The Wirecard Scandal: 3 Red Flags the Board Should Have Seen

Two missed calls from Germany, saying "Hello, is this Pav Gill? We understand you're being told to go to Jakarta. Don't go, you won't come back." And I was anonymous until a year after the company crashed. If you look at leadership, then it's part of leadership's responsibility to take responsibility for this kind of whistleblowing process and approach. >> don't [music] deal with this, things are going to get messy. Welcome to Grit in the Boardroom, the podcast that takes you behind closed doors to unpack the pivotal decisions

that shaped organizations for better or worse. I'm Erica Elias and Norris, and each week I sit down with a senior leader who stood at the edge of a defining moment, a crisis, a turning point, a challenge where the stakes were high and the outcomes uncertain. These are the conversations you won't find in annual reports. Honest, strategic, and grounded in lived experience. Because governance isn't about theory.

It's about pressure, people, and making the call. My guest today is Pav Gill, former fintech general counsel and the whistleblower behind Wirecard's 24 billion euro fraud. Pav's decision to speak up sparked global investigations, regulatory reform, and a spotlight on the blind spots in corporate oversight. Before all that, he trained as a magic circle lawyer, tried his hand at food criticism, and once thought about becoming a rapper.

These days, he's a coffee obsessive, a keynote speaker on ethics and leadership, and the founder of Confide, a platform created to fix compliance failures he witnessed first-hand. Welcome to Grit in the Boardroom, Pav. It's great to have you from Singapore today. Let's get into it. >> Thank you. It's great to be here. So, to get into the questions, what key moment from your experience best demonstrates the critical need for transparency and accountability.

That's a that's a tough start, I think. You know, as general counsel in Wirecard at least in the Wirecard case where I was head of legal for APAC, the critical moment would probably be seeing how everyone reacted to a whistleblowing case or you know, what they were doing which was mostly containment strategies versus wanting to deal with the issue and fix it, right? To get to the bottom of it. So, I think that's that was the turning point for the company and I would say most companies in these kinds

of situations. It's always you know, what I what I like to say it's not always about receiving reports, but it's what happens after you receive the reports that really determines the fate of the company and also of the person who raises those reports. Yeah, so it's very much based on culture I guess of the organization and how that all plays out. Yeah, but there's also a tendency to blame tone from the top. That's always a very convenient excuse that managers like to use. Oh, the tone from the top sucks and what can we do? But my

response is like you can do a lot of things. You know, just because something is bad upwards, that doesn't mean you do the same thing. You could always create a subculture, your own culture that's positive with your peers or with your subordinates and then it's up to you to manage upwards, right? So, we can't always be relying on cultural issues per se while they exist obviously. We shouldn't hide behind them as a way to not act in the appropriate way. Yes, do you think that when it comes to the Wirecard whistleblowing that you

did, do you think that it made a difference you being based outside of Germany with regards to how like your experience of what happened in terms of actually physically what happened, but also what conversations took place and the the level of I don't know impact it had on the organization. I think from a personal safety standpoint, yes, that's being in Singapore is always probably one of the safest places you can be cuz nothing

exciting really happens here from a crime perspective in terms of physical danger. Um but if I was in neighboring countries, uh if I was in anywhere else, you know, even the US or um Europe, I think that would be a very different consideration. Um but from a whistleblowing standpoint, I think it's also important to remember that Wirecard was a case of two kinds of whistleblowing. There was an internal whistleblower that came to me. So, in my role, I managed that. I did the investigation. And then how I became the whistleblower

uh when I left the company. So, it was internal whistleblowing that I managed and then I, the manager, becoming the external whistleblower. Um and it's also key to remember that I was anonymous all the way until a year after the company crashed. So, that's where I think that was also added protection because most whistleblowing cases, most people who speak up and they get exposed in the process, that's where things go downhill for them um as individuals. Hm. Do you think that being being anonymized, obviously, that has

