M-PENNYEvery penny, empowered← BackM-PENNYEvery penny, empowered← BackNatcrest Holdings Company Ltd (trading as M-Penny) · Version 1.0 · Effective from 1 September 2026
This M-PENNY CPA REVIEWER POLICY is issued by Natcrest Holdings Company Ltd, trading as M-Penny, and takes effect on the Effective Date stated on the cover.
Important: You become bound only after a clear affirmative electronic acceptance step. Every Review remains subject to your professional duties, the precise Accepted Allocation and the limits stated in this Policy.
1.1 This CPA Reviewer Policy (Policy) governs the contractual relationship between Natcrest Holdings Company Ltd, trading as M-Penny (Natcrest) and each individual professional whom Natcrest accepts to perform Reviews through the M-Penny Portal (Reviewer or Reviewing CPA).
1.2 The Policy applies to onboarding, professional verification, Portal access, allocation and acceptance of Reviews, performance, Review Outcomes, fees, confidentiality, data processing, quality assurance, suspension, termination, complaints and disputes.
1.3 The Policy governs the ordinary limited-review model and any expressly designated Review-and-Filing Allocation. M-Penny is a business-software and coordination platform and is not, by operating the Portal, an accountancy firm, tax agent, audit firm or statutory assurance provider. Natcrest does not represent that ICPAK, KRA or another regulator approves, certifies or endorses M-Penny.
1.4 Nothing in this Policy creates a contract between the Reviewer and a Customer, authorises the Reviewer to bind Natcrest or a Customer, guarantees any allocation, income or duration of engagement, or gives the Reviewer ownership of a Customer relationship.
1.5 Return preparation or submission and tax-agent representation may be activated only through an expressly designated Review-and-Filing Allocation after Natcrest verifies every required licence, registration, Customer appointment, authority and data-protection step. Audit, assurance, objections, appeals, direct KRA disputes and services outside that allocation still require a separate lawful written arrangement.
2.1 In this Policy, unless the context requires otherwise:
2.1.1 Accepted Allocation means an Allocation Notice that the Reviewer has affirmatively accepted through the Portal or another method recorded by Natcrest.
2.1.2 Allocation Notice means the electronic notice specifying the scope, Review Materials, deadline, fee, required Review Outcome and any special professional requirement for a proposed Review.
2.1.3 Applicable Professional Requirements means the Accountants Act, applicable regulations, current ICPAK licensing and ethical requirements, the IESBA Code as adopted or recognised in Kenya, applicable tax law, final KRA requirements and every other binding standard governing the relevant Review.
2.1.4 Customer or Merchant means the business customer whose information or proposed tax treatment is the subject of a Review. Customer has the same meaning as in the M-Penny Terms of Service.
2.1.5 Customer Data means information, records, documents and personal data submitted to, generated in, transmitted through or made accessible to the M-Penny service by or for a Customer, excluding Natcrest's own system, usage and security data to the extent separately controlled by Natcrest.
2.1.6 M-Penny means the platform, Portal and trading identity operated by Natcrest, and does not denote a separate legal person.
2.1.7 Portal means the CPA reviewer subsystem through which Natcrest onboards Reviewers, offers or allocates Reviews, provides Review Materials, receives Review Outcomes and maintains related records.
2.1.8 Review means the limited, point-in-time professional assessment described in an Accepted Allocation and clause 8.
2.1.9 Review-and-Filing Allocation means an Accepted Allocation that expressly authorises the Reviewer, as the Customer’s appointed tax agent, to review, prepare and submit the identified return after the conditions in clause 8 have been satisfied.
2.1.10 Review Materials means the records, snapshot, notes, computation, filing draft and other information made available for a Review.
2.1.11 Review Outcome means the Reviewer's recorded conclusion and supporting feedback, including a sufficient, insufficient or qualified outcome.
2.1.12 Reviewer Work Product means the Review Outcome, reasons, clarifications and other original professional content created by the Reviewer for an Accepted Allocation.
2.1.13 Service means the M-Penny service as defined in the M-Penny Terms of Service.
2.2 References to a law include amendments and successor provisions in force from time to time. Including and similar expressions do not limit the words preceding them.
3.1 The Reviewer becomes bound only after a clear affirmative acceptance step, such as clicking or tapping an acceptance control that identifies or links this Policy. Applying, receiving credentials, signing in or merely using the Portal without that clear step is not, by itself, acceptance.
3.2 Before Portal access or the first allocation, and whenever the Portal presents the Policy again at sign-in, Natcrest will preserve a reliable electronic record of the Reviewer’s verified identity, the Policy version presented, the date and time, the affirmative acceptance action, the associated Account, the cumulative acceptance count and the professional credentials verified at onboarding or renewal. Signing in without the affirmative control is not acceptance.
3.3 The contract comprises this Policy, each Accepted Allocation, Schedule 1, any accepted written fee schedule, the M-Penny CPA Non-Disclosure Agreement (NDA) and any other document expressly incorporated before acceptance (Contract Documents).
3.4 If Contract Documents conflict, mandatory law prevails, followed by: the Accepted Allocation for its specific scope, fee and deadline; Schedule 1 for Customer-controlled personal data; this Policy; an accepted fee schedule; and the NDA. For confidentiality only, the more protective obligation in this Policy or the NDA applies to the extent it can operate consistently with mandatory law and Schedule 1.
