Canberra Sentinel deep dive: Wirecard whistleblower Pav Gill

Hello and welcome to this edition of Canberra Sentinel, the podcast. My name is Tom Ravlic. Thank you for joining me for this particular episode. Australia is in the midst of exploring how to refine and improve whistleblower protections. It's recently blown up as part of a parliamentary committee inquiry looking at accounting firm KPMG. KPMG had,

for a period of time, ignored a whistleblower's legitimate concerns about conduct within the audit division. The whistleblower took issues to the firm domestically in Australia, then took issues to the firm's directors, the independent ones, That didn't take the allegations any further. It took it to the international firm and eventually it had to make its way into

the Australian Parliament to Senator Deborah O'Neill who tabled a series of allegations related to the conduct in the audit division. There are a series of those that have been substantiated, including one involving the documents of a client of KPMG's lend-lease being used inappropriately in audit bids. The whistleblower has been the central focus of this case study because the whistleblower sought to claim protection under the law and wasn't given it at various points in time. As someone who understands the dynamic of being a whistleblower, the enormous responsibility and weight that falls on their shoulders as a whistleblower was Pav Gill. Pav is a lawyer who is Singaporean. Thank you for joining me in the first instance.

Thank you for having me. Pleasure. Given that people listening to this won't necessarily So if you don't know who you are and what you've done, what is your elevated pitch to somebody who you met the first time? Who's Pav Gill?

Well, Pav Gill is a lawyer by training who found himself in the middle of what ended up being one of the largest financial scandals in European history. I like to call it a case of two kinds of whistleblowing because I was the head of legal of a German company called Wirecard. And there was a whistleblower that came to me. I was sold to investigate it. I protected that lady. And then once the board found out, the general counsel found out, you know, my life took a turn for the worse. A lot of retaliation company even tried to kill me at the end of it.

And then once I left Wirecard, they still didn't stop. So that forced me to become a whistleblower. So, you know, as someone who was investigating a whistleblowing case forced into a whistleblowing situation himself, um, that's who path Gil was. And today, um, I've tried to put that experience into building my own whistleblowing. And governance compliance company trying to put all that experience into a product that hopefully, you know, if something does happen to me one day, who knows, I've left a tangible tool behind my way of giving back, I guess.

Now, you've come to Australia clearly not simply for the weather. It is winter. What's the main purpose of coming out here at this time? Well, the weather's definitely, funnily, one of the reasons. I'm so sick of the heat in Singapore, which is where I'm from. I'm actually Singaporean. And also, you know, the whole that other half, upper half of the map is pretty hot and burning out. So I'm actually in Australia for a variety of reasons. My co-founder in the business,

he's originally from Melbourne, but he's been living in Asia for the last 10 years. But he's now relocating back to Australia. And yeah, I thought it was a good idea to catch up face to face with him for the next four couple of weeks. And at the same time, you know, I've had a lot of whistleblowers in Australia reaching out to me. I mean, I do get whistleblowers all the time from around, I mean, from various countries that reach out, but I personally didn't know that the situation in Australia was that grave from a whistleblowing standpoint.

I always had the impression that As part of Asia Pacific, given it's like the so-called most westernized country, this would be not that bad of an issue. But the more I've spoken to people here, it's kind of really shocked me that the way the destruction has happened in each one of their lives is something I wouldn't have Just off of the top of my head imagined. So yeah, that's another reason I'm here. And obviously, you know, also in the midst of the whole KPMG thing that just so happens to be going on at this time.

Explain the issue. Well, I guess we need to first explain why I can't. Is a was in terms of the entity, and then we can move on really rapidly to where stuff started to unwind. What was Wirecard?

Wirecard was Germany's pride and joy from a technology company perspective, like a fintech, right? It was pretty much the PayPal of Europe. And it grew rapidly. It started as a company that was processing payments in the vice industries of gambling, porn, and so on. It then evolved into getting listed, doing the whole payment spectrum. And yeah, at one point it was 24 billion euros in market cap. It was bigger than Deutsche Bank and Commerce Bank combined and had a presence in virtually most of the countries on the map. So that was kind of like what Wirecard did, just payment processing, card issuance, merchant acquiring and so on.

