By Otim Nape
In a detailed report, a group of auditors supervised by KPMG have made shocking findings and unearthed rot at Post Bank Uganda Ltd (PBUL) which is 100% owned by the government of Uganda. The report, a copy of which is in our possession, shows that many things that have gone wrong at PBUL clearly giving reason why any reasonable depositor or saving customer should shun this bank.
METHODOLOGY
The auditors examined financial statements of the bank regarding its statements of comprehensive income; charges in equity and cash flows. The auditors also quizzed the bank’s directors on some of the shocking scandals they unearthed. The other information was obtained from the bank’s annual internal audit reports and its other reports on corporate governance, risk reporting and shareholders report. The auditors give a disclaimer that their report isn’t exhaustive meaning the situation at PBUL could even be worse than stated in their report.
PBUL began in 1998 and has 40 branches and 92 other locations served by its 10 mobile vans. It’s categorized as Tier II Financial Institution and it’s licensed as such by BoU under the Financial Institutions Act-FIA-2004.
The report captures PBUL’s adherence to financial compliance requirements; internal control structures; safeguarding of its assets; controls in the computer-based systems and its compliance to statutes governing procurement, accounting and HR practices. The shocking findings are as follows;

Post Bank CEO Stephen Mukweri on the right greets one of his PBUL loyal customers

LOANS CLASSIFICATION
The auditors say that at PBUL there is wrong classification of loans in the loan arrears report and that this is rampant practice at PBUL. There is poor performance and monitoring of project/scheme loans and
breaching of rules concerning mobile phone banking platform.
Inaccurate interest is often charged on the loans taken especially under the Miracle Motorcycle Loan Scheme catering for hundreds of boda boda borrowers. There are also lapses in staff training practices at PBUL resulting into incompetence. There are also deficiencies in management reviews on daily teller reconciliations and on spot checks supposed to be done on tellers, vaults and ATMs. Tendencies of non-reconciliation of transactions on the suspense (DR) account and inefficiencies and non-compliance on the loans disbursed to MPs. There are also problems concerning dual access to ATMs not being observed at most PBUL branches; there is wrong classification of loans in the loan book; charged/written off loans often remain on the loan book as well as matured loans being kept on the loan book as active. The loans maturing dates are also often not properly captured and the auditors say this is done to serve the fraudulent motive of some officials at PBUL. There are inaccurate names of customers being kept on the bank’s general ledger; fraudulent interference with unclaimed or uncollected money on the fixed deposit accounts at PBUL; fraudulent practices regarding the SAGE project in comparison to the FINACLE system as many of the successful payments remain deliberately unsynchronized to satisfy the fraudulent motive of some officials at PBUL.

SAGE is a GoU program giving old people monthly upkeep of 25,000 each. It caters for hundreds of thousands of such elderly persons in different districts and PBUL was chosen by the ministry of gender to be the implementing agency at a fee. The auditors further show that ATM transactions at PBUL are poorly processed and inconsistently.

PBUL BOD Chair Grace Bakunda whose supervisory powers auditors say have been eroded

THE SHOCKING DETAILS
The auditors reveal a lot about Peg-pay which is an aspect of mobile  banking platform. That the system is exposed and customers’ money is always deducted and cashed out by fraudsters without the bank
detecting the problem or acting rapidly enough to protect its customers. The auditors state that; “most of these breaches are internally perpetrated” making PBUL very unsafe for the public to transact with. The PBUL management is further faulted for failing or refusing to do “a penetration test to assess the internal and external
vulnerability of its IT systems.” As a result of this vulnerability, the auditors add, “PBUL has incurred losses worth Ugx240m in fraud cases.” The report adds; “There is also a reputation risk associated with such cases and this may have a negative effect on the growth of the bank.” The auditors conclude on this issue that the bank remains highly susceptible to many more future cyber attacks that will most likely re-occur.  The bigger finding by the auditors is that “quite often mobile banking platform clients have had their money or savings withdrawn without their prior approval.”

BRANCH MANAGERS USURP BOD POWERS
The report adds that PBUL has witnessed rampant cases of project/scheme loans being inappropriately monitored and underwritten as a result of fraudulent connivance involving some officials in the bank. Examples are given whereby many “small loans are issued from branches like Arua and Kapchorwa and all of them are covered by a single MoU.” This is a very irregular practice and makes PBU a very risky bank for any depositors to associate with. That branch managers actually approve loans which require approval of the board or top management in Kampala. This is a very big risk for those saving with PBUL. Every loan that exceeds 150m, the branch manager must seek approval of the board but this is rarely done. Speaking of the Arua and Kapchorwa experiences, the auditors have this to say; “The aggregate sums involved are material to the operations of the bank. Such individual small amounts end up being approved by the branch yet the total amounts involved require the approval of either senior management at the head office or the Board.” At one of the two branches, a manager recently approved and gave out up to 1.3bn to a group called Farmers Ltd Company and this happened between January and July 2017 whereby many small farmers got about 5m each totaling to billions. Today the group members haven’t repaid even a penny to the PBUL since the disbursement of the 5m to each. At the time auditors wrote their report, these loans were worth 1.3bn and were in arrears for over 354 days which puts the savers’ money or deposits at risk.

