KRA already knows more about your business than you think

For years, tax compliance in Kenya followed a relatively familiar script. A business could keep its books, prepare its tax computations, file its returns and pay whatever tax it declared due. As far as the numbers could be supported by the company's accounting records, then management could reasonably believe that the business was compliant. However, that world is rapidly disappearing. Kenya is moving towards a fundamentally different tax environment — one in which the question is no longer simply what you declared to KRA. Rather, does what you declared agree with what KRA already knows about your business? That distinction may prove to be one of the most consequential changes in tax administration for Kenyan businesses. Kenya's tax system is not merely becoming more digital but more interconnected. Consider a company that has filed its VAT returns correctly based on its accounting records. The finance team has supporting invoices, and the accounts have been reconciled. From the company's perspective, the records appear correct. From KRA's perspective, the data tells a different story - that difference is where the risk begins. Some input VAT claims cannot be matched to eTIMS invoices. A withholding tax certificate does not align with the income declared. Customs records for imported goods do not reconcile with purchases recorded in the general ledger. KRA's growing ability to draw information from eTIMS, customs records, withholding tax certificates and other third-party information is gradually changing the architecture of tax compliance. Every transaction leaves a digital footprint. That means filing an accurate return is no longer enough. Businesses must increasingly ask whether that return can be independently reconstructed from the information sitting across KRA's systems. This has a significant implication for boards, CEOs and finance directors. Tax compliance is now a data-governance issue. The quality of the information flowing through procurement, payroll, customs, finance and even suppliers can ultimately determine the defensibility of a company's tax position. Perhaps the most uncomfortable consequence of this shift is that part of a company's tax risk may now sit outside the company itself. Imagine purchasing goods from a legitimate supplier; the goods are delivered and payment is made. The transaction is properly recorded in your books but the supplier fails to transmit the invoice correctly through eTIMS or enters an incorrect buyer PIN or in some cases, records incomplete information. Commercially, the transaction happened and from an accounting perspective you may have recorded it correctly. However, if the transaction cannot be validated against the relevant digital records, that discrepancy can potentially affect the tax treatment of the associated input VAT claim or expense deduction. Supplier onboarding and supplier compliance therefore cease to be purely procurement matters. They become part of tax-risk management. For large organisations dealing with hundreds or thousands of suppliers, that is a significant governance challenge. Then come pre-populated tax returns; The Finance Act, 2026 adds another dimension. Through the amendment of Section 75 of the Tax Procedures Act, KRA may generate pre-populated returns using information available within its systems. A taxpayer must then review, confirm or amend the return within the prescribed 60-day period. At first glance, this may sound like an administrative convenience. It, however, represents a gradual reversal of the traditional information dynamic between taxpayer and tax authority. But there is an important catch; KRA having the data does not transfer responsibility away from the taxpayer. Section 56 of the Tax Procedures Act continues to place the burden on the taxpayer to review, validate and where necessary demonstrate that a tax decision is incorrect. Management must still interrogate the numbers, identify discrepancies and retain evidence supporting the company's position. That creates an interesting new reality: Many businesses still approach tax compliance periodically. VAT is reviewed when the return is due, PAYE is examined around payroll deadlines, and corporate tax receives intense attention during the filing season. That approach is becoming riskier in a data-driven tax environment, where KRA can identify discrepancies through the digital information available within its systems. For businesses, the strategic response should be better data. Businesses should therefore move towards continuous tax-data reconciliation, rather than treating compliance as a filing-period exercise. This means ensuring that eTIMS data reconciles with the general ledger, VAT returns with transaction-level information, withholding tax certificates with declared income, customs records with imports and purchases, and payroll information with PAYE declarations. The objective is straightforward: identify and resolve discrepancies before KRA identifies them. . Companies that invest in clean tax data, continuous reconciliation, stronger supplier controls and proper documentation will be better positioned to operate in this new environment. Those that continue to treat tax compliance primarily as the filing of returns may be overlooking a critical reality: compliance increasingly depends not only on the accuracy of your own records, but also on the quality and accuracy of data generated across your transactions and supply chain. This may also require boards and audit committees to start asking different questions because it is no longer enough for your tax return to be correct. You must be able to substantiate your position with accurate, consistent and verifiable evidence.