How do you diagnose The cultural collapse within the organisation because when people start doing things that are euphemistically naughty, there are cultural issues. How would you diagnose the cultural issues within the organisation when you began to see the decay in the governance and internal controls? Flow through to you?

I mean, it's not easy, but oftentimes I think this would start from a gut instinct based on your experience where you know like certain characters and the way they're behaving seems just kind of dodgy, right? Yeah. But then, you know, what you don't want to do is What I don't think anyone honestly should do as an employee when they first join a company is to start digging against your very own employer, right? While things may not add up, things may not make sense, I think you can just go there, figure it out over time and until there's a smoking gun or there's an objective reason for you to just kick off your,

to kind of like, Qualify your doubts, I would say. I think it's just like that in a lot of companies. And it's very easily disguised in successful companies by them coming across as saying, look, we're a victim of our own success and growth. Like we know things are not perfect. There's a lot of ways we can improve compliance or legal or all these different control functions. Can we just ask everyone to just take a step back because we are growing rapidly. Investors are happy. The country is happy because we are a successful company there. Employees are happy. You're working, you're getting paid well.

So yeah, just give us this time and space and one day we will fix these issues. So that was kind of like the playbook, which Wirecard adopted. But I think below that playbook, that would be Probably bigger issues. The question is whether you're privy to them or not. And that's where information control and access to all these things often fall on whistleblowers to bring them to light. Walk me through how you first became aware that there were fraudulent transactions occurring within the Wirecard network.

On my own, I thought things didn't make sense because all the subsidiaries were loss making virtually, for example, in Asia Pacific. So that was my mandate. I was the first, I was the head of legal for APAC and looking after 13 of the countries around here, including Australia, New Zealand. All of them were like loss making, but yet every time while I was daring, it's EBITDA. Numbers every quarter, they were in the hundreds of millions the same way the more established, mature European side of the business was. So it's kind of like funny because, you know, there will be an internal running joke.

Like we didn't know sales were selling so many products. So I guess the sales team was very happy. But we just didn't understand, like, where were these figures coming from? So those were one of the more objective, I would say, red flags. And Wirecard was always filing their financials one and a half years late after a couple of warnings from the regulators. Why was this happening? Were the auditors raising issues? If so, why hasn't this been addressed? I mean, addressed. But then I would say the turning point is when a whistleblower came to me from the finance team. And she said she's very afraid of her life.

She doesn't want to carry out illegal transactions anymore. And she sought my assistance and I guess to some extent protection in how to move forward. So that was when things took a turn. So someone in the finance team with a conscience basically highlighted the fact that they're There was some creative accounting going on.

Yes. All that term entails typically in the pejorative sense, people were cooking the books. Yeah, that's what it came across. I think often in these whistleblowing scenarios, when you first speak to a whistleblower, you get such an info dump. That's got a mix of emotions. It's got a mix of lack of clarity. Yeah. And a lack of, I would say, order is what they're trying to tell you.

So the only thing you can say is, okay, okay, slow down, just try to tell me in simple words, give me all the evidence that you have, right? Because at the end of the day, anyone can love accusations, but investigations kind of Go better if there's objective underlying evidence that you can work off, like, you know, whether they are fake contracts or invoices and stuff. So she was providing me with those things and whatever she provided me with was sufficient enough for me to get the go ahead from headquarters from legal and HQ to. Engage a law firm to actually look at these things.