The 2 branches which are just a tip of the ice berg slipped into a loss-making position as follows; 921m for Arua branch and 742m for Kapchorwa. “These loans were directly disbursed onto the customer accounts and on the same day, the amounts were (dubiously) debited off the customer accounts and directly wired to the Farmers Ltd Company bank account noted above,” the alarmed auditors say in their 46 Pages report. “The customers never received the above disbursed loans…and large exposures that are disguised as various small loans to the Farmers Ltd Company may lead the bank into financial loss.” When contacted the sources within the PBUL top management claimed that the 742m loss in Kapchorwa branch resulted from the bad weather and poor farmers’ harvest and added that staff had been punished for this irregular conduct. Disgruntled insiders in PBUL added that this wasn’t the first time PBUL branch leaders upcountry were committing such crimes leading to financial loss at the bank based at Nkrumah road in Kampala. The bank’s own rules require that every loan that exceeds 150m must get board approval but the practice is different at PBUL.

Insiders blame such losses to poor underwriting by the PBUL teams that poorly assess loan applications.  The auditors refer to the perennial poor rating of PBUL by BoU inspectors in its quarterly reports. This
rating bases on assets quality, management capabilities, liquidity and other sensitivity areas of the banks. PBUL has always registered very poor and marginal ratings in these BoU quarterly reports. Because of
this unsatisfactory performance, PBUL has always been required to pay additional risk adjusted premium towards the Deposit Protection Fund under Section 109(7) of the FIA Act. BoU rates PBUL very poorly,
according to the auditors, because of its “deteriorating assets quality and management weaknesses.”  The auditors candidly state that: “Due to this poor rating by BoU, PBUL is likely to incur additional risk adjusted premiums to its contribution to the Deposit Protection Fund.” BoU makes these quarterly reports basing on its inspectors’ findings during their onsite examination visits. PBUL has been rated as Marginal for the last 5 years-ranging from 2013 to 2017. This is more cause for depositors to worry given its fragility as a bank if the contents of the audit report are anything to go by. The high risk adjusted premiums imposed by BoU is an additional operational cost eating into PBUL’s viability as a bank entrusted with depositors’ money.

BoU believes that experiences like the Farmers Ltd Company-related loans and repeated cyber attacks make PBUL qualify for perennial marginal rating. The bank’s position is also rated marginal by the BoU because of the poor performance of loans lent to UPDF soldiers operating in Somalia. The other problem is that all group loans arrears are never appropriately classified as required by the MDI Licensing regulations of 2004. Sometimes at PBUL, such classifications are manually falsified or altered by rogue elements amongst PBUL’s staff. Disgruntled insiders say that some of the top management bosses who are supposed to reprimand rogue elements are too discredited and weakened by involvement in sex scandals with female staffers.  We don’t want to go into sex scandals involving top
managers at PBUL; lest we trivialize a very important story contained in the audit report.  Insiders say that even the ICT system meant to mitigate against fraud by human actors wasn’t properly constructed or configured yet colossal sums of money went into its procurement.
BODA LOAN SCHEME
The auditors show that under the Miracle Motorcycle Loan scheme, the problems of inaccurate interest being fraudulently charged on borrowers is rampant and wide spread at PBUL.  These loans would be given to Boda groups but some of the individual borrowers were charged and cheated to pay a higher interest rate of 30% instead of the 22% as stated in the group loan agreement. This is broad day robbery clearly targeting the innocent boda-boda borrowers whose income as we all know is very meager. But the shacks at PBUL have no compassion towards such very poor fellows. The auditors note in their very damning report: “There is a risk of bad reputation if customers are charged more than what was agreed in the offer letter.” Because of the weaknesses or even criminal connivance of the credit administration teams at PBUL,
this exploitation of the poor desperate borrowers has been ongoing for long at the different PBUL branches where this scheme has been implemented. Nobody has been punished because the bosses in top management rightly fear that acting will prompt the fraudulent staffers squeezed to spill the beans regarding the sex scandals involving married bosses feasting on their subordinates.
CORPORATE GOVERNANCE BREACHES
In his public speeches, PBUL MD Stephen Mukweri always preaches corporate values but his bank isn’t respecting even the most core or basic corporate governance requirements. How else can we explain the
failure to have a single AGM meeting which the company Act in section 138 requires to be held at least once in every 15 months? The appalling example is that in the whole of 2016, not a single AGM meeting was held yet the previous one had been held in June 2015. One then wonders where and when the PBUL top management gets the chance to interface with shareholders of the company and its members from whom they are supposed to get instructions and guidance. Is it that the top management fears the members and shareholders of the company may ask the very tough questions regarding the scandals at the bank? Your guess is as good as ours. The auditors also raise queries regarding the remuneration of PBUL board members. The top management led by Stephen Mukweri is accused of using hefty perks to compromise the board members and neutralize their expected independence to supervise management.

