The banking order in Kenya is shifting, and nowhere is the evidence more stark than in a single line on two balance sheets filed simultaneously with the Central Bank of Kenya. In the quarter ended March 2026, I&M Group’s total assets crossed Sh742.5 billion, overtaking NCBA Group’s Sh741.1 billion to knock the dynasty bank out of the fourth position it had occupied for years.
The gap is narrow, barely Sh1.4 billion, but the direction of travel is not. NCBA’s balance sheet has been contracting for several consecutive reporting periods while rivals have expanded. That is not a statistical blip.
That is a structural signal, and prudent depositors, investors and counterparties would be wise to read it carefully before their next engagement with this institution.
NCBA has spent the past eighteen months producing press releases about profits and digital lending volumes while quietly glossing over the fact that the asset base on which those profits sit is actively declining.
Total assets fell 5.6 percent year-on-year in the first quarter of 2025 to Sh656 billion from Sh694.9 billion. By the mid-year results, total assets had shrunk further to Sh663 billion, down 3.8 percent.
By the third quarter they closed at Sh665 billion, still down 2 percent year-on-year. Customer deposits, the most fundamental measure of public trust in any bank, fell 9.6 percent in Q1 2025 and remained down 5.3 percent through Q3. These are not minor rounding errors on a growing franchise. They are the numbers of a bank that is losing ground.
To understand how a lender that emerged from the 2019 merger of NIC Bank and Commercial Bank of Africa with such fanfare arrived at this moment requires examining not just the headline numbers management presents to investors, but the pattern of governance failures, internal fraud cases, regulatory sanctions, and ownership conflicts that have accumulated in plain sight.
THE BALANCE SHEET THAT SHRANK
The numbers that NCBA’s communications machinery does not lead with are these. At its peak following the merger, NCBA commanded a balance sheet of nearly Sh695 billion.
By March 2026 that figure had settled at Sh741 billion, a nominal rise that masks the compound effect of inflation and the far more aggressive growth posted by every competitor in its tier.
The loan book, which NCBA has repeatedly cited as evidence of commercial momentum, stood at Sh324.4 billion in March 2026, marginally ahead of I&M’s Sh322.9 billion.
The previous gap had been Sh40.33 billion in December 2022. NCBA has therefore surrendered the bulk of a forty-billion-shilling loan book advantage over a single rival in less than four years, during a period when management was drawing salaries, running marketing campaigns, and issuing quarterly statements about record digital disbursements.
|
-5.6% total asset contraction, Q1 2025 year-on-year NCBA Group unaudited Q1 2025 results vs Q1 2024 |
|
-6.0% customer deposit decline at H1 2025 NCBA Group H1 2025 press release, August 2025 |
|
7% profit growth, full year 2025 vs I&M’s 24.4% NCBA annual results vs I&M Group comparative performance |
The deposit contraction is the more troubling number. Deposits represent the votes cast daily by the market on whether a bank deserves public trust.
When NCBA’s deposit base shrinks by nearly ten percent in a single quarter while the broader banking sector is mobilising savings, it suggests customers are actively choosing to move their money elsewhere.
NCBA’s management has explained the contraction as the result of deliberate repricing, the decision to cut deposit rates from 11.97 percent in September 2024 to 7.3 percent in September 2025. The framing presents a strategic choice as a positive development. The market is less convinced.
BUILT ON A MERGER THAT NEVER FULLY HEALED
The root cause of NCBA’s current institutional fragility is a merger that was celebrated as a triumph of Kenyan capitalism but which, in operational terms, left deep scars.
When NIC Group and Commercial Bank of Africa completed their combination on September 30, 2019, the result was a lender that ranked third by assets, served over forty million customers in four countries, and carried the implicit blessing of two of Kenya’s most powerful business dynasties, the Kenyattas and the Ndegwas.
The optics were impeccable. The integration was another matter.
Within six months of the merger closing, NCBA had permanently shuttered fourteen branches across Kenya, citing overlap in the combined network.