So I was given access to 85 gigabytes of raw inbox data for some of these suspects. We're talking about the head of finance for APAC, the VP accounting and controlling, which was a main suspect who's currently on Interpol. He's on the red notice and a couple of his sidekicks. So what we found was very, very mind-blowingly obvious. Like, you know, some of these guys were just emailing logos to themselves. And putting it on invoices, creating fake contracts. To give an example, one of the companies was called FlexiFlex, which is a, I mean, it's a very sexy name if it's a gym or something to that extent,

but it wasn't like anyone that could check FlexiFlex would see it's a piping hydraulic hose pitching company in Malaysia. So why is FlexiFlex in Malaysia invoicing a Wirecard Indonesian entity? For payment services, right? To the tune of 1.5 million euros, which again, you don't do out of Malaysia. So it's just these kinds of very mind blowing things, which internal audit could have picked up, which anyone who had a Google search could have picked up. And frankly, I was quite unimpressed because I thought if there was like major fraud going on, I would have visualized something that was more high level, like a bunch of guys with their shirts,

their shirt sleeves up and their ties down in a Silicon Valley Wall Street setting, really devising some complex things on how to fake accounts instead of doing basic accounting fraud. So that was the initial kind of sentiments that I had when I looked at that stuff. We've spoken about the whistleblower that came to you and the need for evidence and things that are concrete in terms of getting at the issue or getting at the series of issues that were unfolding in Wirecard. What happened when the heat started turning up on you when you began looking more closely?

Yeah, so what was interesting was the approach that was taken. Which is to get the external offer to look at this, to look at the data and the evidence. The reason why that was decided as a route or the course of action is because what I was told was it's better if an objective third party. Looks at this evidence and creates a report. So in that way, there will be no allegations that PAF doesn't like the finance guy or so and so. It's not political, right? The company will be forced to act on this third party. So that was kind of the approach taken. My immediate concern was to protect the whistleblower.

So I actually gave her the name Bobby because I didn't want people to know who that person is, whether it's male or female, and the first priority It was also to get Bobby's statement in writing as much as possible so that that's locked and kept away and then she can go on live as per usual. Because the initial capture in a whistleblowing scenario Even within companies, it's the most important phase because, you know, people get freaked out at some point. They don't want to give you any more info or they withhold stuff or you didn't get that initial thing that was enough for you to carry on investigation.

So that's why that was like the focus. What I didn't know was that the general counsel didn't know that this thing was happening, even though I was always told that she was aware. So one day when Bobby was freaking out, wanting to go to the regulator, the police wanting to resign and all that stuff, I had no choice but to call the general counsel and tell her that we need to manage Bobby. Otherwise, things will get out of hand and we start to lose control of the process. And that's where she said, I have no idea what you're talking about, but you can send me all the material that you have.

So I sent her the preliminary report by the law firm. What she did is, I mean, the preliminary report was pretty damning. It had like 12, 13 offenses in there, you know, money laundering, accounting fraud and all that stuff. She took it and she ran to the board and said, do you know what's going on? And that's where things suddenly took a turn for the worst. The board, you know, Jan Marsalek was the COO. He's the most wanted man in Europe now, allegedly a Russian spy for the last 20 years. So he said like he wanted to take over the investigation. The problem is he's a person of interest.

So my difficulty was how do you tell the second most powerful person in the company? That they can't investigate themselves because they are a person of an interest, right? But I had to do it diplomatically anyway, right? I'd say it wasn't a great idea. You should keep it objective. But the companies, the company, I mean, Wirecard was quite intelligent. So what they said was, okay, should we change the law firms? But then if we change the law firm, it looks kind of suspect. But now that the law firm has picked out all the holes in the business, let's continue help getting them to do that.

So we know where all our flaws So use the law firm to do a gap analysis on all the holes that's exposing us so we can go fix it. So that was the approach they took. But in the meantime, I was being intimidated. The local director in Singapore would shout and scream saying, if you know what's good for you, you'll play ball. When that didn't work, they tried to create a fake Kind of like me to HR case against me that apparently took three months to investigate when that didn't work out as well. That's where the company got kind of desperate and they decided that they want

to send me to Jakarta on a business trip, which had no real purpose. Um, and then I got a couple of miss, uh, tip off calls from some, some, some folks in Germany on my landline saying, don't go, you won't come back. Um, and that's when I didn't want to go when the company was extremely happy because finally, after so many months, they've got a business reason to fire me, which is I'm not going on a business trip.

