Shadowy firms linked to the eCitizen platform have earned at least Ksh 1.45 billion, raising concerns over their influence on government revenue collection.
Pesaflow, a private firm gazetted to collect payments for government services, has been billing the State between Ksh 100 million and Ksh 200 million per month.
This places its estimated annual earnings at Ksh 2.4 billion.
However, details regarding its ownership, contracts and operations remain undisclosed.
Auditor-General Nancy Gathungu has flagged the firm’s role, questioning its control over eCitizen without a proper backup system.
She has also faulted the Ksh 50 convenience fee imposed on Kenyans seeking digital services, terming it unjustified.
Pesaflow is part of a consortium alongside Webmasters Kenya and Olivetree Limited, all linked to software developer James Ayugi.
While Webmasters Kenya claims intellectual ownership of eCitizen, the government previously stated that the portal was handed over by the International Finance Corporation (IFC).
Before Pesaflow’s entry, Webmasters had contracted Goldrock Capital Ltd to manage funds flowing from eCitizen users to the government.
A fallout led to Goldrock’s removal, paving the way for Pesaflow’s appointment in 2017.
Pesaflow was registered at the height of Goldrock’s legal battle with the government, Safaricom and Webmasters over control of mobile money wallets.
Official records show that its largest shareholders Evid Araka Sibi and Frank Lawrence Ochieng Weya each hold 3,000 shares.
Other stakeholders include Charles Wambani Sewe and Larry Ochleng Agoro, who each own 2,000 shares.
All of them are linked to Webmasters, suggesting a possible silent takeover.
Mr Ayugi has declined to explain his connection to both Webmasters and Pesaflow.
He maintains that Webmasters handles technology, Pesaflow manages payments and Olivetree Limited oversees communication services such as bulk SMS alerts.
The Auditor-General has warned that the government is heavily dependent on private vendors for critical eCitizen functions.
She has raised concerns that over 15,000 public services listed on the portal could be compromised in the event of a cyberattack.
The system’s support services are also under private control, with government agencies resorting to WhatsApp for assistance.
The audit further reveals that eCitizen’s helplines and email correspondence are managed by the vendor, with no clear service-level agreements in place.