3.5 A material later change is governed by clause 24 and requires fresh affirmative acceptance where stated there. Natcrest will retain prior versions and acceptance records for accountability and disputes.
3.6 Electronic records and acceptance actions may be used as evidence to the extent permitted by Kenyan law. This clickwrap arrangement does not require a separate signature page.
4.1 A Reviewer must, before onboarding and throughout the relationship, be lawfully entitled and professionally competent to perform every Accepted Allocation. Ordinary ICPAK membership alone is not sufficient for paid tax-practice work.
4.2 Unless current official law permits a narrower qualification for the exact limited task, the Reviewer must maintain:
4.2.1 current ordinary membership of ICPAK in good standing;
4.2.2 a valid practising certificate;
4.2.3 a current annual ICPAK licence authorising the relevant tax services, ordinarily a Category T tax licence or Category C composite licence, or its lawful successor;
4.2.4 professional-indemnity insurance appropriate to the nature and volume of the work and not less than KES 5,000,000, with any higher allocation-specific cover stated before acceptance; and
4.2.5 every additional qualification, registration, training or authorisation required for the allocated activity.
4.3 If an allocation involves preparing or submitting a return for another taxpayer, liaising with KRA for that taxpayer or otherwise acting as tax agent, the Reviewer must hold current KRA tax-agent registration and the taxpayer’s lawful appointment or authority. An ordinary Review excludes those functions; a Review-and-Filing Allocation includes only the filing functions expressly identified in it and does not authorise an objection, appeal or wider representation unless separately stated and lawfully established.
4.4 The Reviewer must provide accurate and current evidence of legal name, identity, KRA PIN, payment particulars, contact details, ICPAK membership, practising certificate, annual licence, professional-indemnity cover, relevant competence and experience, tax compliance particulars where lawfully required and KRA tax-agent status where relevant.
4.5 Natcrest may verify those particulars through ICPAK, KRA, the issuing insurer and other reliable official or professional sources, before onboarding and periodically thereafter. Verification of one register does not oblige Natcrest to onboard or allocate work.
4.6 Credentials and eligibility are personal. The Reviewer must not allow an assistant, employee, partner, firm, subcontractor or other person to perform a Review through the Reviewer's Account unless Natcrest has expressly approved the arrangement in writing and every professional, confidentiality, security and data-processing requirement is satisfied.
4.7 The Reviewer must notify Natcrest immediately of any lapse, expiry, suspension, restriction or investigation affecting membership, practising status, licence, tax-agent status or insurance; any professional or regulatory disciplinary matter; any fraud, dishonesty or financial-crime proceeding; any conflict affecting an allocation; or any fact materially impairing competence, independence or lawful performance.
4.8 Natcrest may reject an application, request additional verification, restrict allocations or suspend access where information is false, incomplete, expired, inconsistent, unverifiable or presents a material legal, professional, security or integrity risk.
5.1 The Reviewer provides independent professional services as an independent contractor and is not Natcrest's employee, worker, partner, agent, fiduciary, spokesperson or representative.
5.2 For each Accepted Allocation, the Reviewer exercises independent professional judgment, subject to the defined scope, lawful deadline, security controls and Applicable Professional Requirements. Natcrest must not direct the professional conclusion.
5.3 The Reviewer may accept or decline an allocation without penalty merely for declining. There is no guaranteed volume, minimum income, fixed duration, salary, leave, pension, medical benefit, continuous availability requirement or other employee entitlement.
5.4 Subject to the Accepted Allocation, the Reviewer ordinarily determines where and how to perform the Review, provides their own ordinary equipment, connectivity and professional resources, and may serve other clients subject to confidentiality, conflicts and clause 12.
5.5 The Reviewer is responsible for maintaining professional status and insurance, meeting their own tax and statutory obligations and organising their practice consistently with independent contracting.
5.6 Neither party may bind the other or make a commitment in the other's name unless a specific written authority expressly permits it. The practical relationship, not this label alone, determines legal status.
6.1 Portal credentials are individual and non-transferable. The Reviewer must use only their verified Account, change initial credentials where required and protect passwords, one-time passcodes and authentication devices from disclosure or misuse.
6.2 The Reviewer must use a reasonably secure device, current protective software and a private connection; avoid shared or public devices where Review Materials may be exposed; prevent unauthorised viewing; sign out after use; and access only allocations assigned to them.
6.3 The Reviewer must notify Natcrest immediately after discovering or reasonably suspecting compromised credentials, unauthorised access, malware, accidental disclosure or another security event, and must cooperate with credential resets, containment and investigation.
6.4 Natcrest may apply proportionate authentication, access logging, role restriction, session control and credential-reset measures and may temporarily restrict access while investigating a suspected security, eligibility, conflict or integrity issue.
6.5 The Reviewer is responsible for activity they authorised or caused and for failure to use required safeguards. The Reviewer is not absolutely liable for every action taken under valid credentials to the extent the event was caused or materially contributed to by Natcrest's security failure or another matter for which Natcrest is legally responsible.
7.1 Natcrest may offer an allocation to an eligible Reviewer but does not guarantee any offer. A Reviewer assumes responsibility only after affirmatively accepting the Allocation Notice.
7.2 Each Allocation Notice will identify, to the extent applicable:
7.2.1 the Customer, Merchant or secure reference;
7.2.2 the relevant tax head and period;
7.2.3 the Review Materials made available;
7.2.4 the defined review question and required Review Outcome;
7.2.5 the ordinary or urgent deadline;
7.2.6 the agreed fee;
7.2.7 special instructions; and
7.2.8 any licence, registration or competence requirement specific to the task.
