Episode 9: Inside the Wirecard Whistleblower Story

Hello and welcome to the new episode of Nordröhr's Full Price podcast series, Inside Investigations, in which our global investigation team discusses various aspects of corporate compliance and internal investigations. I'm Charone Oded and I'm heading the investigations enforcement and compliance practice in our Amsterdam office. With me, Jesse Steinebach, who is an associate in our Amsterdam investigations practice. Today we're getting a rare glimpse into the mind of a whistleblower.

Uncovering the story behind one of Europe's biggest financial scandals, Wirecard. Imagine a company that started as a small payment processing startup in Germany and quickly became a fintech giant, valued at over 24 billion euros and upheld as a European success story. Yet beneath the surface was a shocking truth. Pav Gill, a former Wirecard lawyer, courageously exposed a 1.9 billion euro black hole in the

company's finances. His discovery brought down Wirecard and sent shock waves through the corporate world. Jesse and I are thrilled to host Pav Gill dive into his personal journey and learn about what it takes to confront fraud at the highest levels. Pav, thank you very much for joining us today. Thank you for having me. So Pav, let me start at the end. Shortly after joining Wirecard as a legal counsel in Singapore,

you learned about potential irregularities within the organization. It was one person who came to talk to you about that and you decided to escalate it to your direct manager. This escalation to the direct manager, who was the deputy general counsel of the organization, was probably the event that at the end of the day changed your life, personally and professionally. Do you regret doing that? No, not at all. Would you do it differently if you could today with the hindsight? No, I don't think so.

Okay, let's go back to the beginning. So you joined Wirecard in September 2017 as a legal counsel from private practice and then six months into the new role you were brought by a colleague who wanted to share some concerns with you. What did she report and how did it go from there? Yeah, so Wirecard was the second in-house rule that I had pretty much and it was the head of legal role for APAC Asia Pacific. I had an employee from the finance team come to me

in confidence because she was afraid of for her life and she did not want to carry out certain kinds of transactions, which she deemed as illegal transactions any further. What kind of transactions did she tell you about? What does she have to do? She effectively described a series of round-tripping transactions where Wirecard, different Wirecard entities would be transacting with unknown third-party companies and booking those transactions and customer relationships under the accounts receivable

section of their financials. And then why was she scared for her life? Because she was of the view that the people that she was accusing, which is pretty much her direct was Ido Kurniawan, an Indonesian male. She was afraid that he and whoever was giving him instructions from Germany would find out that she had read it on them or told me about what they were up to and she didn't want to suffer any repercussions or consequences from them.

Other than that, were there any other red flags or anything else which you consider to be irregular? Yes, the company had a very lean corporate governance structure. They were missing board minutes from executive board meetings. There were very few legal and compliance staff, a total of 13 when I joined globally. There was a very, very small internal audit team, I think that pretty much two employees at one point when I was there. And you had characters like Ido who would always be on a flight dealing with finances of the company,

but yet telling everyone that he was married to a drug dealing family in Jakarta. And to make matters worse, all the financial statements for each entity were being filed one and a half years late after a series of warnings from regulators. I mean, these were just examples of red flags that were far in many. So in addition to that person who spoke to you at that time and yourself, do you believe that others within the organization were already aware of those red flags suspecting questioning the situation? Well, subsequently, we came across

in our investigations examples of how people had raised concerns and were forced out of the company, particularly accountants in the finance team. They had raised issues, for example, saying that Wirecard Singapore was technically insolvent, and they were then managed out through HR processes out of the company for being deemed as troublemakers. So those individuals have essentially blew the whistle internally, but none of them took it further and discussed that with either the media or authorities to your knowledge. Yes, not that I am aware.

So you shared your concerns after listening to that employee who shared their concerns. You shared your concerns with your direct boss, which was the deputy general counsel at the organization. What was the reaction? He told me to gather as much information as I can from the whistleblower internally and create a presentation for him to look at when he comes down to Singapore, which is where I was based, two weeks from that date. And when he did come down, he saw the presentation, he said, I was very serious. He then said, let's engage an external

law firm to look at this information and to carry out a fuller investigation that would be deemed as objective and independent and also credible, which would then result in the company being forced to act on these matters. So what did the investigation refuse? Well, the preliminary report and findings of the investigation from a law firm called Rajentan had a laundry list of offenses listed out of potential offenses ranging from forgery to round tripping, money laundering, risks, suspicious transactions, and just a whole load of other things. So that was all

detailed in the draft. I then took the draft and went to the general counsel to report and understand what next steps could be taken. Because in the meantime, the whistleblower was increasingly fearful of a safety. And what did the general counsel do with reports? Well, she didn't know what was going on for the last six weeks, pretty much. I will always assume that she knew because that's what I was told. It was a bit of a shock that she didn't know. And she said, don't worry, just send her everything that I have so far. And she took

whatever I sent her and went straight to the board and asked them if they knew what was going on. So if I understand correctly, at that period of time, your concerns or at least the initial findings of the investigations showed some suspicious activities relating to, say, an amount of 30 to 50 million dollars, right? Yes. And I understand that the board did not like to hear about the mere fact that this investigation has started. Yeah, exactly. So how did they react? How did you know about the board's approach with that respect?

