[2025] KEELRC 180 (KLR)

Njoroge v SBM Bank Kenya Limited (Cause E347 of 2021) [2025] KEELRC 180 (KLR) (31 January 2025) (Judgment)

Neutral citation: [2025] KEELRC 180 (KLR)

Republic of Kenya

In the Employment and Labour Relations Court at Nairobi

Cause E347 of 2021

J Rika, J

January 31, 2025

Between

Melvin Wairimu Njoroge

Claimant

and

SBM Bank Kenya Limited

Respondent

Judgment

1. The Claimant filed her Statement of Claim on 28th April 2021.

2. She states that she was employed by the Respondent Bank on 18th August 2018, as a Senior IT Officer. She served the first 6 months on probation.

3. She was placed on compulsory leave by the Respondent, on 13th July 2020. This was after there was suspected fraud, through an application managed by the Claimant’s IT unit.

4. The application was called Mfukoni Mobile Banking. The Respondent undertook to carry out investigations, during the period of compulsory leave.

5. She was interrogated by the Human Resource, Security / Forensic Departments, on 30th September 2020 about the fraud. She learnt in the process, that there were other incidents of fraud. She recorded a statement under investigation.

6. Her compulsory leave was extended by 2 months. She received a letter to show cause why she should not be disciplined, dated 17th November 2020. She was to attend a show cause meeting on 9th December 2020. The allegations were laid out in the letter. She replied to the letter in writing, on 25th November 2020.

7. She attended hearing which had been rescheduled to 15th December 2020. At the meeting, she had chosen to be accompanied by a colleague Victor Wanderi. His appearance was declined by the disciplinary committee. She was told that she could only be accompanied by an officer who was senior to her. She was compelled to select another colleague at short notice, Owen Wachira.

8. On 14th December 2020, compulsory leave was extended by a further 2 months.

9. She was dismissed through a letter dated 21st January 2021 for gross violation of the Respondent’s Human Resource Policy, and violation under Section 44 of the Employment Act.

10. She lodged an appeal on 3rd February 2021, which was heard on 24th February 2021. She was never informed about its outcome.

11. Her last salary was Kshs. 130,000 monthly.

12. She therefore urges the Court to find that termination was unfair and unlawful, contrary to the Employment Act 2007, the Administrative Action Act, and Rules of Natural Justice.

13. She prays for: -a.Declaration that termination was malicious, unfair and unlawful.b.Notice for 1 month at Kshs. 130,000. c.Service pay for 2 ½ years, at the rate of 15 days’ salary for each year, at Kshs. 162,500. d.Compensation for unfair termination equivalent of 12 months’ salary, at Kshs. 2,600,000. e.General damages for violation of constitutional and statutory rights, injured reputation and diminished employability at Kshs. 5,000,000. f.Certificate of Service.g.Costs.h.Pension.i.Interest.j.Any other suitable remedy.

14. The Respondent filed its Statement of Response and Counterclaim, dated 16th August 2021. It is conceded that the Claimant was employed by the Respondent. It was among her terms and conditions of service, that she would comply with the Respondent’s IT policy. She was issued, and executed, a job description. It included managing and mitigating risks, related to technology solutions for digital channels, in line with the Respondent’s IT policy, regulations and risk outlines.

15. She was likewise, issued the Respondent’s code of ethics and business conduct, and the code of conduct and declaration of fidelity and secrecy.

16. Her role included management of the Respondent’s digital banking channels, including mfukoni application.

17. The Respondent received a cyber-fraud incident report, on or around 12th July 2020. It involved mfukoni application.

18. The Claimant and her colleagues at the unit, were sent on compulsory leave on 13th July 2020, in line with the Respondent’s Human Resource Policy.

19. The Respondent commissioned a forensic audit of the incident, by an independent contractor. It was confirmed that there were some fraudulent activities, which led to a possible loss of Kshs. 11,491,914. The forensic report is exhibited.

20. It was established that the Respondent’s IT network was compromised. Malicious software was applied, allowing fraudsters access to the Respondent’s servers.

21. The Claimant was specifically found to have been culpable. She left her computer unlocked and remotely connected at night while she was away; malware scripts and files used to perpetrate fraud were created in the Claimant’s computer on 8th June 2020; and, she allowed transaction monitoring staff to enter their credentials on her computer, enabling the malware to acquire the login credentials of the users.

22. She was found to have a close relationship with one of the suspected fraudsters. She had also, made false declarations while taking up credit facilities, which was in conflict of interest.