The perks and allowances of the board members are supposed to be determined by the shareholders and the mother ministry of finance. But Mukweri stands accused for paying them allowances that exceed what the shareholders approved. The auditors question why Board why board members are paid generous allowances in form of sitting allowances, retainer fees, entertainment advances, business development allowances and airtime advances as if they are executive directors involved in daily running of the company. In fact BoU inspectors have for long been bitter about this payment to the board by Mukweri and his management team. In their November communication to PBUL management, BoU inspectors held this to be irregular payment to board members.   The auditors also question why managers at several branches sometimes defy internal audit directives to submit some information. The affected branches are given as City/Summit branch, Kasese, Kanungu, Nakasongola, Bugolobi, Kitgum, Kakiri, Bweyale and Kamwenge. That the officers there don’t answer audit queries and undermine the internal audit department by withholding information yet the PBUL’s own internal audit plan requires they fully submit to the authority of the internal audit department.

A table from the very damning auditors’ report showing discrepancies in Post Bank’s ATM-based transactions

POSTING CYBER FRAUD ENTRIES
Auditors raise a red flag on this saying that the very department which caused the fraud in the mobile banking platform is the one making entries into the cyber fraud journal to correct those frauds which they themselves created in the first place. The auditors say this is wrong and shows that PBUL top management lacks the political will to stamp out fraud in the bank’s systems. The auditors say that duties should be segregated because “fraudulent transactions could easily be originated and processed without being detected and fraud can be penetrated and concealed.”  Best practice journal entries requires that staff who operate the system aren’t the ones who post cyber fraud entries’ correction and rectification. The trial balance of PBUL has been manipulated and used as a gap for fraudsters to have “unauthorized transactions leading to misstatement of financial statements.” The problem was most rampant between 2011 and 2016. In the same period written off/charged off loans weren’t transferred to the general ledger sub head code “38400” for non performing loans.
General ledger imbalances are common at PBUL whereby the written off loans are not transferred to the general ledger allowing it to continue existing in bank records as performing loans. The developer
or vendor who sold the FINACLE system to PBUL should be recalled to review the FINACLE core banking system to identify underlying reconciliation errors causing these imbalances, the auditors recommend. Top management is also faulted for not doing enough on staff development whereby the bank’s well elaborated staff training plan is only on paper and never implemented. The different staff categories were planned to be trained; examples being legal department staff to be trained on contract drafting and negotiation; finance department staff to train in taxation and e-tax management and operations department staff to be trained in laws relating to bank practices. The auditors wonder why there is never induction for new staff that join PBUL. The auditors say “this has led to operational inefficiencies amongst PBUL staff.”
TELLER/VAULTS NOT RECONCILED
The auditors show that whereas it’s a best practice requirement, there is no routine reconciliation of cash received by tellers from the vault at the start of the new day and cash held by tellers at the end of the day. That the managers and supervisors are never in a hurry to do daily reviews of the reconciliations submitted by tellers. This practice is a must, the auditors note, otherwise the tellers play with depositors’ money by concealing fraudulent shortages or overages. Even in rare cases where this is heeded and done, the auditors suspect the reconciliations aren’t accurately done because supervisors are never available to review the reconciliations submitted by tellers. In some branches, auditors show that, tellers commit acts of fraud even in cases involving online payments. This makes PBUL even more risky to be entrusted with depositors’ cash. Branch managers must regularly do spot checks on teller cash and their/branch managers’ reports are in turn scrutinized by quality assurances managers.

