The loan file that looked compliant

The loan was approved for UGX 2.8 billion.

The borrower was a trading company that claimed to supply construction materials across Uganda. Its file was impressive. The application form was complete. The financial statements carried an accountant’s stamp. The collateral valuation showed property worth UGX 5.6 billion. The land searches appeared clean. The credit committee minutes recorded approval. The borrower contributed the required equity. Insurance was in place. The checklist contained ticks in every box.

Seven months later, the account had not made one full installment repayment.

The financed warehouse was almost empty. The company’s largest customers denied the sales recorded in the loan application. The land offered as security was occupied by a family that said it had never agreed to a mortgage. Most of the loan proceeds had moved to businesses that were not named in the credit proposal. Three of those businesses shared telephone numbers, directors, email addresses or transaction patterns with the borrower.

The file had complied with the process.

The transaction had not complied with reality.

Summit Consulting Ltd was called after the lender’s internal auditor noticed that several loans approved by the same small group of employees were deteriorating in the same manner. The borrowers operated in different sectors, yet their valuations came from the same office, their legal searches passed through the same contact, their projected cash flows used similar wording, and their repayments stopped shortly after disbursement.

We gave the persons of interest neutral investigative references.

Suspect 1 was a neat, soft-spoken relationship manager who knew the credit policy better than most staff.
Suspect 2 was a broad-shouldered valuation professional who spoke with the confidence of someone accustomed to having his figures accepted.
Suspect 3 was a middle-aged businessman with polished shoes, several companies and no obvious personal assets registered in his name.
Suspect 4 was a quiet operations officer who rarely attended credit meetings but controlled several steps between approval and disbursement.

These labels did not mean guilt. They helped the investigation team discuss evidence without turning suspicion into a conclusion.

The loan failed before the money left

A bad loan is not automatically a fraudulent loan.

Businesses fail. Markets change. Customers delay payments. Imports become expensive. A borrower can make an honest projection and still be wrong. Fraud begins to emerge when material facts were deliberately altered, hidden or invented to influence the lending decision.

That distinction help to control the investigation.

The team did not begin by asking who stole the money. We asked whether the lender would have approved the facility if it had known the true financial position, the true ownership relationships, the true collateral value and the intended use of the funds.

The application claimed annual sales of UGX 9.4 billion. Bank statements showed deposits close to that amount, but a deposit is not necessarily revenue. Money can move into an account, leave, pass through another related account and return as a fresh deposit. When investigators treat total account credits as sales, circular transactions can make a small business look much larger than it is.

The borrower’s statements contained repeated round figures. UGX 200 million arrived from one company and left for another company within hours. Several days later, a similar amount returned through a third company. The transaction descriptions referred to cement, steel and transport, but the companies involved had common contacts and no clear evidence of the stated trade.

The financial statements also showed receivables from large customers. We asked for invoices, delivery notes, purchase orders, tax records, proof of delivery and direct customer confirmation. Some customers existed but denied the balances. Others had purchased goods, but at a fraction of the amount reported. A few invoices had been created from the same electronic template shortly before the loan application.

That is how credit fraud often hides. Each document appears possible when viewed alone. The scheme becomes visible when the documents are forced to explain one another.

Take one approved loan from your institution. Ignore the checklist and rebuild the borrower’s story from outside the file. Confirm the customers, suppliers, taxes, goods, premises, directors and money flows. The difference between the file and the outside world is where the real investigation begins.

Compliance became camouflage

The relationship manager had not left the file incomplete. He had made it look complete.

That was more serious.

Missing documents attract attention. A well-prepared false document can pass through a busy credit department because it satisfies the reviewer’s expectation. The investigator must therefore test authenticity, timing, independence and substance, not merely presence.

The borrower’s management accounts were dated three weeks before the application. Examination of the native spreadsheet showed that several worksheets had been edited after the credit committee meeting. The formulas behind the printed totals had been replaced with fixed figures. A hidden worksheet contained earlier, lower sales projections. The PDF in the loan file did not reveal any of this.

This is why investigators should not accept screenshots, printed spreadsheets or converted PDFs when native files are available. Native files can retain formulas, hidden sheets, embedded data, authorship fields and other metadata that may help explain how a document was created and changed. Digital forensics requires lawful collection, preservation, examination, analysis and reporting, with integrity and chain of custody maintained throughout the process.