some benefits, of course, in the process. Do you think that it can lead maybe to people blowing the whistle on things if they know they're going to be protected because no one's going to ever know it was them, that that leads people to uh questions or raise concerns that otherwise they they wouldn't feel bold enough to do? Or do you think that that's what you need as a whistleblower to be able to feel that protection in order to be able to have those type of open conversations and know that there is no comeback? Yeah, anonymity is key because the biggest fear is always being exposed and

retaliated against. And it doesn't need to be serious issues, right? It could be if you're a engineer in a data team, I mean doing dealing with data stuff. Um, you're being forced to release code. You know the code's going to have a negative impact on customers, but then your boss is telling you you're overreacting and then you got KPIs and OKRs and all these things over your head. But, you know, internal audit may want to know what's going on because that's a business risk. It's operational risk as well. So, how do you even just flag those kinds of things without being targeted? Um,

I think that's where people would like some form of anonymity and protection. Uh, because to them it's like, "Look, this is an issue. Can we just have someone deal with it, right? Without us getting in trouble." And it sounds so simple and trivial, but, you know, when it comes to bonuses, when it comes to performance reviews, uh, people trying to look good upwards and sideways, whatever, uh, that's where these things actually suddenly become an issue. And as a whistleblower myself, you know, I have people coming to me every every 2 weeks, I would say, on average,

um, as whistleblowers. And what I've noticed is in the last 3 years, ever since I came out publicly, not a single one of these individuals is a junior member of staff. They are all very senior people. And the question is, why? And from what I've seen is because when you're in a senior position, you have more access to information, you're more experienced. And then when suddenly you start raising these things, you didn't expect your peers or whoever's above you to react in that way. And then you suddenly feel

like a deer in the headlights. And then it's like, what do you do? Now everyone's looking at me thinking I'm not a I'm not a team player. He knows this thing. How do we manage him and stuff like that, right? So, I think that's that's what I've seen happening so far. Yeah, do you think that then, if you look at leadership, then it's part of leadership's responsibility to take responsibility for this kind of whistleblowing process and approach because if you're saying that they are essentially the the senior people in the

organization, they're the people with maybe some more power, some more control. They're the people that can actually make a difference, can make a change. They need to own this, right? And they need to look at it from a standpoint of um as far as they can, stepping back and actually just saying, "Is it possible that this could actually be the case?" rather than dismissing things very quickly. We kind of hear quite a bit of that with regards to scandals that then come out afterwards of well, there were lots of people saying things, but nobody actually listened or nobody understood.

Is that something that you've experienced? Yeah, so I think the main issue is that the the knee-jerk response, the initial response, um is to ask who is this person and why are they raising this issue? Why they reporting it, right? So when motive is the at the forefront of your question, your Q&A, then question number one, then you know, things I That's That's just the wrong start. The real start should be okay, person someone has reported, um let's look at the report and see that if we don't act

based on this report, would that be a material adverse impact on the business? So I think that's where the focus should be, not on trying to identify who's reporting and why they're reporting. We could always assess these motives later on. Um you know, at the end of the day, if you're a business leader, do you really care what why this person is telling you something bad's happening in the company if the bad things are really happening, right? Like um you know, don't look at who's lighting the match, right? But look at and ignore the fire. That's what I always try to say.

Um so So I think if we change that mindset from a leadership perspective, then things will be much better. And then you go to the second part of the problem, which is containment. So a lot of business leaders, based on functions, you have HR uh trying to manage these issues and people which means trying to make the problem go away, trying to get them not to deal with it. And then you have legal who's looking at like, is this a legal risk? And then you have com saying we should get ahead of this issue before anyone else. So, I think it all becomes a containment strategy versus what is this

issue? Let's get to the root cause of it. Let's fix it and make sure it doesn't happen again. Yeah, which comes down to integrity, right? Integrity of the organization externally and also the integrity of those leaders that are within it. Yeah, exactly. Um it's it's a very process-driven problem, I would say. Uh you know, there's a lot of focus on process. There's a lot of illusion uh in in terms of structures and tick boxes. But, no one actually I don't know how many companies really deep dive and go into lessons learned

