eTIMS Privacy & Data
Can KRA See Your M-Pesa? What eTIMS Really Tells KRA About Your Business (2026)
· Fact-checked 9 Aug 2026
The short answer: no live spying, yes joined-up records
KRA does not watch your phone, your computer or your WhatsApp. What eTIMS sends KRA is the invoice itself — and beyond that, KRA works from filings and statutory records (withholding tax certificates, customs, PAYE). The 2026 muscle is cross-referencing: eTIMS vs declared sales, withheld tax vs declared income, nil returns vs eTIMS activity.
Why This Question Keeps Coming Up
Ask ten business owners in Kenya what eTIMS is for, and half will say the same thing: "it's a way for KRA to spy on you." That rumour has followed eTIMS from its earliest days — and in 2026 it has grown teeth, mixing with stories about nil returns, M-Pesa balances and bank accounts.
It is a real, common concern. Like most fears around tax, it contains a small piece of truth wrapped in a bigger misunderstanding. So let's state the truth plainly:
KRA does not watch your phone, your computer or your WhatsApp. What KRA sees is what goes into KRA's own systems — your eTIMS invoices, your filings, and the third-party records that tax law already allows it to collect.
This page goes line by line: what eTIMS transmits, what KRA can check, and what it genuinely cannot.
What KRA Actually Receives When You Issue an eTIMS Invoice
When you issue an invoice through eTIMS — app, web portal, USSD or your POS system — KRA receives the invoice itself:
- Your business name and KRA PIN
- The invoice number, date and time of issue
- What you sold: description, quantity, unit price
- The tax charged (VAT or simplified invoice amounts)
- The buyer's KRA PIN — for B2B sales only. For B2C (individual) sales, no buyer PIN is required
- A validation code/QR link that ties the invoice to KRA's records
That is the entire list. There is no hidden channel taking anything else. eTIMS is an invoicing system, not a monitoring program — the invoice that goes out is the invoice KRA gets back.
What KRA Can Honestly See From Elsewhere
The "they know everything" energy has a real basis — but it is built from declarations and statutory records, not surveillance:
- Your own filings: everything you have ever put on iTax — returns, amendments, obligations
- eTIMS data: every invoice transmitted — yours and your suppliers'
- Withholding tax certificates: when clients withhold on your invoices, KRA holds that certificate file
- Customs and import records
- Employment records (PAYE)
None of this is secret — it is the tax records Kenya always kept, now joined up. What changed in 2026 is that KRA actively cross-references these sets at filing time: eTIMS invoices vs declared sales, withholding tax certificates vs declared income, nil returns vs eTIMS activity. That is the real muscle — and it only bites when there is a gap between what you declared and what the records show.
Your Bank Account and M-Pesa: What KRA Cannot Get — and What It Can
- Your private messages, apps or history history history
- The contents of your phone — no eTIMS app reads other apps or files
- Your M-Pesa statements "live" — mobile-money records sit with the operator. The Commissioner General has stated it plainly: "We have no direct access to M-Pesa wallets, unless it is on a case-by-case basis where there is fraud or investigations" (September 2025). A Finance Bill proposal in 2025 that would have let KRA demand bank/M-Pesa records without a court order was rejected by Parliament — the statutory route remains: targeted, case-by-case, for investigations.
- The song on your playlist. (Because some of these rumours need a little comedy.)
The "they can watch your computer" version is false. eTIMS transmissions are invoices only — get any skilled developer, auditor or tax advisor to trace exactly what KRA's e-invoicing protocol carries and they will come back with the items on the first list and nothing else.
The M-Pesa Rumour That Hurt the Most
The rumour that spread hardest in early 2026: "KRA will tax the money in my M-Pesa / bank account."
| What people say | What's actually true |
|---|---|
| "KRA taxes everything in my M-Pesa" | False. Money moving through M-Pesa is not income. Balances are not taxable. |
| "Any cash I receive means I owe tax" | False. Tax applies to income — gifts, family transfers, savings, and own-account movements are not income. |
| "KRA sees my M-Pesa in real time" | False. KRA validates against the records it lawfully collects — filings, eTIMS, withholding, customs. Mobile money sits with the operator; records are obtainable case-by-case for fraud or investigations, not through a silent live tap on every wallet. |
| "The nil-return suspension means I'm about to be assessed on the money I moved" | Half true — and it's the half that matters. The suspension targeted people declaring no income while the records say otherwise. If you issued eTIMS invoices, held withholding certificates, or have customs records, that is what gets checked. M-Pesa balances alone are not the target — undeclared income is. |
So the habit that protects a business is one above all: file what is true. The risk is never "a big M-Pesa balance." The risk is a return that contradicts the records that already exist in KRA's systems.
The Nil-Return Moment That Freaked Kenya — What Changed in January 2026
In January 2026 KRA suspended nil-return filing while reviewing records, then reopened it for the 2025 filing season after 31 March 2026 with validation checks embedded. KRA's own tally: 392,162 taxpayers who had taxes withheld from them in 2025 still filed nil for 2024. That caused real anxiety — people with active businesses who never report. The correct reading: nil returns now have to actually be nil. If you traded or issued invoices in the year, file the matching return; if you genuinely had no income, a return is still your obligation and filing it correctly keeps you clean.
The Line That Replaces the Fear
"If it is not in eTIMS, it did not happen for KRA's purposes."
That sentence works both ways:
- An expense without an eTIMS receipt = not claimable (your deduction "didn't happen").
- A sale never invoiced = a gap between KRA's records and your return — the thing audits look for.
The system punishes gaps, not small businesses. The entrepreneur whose invoices, records and returns match — who asks for their PIN on receipts and declares what they earned — is exactly the taxpayer the system treats best. Fear that pushes people off the system only creates the gaps that the system then catches.
What to Do Before You File This Year
- Get on eTIMS now: onboarding is free — eTIMS Lite (web/USSD) covers low-volume invoicing (up to ~50 invoices a month) for most service businesses.
- Carry your PIN when buying for the business, so receipts come back with your PIN — the highest-value habit tax advisors recommend the most.
- Check the dashboard before filing — match the numbers KRA holds, correct, confirm, file on time.
Frequently Asked Questions
Does eTIMS let KRA read my phone or computer?
No. eTIMS collects the invoice data you enter — seller and buyer PINs, date, description, quantity, price, tax, and a validation QR code. It does not read other apps, files, calls or messages. This rumour is as old as the system itself, and it is false every time.
Will KRA tax the money in my M-Pesa or bank account?
No. Money sitting in an account is not income. Transfers, gifts, savings and family support are not taxable on their own. What is taxable is income you earn and fail to declare — and that is what KRA validates against its records of eTIMS invoices, withholding tax certificates, customs and returns. File truthfully and the picture is fine.
I issued eTIMS invoices last year — can I still file a nil return in 2026?
Not without risking a mismatch. KRA's systems cross-reference nil and non-filers against eTIMS, withholding and customs data — that check is exactly what the 2026 compliance push runs on. If you transacted, file the accurate return, which often still means little or no tax below the thresholds.
How do I know what KRA holds on me before I file?
Log in to iTax and check your pre-filled data — you may see exactly what KRA already holds: withheld amounts, imported data, and eTIMS transactions. That is the tool the compliance push is built on: look, reconcile, and file to match.