Lopokoiyit The Fraudster? Why A Past Scandal At Safaricom Has Come To Haunt Absa Executive Sitoyo

In the cutthroat world of Kenya’s fintech and banking elite, where reputations are built on innovation and broken in courtrooms, a High Court ruling handed down in May has reopened old wounds at Safaricom and dragged a freshly appointed Absa executive into a storm of his own making. On May 8, 2026, Justice Josephine Wayua Mong’are of the Milimani Commercial Courts ordered Safaricom PLC to pay innovator Peter Nthei Muoki and his company Beluga Limited a staggering Sh1.4 billion in general damages, plus a perpetual royalty of 0.5 percent of M-PESA’s gross revenue for as long as the disputed “Manage Child Account” and M-PESA Go products remain in operation.

The judgment in Civil Suit HCCOMM/E407 of 2022 is being described by legal commentators as a landmark in Kenyan intellectual property law, a rare case of David prevailing against Goliath. But for one man in particular, the ruling has reignited questions that go far beyond a single copyright dispute.

That man is Sitoyo Lopokoiyit, the former Managing Director of M-PESA Africa and Chief Financial Services Officer at Safaricom, who on April 1, 2026, walked into a new corner office as Absa Group’s Chief Executive for Personal and Private Banking. Online, the reaction has been brutal, with Kenyans on social media circulating the now-familiar hashtag #LopokoyitTheFraudster and demanding to know whether Absa did its homework before handing him the keys to one of the continent’s largest retail banking operations. The M-TEEN ruling, it turns out, is only the latest of three separate scandals in which Lopokoiyit’s name surfaces at the centre of the controversy.

The Pitch That Became a Billion-Shilling Liability

According to court records, the saga began in October 2020 when Peter Nthei Muoki, working with his firm Beluga Limited, developed a product he called the “M-TEEN MOBILE WALLET USSD CODE.” The concept was simple but powerful: an M-PESA sub-account system that would let parents monitor and control the spending of teenagers aged 13 to 17 and young adults aged 18 to 24, all without requiring the national identity cards that minors in Kenya do not possess. Crucially, Muoki registered the design with the Kenya Copyright Board before he ever set foot in a Safaricom boardroom, a decision that would prove decisive years later.

On March 13, 2021, Muoki first pitched the idea to Sylvia Mulinge, then Safaricom’s Chief Customer Officer. He got no response. He persisted, and between March and June 2021 he shared detailed insights, including USSD flow charts and a full mind map of the product, with Lopokoiyit, who had just been appointed Managing Director of M-PESA Africa effective April 1, 2021 while continuing to serve as Safaricom’s Chief Financial Services Officer.

The court heard that Lopokoiyit dismissed the idea as unworkable, telling Muoki the targeted teenagers lacked the identification documents needed and that Central Bank of Kenya approval would be required. Muoki pushed for a face-to-face meeting, and on June 22, 2021, the two sat down at the Mediterraneo Restaurant in Junction Mall, Nairobi.

According to the court record, Lopokoiyit said Safaricom had been considering something similar and offered to link Muoki with a third party, a claim the plaintiffs would later argue was a pretext designed to buy time.

Seventeen months later, in November 2022, Safaricom launched M-PESA Go, a stripped-down version of M-PESA for children aged 10 to 17, complete with the parent-child sub-account architecture Muoki had pitched. Before that, the company had rolled out earlier iterations under names including “Manage Child Account” and “Manage Junior Account.”

The High Court has ordered Safaricom PLC to pay Peter Nthei Muoki Sh1.4 billion for copyright infringement in the M-PESA child account service, with Justice Josephine Mong’are also ordering the telco to pay Muoki and Beluga Limited 0.5 percent of its M-PESA gross revenue from March 31st 2025 for as long as it continues to operate the Manage Child Account or any similar parent-child functionality.