Eight belonged to the former NIC Bank; six to former CBA. Customers who had built relationships with those branches were advised to visit alternatives. The branch closure programme was framed as an efficiency exercise.
In a market where branch proximity and relationship banking remain powerful drivers of deposit loyalty, it was also a decision to surrender customer relationships built over decades.
The integration of two distinct banking cultures, NIC’s conservative corporate-and-asset-finance model and CBA’s more retail-and-digital orientation, produced structural tensions that were never fully resolved.
The duplication of risk management frameworks, credit systems, and customer data infrastructure created the kind of institutional complexity that makes fraud easier to execute and harder to detect. Evidence of that complexity has since appeared in Kenya’s courts.
THE FRAUD FILES: A PATTERN, NOT AN INCIDENT
NCBA has been at pains to present the criminal conduct that has surfaced within its operations as isolated incidents, the work of rogue individuals acting against the institution’s values. The court record tells a different story. It tells the story of a bank with systemic vulnerabilities in its internal controls, particularly in the critical space between customer accounts and the staff authorised to move funds within them.
In November 2024, the Office of the Director of Public Prosecutions (ODPP) placed before Kisii Law Courts a case involving Philip Kiprono Rotich, the assistant operations manager at NCBA’s Kisii branch and a ten-year employee of the bank.
According to an affidavit by Chief Inspector Johnson Kioli of the Banking Fraud Investigations Unit, Rotich allegedly orchestrated a systematic diversion of customer funds over nearly two years, from November 2023 to October 2024, by exploiting the trust placed in him by the branch’s largest clients.
The funds were routed to his personal accounts at Kenya Commercial Bank and at NCBA itself, as well as through mobile banking platforms. What makes this case particularly alarming is not the scale alone.
The ODPP told the court that Rotich continued to defraud customers even after being suspended by the bank. A suspended employee, stripped of his authority but apparently not his access, continued to steal from the accounts he had been entrusted to protect.
The charge sheet eventually filed against Rotich was staggering in its detail. He faced 134 criminal charges. The alleged sum diverted was Sh52,404,084.95. The charges included theft by servant, acquisition and possession of proceeds of crime, forgery, and the utterance of false documents.
Each charge represents a discrete act, a deliberate decision by a trusted insider to betray a customer. One hundred and thirty-four such acts, over a period spanning three years, at a single branch.
The question that NCBA has never answered publicly is how an assistant operations manager at a branch with large corporate clients was able to execute more than a hundred and thirty fraudulent transactions before the bank’s own security systems flagged the problem.
That question matters because Rotich’s case is not isolated. Court records from 2023 reveal a separate case involving NCBA’s Contact Centre and Credit Risk Management departments, in which employees were implicated in the unauthorised reactivation of dormant customer accounts and the execution of unauthorised debit transactions totalling over Sh3.2 million.
In February 2023, eight individuals were charged with stealing Sh449.6 million from NCBA through the Fuliza mobile overdraft facility.
More recently, a software engineer working as a contractor on NCBA’s mobile banking infrastructure in Rwanda was found to have used his legitimate system access to open floodgates for mobile banking fraud.
The pattern across these cases is consistent: trusted insiders and contractors exploiting inadequate oversight of privileged system access.
THE DATA PRIVACY RECORD: FINED, TWICE
A bank’s internal controls are only as strong as its data management practices. NCBA’s record on data protection is not one that should inspire confidence in customers who share sensitive financial and personal information with the institution.
In November 2024, Kenya’s Office of the Data Protection Commissioner (ODPC) ordered NCBA Bank to pay Sh250,000 in compensation to a UK-based solicitor, Rose Wambui Muigai, after finding that the bank had disclosed her personal data, including her name, phone number, and motor vehicle details, to third parties who were former NCBA employees, without any lawful basis.
The solicitor had received repeated calls from people identifying themselves as NCBA staff and revealing her financial information. Data Commissioner Immaculate Kassait ruled that the bank had processed the complainant’s personal data in violation of the right to privacy under Section 25(a) of the Data Protection Act.
