Nolesca Manyonge Malemo v Republic

Njomo (initiator) and the appellant, who was the approver. The appellant had been employed since January 2013, with M-Pesa approval responsibilities included in his job description. 5. In 2018, the appellant resigned but did not complete the clearance process due to the matter under investigation. While preparing a response to an internal query on 4th June 2019, PW1 came across Mpesa payments totalling Kshs. 200,000 made to the appellant despite him being in the process of exiting. These payments were unusual as all previous disbursements to him had been via bank transfer. The matter was escalated to VSF management and subsequently reported to the police. 6. PW2, Joseph Njomo, a former finance officer now in logistics, confirmed that he handled disbursements and system uploads while the appellant approved transactions. Upon reconciling the Mpesa account in June 2019, PW2 discovered anomalies in the statements showing that the appellant was a recipient of multiple payments. He explained that according to Safaricom's system, an operator would upload data, and a manager (in this case, the appellant) would approve it. The Safaricom Business-to-Customer manual (produced as an exhibit) confirmed the roles and access privileges. 7. Statements printed from the VSF portal and produced in court showed transactions from January to June 2019 in which the appellant was paid. The total unauthorised amount traced to him exceeded Kshs. 17 million, with records dating back to April 2015. PW2 also produced a certificate under section 106B of the Evidence Act, authenticating the electronic evidence. He clarified that he had no role in approvals or withdrawals and denied any involvement in the fraudulent activities. 8. PW3, Catherine Majani, a former Finance Manager at VSF, testified that she served as the administrator of the Mpesa portal from 2009 to 2022. In her role, she could add or remove users but could not transact. She explained that the system was structured so that the operator would initiate payments, which were then approved by a manager. In this case, the appellant was the designated manager while PW2 was the operator. 9. She testified that she had been relying on statements and reconciliations submitted by the appellant until she noticed delays and inconsistencies. Upon reviewing the M-Pesa statements, she observed suspicious payments to the appellant, prompting further investigation and contact with Safaricom for independent confirmation. These payments were later corroborated with official statements showing that funds had been directly disbursed to the appellant from the VSF Mpesa account. 10. PW4 Peter Njoroge Mburu, an accountant at VSF Germany since 2009, testified that on 7 June 2019, during a procurement meeting, he was questioned by the HR Manager, Nancy Chemutai, about an unauthorised payment of Kshs. 240,000 was made to the appellant. He denied any knowledge of the payment and was shown an M-Pesa statement reflecting multiple disbursements to the appellant between April and June 2019. PW4 confirmed that such payments lacked proper documentation and authorisation. 11. Upon further scrutiny of earlier Mpesa statements, including those from 2018, additional unauthorised payments to the appellant were discovered. It was noted that all payments had been channelled through the VSF Germany utility account. Since the appellant had resigned in November 2018 but remained to assist with the handover until March 2019, he was no longer attending work by April 2019. PW4 further stated that discrepancies arose when comparing internal Mpesa records with official statements from Safaricom. These anomalies prompted an internal audit. PW4 maintained he had no personal conflict with the appellant. 12. PW5 Muriki Makathimo Kyambi, an internal auditor with VSF Germany since 2015, testified that he initiated an audit after the HR Manager raised concerns over suspicious payments made to the appellant. Anomalies were flagged during a meeting on 4th June 2019. His investigation covered the https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11244/eng@2025-07-30 2

page 2 of 5

period between 2014 and 2019. His audit report concluded the following: A total of Kshs. 17,988,145 had been paid to the appellant between 17 April 2015 and 3 June 2019 through 540 Mpesa transfers; All payments were made to the mobile number 072xxxxx0, confirmed to belong to the appellant; The scheme involved manipulation of Mpesa reconciliation statements, specifically the deletion of transactions showing payments to the appellant. These tampered statements were then used to compile official financial reports. 13. PW5 told the court that he relied on unaltered statements obtained directly from Safaricom, which differed from those stored in VSF’s internal records. His audit report was signed and dated 12th June 2019. Under cross-examination, he confirmed that no audit had previously detected the fraud due to the absence of any prior complaints. He noted that quarterly audits follow set plans and would not identify such fraud unless allegations arose. He also confirmed that the audit was internal, with no external report provided. 14. PW6 PC Edward Onyango PC Edward Onyango testified that he joined investigations into the alleged theft following instructions from the DCIO. On 6th June 2019, he was briefed by PC Cyrus Wambua, and a court order was obtained to retrieve Mpesa and bank statements linked to the appellant. On 13th June 2019, Onyango accompanied his colleague to Dagoretti Corner, where they arrested the appellant. 15. PW7 PC Cyrus Wambua testified that he was assigned to the case on 6th June 2019 following a report by Nancy Chemutai and Muriki Kyambi of VSF. He confirmed that VSF is a Kenya-registered NGO supported by a Safaricom utility account (Paybill No. xxx), linked to CBA Bank, for transferring funds to livestock-reliant communities. Anomalous transactions were identified involving unauthorised payments to the accused. 16. Between 3rd April and 7th April 2019, the appellant received a series of payments to his Mpesa number, xxx, totalling over Kshs. 250,000. This raised suspicion, particularly since the payments lacked supporting documents. A meeting of VSF senior staff resolved to conduct an internal audit. PW7 confirmed that the audit revealed unauthorised transfers totalling Kshs. 17,988,145. 17. PW7’s investigations also uncovered that the appellant had superior access rights on the Safaricom portal and had full control over login credentials, including those of Joseph Kinyua, the transaction initiator. The audit revealed that the appellant had used these credentials to initiate and approve payments fraudulently. The report and related statements were admitted as prosecution exhibits (EXB 6a–f, EXB 9, 11–15). The appellant was found to have manipulated and deleted transactional data to conceal the fraudulent payments. 18. During cross-examination, PW7 conceded he had not obtained login audit logs from the Mpesa system and had not verified whether others accessed the portal. He acknowledged the possibility that other employees received payments from the utility account with proper paperwork. He also admitted that while internal audit reports were supplied, no external audit report was obtained or presented. Nevertheless, he relied on VSF's internal documentation, Safaricom statements, and witness statements to link the accused to the misappropriation of funds. 19. In re-examination, PW7 maintained that his investigation focused on theft, not the NGO’s source of funding. He confirmed that EXB 6 (from VSF) matched EXB 12 and 13 (Safaricom statements) and corroborated the appellant’s receipt of the unauthorised payments. 20. In his defence, the appellant testified that he worked at a donor-funded NGO from 2013 to 2019, initially as an accountant and later as a Regional Finance Officer. He resigned in 2018 but was recalled in March 2019 due to a backlog. He was arrested in June 2019. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11244/eng@2025-07-30 3