“Even David Can Prevail Against Goliath”

In her judgment, Justice Mong’are did not hold back. The judge found that Muoki’s product, which had been documented in detail and registered with the Kenya Copyright Board, qualifies as a literary work protected under copyright law, and concluded that Safaricom’s overall conduct fell below the standards expected of a market leader. The judge noted the disproportionate scale between the parties, remarking that “Even David can prevail against Goliath”.

The court drew an adverse inference from Safaricom’s failure to produce a key technical document.

The court drew an adverse inference against Safaricom for failing to produce the final Functional Requirements Specification with Huawei, underscoring that in the absence of a documented design trail predating a claimant’s disclosure, a corporation is highly vulnerable to claims of copying.

Despite the scale of the finding, the court stopped short of shutting the product down.

The judge declined to shut down the service, saying that millions of Kenyans including parents and minors now rely on this functionality and a shutdown would cause disproportionate disruption.

Instead, she imposed what legal observers are calling a “reverse royalty,” a continuing payment obligation that effectively forces Safaricom to keep paying for a product it was found to have stolen.

The numbers involved are eye-watering.

Safaricom’s earnings release published two days before the judgment revealed M-PESA revenue had climbed 13.4 percent to Sh182.7 billion for the financial year ending March 2026, meaning the royalty obligation for FY2026 alone will be approximately Sh913 million, with annual payments projected to exceed one billion shillings within the next two financial years. At the mandated 0.5 percent rate applied to the prior year’s M-PESA revenue of Sh161.1 billion, the annual royalty obligation to Beluga Ltd could surpass Sh805 million.

Safaricom has not gone down quietly.

The company has secured a 30-day suspension of the judgment and will appeal at the Court of Appeal, meaning the findings remain subject to appellate review. The company has not issued a public statement on the ruling, even as it reported record earnings, with group net income reaching Sh99.7 billion, the highest in its history.

From Safaricom’s Star Player to Absa’s New Signing

The timing could not be more uncomfortable for Lopokoiyit. Absa Group appointed the Kenyan executive as Chief Executive Officer of retail banking, with his start date set for April 1, 2026, as part of a series of changes within the executive leadership aimed at strengthening governance and supporting the group’s growth strategy.

Previously the CEO of M-PESA Africa and Director of Financial Services at Safaricom, Lopokoiyit had held several leadership positions at the telecommunications company since joining in 2011, including Head of Strategy and Business Development for M-PESA, and is credited with major innovations such as the M-PESA Super App, Fuliza, and strategic partnerships with global platforms like PayPal and AliPay. Absa described him as a highly experienced multi-industry leader with deep expertise across financial services, telecommunications, digital payments, and large-scale transformation.

What Absa’s glowing announcement did not mention is that the man it was welcoming with such fanfare is the same executive named throughout a High Court judgment as the gatekeeper who allegedly waved away an innovator’s pitch only for Safaricom to launch a near-identical product months later.

Kenya’s banking regulations demand that senior executives meet “fit and proper” standards, and critics are now asking pointed questions about whether Absa’s board, and by extension the Central Bank of Kenya, adequately scrutinised Lopokoiyit’s record at Safaricom before installing him atop a division that handles the savings, loans, and private wealth of ordinary Kenyans.

The SportPesa Shadow

Ronald Karauri who’s the face of Sportpesa.

The M-TEEN ruling has also dragged back into view a far older and murkier controversy involving Lopokoiyit: his alleged role in the so-called “SportPesa heist,” a years-long shareholder battle over one of East Africa’s most lucrative betting brands.

The dispute centers on Pevans East Africa Limited, the original owner of the SportPesa brand, and Milestone Games Limited, a rival entity that emerged in October 2020 to claim the same brand amid a bitter falling-out among Pevans shareholders.

The High Court at one point stopped the use of the SportPesa brand in Kenya’s gaming business amid shareholder fights, following a petition from a businesswoman holding a 21 percent stake in Pevans East Africa, who accused Milestone Games of procuring its operating licence under circumstances shrouded in mystery.

Pevans itself was engulfed in a bitter shareholder fallout over allegations that $278 million, equivalent to roughly Sh29.1 billion, had been transferred from the company’s coffers to overseas accounts, alongside the sale of shares in the firm’s holding company.