23. She was issued a letter to show cause. The charges were stated. She responded on 25th November 2020. She was invited for disciplinary hearing, which took place on 15th December 2020. She was accompanied by a colleague of her choice.

24. A decision was made to terminate her contract by notice of 1-month. She was not summarily dismissed. The letter of termination is dated 21st January 2021.

25. She was advised on her right of appeal, which she exercised. She was heard on 24th February 2021. The appeal was dismissed, and the decision communicated to the Claimant, through a letter dated 26th April 2021.

26. The Respondent counterclaims that, the Claimant had an unpaid personal loan with the Respondent, at the time of termination, in the amount of Kshs. 680,454.

27. She was supplied with an IPhone and charger for her work, which she did not surrender on termination.

28. The Respondent counterclaims: -a.Loan balance at Kshs. 680,454 as at 31st July 2021, with accrued interest.b.Payment of the costs of the IPhone.c.Costs.d.Any other suitable relief.

29. The Respondent therefore, prays the Court dismiss the Claim and allow the Counterclaim.

30. The Court has not traced the Claimant’s Response to the Counterclaim, in its record.

31. The Claimant gave evidence on 29th November 2022 and 26th July 2023 when she rested her case. Head of Employee and Industrial Relations division, Simon Mureithi Maina, gave evidence for the Respondent on 8th December 2023. The last witness for the Respondent, was scheduled to be heard on 17th July 2024, but was unavailable. The Court dispensed with his attendance, but admitted the 2 IT reports he was intended to produce, closing the hearing on 17th July 2024. The Claim was last mentioned on 22nd October 2024, when the Parties confirmed filing and exchange of submissions.

32. The Claimant relied on her witness statement dated 20th April 2021, and documents on record [1-14] in her evidence-in-chief. She restated her employment history with the Respondent, the terms and conditions of her employment, and the circumstances leading to termination of her employment. She conceded that there was fraud. Malware was installed in the Respondent’s IT network. Credentials of users were taken by hackers. It was not just her computer that was used. 7 computers were infected, according to the forensic report.

33. The Claimant had no authority to install any application. Only IT security could install applications. She was in office when the malware was installed on mfukoni application. Baskar was the supervisor of the Infrastructure Team. It was possible to install malware remotely. The Claimant was implicated on the ground that she was physically present.

34. She agreed that she was issued letter to show cause. She was taken through the disciplinary process. She went to the hearing, in the company of her colleague Wanderi. He was denied participation, on the ground that the Claimant needed to be accompanied by a senior colleague. The Human Resource policy does not require that a senior colleague is involved. The Claimant conceded that she took a loan. She bought a car, which she resold to her sister. The Respondent alleged that this was in conflict of interest. She had a friend called Karani. The Respondent alleged that Karani was one of the fraudsters.

35. Cross-examined, the Claimant told the Court that she was a senior officer in IT. She was familiar with the Respondent’s policies and her job description. Part of her duties was risk management. She was in the team managing mfukoni mobile. Denis Manyeki was also in the team. The Claimant supervised him.

36. The IT system was compromised. Audit report concluded that money was lost. The Claimant was placed on compulsory leave of 3 months. There was extension. The period lasted for 5 months. Other Employees were also placed on compulsory leave. The Claimant was responsible for her computer and laptop. Employees could share devices, if authorized. In her statement under investigation, the Claimant states that she had allowed other Employees to log in to her computer. There was a procedure for remote access. It would have to be authorized by head of IT. The Head of IT recorded a statement, saying that the Claimant gave access to Peter Wango, without his authorization. Policy was that Employees report suspicion of cybercrime, to Head of IT. The Claimant flagged a suspicious transaction and blocked the use a card. She informed the Head of IT about this, through WhatsApp. The Claimant’s computer was not the first to be infected.

37. The mfukoni application had not been upgraded. It had been hanging a lot. The Claimant did not know if fraud would have been avoided, if the application had been upgraded. The Head of IT stated under investigation, that if the digital team had upgraded the application, it would have assisted with the system security.

38. She knew James Karani. She did not know that Nyamori, was one of the fraudsters. She did not know Sharon Anyango. Sharon might have called the Claimant at the time.

39. The Claimant received the letter to show cause. She responded. She was invited for hearing. She was accompanied by Owen Wachira. She wanted to be accompanied by Victor Wanderi. The Respondent declined her choice. She signed the disciplinary minutes voluntarily. She was given an opportunity to appeal. The appeal was declined.