In a separate ruling in April 2025, the ODPC again sanctioned NCBA, ordering the bank to pay a second Sh250,000 fine after it was found to have persistently sent a business customer’s transaction details to the wrong email address for years, even after both the customer and the unintended recipient had repeatedly notified the bank of the error.
The Data Commissioner ruled that NCBA had either intentionally or negligently violated the customer’s right to erasure.
The penalty is modest.
The behavioural pattern it reveals is not. A bank that receives two regulatory determinations for data mishandling within six months, in different factual circumstances, does not have an isolated data management problem. It has a systemic one.
DIGITAL LENDING: THE NUMBERS BEHIND THE NUMBERS
NCBA has staked much of its institutional identity on its dominance of Kenya’s digital lending market. The bank is co-owner of Fuliza, the M-Pesa overdraft product operated with Safaricom, and operates M-Shwari, the mobile savings-and-credit product it launched as Commercial Bank of Africa in 2012. In 2025, NCBA reported disbursing over one trillion shillings in digital loans, a figure its management has repeatedly cited as evidence of market leadership and innovation.
What this figure does not tell the story of is the quality of those loans or the social cost of the model on which they rest. M-Shwari has for years charged a flat facilitation fee that, when annualised, translates to an effective rate that regulators and consumer advocates have consistently described as far in excess of what conventional banking would permit.
When this publication examined the arithmetic previously, a one-month M-Shwari loan at the standard flat charge represented an annualised rate that dwarfs the Central Bank’s benchmark by multiples. Fuliza, the overdraft product embedded in M-Pesa, charges a daily fee structure that, on an annualised basis, has historically exceeded three hundred percent.
The consequence of lending at these rates to the most financially vulnerable segment of the Kenyan economy is visible in NCBA’s own balance sheet.
The bank was required to write off Sh11.25 billion in bad Fuliza and M-Shwari loans under the Central Bank’s 2022 credit repair framework, a programme designed to release over four million Kenyans from the negative credit listings that digital borrowing at predatory rates had generated. NCBA was the single largest participant in that write-off programme, a distinction that reflects the scale of its digital lending but also the rate at which those loans were going bad. By Q3 2025, provisions for credit losses had jumped 24.5 percent year-on-year to Sh5.1 billion, a figure that management described as a conservative risk posture while simultaneously disbursing over a trillion shillings in new digital credit.
THE OWNERSHIP STRUCTURE THAT WAS HIDDEN IN PLAIN SIGHT
NCBA Group has always carried the financial weight of two of Kenya’s most storied dynasties. The Kenyatta family, heirs to the legacy of founding President Jomo Kenyatta, and the Ndegwa family, descendants of the late Philip Ndegwa who served as Governor of the Central Bank of Kenya, between them built the two institutions that became NCBA. What Kenya’s investing public has not always appreciated is the full scale of those holdings and the specific governance dynamics they create.
On December 1, 2025, Muhoho Kenyatta, the younger brother of former President Uhuru Kenyatta, was appointed to the NCBA board as a non-executive director. That appointment came amid buyout talks with South Africa’s Nedbank Group that had already been underway. Five months later, when Nedbank filed its formal offer circular in May 2026, Muhoho’s appointment triggered mandatory disclosure requirements that revealed, for the first time, the full scale of his personal stake in the institution: 227,395,137 NCBA shares, a position worth approximately Sh20 billion at prevailing market prices.
The governance question that this sequence of events raises is direct. A director who holds a personal financial interest of Sh20 billion in an institution joined the board of that institution in the same period that a takeover bid which would yield him a premium above market value was being negotiated.
The Capital Markets Authority of Kenya’s rules on conflicts of interest in takeover transactions require disclosure, which NCBA has provided. What they do not require is for the public to simply accept that a board member sitting on a transaction that will deliver him a twenty-billion-shilling windfall represents a governance arrangement that small shareholders and depositors should be comfortable with.
