The Branch Manager Whose Loans Never Went Bad

Likely scheme: a fictitious-borrower (ghost loan) scheme run by the manager, possibly with a colluder at the law firm to confirm 'employment'. The evidence pattern is characteristic:

• Structuring of the approval limit - 37 loans clustered in a KES 28,000 band immediately below a KES 500,000 control. Genuine borrower demand does not produce that distribution; a control does.
• Single employer address - a fabricated membership register is easiest to mass-produce around one employer, and a check-off arrangement explains why no individual guarantors or payslips were scrutinised.
• Single disbursement bank branch - a concentration no honest portfolio of unrelated members would show; test whether the manager is a signatory or the accounts share a phone number.
• Identical first-three-instalment cash payments - the manager is 'seasoning' the loans, paying roughly 3 x monthly instalment out of the proceeds to avoid the 90-day delinquency report, then walking away.

Why the good repayment statistics are consistent, not exculpatory: the statistics are measured at 90 days. Paying three instalments costs the fraudster perhaps 3–4% of principal and buys roughly three months of invisibility. The 'best branch' ranking is itself a red flag - it is the fraudster's own control environment, uninspected because it looks good. Alternative hypothesis to test before accusing: a legitimate salary check-off scheme for law-firm staff, in which case the three cash payments still need explaining. Verify members exist (call them, obtain national IDs, employer confirmation) - that single step distinguishes the two hypotheses at low cost.

Before any interview - the sequence matters more than the steps:

1. Preserve before you probe. Secure the 37 loan files, the system audit trail of approvals and edits, till/cash receipts for the instalments, and CCTV of the counter. Confrontation triggers destruction: files disappear, memberships are deleted, the manager 'corrects' records.
2. Verify existence of borrowers discreetly - telephone and ID checks, employer confirmation. Do not visit the law firm through the manager's contacts.
3. Obtain the disbursement account statements through the SACCO's own bank and, if needed, a lawful request; check signatories, phone numbers and the pattern of onward transfers.
4. Brief the right people. Report to the Board Audit Committee, not only the CEO - the CEO's instinct is to resolve it informally, and the CEO may be a witness. Instruct counsel; decide now whether the matter is criminal as well as disciplinary.
5. Only then interview, with a prepared exhibit pack, a caution, notice of the allegations, and a right to be accompanied; a witness who is not the complainant; contemporaneous signed notes or a recording.

If he resigns: do not treat resignation as closure and do not accept it on the spot. Resignation does not extinguish the SACCO's right to recover, its duty to report suspected fraud, or the evidential value of the file. Complete the investigation, keep him on suspension pending outcome if the contract allows, secure his devices and system credentials the same day, and refer the completed file to the police. Withdrawing a referral because the subject resigned is the single most common way these schemes are buried - and this manager has had nine months of practice.

Detection (the gap here - the SACCO prevented nothing and detected nothing for nine months):

• Limit-aggregation / anti-splitting rule in the core system: total exposure per member and per related party measured over a rolling 12 months, so three sub-threshold loans block the fourth. This is a preventive control but is only effective if the system, not the branch, holds the limit.
• Continuous analytics exception report - loans within 10% of the approval threshold; multiple loans to one employer; multiple loans disbursed to one bank branch; identical instalment amounts paid on the same day at the same till. This is a detective control and would have surfaced the pattern in month two.
• Independent member-existence verification at onboarding, with call-back to a number not supplied by the introducer - detective and preventive.
• Disbursement control: pay only to an account in the member's verified name, no third-party or branch-nominated accounts - preventive.
• Rotation of branch managers and mandatory audit of the 'best performing' branches - an explicit rule that top-ranked branches get more scrutiny, not less.

Judgement point: the report should say plainly that the repayment statistics were a manufactured control indicator and that the SACCO was relying on a metric the fraudster controlled. Recommend the audit committee track leading indicators (approval clustering, disbursement concentration) rather than lagging arrears ratios.