CMA asks public for crypto records as investigation into QVSE investment scheme deepens

QVSE promised Kenyans daily returns from trading shares in companies such as Apple, Tesla and Nvidia. Yet according to prosecutors, prospective investors were instructed to send their money somewhere quite different: a cryptocurrency wallet. The payments allegedly passed through Binance, and Kenya's Capital Markets Authority (CMA) is now asking the public for records that could help investigators establish where those funds went.

In a notice issued on October 16, the CMA requested cryptocurrency wallet addresses and transaction hashes linked to suspected fraudulent activities involving Quant Vest Stock Exchange (QVSE) and Global Investment Group (GIG). The regulator, which has previously identified both as unlicensed investment entities, is investigating the matter alongside the Capital Markets Fraud Investigations Unit (CMFIU), a specialised police unit based at the CMA offices. The appeal specifically asks anyone with information about suspicious cryptocurrency transfers involving the platforms to come forward.

The cryptocurrency connection had already emerged during court proceedings in September. According to the Office of the Director of Public Prosecutions (ODPP), prospective investors needed at least KES 65,000 and a referral from an existing member to join the scheme. They were then allegedly directed to open Binance accounts, convert their money into virtual assets and transfer the funds to a wallet associated with QVSE. Prosecutors said the platform was marketed as an opportunity to invest in the European stock market, with recruitment taking place through social media, physical meetings and exhibitions, including agricultural shows in Kisumu and Mombasa.

Those allegations offer a clearer picture of why the CMA is interested in blockchain transactions. Investors were being offered exposure to conventional stock markets, but their money allegedly entered the scheme as cryptocurrency. Whether the funds were subsequently used to purchase shares, moved to other wallets or converted into another form of money has not been established publicly. The October notice provides no details about the wallets investigators have identified, leaving the eventual destination of the funds an important unresolved part of the case.

Questions about QVSE's legitimacy had surfaced before the criminal proceedings. A September investigation by Tech-ish found that the platform presented itself as a stock exchange regulated by the US Securities and Exchange Commission (SEC) and the Financial Industry Regulatory Authority (FINRA). Its documented American registration, however, was with the Financial Crimes Enforcement Network (FinCEN) as a money services business. That registration concerned activities such as money transmission and cheque cashing. It did not authorise QVSE to operate a securities exchange, despite what its promotional materials suggested.

By September 4, users attempting to withdraw money from QVSE were reportedly encountering a notice accusing customers of regulatory violations. The platform cited the USA PATRIOT Act and FINRA Rule 3310, an anti-money-laundering requirement for FINRA member firms, even though QVSE was not a member. A week later, on September 11, the CMA named QVSE and GIG among 15 entities it said were operating without the necessary licences or approvals. The regulator also confirmed that the Directorate of Criminal Investigations was examining their activities in collaboration with the CMA and other law enforcement agencies.

The investigation subsequently reached the courts. On September 23, Ruth Mueni Kimeu and Mary Katuma Mwangangi were charged at Milimani Law Courts with operating an unlicensed collective investment scheme and fraudulently inducing members of the public to trade in securities through alleged deceptive statements and promises. Both pleaded not guilty and were released on KES 200,000 bonds each. Prosecutors alleged that the two acted alongside other individuals who had not been brought before the court.

The latest request for cryptocurrency records introduces another source of evidence into an investigation that has already produced criminal charges. On a public blockchain, a transaction hash can identify a particular transfer, showing when it occurred, the amount transferred and the addresses involved. Investigators can use those details to examine subsequent movements of funds between wallets. The records have limits, though. A wallet address does not, by itself, identify the person controlling it, and tracing cryptocurrency does not automatically mean the money can be recovered.

For now, the CMA has not disclosed the total amount of money involved, how many investors may have been affected or whether any funds have been recovered. Its decision to seek information from the public suggests that investors' own transaction records could help fill gaps in the investigation, particularly where payments moved through wallets that investigators have yet to identify or connect to individuals.

Anyone with relevant information can submit it through complaints@cma.or.ke or the CMA's whistleblower portal. People who made payments to QVSE or GIG should preserve their transaction IDs, wallet addresses and payment confirmations, which may help investigators reconstruct the movement of funds.

The authorities have already identified the investment platforms and brought charges against two alleged participants. What remains publicly unanswered is where the cryptocurrency transferred through the scheme ultimately went, who controlled the receiving wallets and how much of the investors' money, if any, can be recovered.