The general counsel told me what happened in the board meeting. And what followed then? Were you still instructed to complete the investigation? No, I was told to stop investigating and stand down. And one of the board members, the CEO, Marcus, I mean, Jan Marzled, wanted to take over the investigation himself. The problem with that is he was one of the, his name kept coming out in what in the materials we were looking at. And so he was potentially a person of interest. So we had to find a way to make, to raise that concern that

a person of interest shouldn't be investigating themselves. I do understand correctly that management was then concerned about the investigation, but it also took actions to make sure that if there are any other whistleblowing reports coming in, they will be kind of parked with them and not further disseminated within others. Yeah. So Viacard then decided to roll out an anonymous whistleblowing channel. That channel apparently went straight to Jan Marzled himself. And that was clearly an attempt to find out who else knew what and to deal with them accordingly.

So handling whistleblowing reports requires essentially a very sensitive decision making once you get the report to you, right? When the report relates to, or the concern relates to mead or low level employees, then most likely, if it is a severe allegation, most likely the right thing to do would be to escalate it all the way up to management. But in your case, it was the management itself that was essentially involved in the

misconduct or even behind the driving seat of this entire thing. What do you do in this scenario where essentially the escalation goes all the way to management that is involved? Well, you still got to do what your role entails and your job entails, which is to do what you can and to cover yourself in the process of doing what you can. And if that means documenting every step of the actions you have taken and who you have reported it to and the instructions received as a result of that,

then that's what I think any control function should be doing. And you eventually resigned in September of 2018. Could you tell us what led to your resignation from Wirecourt? So during the period of about three months, Wirecourt undertook a series of actions against me, including investigating my work, creating a HR case against me, and finally trying to send me on a one-way business trip to Jakarta in Indonesia.

For which I received anonymous phone calls telling me not to go or I wouldn't come back. And it's only when I decided I wouldn't go for that did the company then have a legitimate reason to force me to resign, which is I didn't want to go for a business trip. And then you left Wirecourt and you were done with the company? Yes, so I then left the company and I went to look for another job. But during this process, Wirecourt still sent people to follow me and my mom constantly and they were creating fake job interviews where the interviewers

would only be interested in why I left Wirecourt and not so much as to my skill sets and the rest of my CV. And then I realized why they were doing that is so that I potentially could breach an NDA or some kind of confidentiality agreement. And then they could, you know, create a lawsuit against me and just continue to make my life difficult. Management didn't like the fact that you find out what you found out that that sounds like a very clear conclusion. They also didn't want you to continue with that. And because of that, they

decided to essentially make you go. Were you offered any payment for silence? No. So they let you go or they made you go, but they didn't see the end of the story there. You say that they continued essentially harassing you and your mother. Why would they do that? I don't know. I mean, I have no idea. Was there anything that you had that they wanted in addition to the fact that you knew about the story? No, but it just could be an ongoing kind of scenario where they are letting me know that

even though I've left the company, I'm still being watched. I have no idea. I can only come up with theories as to why they did what they did. But because they did what they did, it eventually forced me to whistleblower. So essentially from a whistleblower, a lawyer at a company, international successful company who does his job, you find yourself being harassed and pursued by the company that you worked at. Do you understand correctly that when you left the company, you took with you some of those mailboxes, including your own,

the mailboxes that were used for the internal investigation? Yes, that was what I did. And why did you do that? Well, I did that firstly to protect myself. I needed my correspondence and notes. And if I had not taken my own inbox, for example, I would have lost complete access to that or it could have been modified in some way. And similarly, Viacard was in the habit of forging documents and creating stuff. So I needed some kind of objective forensic data with me as a shield, not so much as a sword,

or something to profit off, to protect myself in the event something blew up. And also, of course, I still had some inclination to decide what to do with it. Should I go to the police? Should I go to the regulator? Should I expose this company? So all these things factored into why I did that. So that's a very interesting point. Can you take us into your mind in those days where the stress is high, you just had to resign? If I understand correctly, there is no one