Um, How did you preserve your sanity during that period? Because the psychological pressure on anybody in that situation is always great. What... You knew you had something to be right. You clearly, as with other whistleblowers, knew you had to see this thing to the end. How did you deal with it psychologically?

Because that is always a killer in terms of focus. I actually don't know. It was like, I do know it was very difficult at that time because on one hand, you need to not get emotional about the crazy stuff the company is doing, especially the HR issue, right? Like, I mean, that's like the worst way to damage anyone who's a male. It's so easy. It's so horrible to come up with these Sting to completely discredit you, not only professionally, but as a person. So I think that was the hardest thing to deal with. And also obviously your colleagues knew what that didn't make any sense, but because you are a lawyer and you have been investigating what's happening,

you can't even confide in anyone. Because it's so sensitive, it's privileged, it's not like you can shout and say they're doing this to me because I found out they are fraudulent, right? So it's very isolating in that way. And you also don't want to be in a situation where that impacts your work because then that's a great reason for the company to want to fire you. You're suddenly underperforming, maybe you're very stressed, you need a break. And so on. So yeah, I mean, it was challenging. One of the strategies that the local director adopted was extremely evil on hindsight. So he would ask me to see him every Thursday.

And he will say, look, I've got an update on... The situation, including against you. So I was like, okay, and what is the update? Then he'll say, actually, I'll tell you next Tuesday. So that just kept going on and on. And that way, he knows that Friday comes, the weekend comes, and then even Monday comes, you can't even sleep well because you want to know what the update is. But then it just keeps going on and on and on. So that was one of the ways they tried to mentally destroy It's a form

of intimidation, isn't it? Yeah. I mean, I didn't even understand what his issue was because to me, I told him, look, I'm actually trying to save your job. You're a director of seven different companies in the region. If anything goes wrong, shouldn't you be grateful that I'm trying to save your role as well? How did it, and obviously eventually it started as some of these things always seem to, the company doesn't fix the problem quickly enough. A little bit of assistance from the media comes in handy. How did that unfold? How did that unfold?

Yeah, so that's where, you know, after I left the company, they were sending people to follow me and my mom. My mom's a single parent. I'm the only child. We stay together. It was at this point my mom actually got upset. She said, you know, the company is not letting us move on, not letting you move on. You're the sole breadwinner of the family. Enough is enough. I'm going to teach this company a lesson. I was like, what do you mean you're going to teach this company a lesson? She said, it's all right, just leave it to me. So what? So she did, right? So funnily, you know,

the moral of the story is don't upset moms, I guess, where their kids are concerned. But she went to make friends with Claire Brown, who's the journalist that exposed One NDP. And Claire said she knows the Financial Times has been working on Wirepart for the last five years and getting nowhere. So Claire put us in touch with DFT, and one day I came back as part of my job search efforts, and my mom said, look, we are going to meet DFT this weekend. I was like, what do you mean we're going to meet DFT this weekend? I don't talk to journalists, I'm a lawyer. She's like,

it doesn't matter, you know, the athlete's been working on Wirecard and they are reputable British paper. They will definitely protect their sources. Let's at least have a conversation with them because what we need to do is twofold. One is we need to force Singapore, which is a country that's hypersensitive to foreign press reporting about wrongdoings within the nation state. So if the FT publishes something, then Singapore will A, be forced to act, and B, Wirecard will be fighting fires instead of turning their attention to us. So that was the rationale behind it. And then I think that's also very important because people would say, why didn't you go to the police?

Why didn't you go to the regulators and all these things? But I think practical issues where those two are concern is one, you can go to a police station, but you end up exposing who you are. And similar from a regulatory standpoint, you could file something on their website, but. Like the police, you have no idea if they'll just fight it away for the next few years or what's going to happen. Or they wait for something else to come along to corroborate what's been said or whatever. So the fastest way was the media. That was the approach.