At the center of the Milestone Games camp sat Ronald Karauri, long-serving CEO of Pevans East Africa and later a Member of Parliament. Milestone Games started operating a betting business in October 2020 using the SportPesa brand, a company created by some shareholders of Pevans including Ronald Karauri and Robert Macharia, who under Pevans had held only a three percent stake but under Milestone controlled a combined 85 percent.

It is here that investigative outlets, most prominently the long-running “Fifa Colonialism” series, allege Lopokoiyit’s hand becomes visible.

According to those reports, while serving inside Safaricom’s M-PESA division, Lopokoiyit is accused of facilitating a so-called Novation agreement that purported to transfer Pevans’ Safaricom-linked paybill numbers and short codes, the financial plumbing underpinning the entire SportPesa betting operation, over to Milestone Games.

The same reports allege that this arrangement was made easier by a personal connection: that Lopokoiyit is married to a sister of Ronald Karauri.

These claims, repeatedly published and recirculated across multiple investigative platforms, have never been the subject of a definitive court finding establishing Lopokoiyit’s personal liability, and neither Lopokoiyit, Safaricom, nor Absa appear to have issued a detailed public rebuttal of them. They remain serious, widely circulated allegations rather than adjudicated facts, but their persistence in Kenya’s investigative press is precisely why the #LopokoyitTheFraudster hashtag found such fertile ground the moment the M-TEEN judgment broke.

The Whistleblower Safaricom Sent to Police

Benedict Kabugi Ndungu at Milimani Law Courts in Nairobi on Thursday, June 13, 2019 where he was charged with demanding Money by menaces. On diverse dates between May, 1, 2019 and June, 7, 2019 at unknown place within Nairobi County, jointly with others already before court, and with menaces, demanded Ksh 300,000,000 (Three hundred million) from Safaricom Public Limited Company with intent to steal. Mr Ndungu denied the charges. PHOTO DENNIS ONSONGO.

If the M-TEEN ruling and the SportPesa allegations were not enough, a third controversy has now resurfaced, one that places Lopokoiyit at the centre of what may be the most damning episode of his Safaricom career: the betrayal of the man who tried to warn the company about the theft of 11.5 million subscribers’ data.

The breach itself dates back to 2018 and 2019, when two Safaricom insiders, senior systems auditor Simon Billy Kinuthia and regional executive Brian Njoroge Wamatu, allegedly built an algorithm to siphon subscriber records far beyond what their access permitted. The resulting dataset, covering gambling histories, M-PESA transaction records, IMEI numbers, national identification details, geolocation data and betting platform affiliations for 11.5 million Kenyans, ended up on a Google Drive and on personal laptops that Safaricom has never recovered.

On May 18, 2019, Nairobi businessman Benedict Kabugi Ndungu was approached at a social gathering by individuals trying to offload the stolen dataset. Kabugi checked his own details against the data, confirmed his gambling history and personal records were inside it, and reported what he had found to both the police and Safaricom directly.

What happened next is laid out in a demand letter dated June 10, 2019, written by lawyer Martin Maina of Maina & Maina Advocates and addressed to Safaricom’s chief executive. According to the letter, after Kabugi alerted Safaricom of the leak, the telco’s staff, Sitoyo Lopkoiyot, the chief financial services officer, and Patrick Kinoti, the head of department for ethics and compliance, had recruited him as a whistleblower with a promised reward, and as a sign of good faith Kinoti transferred Sh50,000 via M-Pesa to Kabugi, after which all parties remained in constant communication. Other reporting on the case describes Kinoti proposing a Sh3 million reward for Kabugi’s intelligence, which Kabugi says he never demanded but was instead offered to him.

Acting, by his own account, on repeated verbal and written instructions from Safaricom’s own agents, Kabugi made contact with Charles Njuguna Kimani and Mark Billy Nderitu, the men holding the stolen data, and met them twice, first at Club Milan in Westlands on June 3, 2019, and again at ABC Place on June 7, 2019. At that second meeting, Kabugi was arrested. He was subsequently charged with demanding money with menaces, the very crime Safaricom now says he was always trying to commit, even as the company’s own lawyer’s letter and WhatsApp records suggest its executives had directed his every move.