40. The Claimant conceded on cross-examination that she did not return the Respondent’s IPhone. She had a personal loan, which she had not cleared by the time of termination. A commercial rate of interest would apply, after termination. She did not collect her certificate of service.

41. Redirected, the Claimant told the Court that she was not in office on 20th June 2020, when fraud took place. Her computer was one among others, infected by the malware. 2 Employees were dismissed. 3 remained in employment. The Claimant was dismissed discriminatively. No one had the Claimant’s credentials. She was not involved in the fraud. Baskar was in charge of IT. There was power fluctuation. All systems would go off. The source of malware was traced to Baskar’s side. She did not know Nyamori and Sharon Anyango. The Claimant was not there, when Sharon opened an account, on 18th June 2020. The disciplinary committee did not find calls between her and Anyango. The Claimant was coerced to be represented by Owen Wachira. Her choice was Victor.

42. Simon Mureithi relied on his witness statement dated 31st January 2022. He relied on documents filed by the Respondent, numbered 1-34, in his evidence-in-chief.

43. Cross-examined, he told the Court that he did not witness the power failure mentioned by the Claimant, as having compromised IT security. He could not say if the investigator absolved the Claimant from blame, in the introduction of malware in the system. Fraud took place in June, July and August 2020. She was on compulsory leave in July. She was not present in August. She was working remotely, in June 2020. Her laptop was taken away for forensic investigation. She did not have access in July and August.

44. She disclosed that her loan was personal. She could use it as she wished. She could buy a car for her sister. The charge on conflict of interest was not sustained. There was no witch-hunt against the Claimant. Sharon Anyango recorded a statement, saying she called the Claimant, to open an account. Sharon however, was not a witness for the Respondent, in the proceedings herein. There was fraudulent opening of an account, through which proceeds of fraud were paid out. The Claimant advised Sharon, on opening of the account. She confirmed that she knew Sharon before the disciplinary committee. She denied knowing Sharon, in her response to the letter to show cause. She signed the disciplinary committee minutes. It was alleged that she was a friend of Karani. Karani was a friend of the fraudster. There was no evidence that Karani benefitted from the fraud. Denis was one of the beneficiaries of the fraud. Mureithi was at the disciplinary hearing. He could not say if the Claimant was denied the company of a colleague of her choice.

45. Redirected, Mureithi told the Court that Owen Wachira accompanied the Claimant. Both he and the Claimant signed the minutes. 3 incidents of fraud took place: on 20th June 2020; 11th July 2020; and 3rd August 2020. The malware was introduced on 8th June 2020, when the Claimant was still at work. The charge relating to her car loan and conflict of interest, was dropped. It was not mentioned in the letter of termination. Termination was on account of negligence and breach of security. Sharon Anyango’s account was terminated. There was loss of Kshs. 5. 1 million; Kshs. 1. 6 million; and Kshs. 2. 8 million, in the 3 incidents respectively.

46. The issues are whether: termination procedure was fair, in accordance with Sections 41 and 45 of the Employment Act; whether the Respondent had valid reason[s] under Section 43 and 45 of the Employment Act; whether the Respondent has established its Counterclaim; and whether Parties merit their respective prayers.

The Court Finds: - 47. The Claimant was employed by the Respondent on 18th August 2018, as a Senior Officer IT. Her contract was terminated through a letter dated 21st January 2021.

48. The letter of termination erroneously states that, the effective date of termination was 22nd January 2020. The issues giving rise to investigation and disciplinary process had not taken place, by 22nd January 2020.

49. There were 2 main reasons given in the letter of termination, to justify termination: 1] the Claimant wilfully neglected to perform work which it was her duty to perform, or carelessly, and improperly performed her work, which from its nature, it was her duty under her contract, to have performed carefully and properly; and 2] she committed a breach of secrecy or security relating to matters affecting the Employer’s business, by failing to adhere to the Bank’s Information Security Procedure.

50. She was part of the IT team, managing a mobile money application operated by the Respondent dubbed ‘’mfukoni mobile.’’ Fraud took place in this platform thrice, leading to loss of about Kshs. 9. 5 million.

51. Her salary at the time of termination was Kshs. 130,000 monthly.

52. Procedure: The Claimant was informed that the Respondent suspected there was fraud in its mobile money platform, and placed the Claimant on compulsory leave, on 17th August 2020, to give room for investigations. Leave was for a period of 3 months.

