I would put my trust (not literally) in Citi on this.
The banks have done nothing to debunk Citi's findings besides the fact that creative accounting is usually so complicated as to require forensic accountants to unearth. The CBK's main supervisory tool in this battle is 1) Returns and 2) Audited financial statements. On returns, they are usually so simplified that only a very dedicated analyst will want to examine the detailed schedules supporting the numbers. Analysts have targets on the number of returns they are supposed to turn around in say a month and therefore may not be interested in details.
About audited financial statements, audit firms are known to prefer promoting staff who do not raise many audit issues, meaning that the bright sparks exit audit very quickly. The reason for this surprising preference is that the less questions/matters arising/outstanding issues there are, the more likely that the client will settle audit fees quickly and the audit team can move on to other projects.
Many financial statements including those of banks are therefore audited and signed off by hacks who feeling nothing about sweeping outstanding issues under the carpet. The message is simple, if the auditor refuses to sign on the audit report, management will find someone else who can. The result is audit opinion based on the minimal assurance that the auditor can get away with- then cover his ass with a management representation letter in which management basically puts its neck in a noose. The problem in Kenya is that investors never take enough time to understand companies they invest in and their operations. When that day comes when the investor wakes up, those management representation letters will hang the CEOs but the auditors will hide under them. As I keep on saying on this forum, trust audited financial statements at your own risk.