Kabugi has consistently and publicly rejected Safaricom’s version of events. He dismissed claims by Safaricom that he tried to sell the leaked data to a betting company as a fabrication, insisting that his contact with the data holders followed direct requests from Safaricom’s own compliance department. For years his case sat in limbo, with Safaricom’s civil pleadings casting him as a fraudster who only “converted himself” into a whistleblower after a data sale to SportPesa allegedly fell through.

Then, in May 2026, the High Court delivered a verdict that changed the framing of the entire saga. In Constitutional Petition E095 of 2026, Justice Bahati Mwamuye of the Constitutional and Human Rights Division ruled that Safaricom could not hide behind a “rogue employee” defence, finding that the breach happened because of systemic failures inside Safaricom’s own infrastructure, poor data governance, weak internal oversight and inadequate security controls, and that the company bore a non-delegable constitutional duty under Article 31 to protect subscriber data. The court awarded eleven petitioners Sh900,000 each, a total of Sh9.9 million, plus interest and costs, and found that Safaricom’s own documentary annexures and forensic WhatsApp records, submitted by the company itself to support its rogue-employee defence, ended up corroborating the systemic nature of the breach.

The ruling did not adjudicate Lopokoiyit’s personal liability, and no formal regulatory or criminal inquiry has examined precisely what he knew and when. But the documentary trail places him, by name, at the exact moment Safaricom’s response to the breach allegedly turned from crisis management into the recruitment, use and eventual sacrifice of a cooperating witness. As Chief Financial Services Officer from April 2018, Lopkoiyot held direct institutional oversight of the M-Pesa platform whose 11.5 million customer records were stolen, the very portfolio at the heart of the breach, throughout the period in question.

The criminal case against Kinuthia and Wamatu is now in its seventh year. Kabugi is still waiting for the millions he says Safaricom’s own representatives promised him for walking into a police station with evidence of a crime against millions of his fellow Kenyans.

A Pattern Kenyans Cannot Ignore

Strip away the noise and a pattern emerges that should worry anyone with a stake in Kenya’s financial system. In the M-TEEN case, the court found a documented sequence: an outsider brings a registered, well-documented innovation to a powerful insider, the insider raises technical objections and appears to stall, and not long afterward the company launches a strikingly similar product under a different name. In the SportPesa saga, critics allege a similar dynamic at a much larger scale, with insiders at a dominant telecom allegedly smoothing the transfer of critical financial infrastructure away from one set of shareholders and toward another, with a personal relationship sitting conveniently in the middle. And in the Kabugi affair, sworn court documents place Lopokoiyit’s name at the precise junction where a man who did the right thing, reporting a massive data breach, was allegedly recruited, used, paid a token sum, and then handed to the police by the very executives he had cooperated with.

Three separate controversies, three separate courts, and one name that keeps surfacing at the point where things went wrong. Neither Safaricom nor Absa has issued a detailed public response addressing how these episodes intersect with Lopokoiyit’s record. For Absa, a bank that markets itself on trust and “customer-centric innovation,” the silence is becoming difficult to sustain. For Peter Nthei and Beluga Limited, the ongoing royalty award is a rare, if delayed, accountability win. For Benedict Kabugi, vindication has come only in the form of a constitutional ruling against his alleged employer-turned-prosecutor, with the millions he was promised still unpaid.

Whether the SportPesa and Kabugi allegations against Lopokoiyit ever receive the same judicial scrutiny as the M-TEEN case remains to be seen. But as the Court of Appeal prepares to hear Safaricom’s challenge in the M-TEEN matter, and as Absa’s new private banking chief settles into his role, Kenyans online have already delivered their verdict in the court of public opinion, and it is not flattering. In a nation hungry for transparent leadership in its financial institutions, the question now is whether power will once again shield its own, or whether this latest scandal forces a long-overdue reckoning.