The combined Kenyatta and Ndegwa family positions represent the most concentrated family ownership in Kenya’s tier-one banking sector.
The Ndegwa family holds its stake through various vehicles totalling over 11 percent of the institution.
Together, the two families, alongside their related investment vehicles, committed enough shares to guarantee the 66 percent acceptance threshold that Nedbank required. By February 2026, irrevocable commitments from shareholders representing 77.54 percent of NCBA’s issued shares had been secured. The families had in effect pre-sold the bank before the transaction was put to any other shareholder for consideration.
THE NEDBANK DEAL: EXIT OR ENDORSEMENT?
Nedbank Group of South Africa, acting on the explicit logic that its home market is saturating while East Africa offers growth, has offered Sh105 per share for a 66 percent controlling stake in NCBA Group, in a transaction valued at approximately Sh109.6 billion.
The consideration is structured as 20 percent cash and 80 percent newly issued Nedbank shares listed on the Johannesburg Stock Exchange. The deal values NCBA at approximately 1.4 times its book value.
The mainstream coverage of this transaction has focused almost entirely on the premium it offers over the pre-announcement trading price.
That framing is convenient for the founding families and for Nedbank’s communications team.
It is less helpful for the depositor in Nakuru who banks with NCBA because it is Kenyan, or the small investor who bought shares at Sh69.50 in October 2025 before acquisition speculation sent the price surging, or the pensioner whose retirement savings sit in an institution that will, if the deal closes as planned in the third quarter of 2026, become a subsidiary of a South African group whose primary strategic rationale for the purchase is expansion beyond its saturated home market into Ethiopia and the Democratic Republic of Congo.
What the deal reveals, if it reveals anything, is that Kenya’s two most powerful banking dynasties have concluded that the best available outcome for their capital is to convert their NCBA holdings into Nedbank shares and cash, rather than to continue holding a Kenyan institution at current valuations. Sophisticated investors sell when they believe the price offered exceeds what they would earn by holding.
That is the transaction on the table. Retail investors and depositors are invited to draw their own conclusions about what the founding families’ exit from the institution they built says about their long-term confidence in its standalone potential.
THE PROFITABILITY GAP THAT IS CLOSING
NCBA’s management has correctly pointed to the bank’s profit growth as evidence that the institution is performing. The 2025 full-year profit after tax of Sh23.4 billion was a seven percent increase from Sh21.9 billion in 2024. Profit before tax in 2024 of Sh25.1 billion was actually lower than the Sh25.5 billion recorded in 2023, a decline attributed to increased operating expenses and reduced foreign currency trading income. The trajectory, when examined quarterly, is one of narrowing margins and slowing growth.
The comparison with I&M Group is instructive because the two banks have been running in parallel for the same prize. In 2023, the profitability gap between NCBA and I&M stood at Sh8.1 billion in NCBA’s favour. By 2024 that gap had narrowed to Sh5.92 billion. By 2025 it was Sh3.55 billion. I&M grew its net profit by 24.4 percent in 2025. NCBA grew its by 7 percent.
At the current rate of convergence, the profitability gap closes within two years. Given that I&M has already overtaken NCBA on the asset line, the directional question the market should be asking is not where these institutions stand today but where they will stand in 2028 when the minimum capital requirements being phased in by the Central Bank of Kenya take full effect at Sh10 billion.
The capital requirement escalation, which mandates core capital of Sh5 billion by end-2026, Sh6 billion by end-2027, Sh8 billion by 2028, and Sh10 billion by end-2029, is designed to produce consolidation. NCBA, as a Nedbank subsidiary, will navigate that requirement with the backing of a JSE-listed parent.
The thirty-four percent of NCBA shares that will remain on the NSE after the deal closes will be minority positions in an institution where strategy, capital allocation, and expansion decisions are made in Johannesburg.