7.3 The standard turnaround is forty-eight hours after allocation. If required Review Materials, Customer authority or access are materially incomplete, the Reviewer must notify Natcrest promptly; the clock is paused only for the documented period reasonably required to cure that deficiency. A different deadline binds the Reviewer only if stated before acceptance and accepted by the Reviewer.
7.4 Before acceptance, the Reviewer must consider competence, capacity, conflicts, eligibility, sufficiency of materials and any professional or ethical concern. The Reviewer may decline on any reasonable ground, including insufficient time or information, lack of the required licence, conflict or risk of professional breach.
7.5 If an Accepted Allocation cannot be completed properly or on time, the Reviewer must notify Natcrest promptly, explain the material issue and preserve the Review Materials. Natcrest may reassign the allocation and require an orderly handover.
7.6 Natcrest must not retrospectively change a material scope, deadline or fee after acceptance without the Reviewer's agreement. If Natcrest reassigns an allocation, conforming work already completed will be paid where it remains reasonably usable, unless the reallocation results from the Reviewer's material breach, fraud or professional non-conformity.
8.1 A Review is a limited, point-in-time professional assessment of the defined question and the Review Materials made available through M-Penny. It is internal quality support for the Customer's next stated step and is not a statutory audit, assurance engagement or guarantee.
8.2 Unless a separate lawful written arrangement expressly provides otherwise, the Reviewer does not:
8.2.1 conduct an audit, assurance engagement or independent verification of every underlying transaction;
8.2.2 reconstruct the Customer's books or create missing source records;
8.2.3 prepare or submit a tax return for the Customer;
8.2.4 transmit information to KRA or use the Customer's KRA credentials;
8.2.5 act as the Customer's tax agent or communicate, negotiate or correspond with KRA;
8.2.6 handle an objection, appeal or representation before KRA or the Tax Appeals Tribunal;
8.2.7 provide a legal opinion or services outside the Reviewer's competence;
8.2.8 receive, hold or transfer tax money or other Customer funds;
8.2.9 guarantee KRA acceptance, a refund, deduction, exemption or tax outcome;
8.2.10 assume responsibility for facts or records not disclosed; or
8.2.11 replace the Customer's responsibility to maintain accurate records, determine its filing position and make the final filing decision.
8.2.12 For a Review-and-Filing Allocation, filing may begin only after Natcrest records the Reviewer’s current relevant ICPAK licence and KRA tax-agent registration, the Customer’s electronic appointment and authority, the approved return, and the necessary data permissions and materials. The Reviewer must use the Reviewer’s authorised tax-agent access or another KRA-approved channel, must never request or use the Customer’s personal password or one-time passcode, and must retain the filing acknowledgement in the approved workflow.
8.2.13 The Reviewer remains independently responsible for the professional conclusion, lawful filing and acts or omissions within the accepted scope. Natcrest coordinates the workflow, payment and communications, must not dictate the tax conclusion, and is not the Customer’s tax agent or the author of the Reviewer’s independent opinion.
8.3 A sufficient outcome means only that, on the defined scope and Review Materials available at the review time, the Reviewer has not identified a material issue requiring correction or further information before the stated next step. It is not a certificate of accuracy, statutory compliance, audit assurance or KRA acceptance.
8.4 An insufficient outcome identifies the material information, correction, clarification, inconsistency or professional concern that prevents a sufficient outcome.
8.5 A qualified outcome may be used where the available evidence supports neither an unqualified sufficient outcome nor a definitive insufficient outcome. It must state the unresolved limitation, its potential significance and the next information or action required.
8.6 The Reviewer must not use audit, assurance, certify, approved return, verified as correct, professional opinion or similar wording in a manner that overstates the limited Review or creates a statutory engagement that has not been lawfully established.
9.1 The Reviewer must perform each Accepted Allocation in accordance with Applicable Professional Requirements, including integrity, objectivity, professional competence and due care, confidentiality, professional behaviour, appropriate professional scepticism and the public interest.
9.2 The Reviewer must:
9.2.1 understand and remain within the stated Review scope;
9.2.2 evaluate the Review Materials actually supplied and use tax law applicable to the relevant period;
9.2.3 identify material inconsistencies, omissions, unsupported positions and obvious computational errors;
9.2.4 avoid assumptions not reasonably supported by the record;
9.2.5 state material limitations and unresolved uncertainty;
9.2.6 request clarification through M-Penny where necessary;
9.2.7 record concise reasons supporting the Review Outcome;
9.2.8 distinguish facts, professional judgment and unresolved matters;
9.2.9 avoid backdating, falsifying, altering or suppressing source records;
9.2.10 refuse to endorse information known or reasonably believed to be false, deceptive or unlawful; and
9.2.11 maintain within the Portal an appropriate audit trail of the Review steps performed.
9.3 The Reviewer must not perform procedures represented as audit, assurance or a formal review engagement unless the relevant standard, licence, engagement terms and professional conditions have been deliberately satisfied.
9.4 A tight deadline, low fee, Customer pressure or commercial preference does not justify reducing professional care below the required standard. The Reviewer must decline or pause an allocation that cannot be completed lawfully and competently.
10.1 Before accepting an allocation, the Reviewer must conduct a conflict and independence check using the information reasonably available and must repeat the assessment if circumstances change.
