President Yoweri Museveni has directed Finance minister Henry Musasizi to provide a detailed report on a fraud involving $21,013,562.31 at the Bank of Uganda.
The funds, which were meant for servicing Uganda’s external debt, were instead diverted through fraudulent transactions to MJS International Ltd in London, United Kingdom, and Roadway Company Ltd in Tokyo, Japan.
The scandal has attracted the attention of both the President and security agencies. In a letter dated October 24, 2024, the Director of the Criminal Investigations Directorate (CID) requested the Auditor General to carry out a forensic and IT audit.
The audit was intended to support investigations into alleged abuse of office, embezzlement, causing financial loss, and money laundering. The allegations stem from two fraudulent transactions initiated through the Integrated Financial Management System (IFMS), managed by the Ministry of Finance, Planning and Economic Development (MoFPED), and processed by BoU.
“I have seen a Financial Intelligence Authority report dated September 12, 2025, concerning the USD 8 million plus and USD 6 million plus meant to pay Uganda’s loan obligations to the World Bank Group and the African Development Bank, which was diverted to private companies in the UK and Japan,” Museveni said.
“I demand a report on what happened to this money, those who diverted it, and those who received it,” he added.
A legitimate transaction of $6,134,137.75 intended to settle a loan owed to the International Development Association (IDA) was initiated through IFMS. However, the transaction details were altered on the Ministry of Finance application server, changing the payee to “Roadway Co. Ltd, Tokyo.”
The fraudulent transaction was transmitted to BoU, processed as a normal payment, and externalised on September 12, 2024. Efforts to recover the funds have so far been unsuccessful, resulting in a full loss of $6.13 million.
In a similar scheme, a payment of $8,596,824.26 meant for the African Development Fund (ADF) was altered at the Ministry’s server. The payee was changed to “MJS International, London.”
The transaction was processed by BoU and the funds transferred abroad two days later. However, $8,205,103.81 was later recovered, leaving a net loss of $391,720.45.
The fraudulent transactions exposed serious weaknesses in Uganda’s financial management systems, particularly within IFMS and internal controls at the Ministry of Finance and BoU.
Investigations revealed that transaction files were manipulated before encryption, allowing them to pass through multiple security layers undetected.
The Auditor General confirmed that the IDA loan was legitimate and due for payment. However, the transaction details were altered before transmission.
The report faulted Mubarak Nansamba, Acting Assistant Commissioner of Treasury Services, for failing to promptly request SWIFT confirmation from BoU—a lapse that delayed detection of the fraud.
Further analysis showed that system files and scripts responsible for encrypting and transmitting payments were tampered with by individuals with privileged system access.
System logs linked suspicious activities to two Ministry of Finance IT officials: Tony Yawe, a Senior IT Officer, whose account (“tyawe”) was used to alter system scripts and permissions and Mark Kasiiku, a Data Centre Consultant, whose account (“mkasiiku”) was used to modify critical payment files and manipulate system logs.
Both officials denied involvement, claiming possible system breaches or unauthorized access. However, investigators noted inconsistencies in their explanations.
Investigators established that perpetrators exploited a vulnerability where plain text transaction files remained temporarily accessible on the IFMS server before encryption.
The attackers altered payment details in these files, changing beneficiaries and descriptions. Once encrypted, the fraudulent transactions appeared legitimate and were processed by BoU without detection.
While the Ministry’s records indicated payments to legitimate lenders such as IDA and ADF, BoU processed transactions showing payments to foreign companies—confirming that manipulation occurred before transmission.
The Auditor General also revealed an attempted fraudulent transaction worth $6,674,320.75, targeting another IDA loan repayment.
The funds were to be diverted to an account in Poland. However, the SWIFT system flagged inconsistencies between the payee name and bank details, leading to the transaction being rejected.
A SWIFT message from Citibank New York confirmed the recovery of $8,205,103.81, which was returned to the Ministry of Finance account at BoU.
Despite this recovery, the government still incurred a net loss of $391,720.45 due to the fraudulent transactions and procedural failures.
Authorities are expected to take further action to hold those responsible accountable and strengthen controls within Uganda’s financial systems.
The scandal raises broader concerns about oversight, cybersecurity, and accountability in the management of public funds.