53. She was invited for an investigation interview meeting, held on 30th September 2020. She recorded a comprehensive statement under investigation, on this date.

54. Leave was extended by 2 months, on 14th October 2020.

55. She was issued a letter dated 17th November 2017, to show cause why disciplinary action should not be taken against her, on account of the fraud.

56. The allegations were detailed, and included CCTV footage of the Claimant at her computer desk on 8th June 2020; her approaching a colleague Baskar, to use her computer; and Baskar taking charge of the Claimant’s computer.

57. She replied again in detail, on 25th November 2020. She explained that there was power failure, which caused downtime in the mobile money application, and that Baskar had been invited to her desk for a few minutes, to attend to the problem.

58. She was invited for disciplinary hearing, rescheduled to 15th December 2020.

59. The minutes of the disciplinary hearing, which took place on 15th December 2020, were signed by the Claimant and her colleague Owen Wachira.

60. She told the Court that she was denied the right to be accompanied by a colleague of her choice, and that she had chosen another colleague, Victor, who was shut out by the disciplinary committee.

61. The record as captured in the minutes, does not bear her out on this. She is not recorded to have protested the imposition of Wachira upon her. At the beginning of the hearing, she confirmed that she was aware of her right to be accompanied, and that she was accompanied by Owen Wachira. She said nothing about Victor. At the close of the hearing, Owen Wachira himself made remarks, but never suggested that he had been imposed on the Claimant.

62. The Court does not find merit, in the Claimant’s position, that she was denied representation or company to the hearing, of her choice.

63. She was heard on all charges. Details supplied during investigation and show cause, including CCTV footage, were placed before the disciplinary committee.

64. Compulsory leave was extended by another 2 months, from 14th December 2020, which would have ended around 14th February 2021. Termination however was on 21st January 2021, and the Court does not think that the period of compulsory leave, was therefore inconsistent with the period of 6 months, granted under the Respondent’s Human Resource Policy.

65. The letters placing the Claimant on compulsory leave reassured her that they did not constitute disciplinary action, and there was no finding of guilt yet, on her part. She would continue to earn her full salary and all the other employment benefits. She lost nothing, for the period of prolonged compulsory leave. Although she was not working, she continued to earn her full monthly salary and assortment of benefits.

66. She was issued a letter of termination, dated 21st January 2021. The reasons for the decision are set out comprehensively. She was advised that she had a right of appeal, to be exercised within 15 days.

67. She was offered her certificate of service, and terminal dues less her liabilities to the Respondent.

68. She lodged an appeal, and was heard, on 24th February 2021. The minutes of the appeal hearing are signed by the Claimant.

69. She was advised at the end of the appeal hearing, that the appeals committee would deliberate on the appeal, and revert to her. Although she pleads that she was not informed of the outcome, she told the Court on cross-examination that, ‘’I was given chance to appeal. Appeal was heard and declined. Page 274 of the Respondent’s documents is the decision...’’

70. The Claimant was aware that a decision was made rejecting her appeal, and the Court does not find merit in her position, that she was not informed about the outcome.

71. Procedure was in conformity to the Respondent’s Human Resource Policy and Sections 41 and 45 of the Employment Act.

72. Validity of reason[s]: - The Claimant was a Senior IT Officer, managing the Respondent’s mobile money application.

73. Clause 9 of her contract, bound her to act in the best interest of the Respondent, and to discharge her duties with diligence, and knowingly or willingly not to do, or cause or permit to be done, anything calculated to, or which could prejudice or injure the Respondent’s interest.

74. Clause 9 regulated cybersecurity. It bound the Claimant, when using computer, computer software and information/ data held on computer systems, to act legally and in full compliance with the Respondent’s ICT policy. Any failure to do so, could result in personal criminal and /or civil liability.

75. The Claimant’s job description, the Respondent’s code of ethics and business conduct, the code of conduct and the declaration of fidelity and secrecy, are other instruments which elaborated the Claimant’s responsibilities, in her role as Senior IT Officer, tasked with the running of mfukoni mobile.

76. There was evidence presented by the Respondent, that the Claimant granted unauthorized access of her computer, to her colleagues. The mfukoni mobile team was shown to have been misusing the Respondent’s remote access tools. The computer would be left on at night, on the pretext that it was loading. It was accessible remotely.

77. The Claimant and her team disregarded Section 3. 0 of the Idle Time Out on the general password standards. The section requires that there is a configurable idle time out parameter.