The branch managers must also spot check on the ATM cash transactions at least twice a month to confirm existence of the ATM physical cash. The auditors say that the above wasn’t heeded or done at PBUL for much of 2016 and the most affected branches were Kampala Road, Wandegeya, Ndeeba and Fort Portal mostly in the months of January, June, September and October.
“Failure to perform spot checks creates a lapse in the treasury management process at the branch and gives opportunity for concealment of fraudulent activities,” the auditors note.  Spot checks have to be done in relation to teller staff, vault and ATMs. There is also the issue of incident reporting whereby branch managers must report to the head operations whenever they receive late deposits and are unable to bank that excess cash. But the practice at most PBUL branches is that branch managers can hold cash exceeding the vault cash holding limits and the auditors were unable to find any evidence for incidence reporting ever being undertaken. Examples are given including the Kampala road branch manager who recently held more than 310m against his branch vault limit of 300m; Makerere branch manager in September held over 259m against the branch vault limit of 250m; Ndeeba in  August held 486m against the vault limit of 400m and Arua branch manager in September held up to 650m against his branch vault limit of 250m. The alarmed auditors say that “failure to raise the incident report exposes the bank to risk in case such excess amounts are not insured.”
DEPOSITORS’ CASH NOT SAFE AT ATM LOCATIONS-
Section 9.15.4 of the PBUL’s operations manual requires that no staff is allowed to access the ATM lobby area alone yet in practice that isn’t enforced at all PBUL branches. In most cases one staff freely accesses the ATM lobby area and the example given by auditors is of 30TH September at Wandegeya branch when the technician called Fred W was locked up there between 4-5pmwith no one else. On 20th October the
Fort Portal branch manager negligently allowed one staff to be in the ATM lobby area under the guise of upgrading the ATM machine yet he wasn’t a technician possessed with the requisite technical know-how.
The auditors warn that “failure to observe dual access to the ATM lobby area provides opportunity for concealment of fraudulent activities and theft of the depositors’ money.” There are cases of negligence amongst PBUL staffers eg the auditors say that at Makerere branch; the worker on teller 01 connived with a customer to steal money. The customer whose account had zero balance filled the withdraw slip and Ugx260,000 was given to him yet he clearly had insufficient funds on his account. The auditors say “such cases expose the bank to losses in case such a customer can’t be traced anymore yet the cash is already paid out.”
MPS’ LOAN SCAM-
The Board on May 19th approved the MPs’ loan scheme with following guidelines; the total scheme was to initially have 20bn and no single MP would borrow more than 400m. The interest rate was put at between
18-20%. However the PBUL management flouted these very basic rules and guidelines by allowing at least 5 MPs to borrow in excess of 400m each and unfortunately the MPs even defaulted and these became bad loans hence a loss to the bank. The auditors say this has exposed the bank to “avoidable credit risk.” The management is also on the spot for spending billions procuring the Group Lending Software (GLS) but even
with that software, PBUL has had difficulties monitoring especially group loans. Despite having the GLS in place, the PBUL loan book doesn’t capture or show details of individual borrowers but details for the entire group yet cash continues to be negligently lent out to such multiple groups. The bank also lacks a unique identifier for project loans hence making monitoring a nightmare. There is also the problem of multiple borrowing from the same bank by unscrupulous members of such groups. There depositors are concerned that the current PBUL loan book records group borrowers and not individual borrowers in such cases. In the bank’s loan book, some still active loans are recorded as charged or written off loans whereas not.

Examples include loans taken under the following account numbers; 9160032000374; 9060042000053; 9140034000251; 9140027000189; 9140027000190; 9140027000188; 9140027000186 and 9180017007724. The auditors consequently say “there is a risk of material misstatement of the financial statements.”  The PBUL management has been reluctant to enforce a control to call over all loans disbursed in the system to ensure appropriate classification of the loans.  In some cases written off loans are dubiously maintained on the loan book including on account numbers like 9160000000202 under GL Code 38400. Matured loans too are sometimes fraudulently maintained on the loan book e.g. as of 2017, the PBUL loan book still had 45 loan accounts for loans that had matured in 2013!!!! “These loans had also exceeded the mandatory 365 days for loan write off as per the Act,” the auditors note in their report. PBUL also lacks a system that can properly close off fully paid loan accounts. And the auditors find that “Over 11,300 accounts with maturity dates ranging from 2012 up to 2018 with NIL balances remained on the loan listing as of December 2017 and haven’t been
automatically closed off.”  They add that “Non-performing loans increase uncertainty regarding the bank’s net worth and lower the bank’s risk taking capacity.” Equally bewildered BoU officials are concerned that such anomalous omissions, which Mukweri blames on human error, are becoming too many and too rampant at PBUL.  Some loans have had their maturity dates wrongly captured and in some cases maturity dates stated exceed the period duration assigned to the account as per the loan agreement with the customer. Examples of such cheated customers or borrowers include those under the following account numbers; 9180001007208 to whom a 15m loan was advanced; 9190045000017; 9030000018056 and 9080007008566. That isn’t all the auditors are faulting PBUL about.