and how we can prevent these issues um other than just say, "Okay, this thing is dealt with. Great. Let's move forward on to the next one." So, one of the things I always like to ask business leaders who deal with whistleblowing cases and I'm like, "Okay, you've been told that Oh Oh, even boards, right? Let's talk about boards in that sense. So, boards are told like we have three whistleblowing cases. They were dealt with." And then every month there's three whistleblowing cases that were dealt with. But then, what's the meaning of dealt with? It was resolved? Okay, sure. But I think one useful exercise board members can do or anyone could do

is actually go find out who which I mean, who reported it if that person has been disclosed. Sit with that person. Ask them how their experience was. Like, how did you find the whole reporting experience? Are you satisfied with the outcome? Are you satisfied with how things were? I think that's where you get some real insights as to the the process and what it really means instead of just relying on outcomes, right? Like, yeah, dealt with and and so on. Mm. And I've experienced situations where whistleblowing reports have been

put to the board and the board have been super happy that there's been nothing on them. But the reality of that isn't necessary that everybody should just kick back and you know, take a holiday. The reality is that people perhaps are fearful of raising concerns or complaints. And actually, it isn't a fact that there aren't any, it's the fact that they're not being heard. And Yeah. you are one of those people that the kind of had that kind of courage to kind of speak up in that moment. So, can you go into a little bit of detail of

what the situation was and when you realized something wasn't right? I think it's when I found out that the general counsel didn't know what was going on. And I was always told that she was aware. And then, so one fine day when I called her because the whistleblower was going It was getting increasingly irrational. And you know, she wanted to go to the police, the the law enforcement agencies, the regulators, and all these things. And that's where I had to pick up the phone and call the GC and say, "Look, if we don't deal with this, things are going to get messy."

And she had no idea what I was talking about. But she said, "It's okay, just send me everything you have and we'll deal with it." So, [snorts] I did. I sent her whatever I had and she which was a law firm report, a preliminary report with like 20 offenses in there um potentially being committed by certain individuals. She ran to the board and she said, "Do you know what's happening?" Um and they said, "No, but let's now take over the investigation." The problem with that is that some of them were mentioned within the whistleblowing reports and the information we came came

across. And that's where you get into a situation which is also pretty typical, which is you have persons of interest trying to um deal with these issues, right? You can't investigate yourself. And that's also a practical problem because what happens, for example, if the very person that you are uh reporting about is one of the whistleblowing case managers? Or it's the person's department, right? What if HR's in charge of whistleblowing, but the complaint is about the CHRO? Like that's a clear conflict. How do you

get out of that situation? Um So, these are things I think if not managed properly, like in the Wirecard case, uh that's where things just go downhill. There's often you know, often a tendency to want to protect the company from external knowledge of events. But, in the desire to do so, you tend to not deal with the real problem again, and you try to just like make it go away and hope that it doesn't go outside. But,

then not dealing with the problem is when you create angry, isolated, disgruntled people who then realize the only option is now to go outside to take the company to make sure something's done, basically. And and so, it's kind of like a ironic, paradoxical situation, and I don't understand why people are still behaving that way. I would think that if you're a business leader, you want more reports because even if the reports are trivial, that's fine. At least you know that people trust the system enough to raise things which they find which might be

trivial in the first place. So, don't hide behind like zero reports and be proud of it. You know, I always like to say there's a difference between having a culture of silence, which is people just are quiet like in Asia. They just like to do their work, go back. And then the other culture of silence, which is the real disease, which is people are fearful of speaking up because they know what's going to happen to them if they do so. And where where do you think people get that thought process of what's going to happen to them,

