Economic-crime defence in Kenya begins with reconstruction, not explanation. Before a suspect, director or finance officer tries to “clear things up,” the legal team should know which transaction is challenged, who authorised it, what representation was made, where the money moved and which criminal offence investigators appear to allege. A failed investment, unpaid invoice or accounting error may create civil liability without proving fraud; the opposite is also true—a contract cannot shield a deliberately dishonest transaction.

Identify the offence behind the label “fraud”

Obtain the complaint, summons, investigator request or charge sheet and record the exact statutory section. The Penal Code treats theft under section 275, obtaining by false pretences under section 313, and forgery or use of false documents under sections 345–349 as distinct offences. Each requires its own proof. Do not prepare a generic defence to “economic crime” while the prosecution relies on a specific representation, document or appropriation.

For every count, list the alleged victim, amount, date, representation, property, document, act and mental element. Where several accused persons or companies appear, allocate the role attributed to each. A signatory, beneficiary, accountant, agent and system user may have different authority and knowledge. Grouping them together because they worked at the same company can obscure the actual case.

Build a transaction map before any substantive interview

Trace the transaction from proposal through approval, invoice, delivery, payment instruction, bank settlement, accounting entry and ultimate use. Use one timeline and one money-flow diagram, but retain links to source records. Mark what was contemporaneous, what was entered later and who created each record.

Separate three questions: what the parties agreed, what occurred, and what each person knew at the time. A later loss does not prove an original intention to deceive. Conversely, a polished contract does not answer evidence that the promised asset never existed. Counsel should test both narratives rather than adopt management’s first explanation.

Preserve the full accounting environment

Issue a legal hold covering the general ledger, sub-ledgers, bank statements, mobile-money records, invoices, purchase orders, delivery records, expense claims, audit working papers, emails, messaging platforms and approval systems. Preserve native exports with date ranges, field definitions and user information. Avoid printing selected entries without the journal history that explains creation or amendment.

Record the accounting system, access rights, backup routine and responsible administrator. If investigators seize devices or servers, retain the warrant or asserted power, inventory, serial numbers and business-continuity steps. Do not overwrite, “clean up” descriptions or backfill approvals after learning of an investigation.

Authority and dishonesty are different factual questions

Collect the constitution, board resolutions, delegated-authority matrix, employment terms, bank mandates and project approvals. Determine whether the actor had authority, believed authority existed, exceeded a limit or used another person’s credentials. An unauthorised act can be serious without necessarily proving every element of the charged offence.

To assess alleged dishonesty, compare contemporaneous statements with information then available. Was a forecast presented as a forecast or as an existing fact? Was a conflict disclosed? Was the goods receipt genuine? Did the accused know a document was false? Later emails should not be used to rewrite earlier knowledge without a clear evidential bridge.

Test the alleged representation precisely

For false-pretence allegations, identify the exact words or document, recipient, date, channel, fact asserted, falsity, reliance and property obtained. Preserve the complete conversation, not the complainant’s screenshot of one sentence. If the representation came from marketing material or a subordinate, prove who approved and communicated it.

Distinguish a statement of existing fact from opinion, promise or estimate in the legal context of the section charged. Do not assume that every broken future promise was false when made. Examine contemporaneous capacity, steps toward performance, changed circumstances and how funds were actually used.

Forgery analysis starts with the document’s lifecycle

Secure the best available original, templates, signature exemplars, creation metadata, version history, printer or scanner records and transmission trail. Identify who requested, drafted, reviewed, signed, altered and used the document. A document can be false while the accused did not make it; use of a false document raises its own knowledge and conduct questions.

Engage a document or digital expert only for defined questions. Handwriting, ink, metadata or PDF structure may assist, but the expert needs reliable comparison material and chain of custody. Avoid asking an expert to decide whether the accused is “fraudulent,” which is a legal conclusion beyond the technical task.

Bank movement proves flow, not automatically criminal knowledge

Create an account-by-account schedule of deposits, transfers, withdrawals, beneficiaries and narrative references. Reconcile it to contracts and ledgers. Identify pooled funds, refunds, related-party loans and legitimate payments. Do not hide an unexplained transfer; isolate it and seek source documents.

Where a person received money, determine capacity: beneficial owner, agent, employee, trustee, vendor or nominee. Receipt is evidence but not the whole mental-state analysis. Equally, rapid dispersal, cash conversion or circular movement may require a documented business explanation, not a generic assertion that “finance handled it.”

Company and personal interests may conflict

The company may need to respond to a production request, protect customers and preserve operations, while individual officers face personal exposure. Decide who the lawyer represents and document that scope. Do not share one confidential defence strategy across people whose accounts or interests diverge.

The board should appoint an authorised response team, preserve privilege lawfully and keep an immutable production log. A director should not use company access to remove personal messages or influence employees. Employees should receive evidence-preservation instructions without being told what account to give investigators.

