Why Senator Omtatah Wants Absa Bank Kenya Investigated Over Leaked Client Data

Busia Senator Okiya Omtatah has asked the Central Bank of Kenya (CBK) and the Directorate of Criminal Investigations (DCI) to investigate Absa Bank Kenya PLC.

His claim is that the bank's own officers leaked a customer's confidential financial information to third parties, then failed to deal honestly with the complaint.

The two letters are dated 17 September 2026 and were received on 21 September. They draw on evidence already filed in Mombasa High Court Commercial Case No. E068 of 2022, New Mega Africa Limited v Absa Bank Kenya PLC.

The senator argues that the most damaging admissions do not come from the aggrieved customer. They come from people who worked for the bank.

A haulier, a bank and a collapsing business

New Mega Africa Limited is a road haulage company. It hauled clinker for Mombasa Cement Limited from Mombasa to its sister company, Tororo Cement, in Uganda.

Absa financed its receivables and truck fleet from March 2020 through term loans, overdrafts and guarantees, all fully secured.

In September 2021, the company asked Absa to consolidate its facilities into one term loan. The request then stalled for about seven months.

During that period, the company says, its finances were exposed to the very people it depended on for business.

The leak, in the company's words

In a Further Witness Statement dated 28 July 2023, the company's director, David Omusala Abai, says bank officials leaked the company's financial details to its suppliers and customers.

One supplier, he says, confronted him with printed bank correspondence and statements showing an overdrawn account.

He complained to the regional head, Evans Murumba, and the relationship manager, Sophie Omondi. They promised to find the source of the leak. He says he was persuaded to hand over his physical evidence for their investigation, and that a later letter from Ms Omondi apologised and said action had been taken against staff.

He says the letter never specified what that action was. He also claims that the employee responsible was later promoted and given a large pay rise.

The bank's own officer confirms it

The senator's strongest evidence is the sworn statement of Evans Murumba Wekesa, formerly Absa's Sector Head for Business Banking at the Coast, dated 5 March 2024.

Mr Murumba says relationship manager Wycliffe Makori made an unsolicited call to Eng. Jared Makori of KeNHA, disclosing the company's financial difficulties and warning him against dealing with it.

Mr Murumba says he called Mr Makori to his office and questioned him about the call. Mr Makori then confessed to calling Eng. Makori minutes after a meeting with the client that morning.

Mr Murumba describes the conduct as made in bad faith, in breach of data confidentiality and data protection law, and intended to scare away the company's investors and suppliers. He says he escalated the matter internally and was later told that Mr Makori had admitted the disclosure.

Then comes the most serious claim. Mr Murumba says management cautioned him not to admit the breach to the customer or take disciplinary action, because doing so would amount to the bank admitting liability.

Mr Makori disputes this account. In his statements, he admits calling Eng. Makori about payment delays from Mombasa Cement. He calls it a routine call and denies disclosing the company's debts. He also says he had no access to customer data systems. He also admits knowing that Eng. Makori had commercial interests in New Mega and had helped secure the Mombasa Cement contract.

The senator argues this is an undisclosed conflict of interest. He also argues that the admitted call itself creates a strong inference that confidential information was discussed.

Absa's position in court is that an internal investigation in September 2022 found no disclosure and no wrongdoing by staff. The senator argues that this investigation is compromised. According to Mr Murumba, it took place after he had left the bank, and he never commissioned the investigation the bank describes. The customer says he was never told how it progressed or what it found.

The law the senator relies on

Omtatah's case rests on the banker's duty of secrecy. That duty dates back to Tournier v National Provincial and Union Bank of England (1924), which allows disclosure only under compulsion of law, a public duty, the bank's own interest, or with customer consent. He argues that none of these exceptions applies to a phone call warning a business partner away from a client.

He also cites Section 31 of the Banking Act, the right to privacy under Article 31(c) of the Constitution, consumer rights under Article 46, and the Data Protection Act 2019. He also cites CBK's 2013 Prudential Guidelines on consumer protection, which require banks to investigate complaints properly, keep complainants informed and resolve complaints in good time.

Leaks alongside alleged bribes

The confidentiality complaint sits within a broader set of allegations. The company claims bank staff demanded "facilitation" payments of between KES 2,000 and over KES 500,000 to process drawdowns. Some payments allegedly went to officers' spouses and to an interior design business.

Mr Makori's statement admits several M-Pesa transactions with the director, which he describes as personal. The senator has asked the DCI to examine possible offences under the Bribery Act and the Penal Code's extortion provisions.

The company says the combined effect cost it its Mombasa Cement and Tororo contracts and a fleet of over 40 trucks, and put it out of business.

What he is asking for

From the CBK, Omtatah wants an investigation into the disclosure and the handling of the complaint, sanctions under the Banking Act, and referrals to the EACC and the Data Protection Commissioner. From the DCI, he wants statements recorded from the officers, call data records for both Makoris, an interview with Eng. Makori, and the bank's internal investigation file.

He addresses the obvious objection directly. The case is still before court, but he says a regulator's inquiry into whether a licensed bank followed banking law does not conflict with a civil claim for damages.

Why it really matters

None of these allegations has been proven in court, and Absa denies wrongdoing. The court will decide the civil claim. Omtatah's point is that the regulator does not need to wait for that ruling.

A borrower gives a bank everything: accounts, debts, collateral, contracts. If that information can be used to undermine a borrower, and the institution's reported response is to stay silent to avoid liability, the issue goes beyond one haulier's dispute. It becomes a question of whether a CBK licence still guarantees banking secrecy.

The CBK and DCI now have the sworn statements. The question is whether they will act.