you know, if they do so, as you said. So, where where do people get where do they get their ideas from of what the consequences might be of something that maybe has never happened in an organization? Well, it's definitely I would say precedent driven. So, they would have seen or heard like, "Oh, do you know last time when this guy tried to raise this issue, he suffered some horrible consequences, whether he was fired or he was let go or something else, right?" So, I think that kind of that's where

fear comes in because of the horror stories of what happened to those that tried to speak. Um And and that goes straight to culture as well. So, if truth tellers, if people trying to raise concerns are punished instead of being rewarded, then that's where you've got a very negative culture in the company. Mhm. Absolutely. And if people fear, not necessarily even fear the consequences, but fear speaking up because they don't know if it's worth

saying something, um they think that there might be something that's going to happen as a result of it or something that isn't happening as a result of something, but they don't want to be that person. I think particularly in British culture, it's very much of the view that, you know, stiff upper lip. Everybody just carries on as they are. Obviously, that that's broad brush terms, but you know, kind of go, "Well, it's kind of okay. I'm not that worried about it. It's not going to affect me." What is it that made you feel that you

couldn't just stand by and just let this happen? Because when I was in the company, they had the way they came after me because of what I knew, uh that was bad in itself. Like, they really went all the way. So, they did it in staged in a staged fashion. So, the first way is obviously the board got involved. And they told me to stand down. I was then isolated out of the investigation. Um I they [clears throat] they then coordinated with the local director in Singapore telling him to make my life um

Make sure like I know who's the boss, right? Basically. So, he would come, he would shout, he would say, "Don't think I don't know what you've been doing the last few months. If you know what's good for you, you'll play ball." And this is also weird because like if you're a director, and I was telling him this. I was like, "I don't understand what's wrong with you because I'm really trying to protect you. You're director of seven companies in in this region. If anything goes wrong, you're in trouble, too. Right? You're you're you're not just an employee, but you're also a director the same time. So, I didn't understand why he didn't

understand. Uh by the end of the day, he didn't care. So, he would shout, scream, um and then when that didn't work, they created a HR case against me. Uh so, that was like 3 months long of an investigation. So, now I'm being investigated for something I clearly didn't do. And then when that failed, they tried to send me on a one-way business trip to Jakarta, uh where one of the key suspects was from. And he That key suspect was very fond of boasting that he's married into a drug-dealing family. And now the same

guy wants to send me to Jakarta on a business trip. And the way he phrased it was also very dodgy. He's like, uh whether you go in 2 weeks, 2 days, or 2 months, you have to go. But you've nothing to worry about because you know who my father-in-law is, right? And then during that same week, I had um two missed calls from Germany saying, "Hello, is this Pav Gill? We understand you're being told to go to Jakarta. Don't go, you won't come back." And they put the phone down. So, clearly they were they had then accelerated it to uh trying to take me out. And that's when I

resigned because I actually I was forced to resign because I didn't want to go on that business trip. So, the company was like super happy because after 4 months, they've got a legitimate business reason to get rid of me. And I did. So, I left, right? I left the company, and they still didn't stop. You know, they were sending people to follow me and my mom. They were creating fake interviews where the interviewer uh in that friendly company would only ask me why I left Wirecard. And what they were again trying to make me do is breach an NDA or leave a confidentiality aspect. So, they

could sue me and stuff. So, that's where I had, you know, we had enough of this whole nonsense, and we said, "Let's um do something about it instead of just being a sitting duck, right?" So, that's what actually caused Wirecard's downfall. And at the end of the day, if you look back, it could it was completely avoidable. Right? They could have just said, "Look, it's not working out. Why don't you just go on gardening leave, we'll pay your salary until you get another job, and everyone's happy. But, because they had that arrogance and that desire,

uh probably fueled by 20 years of successful fraudulent behavior, you know, I think that's where that resulted in their downfall eventually. Mhm. You are very balanced with your responses for the fact that you have had kind of threats to your own life as a result of these issues in the whistleblowing. You seem to take everything in your stride. How did you feel at the time? Well, I was really upset, to say the least,

because, you know, on top of >> bit of an underestimation, Pav, yes? >> [laughter] >> Uh and um as a lawyer, you're kind of super restrained as to what you can say, what you can do, what you can reveal, even about why you're being treated as that way, right? So, you're like in a super isolated state even within the company. Like, everyone knows that the company's punishing you for for reasons, but >> [clears throat] >> they know also it's maybe because you came across something, but you can't share it. So, you've got nobody to confide in, basically.