Sometimes, as most people find here... In the case of the Commonwealth Bank there were a range of issues happening where people who sought loans were being poorly treated by the bank and there were people who were working in the bank who were not ethical and somebody decided to expose this and they weren't treated particularly well by the bank at all. Including a whistleblower by the name of Jeff Morris. But he then went to the media at the suggestion of a senator, John Williams, from the National Party, and Adele Ferguson, who you may have heard of, Rambled the story and it became a runaway,

let's call it a runaway success because it ended up causing a royal commission in this country after some years. What then happened? Yeah, you've done all this, you've spoken to the media, it's blown up and the company will and truly has egg on its face. What happens after that? Yeah. So, you know, the FT after four months of speaking to me, gathering evidence during their investigation, they published their first article. What was shocking was the reaction from the German regulators. They immediately said on day one, this is not a wire card problem. This is a short selling problem. So they started going after the FT.

They started going, saying it's short selling. They said this, even if it is somewhat a wire card problem, it's an Asian problem, not a German one. So it was very strange because you would expect regulators to write to say the usual script, which is, oh, we understand allegations have been made against one of our list of companies. We're looking at them until then. We have nothing more to say on it. You couldn't expect them to go out and straight away say there's nothing really. Wrong. It's probably not a Wirecard issue, right? But that's what they did. They then banned short selling on Wirecard stock for a few months, which was even crazier. And, you know,

that's when I realized that I needed to change the perception from within Germany. And that's when I got this to come down. As a paper DSZ. And at this point, my mom had a stroke because she was so stressed. And then as part of the stroke scans, they found out she has stage two lung cancer to cut off half a lung. So it became very personal and I thought, you know, I now need to see So the asset came down. I gave them even more information that I didn't give the FT because initially I didn't really know how much to trust them.

They published their first piece. It shook Germany. I then went on Twitter and I created an anonymous profile. I started posting things there anonymously. And again, like all this while I was anonymous. So that's very important, right? I was anonymous behind the scenes. Companies suspected it's probably me and maybe two, three others. In fact, the company even paid a investigation's outfit to go and track down who the whistleblower is. But the investigation outfit gave them the wrong person, which I thought was quite funny because that was two, 300 grand wasted on that. Yeah. So then finally, after one and a half years, Wirecard crashed.

But it was very difficult because, you know, SoftBank threw in a billion dollars into Wirecard. No one was questioning, really. The company was just smokescreening and navigating its way through. Stock price kind of recovered. And yeah, it was very difficult for me to sit behind a desk while still having a job. To see this true to the end, but it happened, right? So after one and a half years, the company finally crashed. They couldn't find 1.9 billion euros that Wirecard claimed it had as profits. And that was the first time a German DAX listed company collapsed overnight. And yeah, the trial still going on.

People are still on the run. And yeah, it's one of those tales of Of how, you know, frankly, everything could have been avoided from a Wirecard perspective if they just didn't go all the way in upsetting employees or whistleblowers who were just trying to act in good faith. It seems like an age-old story, doesn't it? The cover-up is often worse than the crime because people don't want the reputational damage which then comes anyway because things that happen within walls end up going outside those walls if the leaders of an organisation fail to address it. Before we go talking about government,

it's probably timely to share this little insight from an accounting firm. Again, KPMG, back in the day, a former partner like Ken Spencer used to say to me, whenever there was a problem in the business world, in the accounting world, he would say, Tom, the problem always begins at home.

The problem always begins at home and all the things that are done to try and keep things quiet or manage appearances happen because the problem began at home to begin with. You found yourself in the middle of a situation as a whistleblower, a And it's probably prudent for us to talk about what you're now doing to try

and create a situation where people can report more easily and with greater protection. Talk to me about the concept behind the company you've set up. Yeah, so I came out publicly a year after the company crashed, after Wirecard crashed. Yeah. Again, like, you know, I was anonymous. I also want to tell, I want to make clear that Wirecard is a very rare case of successful whistleblowing as well. Most of the time, that's not the case.

