Beyond CBK Protection: Why Kenya’s Dual Regulatory Gap Leaves CEOs Personal Exposed
Citibank Kenya’s bid to block the DCI highlights a dangerous reality for executives: compliance with sectoral regulators will no longer insulate you from criminal investigation.
The Citi Bank Precedent: Why the DCI is Targeting CEOS in Commercial Deals
Part 1: Commercial Risk vs. Criminal Intent
In June 2026, The Directorate of Criminal Investigations (DCI) served summons on Citibank Kenya CEO Martin Mugambi at the bank’s Nairobi headquarters, it signaled a fundamental shift in how commercial disputes are arbitrated in Kenya. As Martin Mugambi faces DCI prosecution over Kiru Tea Factory’s KSh 261M loan, Justice Mugambi’s Feb 2026 landmark ruling proves that CBK oversight won't shield corporate leaders from criminal liability.
The core of the investigation appears straightforward on the surface: a 2.02 million (KSh 261.5 million) credit facility advanced to Kiru Tea Factory Company Limited. However, the legal classification applied by investigative authorities marks an unprecedented departure from standard corporate practice. The DCI is seeking to question, and potentially charge, the bank’s chief executive over allegations of “negligently accepting a credit application” and authorising the loan’s disbursement.
This dynamic sets up a direct clash between two irreconcilable interpretations of law and corporate governance:
The Bank’s View: Credit appraisal, risk assessment, and loan underwriting are purely commercial functions. A failure in procedural verification or a default in repayment constitutes a civil matter—governed by contract law, loan covenants, and regulated under the supervisory framework of the Central Bank of Kenya (CBK).
The State’s View: Procedural lapses, unauthorized disbursements, or loan approvals executed during internal governance disputes are no longer treated as mere credit underwriting failures. Instead, investigative agencies are framing them as potential acts of criminal negligence or fraud, effectively piercing the corporate veil to target the decision-makers directly.
For corporate boards, credit committees, and institutional investors, the petition filed in the High Court (HCCHRPET/E373/2026) represents far more than an isolated legal defense of a single banking executive. It unveils an increasingly aggressive enforcement strategy: bypassing institutional corporate shields to place C-suite executives under personal criminal jeopardy during routine commercial transactions.
Part 2: The Comparative Benchmark — The Safaricom Precedent
To understand the legal headwinds facing Citibank Kenya and Martin Mugambi, one must analyze the landmark precedent set in the High Court judgment delivered by Justice Lawrence Mugambi regarding Safaricom PLC.
In the Safaricom petition, the telco moved to the High Court seeking conservatory orders to block the DCI and ODPP from investigating, summoning, or prosecuting 18 of its corporate officials over a disputed 2016 creative and digital agency tender involving ATL/BTL Creatives. Like Citibank, Safaricom argued that the DCI failed to disclose specific evidentiary details in its summons, provided insufficient notice, and violated the constitutional rights of its officers.
Justice Lawrence Mugambi dismissed Safaricom’s petition in its entirety, establishing three critical principles that now directly undermine Citibank’s suit (HCCHRPET/E373/2026):
1. Criminal Probes Are Not “Administrative Actions” (Article 47)
Citibank relies heavily on Article 47 (Right to Fair Administrative Action) to challenge the two-day notice period and vague DCI summons. However, the High Court explicitly ruled that criminal investigations conducted by the DCI under the Criminal Procedure Code are governed by specialized penal statutes, not administrative law. Consequently, executive officers cannot invoke administrative fairness to halt investigative proceedings.
2. Pre-Charge Disclosure Is Not an Automatic Right (Articles 35 & 50)
Citibank fault-finds the DCI for failing to state the exact factual basis or specific role played by Mugambi in the KSh 261.5 million loan. Justice Mugambi rejected this exact argument in the Safaricom case, ruling that requiring the DCI to supply evidence before statements are recorded would “undermine and disrupt a genuine probe”. The court clarified that the right to full disclosure under Article 50(2)(j) only kicks in after formal criminal charges are preferred—not during the investigation stage.
3. Personal C-Suite Liability as a State Lever
By attempting to question Safaricom’s senior managers—and now Citibank’s Chief Executive—the DCI leverages a strategy that bypasses lengthy corporate dispute processes. Because the High Court set a high threshold for intervening in ongoing investigations, state agencies recognize that targeting C-suite leaders directly forces institutional legal teams into defensive constitutional litigation rather than standard commercial arbitration.
Part 3: The Legal Vulnerabilities in Citi’s Defense
Analyzing Citibank Kenya’s petition (HCCHRPET/E373/2026) against the backdrop of Justice Mugambi’s ruling reveals structural vulnerabilities in the lender’s strategy.
Vulnerability 1: The “Non-Existent Offence” Argument
Citibank contends that “negligently accepting a credit application and disbursing a loan” describes a civil breach or contractual liability rather than a statutory crime.
While negligent underwriting itself is not explicitly listed in the Penal Code, the DCI typically uses initial summons descriptions as broad proxies while gathering facts. Under standard investigative procedures, investigators use statement recording sessions to determine whether procedural negligence overlaps with statutory offenses such as:
Abuse of office / breach of trust.
Fraudulent inducement or conspiracy to defraud.
Non-compliance with statutory anti-money laundering (AML) and credit approval mandates.
By filing a petition at the summons stage, Citibank risks receiving a ruling that the DCI has the statutory mandate to investigate whether “civil negligence” masked criminal intent.
