FRAUD ROCKS CENTENARY BANK: Catholic Institution Embroiled in Multi-Billion Scandals

Centenary Bank, a prominent Catholic bank and a second leading financial institution in Uganda, has been hit by two massive fraud scandals, exposing glaringly shocking lapses in internal controls and raising concerns about the bank’s commitment to transparency and accountability.

The first fraud orchestrated through the Utilities payment system occurred on October 4, 2023, involving the theft of 3.56 billion shillings through a series of suspicious transactions posted from the Kabale Branch using a loans department computer. The transactions, which ranged from 80 million to 99 million shillings, were made on 31 registered MTN business lines. What’s more alarming is that the transactions were made using the login credentials of a teller at the Mapeera Branch head office.

The system was so vulnerable that it could not counter that fraud since the critical controls like teller transaction limit, One Time Password (OTP),Dual Control and Auto-timeout mechanisms had not been implemented.

The second fraud, which occurred on August 1, 2024, involved the theft of 1.95 billion shillings through transactions posted on different Agent Banking float accounts. The transactions, which were made in amounts of 50 million shillings, were posted from the Kawempe-Bwaise Branch using a computer from the Loans department. Again, the login credentials of a teller at the Mapeera Branch were used.

What’s most disturbing is the bank’s handling of the investigations. In both cases, innocent IT staff were implicated and accused of being involved in the frauds, while the tellers whose login credentials were used were retained and protected. The investigations were marred by irregularities, including the summoning of an IT officer for questioning three months after a burglary incident at his home in Mutungo Kampala, where a bank laptop was stolen on January 14, 2024.

Furthermore, Since the internal investigation department had no capacity to handle the intricacies of the frauds, the bank hired an external forensics company to investigate the first fraud but denied them access to the Core Banking System, which was very critical in this investigation as it would identify who had access to the teller profiles.

It should also be noted that a criminal case was opened at CPS but it failed to yield any results since investigations where hindered by abrupt transfer of the investigating officer to another Station. We learned that the file got stuck at Buganda road Court where the State Attorney by the name of Kyazze failed to move the file for sanction due to lack of substantial evidence.

The two heists raise serious questions about Centenary Bank’s internal controls, risk management practices, and commitment to transparency and accountability. Why were innocent IT staff implicated and accused of being involved in the frauds? Why were the tellers whose login credentials were used retained and protected? Why was the external forensics company denied access to the Core Banking System?

We demand that Centenary Bank’s Board of directors takes immediate action to address these concerns and ensure that those responsible for the frauds are held accountable especially the top Management. We call on the Bank of Uganda to launch a thorough investigation into these heists and to take appropriate action to prevent such incidents from occurring in the future in order to protect Customers’ Deposits and restore trust from the Public.

The people of Uganda deserve transparency and accountability from their financial institutions. It’s time for Centenary Bank to take responsibility for its actions and to ensure that justice is served.