to trust around you because you never know who is playing with whom. You're taking a set of electronic data with you, which essentially proves the bluff around this huge, apparently successful organization. What goes through your mind? What are the considerations? What are the options that you're considering? Yeah, of course, as a lawyer or any kind of employee, you shouldn't be taking company data out of the company. But this was a very unique situation because of what the company had been doing to me. For example, trying to discredit

me and ruin my career, potentially start rumors in the market. So it was an ongoing assault, pretty much, and I couldn't be a sitting duck. I needed to have something that I could defend myself with, or even at some point use as a sword, which is what effectively happened when I decided to whistle blow against the company and expose them for what they were doing. So in that way, from what was effectively a shield, a defense mechanism, the data, it ended up being something I'd used to now attack the company and distract it

with bigger problems and fires that it would now be forced to deal with, and instead of coming, continuing to arrest me and my family. And this is how essentially the information and the knowledge that you had about the misconduct within Wirecard ended up with the financial times? Yes. So I gave the FT about 70% of the data. And what did you wish to achieve by that? Well, the financial times is a reputable paper,

and I knew that if the FT were reporting on Wirecard and certain misconduct that was happening within its Singapore office, for example, that would force the Singapore regulators or authorities to act. And that's exactly what happened. So that was a strategy in mind. It was the quickest way to get enforcement action on this company and have people looking at it from multiple angles, not only in Singapore, but in Germany and the rest of the jurisdictions it operated in. Do you consider going directly to the authorities or to the police

because you were being harassed or people following you? Do you not want to take the evidence you brought directly to those people? Yes, but I didn't want to expose myself in the process. So contacting the financial times essentially allowed you to stay anonymous? Yes, because from what I understood, the FT would not expose its sources. And your identity was revealed essentially only in 2021, right? Sometime later. Why did you decide to go public with your identity? So a year after the company crashed,

I was involved in the production of this guy documentary on Wirecard called Wirecard The Billion Euroli. And that documentary was being released. So I decided to control the narrative if I wanted to. I should let everybody know on the day of its release that it's me. After all, the movie itself would be doing that. So I told the Financial Times and Sudraesh's iTunes and also the build that you can finally tell everyone who is and that everything went out

on the same day. So in parallel to the Financial Times, you also prepared a pack of evidence which was crucial to understand the background of this scandal and file that with several authorities. Yes, so that was prepared together with the reporters of the Financial Times. Yeah, and it was created to be a dossier that was mailed out to various regulatory bodies and enforcement agencies and also external auditors. So that was mailed out right before

the articles went out. The first articles went out. Did you receive a reply from any of the authorities? No, because it was anonymously sent. Have you ever considered sending that same material to the authorities but without going to the media and keeping yourself essentially anonymous until today? No, because once you go to the authorities you have to, you are going in person and you are revealing who you are. But in this specific case, you first submitted all these

documents to the authorities anonymously, right? So one good thing, I'm essentially trying to understand whether this crossed your mind as well. What's the role of the media here and why is it needed? While we're talking about financial crime, the relevant authorities to deal with that are known to you in the relevant jurisdictions and you in fact contacted them. So I'm trying to understand what are the considerations that a whistleblower would take into account when

deciding also to expose such a story, knowing that the same company was already or at least a management or somebody within the company was chasing you up to the level of life-threatening. Why going public with that? There is no control over timelines. For example, if you go to authorities, they could file the report, they could put it there for a few years and decide not to act on it. And all this time you're just sitting around wondering what to do or will this happen? Whereas with the media, once the media starts publishing stuff that

forces multiple actors to start to look at the company, from market participants to shareholders, to regulators, to licensing bodies, auditors, everyone. So all the focus goes on the company because of the media attention and that really accelerates the entire process. And that was the reason why the media was chosen as the fastest and most efficient way to get Wirecard off the back of me and my family. And instead of for you, time was of the essence,

right? Because essentially during that time before you contacted the newspaper, you were harassed. And that was, if I understood correctly, one of the main reasons to actually expose the entire thing. Yeah, and I think what's also very important is the fact that time was also of the essence given the fact that Wirecard already knew what the contents of the investigation were when I was in the company. So every day that passed gave them the opportunity to

erase that evidence or modify it or create even new documents to justify some of those things. So there was also that time pressure to make sure that the company would not have that much of a leeway and leisure to fix a lot of these things. And then so you went through the financial times, they started publishing. What happens after they take us through the next timeline? Yeah, so they published their first report on 30th January 2019. The German regulators came out and