10.2 The Reviewer must disclose to Natcrest and decline or pause the allocation where:
10.2.1 the Reviewer or a close associate has a material interest in the Customer;
10.2.2 the Reviewer already acts for the Customer in a potentially conflicting matter;
10.2.3 a personal, financial, business or family relationship impairs or appears reasonably likely to impair objectivity;
10.2.4 the Reviewer prepared the same work in circumstances that compromise the intended independent check;
10.2.5 fees, gifts, side payments or commercial pressure threaten professional judgment; or
10.2.6 another professional or ethical threat cannot be reduced to an acceptable level.
10.3 The Reviewer must not request or accept a gift, side payment, commission, referral benefit or other advantage from a Customer or a person connected with an allocation.
10.4 The Reviewer must promptly escalate through Natcrest any reasonable suspicion of fraud, fabricated records, identity misuse, tax evasion, corruption, unlawful instruction, material security incident or serious professional misconduct. The escalation should preserve evidence and avoid unnecessary disclosure.
10.5 The Reviewer is not required to continue work that would breach law or professional obligations. Nothing in the Contract Documents prevents a lawful report to ICPAK, KRA, the ODPC, law enforcement or another competent authority, or compliance with a binding professional duty.
10.6 Natcrest must not retaliate against a Reviewer for raising a genuine concern in good faith or complying with a mandatory reporting obligation.
11.1 Each Review Outcome must be clear, confined to the Accepted Allocation, supported by concise reasons, professionally expressed, free from unnecessary personal data and capable of being relayed accurately to the Customer.
11.2 The Reviewer must submit the Review Outcome through the Portal and must not send it to the Customer or an unauthorised channel unless Natcrest has expressly approved that method.
11.3 Natcrest or the Reviewer may request clarification or correction where the Reviewer made an objective error, overlooked information already included in the Review Materials, further Customer information changes the analysis, Natcrest needs explanation to relay the outcome accurately, or quality review identifies a genuine inconsistency.
11.4 The Reviewer must correct an objective error promptly. New or materially changed Customer information may require a revised allocation, deadline and fee where it falls outside the Accepted Allocation.
11.5 Natcrest may format, summarise or relay feedback but must preserve its professional meaning. Natcrest must not pressure the Reviewer toward a preferred tax conclusion, silently delete an adverse finding or represent a limited Review Outcome as an audit certificate, assurance opinion or guarantee.
11.6 A genuine disagreement should be addressed through reasoned clarification, independent quality review or reassignment. The Portal should preserve the original outcome, the reason for any change and the identity and time of the change.
12.1 Communication concerning an allocation ordinarily passes through M-Penny. Natcrest provides the limited Review Materials needed for the task, receives the Review Outcome and communicates relevant feedback to the Customer.
12.2 The Reviewer must not use Review Materials to identify, locate, contact or solicit the Customer independently. Customer and Reviewer contact details will not ordinarily be exchanged.
12.3 If Natcrest authorises direct communication for a specific allocation, the Reviewer must remain within the approved scope, use the approved channel, keep an appropriate record and comply with confidentiality, professional and data-protection obligations.
12.4 During the relationship and for twelve months after the relevant M-Penny introduction or last Accepted Allocation, whichever is later, the Reviewer must not use M-Penny information or access to solicit or accept a direct engagement from that Customer without Natcrest's written approval.
12.5 Clause 12.4 does not apply to a documented pre-existing professional relationship disclosed before acceptance; a relationship arising independently without use of M-Penny information; contact required by law or a professional regulator; or an engagement expressly approved by Natcrest.
12.6 The Reviewer remains free to practise generally and serve other clients. This clause does not create exclusivity or an indefinite restraint.
12.7 The Reviewer must not represent themselves as Natcrest's employee, partner, spokesperson, authorised tax agent or person entitled to bind M-Penny or a Customer.
13.1 The fee for an ordinary Review must be stated in the Allocation Notice before work begins. For a Review-and-Filing Allocation, the Reviewer fee is the greater of KES 5,000 or 3% of Tax Payable, where Tax Payable is the amount shown as payable on the final Customer-approved return for the relevant period, excluding penalties, interest and unrelated arrears unless the Allocation Notice expressly states otherwise. The fee and calculation inputs must be shown before acceptance.
13.2 Natcrest, not the Customer, settles the agreed Review fee. The Reviewer must not invoice, collect money from or impose a separate charge on the Customer.
13.3 For a Review-and-Filing Allocation, the fee accrues after successful filing and receipt of the KRA filing acknowledgement or other valid filing evidence. Natcrest will pay the accrued and undisputed fee promptly after that evidence is recorded, by M-Pesa or bank transfer to the verified Reviewer account, subject to any lawful invoice or tax documentation specified before acceptance.
13.4 The percentage-based fee must not influence the Reviewer’s judgment or create a target tax amount. The Reviewer must not select, increase or preserve a tax position to increase the fee, and no fee is payable for a knowingly false, deceptive or unlawful filing. Any threat to objectivity must be disclosed and reduced to an acceptable level or the allocation must be declined or paused.
13.5 The Reviewer is responsible for their own taxes, statutory contributions, professional costs and practice obligations. Natcrest may deduct and remit withholding tax where law requires and will provide the applicable withholding evidence or certificate when available.