You know, whistleblowers get identified and destroyed in the process. And so I went on, I became like this keynote speaker globally, like, you know, regulators, banks, big companies asking me for My experience, which was kind of unique because I'm also a lawyer. So I've also, you know, it's not normal for lawyers. They've got all these like confidentiality, privilege kind of things attached to them. And so I think people were very interested in, from a governance standpoint, what were the gaps? What were the learning points? But then I realized, like, instead of always just talking about it, why not put it into a real kind of like You know,

tangible software, because what I found in the market was quite interesting as well. Like all these whistleblowing solutions that existed that people like to say they have. So firstly, companies like to say they have policies, right? But I think by now it's obvious that policies are kind of like meaningless per se, because you could just chat GTT out of policy or whatever, but how are you operationalizing it? And then they were like, okay, fine. We don't even, we don't have just a policy. We got a hotline, but then That's fine. It's still a receiving channel. Anyone can spin up a receiving channel and call it whatever they want.

That's just what I call a glorified inbox. Things actually go wrong after that. So receiving The case or the issue is not a challenge. The challenge is what happens in the next 48, 72 hours. How did a company deal with the issue? Is there an audit trail? Is there a way that the company can defensively say it acted? Who had access to what? What evidence was collected? How was it resolved? Where did it stagnate? If so be it, for example, if you couldn't get more information. So that's where I found the gap in everything in the market. And that's when I founded Confide and,

you know, Confide went to market as the world's first end to end whistleblowing software because we didn't just focus on receiving, but we empowered the companies to be able to then conduct the investigation from start to finish on the platform itself. So then that way, no matter what happens in your business, you can see how something started, who dealt with it and what happened at the end, which is the exact issue most companies face. So Confide. Correct me if I misunderstood this, but a confide receives the initial complaint or the initial account from a whistleblower. And that becomes the first entry in the organisation's investigation or interrogation of a set of facts. It's effectively a complete audit trail rather than somebody complains

about something or brings something to the company's attention that sits in the mailbox. And then from that mailbox, it goes into another internal process that then has to be acted on. In one case, a whistleblowing report service is simply a megaphone. A megaphone, for want of a better term. But in the case of confined, you've set up a workflow to deal with the problem within the confines of that platform. I would imagine that the platform would have to have a degree of encryption to it and a deal of security attached to it. Am I correct?

Yes. So to be made clear, it's a software for companies to run on their own. However, they could always outsource access. To us, if they want that, like, for layer of independence, or they could outsource it to a 3rd party law firm or audit firm or anyone else that's a that they trust to receive the level 1 cases and review them. Um, because there's always independence requirements every now and then. Employees might feel safer if they realize the person that's receiving that case is not from the company. But this is getting up to companies how they want to set it up.

What we are trying to solve is the broken, the fragmentation, right? Because if you don't have an end-to-end kind of solution like ours, you only have a receiving channel. Then you have when things go wrong, everyone's scrambling around trying to figure out who was involved, what happened. And then you're dealing with he said, she said you're dealing with conversations that may be on Slack, on Zoom or all these things. It's just kind of like a broken data process that's very annoying. And yeah, you know, I mean, so every step that you're taking, it's being audit logged. You have to stand by it.

Even if you leave the company, it's historically already there. So that's kind of like what we started with. But now we've kind of like expanded into like grievances, you know, oftentimes grievances going to whistleblowing channels, but they're not whistleblowing. They're just like employee disputes or harassment, discrimination kind of issues. Yeah. How does it help? How does Confide help when it comes to pulling together material for investigators, whether it be a law firm or whether it be at a local police service? Because it... From what you've said to me, it's been designed so that it captures every element of a particular incident or series of incidents. Things can be linked.

And it strikes me that having everything in one place makes it easier to provide evidence to legal authorities, law enforcement, should it be necessary. Yeah. Was it a part of your thinking and setting it up the way you have? Yeah, but it came at it more from a B2B, kind of like company's defensibility standpoint, right? Because, you know, you always, as a company, need to be able to show that, to defend every action that you're taking and to have that logged or demonstrated. Okay. Otherwise, say if a regulator just suddenly one day asks you how many

Non-financial misconduct cases, did you suffer as a listed entity in the last say 18 months? That's a huge headache if you don't have a confide because now you're like, okay, who was involved? Okay, was it HR? Like HR, how many cases? And the HR needs to go manually count those cases. And then how will they resolve? What happened in them? What actions were taken? Whereas if you have a confide, you just go in there and you just literally type out the prompt. And then you can include what you want in the report, including the evidence. You can export it out to PDF, CSV, presentation style. So it's kind of like three-dimensional in the way.