say it's not a Wirecard Germany problem. It's a short selling problem. It's an Asian problem. And they then decided to ban short selling on Wirecard stuff for a few months. I then realized that for some reason, all the powerful authorities and enforcement agencies are not acting other than Singapore that raided the company within three weeks of the first FD article. I then decided to go on Twitter and create a profile. And over the course of the

next couple of months, I decided to also get German papers involved, which is why I reached out to Sundoises Aitou, who then flew down to Singapore and I gave them even more data and then they proceeded to look at it and publish as well. And if I understand correctly, there was another auditing review that was done, which was kind of the final knockout to the life of this company. Yes, so shall hold the pressure eventually forced. Mark has grown the CEO and whoever was in the

decision making process with him to engage KPMG to do a special audit. That audit took several months and eventually together with EY, the existing auditors, Wirecard, I mean, they could not be determined whether Wirecard's declared profits of 1.9 billion actually existed or not. And that's how the company collapsed. I went in one of your previous interviews that you felt the term whistleblower is overused. Can you explain that approach?

Yes, because I don't think that raising concerns should have a whistleblowing element to it. It's a subset of whistleblowing if you want to categorize it that way. Just because I raise a genuine concern, for example, if I'm saying whatever code an engineer is trying to release has security vulnerabilities with it, and I'm raising that to senior management, I wouldn't see that as whistleblowing. But yet you have the media and people loosely using that term. And of course,

whistleblowing, real whistleblowing would entail legal protections, for example, in the EU. And what we don't want to do is confuse people who, for example, in an HR situation, because they've used a whistleblowing channel to raise such concerns, believe that they are legally protected as whistleblowers. So I think we need to have a lot of training and education within companies as to what constitutes speaking up, what constitutes whistleblowing, and what also constitutes just basic raising of concerns and requirements of clarifications.

So for the compliance officers among the listeners today, is your essentially takeaway, is that the use of the word whistleblower should be essentially limited? Because from your perspective, the mere fact that we're determining speaking up whistleblower would deter some of potential reporters to actually come forward? Yes, because of the stigma associated with the word

and the gravity associated with the word, I think there are various ways to go about it. If you don't want to call your speak up a whistleblowing channel, a whistleblowing channel, you could call it a suspicious activity reporting tool, a Aztec spotlight, or any of those variations. I think it will really disarm employees, and they would potentially be more willing to use that as a medium to raise concerns that they come across. Any other key lessons that you took from

your journey that you could share with compliance leaders within organizations? I think it's really important to make sure that you look after yourself, and that also involves doing your job properly. Always with the view of what if something explodes or goes wrong, would you be able to stand by your decisions that you have made? And would you have documentary evidence or any kind of evidence that's objective to prove what you've done in the process? Because the last thing

you want to do is be in a situation where you didn't act because simply your boss told you not to act. I don't think that really flies. Sometimes when things go wrong, when things go wrong, so really just look after yourself. It's very difficult, I know, to write as discussed emails. A lot of times when conversations involve gray areas, we have face-to-face conversations, but it's really important to document them as well as the next steps that are then undertaken. What you don't want to be in a situation is again, if something goes wrong,

and even if you did raise the flag, you are told that you didn't raise it seriously enough. You didn't sit the CEO down and shake him and say, no, you can't do this no matter what. He would say potentially that he didn't know it was that much of a risk. So how do you then foresee and navigate these things without being thrown under the bus or exposed in the process? I think it's really critical. Perhaps a strange question, but if you had the opportunity to put one question to the former CEO of Wirecard,

what would that question be? Who are you taking instructions from? That's an interesting one, because you believe that that was not only kind of the aspiration to become richer and richer at any price. Yeah, I mean, he was also the biggest shareholder in the company. But what he's saying today is that he didn't know any of these things. Everything was done by Jan Marselech, the CEO, and he's an innocent victim.

But if you have seen a company grow for 15 years in such a phenomenal way, and three, only three companies are responsible for 100% of your profits, had you not at any point during those 15 years wanted to know who these three companies are? So maybe as a last question, on a personal level, you went on with your life, you continued your professional career. What can we wish you for the next decade?

I think I would like to be an inspiration or change maker in a positive way for the governance risk, compliance and legal community. I think we can all take lessons in this that if we actually do the right thing, which is also doing our jobs at the end of the day, we should be proud of that. And I always get the question, what is the meaning of doing the right thing, which is a very complicated question. But I think at the end of the day, we should do what enables us to sleep well every night.

Already inspiring. Bob, thank you very much for being with us today and for this eye-opening discussion. Thank you, Jesse. And thank our listeners for joining us today. We hope that you find this conversation as insightful as we did. Be sure to be tuned to our next episode. And until then, stay curious, keep questioning. See you next time.