13.6 Natcrest may withhold or adjust payment only for a defined, documented and material non-conformity, duplicate claim, fraud, unlawful work or another lawful reason. Natcrest will notify the Reviewer and provide a reasonable opportunity to clarify or remedy a remediable deficiency.
13.7 Natcrest must not retrospectively reduce an accepted fee. Rework arising from the Reviewer's objective error or non-conformity is ordinarily included; a material change in Customer information or scope may require a new fee agreement.
13.8 No minimum income or allocation volume is guaranteed. Termination does not extinguish an accrued and undisputed fee for conforming work completed before termination.
14.1 The Reviewer must keep confidential all non-public information obtained through Natcrest or an allocation, including Customer identity and Customer Data; tax, financial, transaction and business records; Review allocations and outcomes; M-Penny software, pricing, workflows, product plans and security information; credentials; and non-public Portal information.
14.2 The Reviewer may use confidential information only to perform an Accepted Allocation, meet related compliance obligations or exercise a lawful right under the Contract Documents.
14.3 Confidentiality does not apply to information that the Reviewer proves was lawfully known without restriction, became public without breach, was independently developed without use of confidential information, was lawfully received from another source without restriction, or must be disclosed by law or a competent authority.
14.4 Where disclosure is compulsory, the Reviewer should give Natcrest prior notice where lawful and practicable, disclose only what is required and reasonably cooperate to protect confidential or privileged material.
14.5 Unless technically necessary and expressly permitted, the Reviewer must not:
14.5.1 take screenshots, download or print Review Materials;
14.5.2 forward information to a personal email address or messaging account;
14.5.3 store Review Materials in an unapproved cloud service or local archive;
14.5.4 discuss an allocation with an unauthorised person;
14.5.5 reuse information in another client engagement;
14.5.6 use information for marketing, profiling, benchmarking, monetisation or model training;
14.5.7 upload Review Materials to a public or unapproved AI or third-party tool; or
14.5.8 identify a Customer, Natcrest or the relationship publicly without written permission.
14.6 The NDA supplements this clause. It does not replace Schedule 1 or reduce any mandatory data-protection duty.
14.7 Confidentiality survives termination for as long as the information remains confidential. Trade secrets and information protected by statute remain protected for the period provided by law.
15.1 Natcrest acts as controller for personal data used to manage the Reviewer relationship, including identity, credentials, professional verification, payment, security, compliance, complaints and relationship administration. Natcrest will handle that data under the M-Penny Privacy Policy and applicable law.
15.2 For Customer-controlled personal data supplied for a Review, the Customer ordinarily acts as controller, Natcrest as processor and the Reviewer as Natcrest's authorised subprocessor. The actual role follows the processing purpose and means, not merely this label.
15.3 The Reviewer must process Customer-controlled personal data only on Natcrest's documented lawful instructions, within the Accepted Allocation and Schedule 1, and must notify Natcrest promptly if an instruction appears to infringe applicable data-protection law.
15.4 The Reviewer must apply appropriate technical and organisational safeguards, restrict access to the minimum necessary, preserve confidentiality, prevent independent use and provide reasonable assistance with data-subject rights, security, data-protection impact assessments, regulatory enquiries and audits.
15.5 The Reviewer must not appoint an assistant, firm, cloud service, AI tool or other further subprocessor, or allow remote access or a transfer outside an approved location, without Natcrest's prior specific written approval and every lawful safeguard. The Reviewer remains responsible for an approved further processor's conduct to the extent provided by law and contract.
15.6 The Reviewer must report an actual or suspected personal-data breach or security incident to Natcrest immediately and in any event within twenty-four hours after becoming aware of it, preserve evidence, avoid unauthorised notice to affected persons and provide available information and cooperation for investigation and lawful notification.
15.7 At the end of an allocation or the relationship, the Reviewer must return or securely delete Customer Data as Natcrest directs, unless binding law or a professional obligation requires limited retention. Retained information must be isolated, protected, used only for that legal obligation and deleted when the obligation ends.
15.8 Natcrest must not give the Reviewer access to Customer controlled personal data until the Customer-facing data-processing terms authorise the subprocessor arrangement and any required prior authorisation or notice has been completed.
15.9 Schedule 1 forms part of this Policy and supplies the written processor-subprocessor particulars. The NDA is not a substitute for those terms.
16.1 Natcrest and its licensors retain all rights in M-Penny, the Portal, software, product design, documentation, workflows, branding, templates and system-generated content, subject to the Customer's lawful rights in Customer Data.
16.2 The Reviewer receives only a limited, revocable, non-exclusive and non-transferable right to access the Portal and Review Materials for Accepted Allocations during the relationship. No ownership is transferred.
16.3 The Reviewer remains professionally responsible for the content and accuracy of Reviewer Work Product. The Reviewer grants Natcrest a perpetual, non-exclusive, worldwide, royalty-free licence to store, reproduce, format, communicate, relay and use that Work Product for the relevant Customer service, compliance, quality assurance, record keeping and dispute handling.
16.4 The Reviewer retains pre-existing professional methods, general know-how and materials that do not contain Customer Data, Natcrest confidential information or third-party material used without authority.
16.5 Natcrest must not falsely attribute to the Reviewer a conclusion that Natcrest materially altered. The Reviewer must not reuse identifiable Customer Data or Natcrest confidential information in another work product.
16.6 Neither party may use the other's name, trade marks, logo, endorsement or relationship publicly without prior written permission, except for a disclosure required by law.
