Does My Company’s Whistleblowing Duty Stop at Bribery? What Kenyan Law Actually Covers

No, and a whistleblowing policy built only to satisfy bribery law will leave gaps. The Anti-Bribery Act, 2016 and the Bribery Regulations, 2022 impose specific reporting and anti-retaliation duties for bribery and corruption. A report about theft, unsafe practices or ordinary financial dishonesty that falls short of bribery does not sit squarely within those provisions, and protection for that kind of report comes from other laws that were not written as whistleblowing statutes. A good whistleblowing policy therefore extends your commitments to any good-faith report of wrongdoing, and says so in terms.

What the bribery rules require of a company

Section 9(1) of the Anti-Bribery Act requires a public or private entity to put in place procedures appropriate to its size and the scale and nature of its operations for the prevention of bribery and corruption. If a private entity fails to do so and the failure is proved to have been committed with the consent or connivance of a director or senior officer, that person commits an offence under section 9(2). The Bribery Regulations, 2022 (Legal Notice 88 of 2022) add detail. The procedures must be in writing (regulation 12), and in developing them an entity must incorporate guiding principles that include risk assessment, communication and training, internal reporting mechanisms, mechanisms for the protection of whistle-blowers, informants and witnesses, and compliance monitoring and review (regulation 13(2)). The six-month period in regulation 13(1) runs from publication of the guidelines under section 12(2) of the Act.

The Regulations also deal with reporting directly. Regulation 19 requires an entity to establish mechanisms for internal and external reporting of acts of bribery or corruption by its employees or persons associated with it. Regulation 17 requires the entity to keep a record of reports, regulation 18 requires confidentiality of the report and the identity of the person making it, and regulation 20 requires appropriate measures to protect from retaliation, reprisal or victimisation any person who reports in good faith.

The Act’s reporting duty is firm. Section 14 requires any person in a public or private entity to report knowledge or suspicion of bribery to the Ethics and Anti-Corruption Commission within twenty-four hours, and failure to do so is an offence. Section 21 protects a whistle blower, informant or witness in a bribery complaint from intimidation or harassment. A person who demotes, admonishes, dismisses, transfers to an unfavourable working area or otherwise harasses or intimidates a whistle blower or witness commits an offence, with a fine of up to KES 1 million, imprisonment of up to one year, or both.

Where the whistleblowing policy needs to go further

Other statutes protect people who report, each for a defined situation. Section 65 of the Anti-Corruption and Economic Crimes Act, 2003 provides that no action or proceeding, including a disciplinary action, may be instituted or maintained against a person for assistance given to, or a disclosure of information made to, the Commission or an investigator. That protection does not apply to a statement the person did not believe to be true. The same section protects the identity of the person who assisted, subject to the court’s view of what justice requires. Making false accusations to the Commission is itself an offence under section 66.

In the Employment Act, 2007, section 46(h) says that an employee’s initiation or proposed initiation of a complaint or other legal proceedings against the employer is not a fair reason for dismissal or a disciplinary penalty, except where the complaint is shown to be irresponsible and without foundation. Under section 43 the employer must prove the reason for any termination. That is real protection, but it is framed around complaints against the employer, and it was not drafted as a whistleblowing regime. Section 21(3) of the Anti-Bribery Act separately entitles a whistle blower or witness to protection to the extent determined by the Witness Protection Agency.

The result is that protection depends on what the employee reports and to whom. An employee who reports poor safety practice, a harassment concern, or financial irregularity that is not bribery or an economic crime may find the protection thinner, and the employee rarely knows in advance which statute would apply. We have not identified a single general whistleblower statute that covers every kind of report, so the practical protection has to come from your own policy.

What a broader whistleblowing policy should say

At minimum, a whistleblowing policy should cover the following points:

• who a concern can be raised with, including a route that does not go through the employee’s manager if the manager is the subject of the concern;
• a commitment to confidentiality that goes beyond what any one statute requires;
• an explicit statement that no adverse action will be taken against someone who reports in good faith, whatever the subject matter;
• a defined process for what happens after a report is made, including acknowledgment, investigation and feedback; and
• a clear statement that suspected bribery must go to the Ethics and Anti-Corruption Commission within twenty-four hours.

None of that beyond the bribery rules is legally mandatory. It is the difference between a company that can point to a real policy when something goes wrong and one that can only point to what the bribery rules happened to require. For what to do on the day a report arrives, see our guide to handling an employee misconduct report in the first 48 hours. If you operate through foreign subsidiaries, our article on anti-bribery procedures for foreign subsidiaries in Kenya covers the group dimension.