizen scandal ultimately exposes is not simply the avarice of a single entrepreneur or the negligence of a few civil servants. It exposes a structural failure of the Kenyan state, a failure to develop and retain the technical capacity to run its own critical infrastructure, to enforce its own contracts and presidential directives, and to protect public funds and citizen data from private exploitation.
The government has known about the Webmasters problem since at least 2017, when its own internal audit first raised the alarm. It has known about the illegal convenience fee, the unapproved payment arrangements, the absence of data protection assessments, and the concentration of operational control in private hands. It has received the same recommendations from the Auditor-General in successive annual reports.
It has summoned principal secretaries, held parliamentary committee sessions, commissioned special audits and signed handover agreements. And every time, the platform has remained exactly where it was: in the hands of James Ayugi.
President Ruto stood before cameras on June 30, 2023, to relaunch eCitizen with fanfare as a flagship achievement of his administration’s digital agenda. Behind the spectacle, the man whose firm retained the kill switch over the entire enterprise had attended the same event. A platform built with World Bank money, declared government property in 2017, remained, in every operational and practical sense, a private business.
The May 2023 contract with the ECS consortium runs for three years. It expires in May 2026. As the deadline approaches, the question is whether this government will, at last, do what two administrations have failed to do, or whether James Ayugi will once again demonstrate that in the contest between a determined private operator and a diffident state, the one who actually controls the infrastructure wins every time.
In the meantime, every Kenyan who logs onto eCitizen to apply for a document, pay a fee or register a service is, whether they know it or not, enriching a private consortium that has turned the machinery of democratic governance into a revenue stream. The state they are paying to access is not, in any meaningful sense, theirs.
The state they are paying to access is not, in any meaningful sense, theirs.