THE CLIENTS WHO VOTED WITH THEIR FEET
Institutional confidence in NCBA has been measured not only by balance sheet flows but by the behaviour of major commercial clients. Among the clients lost by WPP Scangroup, the Nairobi-listed marketing and communications group, in the period since its board changes in 2021 were four significant institutions: KCB Group, Equity Bank, NCBA Group and Airtel Africa.
The departure of NCBA from WPP Scangroup’s client roster was noted in shareholder documents filed in May 2026 by minority investors seeking to oust the Scangroup board. The bank’s exit from one of Kenya’s most prominent marketing firms is not, by itself, a material event. It is, however, another small data point in a pattern.
WHAT PRUDENT STAKEHOLDERS SHOULD ASK
Customers who bank with NCBA are entitled to ask their institution the following questions, none of which NCBA’s public communications have answered satisfactorily.
How many unresolved fraud investigations are currently active across the bank’s branch network, and what systemic control failures facilitated the cases that have reached the courts? What is the current status of the bank’s data management compliance programme following two regulatory determinations in less than twelve months? When Nedbank completes its acquisition, which is expected by the third quarter of 2026, what protections will the Central Bank of Kenya require to be in place to ensure that depositors’ funds held in an institution now controlled by a foreign parent receive equivalent regulatory oversight? And for those customers who bank with NCBA because it is a Kenyan institution backed by Kenyan capital, what precisely does that characterisation mean after the Kenyatta and Ndegwa families have completed their exit?
Shareholders who have not yet tendered their shares under the Nedbank offer, which closes on July 10, 2026, face a version of the same question.
The offer price of Sh105 per share represents a 20.3 percent premium over the pre-announcement market price.
The eighty percent of that consideration that is payable in Nedbank shares is denominated in rand and priced on the Johannesburg Stock Exchange.
Shareholders accepting this structure will exchange liquid NSE holdings for JSE-listed shares in a South African lender whose primary reason for acquiring NCBA is access to markets, Ethiopia and the DRC, where the risks and timelines for return are substantially longer than the East African operations that have generated NCBA’s historic profits.
For investors who choose to remain in the thirty-four percent rump that will continue to trade on the NSE, the relevant question is what governance rights they will have in an institution where the majority shareholder is a foreign group whose primary accountability is to its own shareholders and regulators in South Africa.
THE CONCLUSION THE EVIDENCE COMPELS
NCBA Group is not a failed bank.
Its profits are real, its digital lending volumes are extraordinary, and its management team is competent. None of that is under dispute here.
What is under dispute is the institutional narrative that has been sold to Kenya’s investing public: that NCBA is a growing, well-governed, domestically-anchored institution that represents a sound long-term home for deposits and investment capital.
The evidence assembled in this report points to a different characterisation.
This is a bank whose asset base has contracted for multiple consecutive periods while competitors grow. It is a bank that has produced two regulatory findings for data mishandling in a single year.
It is a bank whose internal fraud record reflects unresolved systemic vulnerabilities in its branch operations and digital infrastructure.
It is a bank whose founding shareholders are in the process of converting their equity into the shares of a foreign institution, structured in a way that delivers them a guaranteed premium while the minority shareholders they leave behind inherit positions in a controlled subsidiary.
It is a bank whose digital lending franchise, while commercially impressive, rests on a model that has generated Sh11.25 billion in write-offs and trapped millions of low-income Kenyans in cycles of high-cost debt.
None of this means depositors should withdraw their funds tomorrow or that shareholders should tender at Sh105 without independent financial advice.
What it means is that the due diligence question that NCBA’s marketing materials will never ask on your behalf is the one this publication is asking on the record.
Is this, in its current form and on its current trajectory, the institution you were told it was? The balance sheet says no. The court docket says no. The exit of the founding families says no.
The Nedbank offer closes July 10, 2026.
This report was prepared from publicly available financial disclosures, court records filed at Milimani Law Courts and the Employment and Labour Relations Court, determinations of the Office of the Data Protection Commissioner, and regulatory filings with the Capital Markets Authority of Kenya and the Nairobi Securities Exchange. No information in this report has been fabricated. All figures are sourced from primary documents.