The credit memorandum also contained phrases that appeared in other borrowers’ proposals. Similar wording is not proof of fraud. Bank templates naturally create repetition. The stronger fact was that unusual spelling errors, calculation mistakes and unsupported assumptions appeared in several unrelated applications. The same error had travelled from file to file.

The approval system recorded who submitted, reviewed, recommended and approved the loan. That did not prove who physically performed each action. Employees sometimes share credentials, leave sessions open or allow colleagues to process work on their behalf. The investigation therefore compared system logs with staff attendance, device records, email activity, document versions and the sequence of approval.

A username is a signpost. It is not the person standing beside it.

Ask your credit team to produce one recent approved file in its original electronic form. Request the native spreadsheet, original emails, workflow logs, valuation photographs, legal-search requests and final approval trail. When staff can produce only printed documents, the institution has preserved a decision but lost much of the evidence explaining how that decision was made.

The borrower was not one company

The loan application presented the borrower as an independent company.

The money flows showed a group.

Within two days of disbursement, UGX 1.1 billion moved to three businesses described as suppliers. Corporate searches showed different shareholders, but the investigation found common telephone contacts, shared premises, repeated use of the same email recovery address and payments for expenses that benefited Suspect 3.

Connected borrowing is often hidden behind formal separation. Different company names do not prove independence. The investigator must examine beneficial ownership, common control, family relationships, shared directors, guarantors, addresses, staff, devices, accountants, suppliers and cash flows.

The Financial Institutions Act regulates insider lending and credit exposure, while Uganda’s corporate-governance regulations require board oversight of facilities granted to shareholders, directors, executive management and other related parties. The regulations also place responsibility on the relevant board committee to review portfolio quality, provisioning and credit-policy limits.

The problem was not simply that the borrower knew other businesses. Commercial groups often trade among related companies for valid reasons. The issue was whether those relationships had been disclosed, assessed and approved as connected exposure, and whether the lender understood the combined ability of the group to repay.

Suspect 3 had submitted one company’s sales as evidence of the borrower’s market strength, another company’s property as security and a third company’s bank transactions as proof of liquidity. When repayments became due, each company claimed to be legally separate.

That arrangement is like inviting the lender to eat from one family pot during appraisal and then presenting separate kitchens when the debt must be paid.

The investigation mapped every borrower, shareholder, director, guarantor, account, telephone number, address and payment recipient. The map showed that what appeared to be four independent customers was one economic risk wearing four company names.

Draw your top twenty borrowers on one page. Connect common shareholders, directors, guarantors, valuers, lawyers, addresses, suppliers and payment beneficiaries. Credit concentration is often larger than the core banking system reports because the system sees legal names while the investigator looks for common control.

The collateral value existed only on paper

The property was valued at UGX 5.6 billion.

A later independent assessment placed the likely market value much lower. More importantly, part of the land was difficult to access, occupied by a family and affected by interests that were not properly explained in the original report.

An inflated valuation is not proved merely because another valuer reaches a lower figure. Valuation involves professional judgment, market conditions, assumptions, comparable sales and the purpose of the valuation. The investigation had to establish why the original figure was unreliable, not simply that it was high.

We examined the instructions given to Suspect 2, the inspection notes, photographs, coordinates, comparable properties, calculations, report versions and communications with the relationship manager and borrower. Some photographs did not show the boundaries clearly. The comparable properties were in more developed locations. Development assumptions had been included without adequate support. The report used a value per acre that could not be reconciled to the evidence retained in the file.

The file also contained a spousal-consent document. The signature was disputed.

Uganda’s Mortgage Act requires the mortgagee to satisfy itself that spousal consent, where required, is informed and genuine. The Act also provides remedies where a mortgage has been obtained through fraud, deceit or misrepresentation.

A 2025 Commercial Court ruling held that allegations of bank fraud, forged spousal consent and a potentially void mortgage raised genuine issues requiring a full hearing rather than summary disposal. The ruling did not prove the allegations. It demonstrated why lenders must preserve proper evidence of identity, explanation, consent and witnessing.

A signature on a consent form is not the end of due diligence. The lender should be able to show who identified the spouse, where the consent was signed, who explained the transaction, whether the spouse understood the property and facility, and what independent evidence supports the process.