78. The mfukoni team, comprising the Claimant, Peter Wango and Denis Manyeki, were found to have in place a root password, or a wildcard password, saved in their computer. With the wildcard, any host could access the database. They acted in violation of Section 4. 0 of the general password standards, which required each staff to maintain a unique password.

79. The Claimant was shown through CCTV, to have left her computer unattended. It was accessed by one Baskar. Her computer was infected with malware. The IT supervisor Baskar’s credentials, were compromised through the Claimant’s infected computer. The Claimant was not scheduled to be at work on 12th July 2020. She had made arrangement for Denis Manyeki to relieve her, but overstayed in office, and engaged Baskar. She claimed she engaged him to sort out downtime which had been occasioned by power failure. There was no persuasion in this evidence.

80. The Claimant conceded in her evidence that database was compromised. Money was lost. Kshs. 5. 1 million, Kshs. 1. 6 million, and Kshs. 2. 8 million was lost, in three separate incidents. In total the amount lost, was Kshs. 9. 5 million, according to the evidence of Simon Mureithi.

81. Although some of the incidents took place in the absence of the Claimant, it is noted that the malware opening the Respondent’s systems to fraudsters, was introduced on 8th June 2020, while the Claimant was still at work.

82. On cross-examination the Claimant told the Court that, ‘’I had allowed other staff to log in my computer… the Head of IT states that I gave remote access to Peter Wango, without his authorization… my computer was infected…’’

83. The Claimant acknowledged that she was a friend to one James Karani. They were both involved in motorcycling sport. The Investigation disclosed that Karani was a close associate of Denis Nyamori, one of the fraud masterminds. The account used to channel the stolen funds, was opened at the Respondent’s Donholm Branch, by Sharon Anyango, an Employee of the Respondent at the said Branch.

84. Sharon recorded a statement, stating that the Claimant called her, advising her on opening of the account. It was abnormal, because the Claimant was not in accounts opening department. She was in IT. Although the Claimant denied calling Sharon, in her response to the letter to show cause, and disciplinary hearing, she told the Court on cross-examination that Sharon Anyango, ‘’might have called me.’’

85. The Claimant’s handling of her computer, and her association with characters who were either the wheels, or cogs within the wheels, of the massive cybercrime perpetrated against the bank, cast her in the light of an insider participant in the fraud. It was especially incriminating, that she was associated with characters who were not bank staff, and who were implicated in the fraud. She was cast as an insider, assisting fellow insiders and outsiders, to rob her bank using a computer, instead of a gun. The Respondent lost about Kshs. 9. 5 million.

86. The Court agrees with the submission made by the Respondent, on authority of Kabaru v. Craft Silicon Limited KEELRC 1584 [KLR] [30th June 2023] [Judgment] that the standard of proof of reason for unfair termination, under Section 43 of the Employment Act, is not proof beyond reasonable doubt. The Employer is only required to show that, the reason or reasons for termination of a contract, are matters that the Employer, at the time of termination of the contract, genuinely believed to exist, and which cause the Employer to terminate the services of the Employee. A valid reason is one which is sound, defensible and well-founded, and not fanciful, spiteful or prejudiced

87. The Court is satisfied that the Respondent’s decision to terminate the Claimant’s contract, was sound, defensible and well-founded in law and fact. There was sufficient reason established by the Respondent, through investigations and hearing, to justify termination under Sections 43 and 45 of the Employment Act.

88. Counterclaim: The Court did not find any Response to the Counterclaim on record. In her evidence, the Claimant did not dispute any aspect of the Counterclaim. She told the Court on cross-examination that she was granted a personal loan by the Respondent, repayable in 3 years. She had not retired her loan, by the time she left employment. She did not dispute the amount owed, as at the time stated by the Respondent. She also conceded that she was issued an IPhone which she did not return.

89. The Counterclaim is allowed.It is ordered: -a.The Claim is dismissed with no order on the costs.b.The Counterclaim is allowed as prayed, but with no order on the costs.c.The Claimant is at liberty to collect her certificate of service and terminal dues, as offered by the Respondent, in the letter of termination.

DATED, SIGNED AND RELEASED TO THE PARTIES ELECTRONICALLY, AT NAIROBI, UNDER PRACTICE DIRECTION 6[2] OF THE ELECTRONIC PRACTICE DIRECTIONS, 2020, THIS 31ST DAY OF JANUARY 2025. JAMES RIKAJUDGE.