17.1 Natcrest may maintain proportionate records of applications, credentials, verification, allocations offered, accepted, declined or reassigned, access and security logs, Review Materials made available, Review Outcomes and reasons, deadlines, fees, withholding, complaints, quality concerns and suspension or termination decisions.
17.2 Natcrest may conduct proportionate quality review, audit and investigation for legitimate service-quality, legal, professional, security, fraud and data-protection purposes. Monitoring must be confined to those purposes and must not amount to undisclosed surveillance for unrelated use.
17.3 The Reviewer must provide information and reasonable cooperation necessary to demonstrate compliance with the Contract Documents, subject to confidentiality, privilege, proportionality and protection of unrelated clients.
17.4 Each party must cooperate with lawful court orders, Customer complaints and properly authorised inquiries from ICPAK, KRA, the ODPC, law enforcement and other competent bodies. A request should be verified and limited to the lawful scope where practicable.
17.5 Nothing in the Contract Documents prevents either party from preserving evidence, reporting suspected unlawful or professional misconduct or exercising a statutory right.
18.1 The Reviewer must not:
18.1.1 provide false, misleading or borrowed professional credentials;
18.1.2 allow another person to use the Reviewer's Account or perform an allocation without approval;
18.1.3 access, search for or disclose an unassigned Customer or record;
18.1.4 copy, scrape, reverse engineer, disrupt or introduce malware into the Portal;
18.1.5 falsify, backdate, conceal, alter or delete Review evidence improperly;
18.1.6 endorse records known or reasonably believed to be false or materially misleading;
18.1.7 accept a side payment, gift, commission or improper benefit;
18.1.8 solicit or contact a Customer contrary to clause 12;
18.1.9 submit information to KRA or act for a Customer without lawful authority;
18.1.10 hold themselves out as Natcrest's employee, partner, spokesperson or authorised representative;
18.1.11 use M-Penny's name or Customer information for promotion;
18.1.12 upload Review Materials to an unauthorised AI or third-party tool;
18.1.13 retaliate against a person raising a genuine compliance concern; or
18.1.14 act beyond the Reviewer's licence, competence or Accepted Allocation.
18.2 A prohibited act may justify immediate restriction, investigation, reallocation, non-payment for non-conforming work, termination, regulatory reporting or other lawful action, subject to clauses 13, 20 and 21.
19.1 The Reviewer warrants on acceptance and throughout each Accepted Allocation that:
19.1.1 all onboarding and professional information is accurate and current;
19.1.2 every required licence, registration and insurance policy remains valid;
19.1.3 the Reviewer is competent and has sufficient capacity for the allocation;
19.1.4 no undisclosed conflict or material threat to objectivity exists;
19.1.5 the work will be performed with professional competence and due care;
19.1.6 Reviewer Work Product will be original or lawfully used;
19.1.7 the Reviewer will comply with law, professional rules and the Contract Documents; and
19.1.8 the Reviewer will not knowingly facilitate false or unlawful tax reporting.
19.2 Natcrest warrants that it will:
19.2.1 operate the Portal with reasonable care and skill;
19.2.2 provide the Review Materials it has agreed to provide;
19.2.3 relay Review Outcomes without deliberate material distortion;
19.2.4 pay accrued and undisputed fees under the accepted terms;
19.2.5 maintain the security and data-protection obligations allocated to it; and
19.2.6 comply with duties that applicable law does not permit it to exclude.
19.3 Neither party warrants that Review Materials will reveal every relevant fact, that a Review will eliminate all error or fraud, or that KRA will accept a filing or tax position. This does not excuse failure to meet the agreed professional or operational standard.
20.1 Nothing in the Contract Documents excludes or limits liability for fraud, fraudulent misrepresentation, wilful misconduct, gross negligence, death or personal injury caused by negligence, breach of confidentiality or data-protection obligations to the extent such liability cannot lawfully be limited, or another liability that mandatory law does not permit to be excluded or limited.
20.2 Subject to clause 20.1, each party is responsible for direct and reasonably foreseeable loss caused by its breach, negligence or unlawful conduct. Neither party is liable for genuinely indirect or consequential loss that was not reasonably foreseeable when the relevant obligation was accepted.
20.3 The Reviewer is responsible for professional negligence, the independent professional conclusion and any filing performed within an Accepted Allocation. Natcrest is not responsible for the Reviewer’s independent conclusion merely because it coordinated or paid for the allocation, but remains responsible for its own selection and verification process, Portal operation, instructions, security, data handling and accurate relay of Review Outcomes.
20.4 Subject to clause 20.1, each party’s aggregate ordinary liability arising from this Policy in any twelve-month period will not exceed KES 5,000,000. The cap applies in contract, tort, negligence, breach of statutory duty and otherwise, but does not reduce a mandatory statutory remedy or any higher allocation-specific liability limit expressly accepted before work begins.
20.5 The Reviewer will indemnify Natcrest against a third-party claim, regulatory demand, loss or reasonable external cost only to the extent arising from the Reviewer's material breach, professional negligence, fraud or wilful misconduct, unlawful conduct, breach of confidentiality or data-protection obligations, infringement of third-party rights, or performance outside lawful professional authority.
20.6 The indemnity does not apply to the extent loss was caused or materially contributed to by Natcrest, the Customer or inaccurate Review Materials that the Reviewer could not reasonably identify as defective.