Vulnerability 2: Over-Reliance on CBK Inaction
The bank highlights that no complaint has been lodged with the Central Bank of Kenya (CBK) nor has any regulatory concern been raised through supervisory channels.
From a constitutional law perspective, regulatory oversight by the CBK under the Banking Act runs parallel to—and does not supersede—the DCI’s mandate under Article 244 of the Constitution and the National Police Service Act. The absence of a CBK audit finding does not insulate a bank or its executives from criminal inquiries initiated by external complainants or state investigators.
Vulnerability 3: Procedural Challenges vs. Bad Faith (Mala Fides)
To successfully restrain investigative agencies, the High Court requires proof of clear malice, bad faith, or gross constitutional overreach. Citibank’s grievances—short notice periods (two days), opaque summons, and warnings of prosecution upon failure to attend—are treated by the courts as standard administrative frictions of police work rather than grounds to throw out a criminal probe.
Unless Citibank can demonstrate that the investigation is entirely fabricated or driven by ulterior motives disconnected from the Kiru Tea Factory loan, the petition faces a steep hurdle in light of recent precedent.
Part 4: The Financial Mechanics & Corporate Governance Breakdown
Behind the constitutional filings and jurisdictional posturing sits the core catalyst of the dispute: a 2.02 million (KSh 261.5 million) credit facility extended to Kiru Tea Factory Company Limited.
Unpacking this transaction reveals how routine corporate banking procedures can become collateral damage when internal corporate governance fractures at the borrower level.
1. Board Approvals and the KTDA Ecosystem Disconnect
The Kiru Tea Factory loan was structured during an era defined by intense governance friction between smallholder factory boards, former Kenya Tea Development Agency (KTDA) leadership under Chege Kirundi, and state-backed tea sector reforms.
For institutional lenders like Citibank, extending credit to tea factory proxies typically relies on standardized documentation:
Corporate board resolutions authorizing borrowing.
Mandates detailing designated signing officers.
Pledged commercial assets or green-leaf receivables as security.
The DCI’s investigation centers on allegations that the credit application was “negligently processed”. In commercial banking terms, this implies the State believes Citibank’s credit desk acted on unauthorized board resolutions, overlooked internal corporate governance disputes at Kiru Tea Factory, or disbursed funds to signatures that lacked legal standing.
2. The KYC / KYCB Execution Deficit
For tier-1 commercial lenders, Know Your Customer (KYC) and Know Your Customer’s Business (KYCB) frameworks are designed to verify identity and legal capacity. However, when corporate governance at a borrower institution is actively contested in court or via internal board coups, standard KYC checklists hit a blind spot:
When internal factory factions challenge the validity of historical loan agreements, the lender is retroactively accused of “negligence” for relying on corporate documentation that appeared facially valid at execution.
3. The Dual-Regulatory Dilemma
The dispute brings to light an unaddressed structural conflict in Kenya’s financial sector oversight:
Citibank points out that the Central Bank of Kenya (CBK)—the statutory regulator empowered to audit banking books and penalize underwriting failures—has raised no regulatory objection or compliance flag regarding this loan.
If investigative agencies can bypass the prudential supervisor to classify commercial loan underwriting failures as penal offenses, commercial lenders are exposed to dual legal exposure: operating fully within CBK compliance guidelines while remaining criminally vulnerable to the DCI for credit judgment calls.
Conclusion: The Era of Non-Delegable C-Suite Liability
The High Court’s eventual determination in HCCHRPET/E373/2026 will reverberate far beyond Citibank’s Nairobi boardroom.
If the courts affirm that state investigative agencies have the mandate to criminally interrogate and prosecute C-suite executives over operational or procedural failures without a prior regulatory finding or civil judgment, the operational baseline for all corporate leadership in Kenya—across both private enterprises and public institutions—will permanently shift:
The End of Institutional Insulation: Corporate legal entities, statutory dispute channels, and regulatory shields (such as the CBK or sector-specific boards) will no longer protect individual executives. Decision-makers can no longer hide behind corporate policies, board resolutions, or delegated approvals.
Universal C-Suite Accountability: Managing directors, CEOs, and senior officers in both private companies and public entities face a reality where administrative shortcuts, procedural missteps, or flawed commercial approvals are aggressively reclassified as personal criminal acts (such as abuse of office, criminal negligence, or conspiracy).
Chilling Effect on Enterprise & Decision-Making: Executive boards and procurement/credit committees will encounter operational paralysis as leaders demand exhaustive legal cover and dual-authorization clearances to insulate themselves against personal criminal exposure.
Repricing C-Suite Risk: Managing directors and executive officers must fundamentally re-evaluate their personal liability exposure, as standard corporate indemnities and directors’ and officers’ (D&O) insurance offer virtually no protection against criminal summons, arrests, or state prosecution.
The New Reality: The “Mugambi Precedent” demonstrates that the line separating operational risk from criminal liability in Kenya is no longer drawn inside corporate boardrooms—it is actively being defined in criminal courtrooms.
About Boardlot Africa Research
Boardlot Africa is a premier financial intelligence and corporate governance publication dedicated to unpacking the mechanics of capital, market strategies, and structural shifts across East Africa’s corporate landscape. By bridging the gap between raw economic data and actionable market intelligence, we deliver deep-dive research, independent corporate analysis, and policy insights designed for institutional investors, boardrooms, and sharp market observers.
Get in Touch
Email: boardlot.research@gmail.com
Phone: +254 753 133 901
Substack: Subscribe to Boardlot Africa
X (Twitter): BoardLotSultan