page 3 of 5

21. He explained that the utility account was used for approved payments, either initiated or approved by designated users, including himself, the Head of Finance, and other accountants. Transactions required supporting documents, and M-Pesa was used for disbursements, including per diems. Credentials for system access were granted by the system manager, Catherine Majani. 22. The appellant denied any wrongdoing, stating there were no complaints or disciplinary issues during his tenure. He maintained that audits, project-specific, internal, statutory, and donor-led, were conducted regularly and never raised concerns. He saw the audit report for the first time in court and denied being involved in its preparation. He claimed the audit was biased and that an independent external audit would have been more reliable. He identified Joseph Kinyua and Catherine Majani as individuals with system access and insisted the funds he received were for project activities, with no reports of incomplete work or unpaid suppliers. 23. In re-examination, he reiterated his limited access to documents after resignation and questioned the credibility of the audit findings. 24. The appeal was canvassed by way of written submissions, which have been duly considered. For the prosecution to prove the charge of stealing by servant, it must establish the following: that the Appellant was an employee of the complainant, that the Appellant stole the property of the employer that came to his possession in the course of the employment, and finally that the appellant dishonestly appropriated the said property thereby depriving the employer of the same. 25. It is not in dispute from the evidence on record that the appellant was an employee of VSF Germany from 2013 to 2019. During his employment, he served as an accountant and later as a Regional Finance Officer. In his various roles, he possessed approval rights on the M-Pesa platform, forming part of his official duties. Multiple witnesses, including PW1, PW2, and PW3, confirmed his employment and the authority he exercised on the Safaricom business portal. 26. The second ingredient is whether the appellant stole the money alleged by virtue of his employment and role. The prosecution claimed that the funds in question, totalling Kshs. 17,988,145 were paid to the appellant between 17th April 2015 and 3rd June 2019 through 540 Mpesa transactions. In addition, these payments were made to the mobile number xxx. From the record, no expert witness from Safaricom was called to confirm that the said number was registered to the appellant. The court notes that mobile phone ownership is verifiable through official subscriber records, and in the absence of such proof, the claim that the appellant personally received the funds remains speculative. Consequently, the second ingredient that the appellant came into possession of the funds in the course of employment was not proved. 27. Further, the internal audit report produced by PW5 was based on statements allegedly manipulated by the appellant. The audit was not subjected to any external or forensic review. No digital forensic expert testified, nor were tools such as Cellebrite used to authenticate the alleged tampering or confirm system activity by the appellant. The login audit trails were not produced to show whether the appellant, and not other users with access, authorised or manipulated the transactions. The absence of such forensic evidence leaves a material gap. Therefore, the final element of the offence, dishonest appropriation of the property, was not established beyond reasonable doubt. 28. Although the prosecution suggested that the appellant had approval rights and authority over the M-Pesa portal. The prosecution witness confirmed that other individuals, including Joseph Kinyua and Catherine Majani, had user rights on the same system. The evidence failed to explain why these individuals were not investigated or charged, despite their confirmed access. This failure undermines the claim that the appellant acted alone and supports the appellant's defence that he was unfairly https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11244/eng@2025-07-30 4

page 4 of 5

singled out. Therefore, the court finds that the allegation that he dishonestly appropriated property to the exclusion of other potential suspects was not sufficiently proven. 29. The appellant explained that any funds received, if at all, were for project-related disbursements and that the audit report did not fairly reflect his role. He stated that he had no access to complete records after resignation, and that project audits never flagged misconduct during his tenure. The prosecution did not present evidence to disprove the legitimacy of the claimed disbursements, nor did they show that the employer was deprived of its funds by the appellant's actions. The absence of proof of loss to the employer attributable directly to the appellant weakens the prosecution's case. Accordingly, the court finds that the third element of the offence, being the dishonest appropriation of property to the detriment of the employer, was not proved beyond reasonable doubt. 30. In the premises, the appeal is meritorious. The conviction of the trial court is quashed and the sentence set aside. The appellant is set at liberty unless otherwise lawfully held. Orders accordingly. JUDGEMENT DATED AND DELIVERED VIRTUALLY THIS 30TH DAY OF JULY 2025 D. KAVEDZA JUDGE In the Presence of:Appellant Present Mr. Bigambo for the Appellant Mr. Chebii h/b for Mutuma for the Respondent Ms. Karimi Court Assistant. https://new.kenyalaw.org/akn/ke/judgment/kehc/2025/11244/eng@2025-07-30 5

page 5 of 5