20.7 A party seeking indemnity must give reasonably prompt notice, take reasonable steps to mitigate loss, permit the indemnifying party to participate in the defence and not admit fault, settle or impose a non-monetary obligation on that party without consent, which must not be unreasonably withheld. The indemnity does not permit double recovery.
20.8 Each party must take reasonable steps to mitigate loss and notify the other promptly after discovering a material error or claim so that the other has a reasonable opportunity to investigate and, where possible, correct or contain it.
20.9 The Reviewer must maintain the professional-indemnity cover required by clause 4 and provide evidence on request. Natcrest may require higher cover before offering an unusually high-value or high-risk allocation. Insurance does not replace the Reviewer’s underlying responsibility.
21.1 Natcrest may immediately suspend or restrict Portal access where reasonably necessary because of compromised credentials; loss or uncertainty of professional eligibility; conflict; confidentiality or data risk; suspected fraud, dishonesty or serious professional misconduct; regulatory direction; unlawful conduct; material breach; or material risk to a Customer, Natcrest or the Portal.
21.2 Where the issue is remediable and does not require urgent protection, Natcrest will give written notice describing the material concern and a reasonable opportunity to remedy it before termination.
21.3 Either party may terminate the relationship by written notice. During a notice period the Reviewer is not obliged to accept new allocations and Natcrest is not obliged to offer them.
21.4 If an Accepted Allocation is incomplete at suspension or termination, the Reviewer must promptly preserve the Review Materials, disclose the status and cooperate with an orderly handover or reassignment without compromising professional obligations or the Customer's deadline.
21.5 On termination:
21.5.1 Portal access ends and credentials must no longer be used;
21.5.2 Review Materials must be returned or securely deleted as directed, subject to mandatory retention law;
21.5.3 confidential information remains protected;
21.5.4 accrued and undisputed fees for conforming work remain payable;
21.5.5 incomplete allocations are handled as Natcrest lawfully directs;
21.5.6 the Reviewer must not retain Customer or Natcrest material except where law requires; and
21.5.7 the limited non-circumvention obligation and provisions intended to survive continue for their stated period.
21.6 Termination does not affect accrued rights, lawful regulatory reporting, pending complaints or claims, or any provision that logically continues after termination.
22.1 A Reviewer may submit a written complaint about an allocation, fee, Portal access, quality finding, professional pressure, privacy matter or other issue through the contact in clause 26. The complaint should identify the allocation, issue, supporting information and outcome requested.
22.2 Natcrest may raise a quality or conduct concern with the Reviewer and may relay a Customer complaint. Each party should preserve relevant evidence, communicate professionally and provide a fair opportunity to respond where urgency does not require immediate protective action.
22.3 An objective Review error should first be addressed under clause 11. A conflict, suspected misconduct, confidentiality breach, security incident or privacy complaint must also follow the relevant protective and statutory process.
22.4 If the ordinary process does not resolve the matter, either party may request good-faith escalation to an authorised representative. The parties will attempt resolution for thirty days after written escalation unless urgency or mandatory law requires earlier action.
22.5 If unresolved, either party may refer the dispute to a court or tribunal of competent jurisdiction in Kenya. Small Claims Court jurisdiction is preserved where applicable, as are urgent interim relief and statutory complaint, disciplinary or enforcement routes through ICPAK, KRA, the ODPC and other competent bodies.
22.6 A person is not required to exhaust Natcrest's internal process before using an urgent or mandatory statutory route.
23.1 The Contract Documents and every non-contractual obligation arising from them are governed by the laws of the Republic of Kenya.
23.2 Subject to clause 22, courts and tribunals of competent jurisdiction in Kenya may determine disputes. The parties do not agree to mandatory arbitration through this Policy.
24.1 Natcrest may update this Policy prospectively for legal, regulatory, professional, security, operational or product reasons. The current version number and effective date will appear on the cover.
24.2 Natcrest will give appropriate advance notice of a materially adverse change where practicable or legally required and will require fresh affirmative acceptance where the change materially affects reviewer eligibility, scope, fees, liability, data use, confidentiality, non-circumvention, dispute rights or professional obligations.
24.3 Continued Portal access does not by itself amount to blanket consent to an unexpected material change. A Review already accepted remains governed by the version, scope, deadline and fee accepted for that allocation unless law requires otherwise or the parties agree to the change.
24.4 Natcrest may make an urgent change required by law, a regulator or a serious security risk with shorter notice, but will explain the effective change and obtain reacceptance where the law or clause 24.2 requires it.
25.1 Notices. Natcrest may send operational notices to the Reviewer's verified email address or Portal Account. A legal notice to Natcrest must be sent to support@mpenny.ke. A failed delivery notice means receipt has not occurred.
25.2 Assignment. The Reviewer may not assign, transfer or delegate the relationship or an allocation without Natcrest's prior written approval because professional eligibility and Portal access are personal. Natcrest may assign the Policy as part of a genuine restructuring, financing, merger or sale of M-Penny if the successor assumes Natcrest's relevant obligations and the Reviewer's material rights are not reduced.
25.3 Subcontracting. The Reviewer may not subcontract or appoint a further processor except under clauses 4 and 15. Natcrest may use service providers for its own obligations but remains responsible to the extent required by law and contract.
25.4 Force majeure. A party is not liable for delay caused by an event beyond its reasonable control, including a widespread telecommunications, electricity, cloud, KRA or cyber incident not caused by failure to use reasonable safeguards. The affected party must notify the other where practicable, mitigate the effect and resume performance. Professional or Customer deadlines may still require prompt reallocation.