Ask your team to defend one mortgage without using the words, “The form is on file.” Make them explain how the property was identified, inspected, valued, searched and linked to the borrower, and how each person giving consent was identified and informed. That is the explanation a serious challenge will demand.

The money did not follow the approved purpose

The credit proposal stated that the facility would purchase construction materials.

The disbursement trail told another story.

Part of the money went to named suppliers. Some payments were genuine. Others moved to recently opened companies, returned to the borrower or funded unrelated obligations. One payment described as steel purchases was followed by transfers to a car dealer, a school and a personal investment account.

Loan diversion is not automatically fraud. A borrower may breach the facility agreement without having deceived the lender during application. The legal and investigative question is whether the diversion was planned before approval, concealed through false documents or supported by internal collusion.

In a 2025 Court of Appeal decision, failure to pay instalments and diversion of funds from the agreed purpose were treated as a fundamental breach of the loan arrangement.

The investigation therefore compared the approved purpose, disbursement instructions, supplier invoices, account ownership, delivery evidence and the actual use of money. We did not rely on narration fields alone. A transfer labelled “stock purchase” remains only a description until goods, supplier capacity and delivery can be verified.

Suspect 4 had processed changes to supplier details shortly before disbursement. The workflow recorded an approved supplier, but the payment instruction used a different account. The change had been authorised through email, yet the email existed only as a printed page in the file.

We obtained the native message with its headers and attachments, then checked the mailbox and approval trail. The evidence showed that the message had been forwarded from an external address and manually inserted into the process. That finding still did not identify the author. It established how the control was bypassed.

Select one large disbursement and follow it until the money reaches its final economic use. Do not stop at the supplier’s bank account. Check whether the supplier existed, had the goods, delivered them, paid related parties or returned funds to the borrower. The first recipient may be only a bridge.

Portfolio decay exposed the network

The case was discovered because the internal auditor stopped reviewing loans one by one.

She reviewed the portfolio as a population.

Twelve accounts had missed early instalments. Nine had been approved within a similar period. Seven shared the same valuer. Six had been introduced by Suspect 1. Five had received large transfers from one another after disbursement. Four had collateral in distant locations even though the borrowers operated in Kampala.

No single connection proved misconduct. Together, they justified a deeper examination.

Portfolio decay usually begins before an account is classified as non-performing. Early signs include missed conditions, delayed equity contribution, interest funded from fresh borrowing, repeated restructuring, unexplained changes in supplier details, rapid transfer of disbursed funds, temporary deposits near reporting dates and repayment from other borrowers within the same network.

The serious investigator does not ask only, “Has the borrower paid?”

The stronger question is, “What is the true source of repayment?”

A borrower can appear current because another related borrower is sending money into the account. That arrangement may hide deterioration until the whole group runs out of new money.

The board should also be careful with restructuring. A restructured facility can be a sensible response to a viable business facing temporary pressure. It can also delay recognition of loss, preserve reported interest and postpone accountability for a poor original decision.

Take all loans approved by one relationship manager, branch, committee, valuer or lawyer during a selected period. Compare early arrears, restructuring, collateral coverage, exception approvals and transfers among borrowers. Patterns that remain invisible in a single file often become obvious across twenty files.

We investigated the decision, not only the default

Many loan investigations concentrate on the borrower because the borrower received the money.

That is too narrow.

A fraudulent loan may require several people to perform apparently ordinary acts. Someone introduces the borrower. Someone adjusts the projections. Someone accepts the valuation. Someone clears the legal conditions. Someone approves an exception. Someone changes the supplier. Someone releases the money. Not every person in that chain is dishonest, but every critical action must be explained.

The team reconstructed the loan decision from the earliest contact to disbursement. We examined calendars, emails, messages, file versions, approval logs, call patterns, meeting minutes and system events. We looked for evidence of undisclosed relationships, pressure, unusual speed, repeated exceptions and actions outside normal duties.

We preserved the original systems before employees were interviewed. Interviewing too early can alert persons of interest, change behaviour and lead to deletion or coordination of explanations. Digital evidence is easy to alter, so preservation should use documented methods, validated tools and integrity checks. Hash values can help demonstrate that collected data has remained unchanged, but a hash does not explain who created a file or whether its contents are true.