Yeah, I get that. Because today you've got all sorts of ways in which people communicate, be it via email or encrypted apps or the phone. Some people still call. Video conferencing like we're doing now, recording this. Yeah. And then finding a way of bringing all of that together in terms of one source of one undisputed source of evidence for an entity to be able to present to whichever regulator that appears to be. Yeah. Good. You've been very generous with your time this afternoon, and thank you for that, but there are a couple of other issues to explore. We've looked at the challenges an individual whistleblower faces,

the challenges a whistleblower listens to whistleblower faces in your case, and Governments have an important role in setting the tone, whether it be through legislation or whether it be through mandates to regulators. You've observed a range of things over your time in your career, whether it be as a lawyer or whether it be within Wirecard or given your responsibilities there or more generally now. What are the most important things for governments to consider when they are looking at how to improve the conditions for whistleblowers to be able to report wrongdoing that they see within an entity?

I think the EU has done a good job. With the directive, the whistleblowing directive, because that kind of reverse the burden of proof onto the companies now. So now companies need to prove they didn't retaliate. So that's one. It also kind of like expanded the scope to Not only employees, but in contractors, vendors, interns, spouses of employees and so on. Are you seeing that as a bit of an issue? Technically, I think in the KPMG Australia case where there's like the audit side, the consulting side, the corporate services side, everyone's regulated by different entities and so on. From a whistleblower standpoint, you just see KPMG as KPMG.

You're not going to get into the intricacies of the different units. So don't put that burden on the whistleblower. And also, I think most importantly, like any regulation, that it needs to have teeth. So it needs to bite severely. And I think the general problem we have not only in the whistleblowing space, but in corporate crimes or financial crimes, white collar crimes, is you just see fines happening. That kind of like don't damage a company so much. In fact, I know companies that actually have a budget for fines. You know, like in crypto and all these different industries. So they're like, yeah, don't worry.

We've got a budget for all these regulatory sanctions. They'll just pay them when it happens. So if you have regulations like that, they don't really work, right? Even if you have a whistleblowing protection, a protective act, you need to have that act really demonstrate what happens If you breach it, like because you are destroying lives of say bonafide whistleblowers. Now the commensurate sanction on you needs to be also equally harsh, ideally, but a lot of governments don't like that. A lot of countries don't like that. They're like, why do we want to increase compliance burden? We already have so many and so on.

And there's this kind of like There's this assumption that, no, but we have so many government agencies and avenues you can report to. That's true. But then how are you going to protect the whistleblower? Because that person is an individual. It doesn't have the resources the same way an organization has. So an organization, if they identify the whistleblower, they can sue the whistleblower. You can... You can have a defamation suit. You can have all kinds of your life. You've been just totally destroyed before you even go to court in order to prove your case. And I think what's more important to pose out the point is 2026 now.

And this is the age of deepfakes and AI. There's nothing preventing a company to utilize certain technologies to then say that you were part of a scheme or you signed off from this and that. And then do you have the resources to forensically prove otherwise, for example? I mean, these things sound like fantasies, but if you think But why it was faking documents and all that stuff, right? There was nothing preventing them from forging stuff about me either. So you may think as a whistleblower, you have the truth on your side and all that stuff. But do you have the resources to go prove that?

I think that's the gap that governments should try to address. What would be the best way to deal with that gap that you've just highlighted in terms of resources? Government agencies like whistleblower protection agencies, you know, bodies that are set up deliberately to help whistleblowers through the journey? Is that an answer?