25.5 Entire agreement and precedence. The Contract Documents are the entire agreement on the reviewer relationship and replace earlier discussions on that subject. Clause 3.4 determines precedence. Nothing excludes fraud or a written representation on which a party reasonably relied.
25.6 Variation. Except for an update made under clause 24, a variation must be recorded in writing and accepted by both parties. A Portal record may satisfy the writing requirement where legally valid.
25.7 Severability. If a provision is invalid or unenforceable, it will be limited or removed only to the minimum extent necessary and the remainder will continue. Its lawful commercial purpose should be preserved where possible.
25.8 Waiver. A failure or delay to exercise a right is not a waiver. A waiver must be clear and applies only to the specific circumstance for which it is given.
25.9 Third-party rights. A person who is not a party has no contractual right to enforce the Policy, except that this does not limit a Customer's, data subject's or regulator's independent statutory rights.
25.10 Relationship. The independent relationship is stated in clause 5. Nothing creates partnership, employment, fiduciary duty or general agency.
25.11 Language and interpretation. The English version controls unless Natcrest expressly states otherwise. Headings assist navigation and do not limit meaning.
25.12 Electronic records. Reliable electronic notices, acceptance records, Portal logs and Review records may be retained and used as evidence to the extent permitted by law.
25.13 Survival. Clauses on confidentiality, data protection, intellectual property, records, liability, accrued fees, non-circumvention, complaints, governing law and any provision intended by its nature to continue survive termination for their stated or lawful period.
26.1 Natcrest Holdings Company Ltd (trading as M-Penny), Company Registration No. PVT-ZE186LV6, Pride House, Kitengela, Kajiado County, Kenya; P.O. Box 817-00242, Kitengela, Kenya; email: support@mpenny.ke.
26.2 A communication should identify the Reviewer, relevant allocation and request without including passwords, one-time passcodes or unnecessary Customer Data.
SCHEDULE 1
PROCESSOR-SUBPROCESSOR PARTICULARS
This Schedule forms part of the Policy and applies to Customer-controlled personal data made available for an Accepted Allocation.
Status and subject matter. For Customer-controlled personal data in Review Materials, Natcrest acts as the Customer’s processor and appoints the Reviewer as an authorised subprocessor. The subject matter is the limited Review or, where expressly designated and authorised, the review, preparation and filing specified in the Accepted Allocation.
Duration. Processing begins when Review Materials are made available and ends when the allocation and any directed correction or handover are complete, followed by secure return or deletion, subject only to mandatory legal retention.
Nature and purpose. Accessing, examining, comparing, recording observations, requesting clarification through Natcrest, producing the Review Outcome, correcting an objective error and supporting lawful quality assurance or dispute handling; and, for a Review-and-Filing Allocation only, preparing and submitting the approved return through an authorised KRA channel and recording the filing acknowledgement.
Data subjects. Customers who are natural persons; Customer owners, directors, authorised users and staff; the Customer's customers, suppliers, employees, contractors and other counterparties; and other individuals whose personal data appears in Review Materials.
Personal-data categories. Identity and contact data; business and tax identifiers; invoices, receipts, sales, expenses, stock, bookkeeping, payroll inputs, tax-related records, transaction references, reconciliation data, professional communications, account references and other data strictly necessary for the Accepted Allocation.
Instructions and purpose limitation. The Reviewer will process personal data only on Natcrest's documented lawful instructions, only for the Accepted Allocation and never for direct marketing, unrelated profiling, monetisation, another client engagement or training an AI model.
Confidentiality and access. Only the individual approved Reviewer may access the data unless Natcrest gives prior specific written approval. Every approved person must be bound by confidentiality and receive access limited to what is necessary.
Security. The Reviewer will use appropriate technical and organisational measures, including individual credentials, secure devices and connections, access restriction, secure storage where expressly permitted, malware protection, prompt patching, secure deletion and incident response proportionate to the risk.
Further subprocessors and transfers. No assistant, firm, service provider, AI tool, cloud storage, transfer outside Kenya or remote access from another country may be used without Natcrest's prior specific written approval and a legally valid written arrangement providing no less protection.
Data-subject and compliance assistance. Taking account of the processing and information available, the Reviewer will reasonably assist Natcrest with rights requests, security, breach response, DPIAs, regulator inquiries, Customer audits and evidence of compliance.
Incidents. The Reviewer will notify Natcrest immediately and within twenty-four hours after awareness of any actual or suspected breach or security incident, preserve evidence, provide available facts and cooperate with containment, investigation and lawful notification.
Audit and inspection. On reasonable notice, or promptly for a serious incident or regulatory requirement, the Reviewer will provide information and proportionate access necessary to demonstrate compliance, subject to security, confidentiality, privilege and protection of unrelated clients.
Return, deletion and retention. At Natcrest's direction, the Reviewer will return or securely delete Review Materials and copies. A binding professional or legal retention duty permits only the minimum retained record, isolated and used solely for that duty until deletion becomes lawful.
Unlawful instructions. The Reviewer will inform Natcrest promptly if an instruction appears to infringe applicable data-protection law and may pause the affected processing pending lawful clarification.
Natcrest Holdings Company Ltd (trading as M-Penny) · Nairobi, Kenya · support@mpenny.ke