During interviews, we did not begin with the allegation. Suspect 1 explained the normal credit process, customer sourcing, document handling and approval duties. We then moved to the specific file, unusual decisions and contradictions. This allowed the team to compare his account with evidence already preserved.

Suspect 2 was asked to explain the valuation method, comparable properties, inspection, photographs and assumptions. Suspect 4 explained supplier changes, email approvals and disbursement controls. Suspect 3 was asked to explain the group companies, customer balances and final use of funds.

A good interview does not force a confession. It records an account that can later be tested.

Before interviewing a person of interest, write down what you already know, what you only suspect, what that person can explain and which documents should be shown last. When the interviewer reveals all the evidence at the beginning, the witness is given the answer sheet before the examination starts.

The court will not repair a careless investigation

Calling conduct fraudulent does not make it fraud.

Ugandan courts require allegations of fraud to be specifically pleaded and strictly proved. A court should not infer fraud that was not properly pleaded, and the person accused must be given a fair opportunity to answer the allegation.

That means the investigation report must identify the representation, who made it, when it was made, why it was false, whether the maker knew or intended the deception, how the lender relied on it and what loss followed.

The report must also separate fraud from negligence, policy breach, poor judgment and contractual default. A careless valuer is not automatically a fraudulent valuer. An approving officer who missed a warning sign is not automatically part of a conspiracy. A borrower who diverts money may be in breach without having committed fraud at application.

Electronic evidence also needs a proper foundation. Uganda’s Electronic Transactions Act recognises electronic records, but evidential weight depends on reliability, integrity, origin and the manner in which the information was generated and maintained.

In a 2025 Land Division decision, copied video evidence was rejected because authenticity and integrity had not been properly established. The lesson reaches beyond video. A screenshot, printed email, exported log or copied spreadsheet may be relevant, but the person relying on it must still explain its source, collection and reliability.

The lender must also prove its own case carefully. A 2025 High Court decision rejected a claimed outstanding loan balance where the complete facility agreement had not been properly tendered and the foreclosure process was flawed. The court also considered the lender’s duties concerning the sale price and accounting for proceeds.

A lender can uncover serious borrower misconduct and still weaken recovery through incomplete contracts, unreliable statements, improper notices or a defective sale.

Give an independent lawyer the investigation file and ask counsel to attack it. Can the bank prove disbursement? Can it prove the contractual balance? Can it authenticate the electronic records? Can it explain custody? Can it show genuine consent? Can it distinguish an inference from a proven fact? The weaknesses found before filing are cheaper than the weaknesses exposed in court.

How the case closed

The investigation did not conclude that everybody connected to the loan was dishonest.

The borrower had submitted materially unreliable financial information, concealed connected businesses and diverted a substantial part of the facility from the approved purpose.

Evidence showed that Suspect 1 had undisclosed contact with related companies, participated in preparing financial projections presented as the borrower’s work and supported exceptions without recording material relationships.

The available evidence did not establish that Suspect 2 had invented the property. It established that the valuation was inadequately supported, relied on weak comparables and failed to deal properly with occupation and access. The professional and legal consequences required determination through the appropriate disciplinary, civil or investigative process.

Suspect 4 had processed payment-detail changes outside the intended workflow and relied on an email that could not be validated through the normal approval chain. The evidence justified disciplinary and further legal review, but the report stopped short of asserting facts that had not been proved.

The lender identified UGX 1.36 billion transferred to connected or unsupported recipients. Recoveries and preserved assets reduced the immediate exposure, but the final loss remained dependent on enforcement, collateral realisation and the outcome of legal proceedings.

The credit file had not failed because one document was missing.

It failed because the institution treated completion as verification, legal ownership as economic independence, valuation as value, a username as a person, account credits as sales, a supplier payment as proof of stock and collateral as a substitute for repayment capacity.

A loan file can be perfectly arranged and still be false.

That is the lesson for directors, lenders, auditors and investigators. Do not ask whether every document is present. Ask whether the documents describe a real borrower, a real business, real cash flow, real collateral, genuine consent and a lawful decision that can be defended after the relationship has collapsed.

Credit fraud rarely enters the institution through a broken window.

It is often carried through the front door in a labelled file, approved by authorised people and protected by a checklist that nobody thought to challenge.