I don't know, really, because I... I mean, I'm still business minded and practical in that way, and I try to understand all sides. So if you set up like an autonomous agency, I don't know who's going to be running that agency. Would it be deemed as apolitical or is it going to be political one way or another? I mean, these things do impact outcomes as well. And then do you really want an autonomous agency looking Being that point where employees from all companies could be leaking information to, I mean, not all whistleblowers are clean, right? You have those that are trying to blackmail the company,

those that are trying to teach them a lesson and so on, or just expose them in some way for whatever reason. So I don't know if that kind of body is there. It's going to solve the problem. I think what's going to solve the problem is really a protective mechanism where If a whistleblower can say, look, in good faith, with clean hands, I'm here trying to raise concerns to you, government agency or enforcement agency or regulator, whatever, this is what I'm doing. This is what has happened to me as a result of it. The company is still doing it. That's why I said, is there a way you can protect me?

That could be funding my legal costs. That could be... Just helping me out neutrally in some way. I don't know. Like this is one of the things I actually don't know. I know Japan's pretty good now because the recent amendments that kick in, they have made significant amendments to their whistleblowing act. They're kicking in in December this year. They have kind of tried to go towards the behavioral side of things, but they have tried to address or criminalize or Attack trying to unmask say a whistleblower unnecessarily and punish companies for doing that. And they have also kind of put into place an assumption or presumption rather that

if a whistleblower that raises something that's in the public interest is fired within the first year, then the company also needs to prove that it wasn't done because of the whistleblowing. So it could be things like that. I don't know. I mean, it's a complex situation. The US has tried to fix that with incentives that can be very high. I don't think that's a solution either. You don't want to pull people out of companies in order to solve problems that are within the company. You still want to give companies a chance to do so at the first stage.

So yeah, I think it's an evolving complex And also depends on the country itself and the cultural elements there. That's true. So one of the main things that we've covered up on in terms of penalties and culture is to actually have a serious financial or other kind of penalty that can act as a deterrent to companies who are intent on misleading the market and victimizing a whistleblower.

Yeah, I think that these are bad actors, especially if they maliciously try to destroy an innocent life. And I think those acts have to be investigated as well. So it's not about investigating allegations that a whistleblower is saying only. But if that was retaliation, there needs to be a consequence for that. Because a lot of times in companies, people like to bandy around and protect the company against that so-called troublemaker, which is the whistleblower. And then in that process, people get carried away. They start to do pretty crazy things in their mindset, show value to the bosses and the company. That they are now like, you know,

so passionately protecting the firm that they're getting, you know, they're going out their way to get rid of this so-called problem. And the problem is often a human being. So, you know, that kind of acts need to be taken a look at as well and punished accordingly. I guess the one final question, which is, We've covered a little bit on, but I'd like to practice some. In terms of confide, how is it going at the moment in terms of talking to people who take it up? What's been the vibe?

I mean, it's good. Like, you know, we only launched two years ago. We've gone over 50 customers globally, from the Baltic teams in the UK to energy grids in Europe. Couple of companies here. So it's been pretty sector agnostic. I think we are not just a whistleblowing software. That was just the first product. We've got like 10 now. What we are really trying to solve is a data issue. That is the problem which most companies have, which is a broken data process. Companies may be using 10 different softwares for 10 different things, but none of these things are speaking to one another, right? We shouldn't be operating this way.

So what we want to do is be like, You know, we want to link all governance, risk and compliance workflows into one place. And because it's in one place, you can see the connections between cases, events, people, entities, and so on. So if a report comes in saying, I don't know, Tom Jackson, your employee tried to bribe me, it straightaway flags Tom Jackson was two years ago in a grievance case. This is who the vendor is because it's been onboarded through the vendor risk module. Tom also declared a conflict of interest saying this is his wife's cousin's company and so on.

So I think that kind of intelligence of three dimensionalizing cases and instances is where we see the future in this space. I've been talking to Pav Gill, the whistleblower, who is at the centre of telling the world about Wirecard. He was with the internal legal team at Wirecard in the Asia-Pac region, based in Singapore. He's also the founder of Confide. Pav, thank you so much for explaining that to the audience,

and I hope things go well with Confide from this point on. Thanks so much. Really enjoyed the chat.