Respond to document requests without destroying context

Record the legal instrument, issuing authority, scope, date, deadline and custodian. Preserve objections but do not obstruct lawful production. Collect responsive material reproducibly, review confidentiality and privilege, and supply an indexed set with a record of what was withheld and why where the law permits.

Never deliver an unexplained selection chosen by the person under suspicion. That can omit exculpatory context and raise manipulation concerns. Keep copies, hashes or other integrity records for digital productions and note passwords or file formats necessary to read them.

Interviews and statements should follow the evidence review

Article 49 protects rights at arrest, and Article 50 protects the fair-trial process. Clarify whether the person attends as a witness, suspect or arrested person and obtain advice before substantive answers. Do not guess transaction dates, invent the purpose of an entry or adopt an investigator’s summary because the ledger is not available.

Section 25A of the Evidence Act governs confession evidence. Record language, persons present, caution, document shown and whether the statement is written or recorded. Correct errors before signing and request a copy. Silence should not be replaced by a knowingly false account.

Use forensic accounting to explain, not advocate

Define the expert’s task: reconcile accounts, trace funds, quantify loss, identify duplicate payments, test a procurement sample or reconstruct journal changes. Provide complete source data and disclose assumptions. The expert should distinguish verified fact, accounting treatment and inference.

A colourful flowchart is not proof unless each arrow links to a bank entry or record. Test exchange rates, taxes, reversals, credit notes and opening balances. If the prosecution loss figure includes recovered assets or legitimate value received, quantify the difference transparently.

Asset restraint is not a finding of guilt

The Proceeds of Crime and Anti-Money Laundering Act (POCAMLA) contains preservation and forfeiture regimes, including Parts VII–VIII and related general provisions. Obtain the exact order, property schedule, statutory route, notice and response date. Determine whether the proceeding is conviction-based or civil and what test applies.

Trace each asset’s purchase funds, ownership, security, improvements and third-party interests. Keep the criminal defence distinct: explaining lawful ownership need not concede the charged transaction. Family members, lenders and business partners may require separate representation. Do not transfer, encumber or conceal restrained property.

Plan for bail and operational continuity

Prepare verified residence, identity, employment, travel, device-custody and reporting information. Where investigators allege document access, witness influence or offshore movement, propose specific safeguards: role suspension, controlled system access, passport surrender or no-contact conditions where appropriate. The bail and bond guide covers release preparation.

The business should revoke compromised credentials, preserve backups and maintain lawful payments without destroying evidence. A continuity plan is not an admission. Record every security change so later forensic work can distinguish pre-investigation activity from protective action.

Trial preparation must remain offence-specific

Build one proof chart per count. Link the representation, property, authority, document, money movement and alleged intent to admissible evidence. Identify hearsay summaries, missing makers, unexplained spreadsheet extracts and electronic-authentication issues under sections 78A and 106B of the Evidence Act.

Cross-examination should test the transaction, not merely accuse the complainant of running a failed business. The criminal trial guide explains disclosure, experts and the no-case stage. Cyber-attribution questions are treated separately in the cybercrime guide.

Economic-crime defence file

• charge, complaint and investigator requests;
• offence-by-offence element and role matrix;
• transaction timeline and source-linked money-flow chart;
• contracts, approvals, invoices, delivery and accounting records;
• native communications, access logs and production history;
• forensic accounting scope, source data and reconciliation;
• POCAMLA orders, ownership evidence and response calendar;
• company representation, privilege and conflict records.

Official Kenyan provisions checked

• Penal Code (Cap. 63): sections 275, 313 and 345–349 on theft, false pretences, forgery and use of false documents.
• Proceeds of Crime and Anti-Money Laundering Act: Parts VII–IX and applicable offence provisions on preservation, forfeiture and related asset process.
• Evidence Act (Cap. 80): sections 25A, 35, 48, 78A, 106B and 107–112 on confessions, records, experts, digital evidence and proof.
• Constitution of Kenya, 2010: Articles 49, 50 and 157 on arrest, fair trial and prosecution powers.

Facing a Kenyan fraud or economic-crime investigation? Request a confidential transaction and evidence review from an independent Kenyan advocate. This page is general information, not legal advice; the charge, records, asset orders and current statutory text must be examined.

Frequently asked questions

What should be examined first in a Kenyan fraud allegation?

Start with the exact charge and particulars, then build a dated transaction map from approvals, contracts, invoices, bank entries and communications. That separates a false representation or dishonest taking from a failed commercial arrangement and exposes any gap between the alleged loss and the money trail.

Does a frozen account prove that its owner committed money laundering?

No. A preservation or restraint measure protects property while the statutory process continues; it is not a criminal conviction. The order, identified property, ownership evidence, source of funds and response deadline must be analysed separately from the criminal count.

Can company records be handed to investigators without legal review?

A lawful request or order must be obeyed, but its scope, custody and deadline should be recorded. The company and individual officers may have different interests, and privilege, confidential third-party data and document integrity should be addressed before producing a controlled, indexed copy.