The bank’s general ledger has sub codes with company names that don’t exist anymore and examples include; Alliance One being recorded in PBUL general ledger as BAT Farmers; Sparkasse Bank as Allied Bank; WFP DRC & REA recorded as IFRS Fees; Mobile Banking Registration miss-recorded as UTL ; Smart Saver Cards recorded as Passbooks; and Board Costs or expenses recorded as AGM costs.   The auditors say this increases the risk of general ledger accounts being used to commit fraud. The auditors add that it’s bad for “the GL names to reflect names that are different from what currently appears on the current activities of those accounts.” In banking practice, long outstanding reconciliation items should be cleared within one month
but at PBUL, 4 months can elapse without the same being done. Examples include the 23rd August Citibank-related incidence which witnessed transfer instructions to Citibank not being executed for 4 months. The
same fate befell 8 remittances PBUL was instructed to transfer to BoU internal account on 12th December. The two instructions related to 8.6m and 7.9m respectively. Yet failure to clear reconciling items can give cover to staff to conceal fraudulent overages or shortages.
UNCOLLECTED FIZED DEPOSITS-
Many fixed deposits matured but weren’t claimed by the customers as at 31st December. The auditors wonder why PBUL management would be indolent and quiet on such an issue well knowing that “such acts are susceptible to fraud and can be used to perpetrate fraud or conceal unauthorized transactions on such fixed depositors’ accounts.” The best practice would be that once one’s fixed deposit account matures; the money thereon is automatically transferred to his or her operational account in the same bank.  This seldom happens in PBUL.
There are 1000s of such accounts in PBUL and auditors call for deeper investigations to establish the full extent of the problem. The auditors also unearthed 345m lying idle on what management called Customer Proxy Account. This unclaimed cash has been accumulating on this account since 2009 and the owner has never showed up claiming his money. The auditors say even if he showed up to day, this being PBUL,
“the recoverability of this money is in doubt.” The auditors warn that categorizing such money as income for the bank results into the bank’s income being grossly misstated once the system keeps creating such proxy accounts.
DISCREDITING SAGE

The auditors also unearthed big problems discrediting PBUL’s relationship with the Ministry of Gender to manage the SAGE page scheme which gives old people 25,000 per month as the Social empowerment grant from the government. The audit report shows that some unscrupulous bank officials sometimes cheat the intended beneficiaries and auditors recommend deeper inquiry into this scam orchestrated by some heartless PBUL officials. The auditors say there is no proper interface on the FINACLE system and SAGE pay server in the bank. This is what the auditors have to say specifically; “Of the 78,902 accounts that matched in both SAGE pay server and FINANCLE, the audit team noted that 20,621 accounts didn’t agree to what was debited on the corresponding customer accounts in FINACLE.” The auditors add that “whereas only SAGE pay transactions of status SUCCESS are expected to be debited on customer accounts in FINACLE, the audit team noted that 40,106 accounts in SAGE pay system with payment transactions of status UNCONFIRMED which however had been processed and debited on customer accounts in FINACLE system.” As a result, auditors fear that, “unauthorized transactions may be passed and easily go unnoticed under SAGE.” Auditors fear that SAGE may put PBUL in big problems because there is evidence of millions being paid to beneficiaries in the field yet the records haven’t been updated on the respective accounts in FINACLE.” This further makes PBUL a bank any risk conscious customer must shun on grounds of being unsafe. There are regular interface failures between SAGE pay servers and FINANCE which exposes the bank to additional risk to lose money.

Many of the old people continue to get monthly payments from PBUL mobile vans yet the bank has no record of their biometric data, photographs and finger prints. This is important for system validation and authentication of payments made thereof. Over 84,362 beneficiary accounts are being operated without biometric data, photos and finger prints. This shows fraudulent intent, negligence and laziness among the concerned PBUL staffers. Some top PBUL officials we spoke to on anonymity blamed the problem on the ministry of gender officials whom they said haven’t been cooperating well because some of them preferred another bank taking the SAGE deal. Even for the elderly whose biometric data was availed, the PBUL teams have been too lazy to synchronize the information. Beyond SAGE, there are also inconsistencies in the utility payments processing via PBUL. The auditors are also questioning the PEG-pay system being used to pay NWSC, UMEME and KCCA utility bills through PBUL and over 1.9bn is at stake. There are also inconsistencies in the ATM transactions processing at PBUL.

To  talk to  the Grapevine, call or sms: 0755973863, Email: info@thegrapevine.co.ug