>> [snorts] >> Even when you leave the company, you can't, because you don't want like, you know, whatever word goes back to them, then that gives them ammunition as well. So, it's a very So, this is something I think whistleblowers go through as well, um that isolation [clears throat] and not knowing who to trust, uh who will look after them, who will actually deal with the situation, and not them. So, yeah, I mean, I was really upset. And of course, if a company tries to kill you, then all uh legal privilege and all these other lovely rules get thrown out the window,

right? And then you decide, okay, why don't I repay the favor, and just expose them for who they are. It's very difficult situation, because then you That is when you start weighing things like, okay, should I go to law enforcement? Should I go to regulators? Should I go to the media? Um and each one of them have the pros and cons. Like of course people would say like look you should have just gone to the authorities, but the problem is when you go to authorities you expose who you are. And then they can just file the report away and maybe not look at it for the next several years, but in the meantime you're still getting hammered.

So and then people think like okay then go to the media, right? But the media is the same thing. It's like reporters probably get hundreds of emails every week at least of people trying to tell them to report something. How do you know that someone's going to take your report seriously, right? So again like all these things are very difficult external avenues. But the minute you trigger like a public angle like the FT for example who we went to, I think then that's it for the company like it's

unnecessary PR battles, legal battles, stock price damage and all kinds of firefighting. I suppose as soon as you become known to a certain extent you become slightly more protected. Um to a certain extent you become slightly more exposed because then everybody knows that you are kind of the person that raised that. Did you in this process or or anyone in your family, did you feel scared? No, I was still anonymous, right? Until a year after the company crashed.

But of course the company suspected it was me or maybe two three other people. Uh they actually engaged a intelligence agent kind of like corporate intelligence firm. Uh they paid them two 300 grand in euros to try to figure out who the whistleblower was. And out of the two possibilities that they had which was me and another guy, they said it was the other guy which I still find pretty funny. Um So you know they they did try to find out, but I think the strategy is also like if the company's fighting fires

globally and because of the FT reports and stuff like that and regulatory scrutiny now everyone's looking at them, I think then they have less of I mean they're more distracted dealing with those issues and then hopefully leaving you alone. Um Yeah, so that was also one of the drivers. Like distract the company, have them fight those fires, have other people now start looking at them and investigating, and hopefully exposing the truth in the process. Mhm. And when you had those phone calls to

say don't you go to Jakarta because you won't come back, would you say that that's one of the defining kind of moments of your life? I mean, the defining moment was probably the HR case because that goes to the core of who you are, especially as a man. Um you know, it's such a lazy and I mean, it's literally a low blow, right? Like what? Once you falsely get tainted with these things, then you you you it really upsets you as a person. Um

and it sends you into a different kind of spiral. But, um What sort of things were you accused of falsely? They had hired like a female staff to work under me for a brief period, and then when I realized that staff was actually not doing her work, but trying to figure out what is my investigation about. That's when I tried to fire this person, and that's where this person ran to that same director in Singapore. And said that he's firing me because

he I I mean, he's trying to fire me because I rejected his advances and that kind of nonsense, right? So, that became like a 3-month long investigation, which as you can imagine is just ridiculous. Um but, that was one of the strategies that they used because they I mean, they couldn't attack the work. That failed. Shouting and screaming failed as as well. So, I think they really just tried everything. They just threw the whole kitchen sink to see what works. And the desperation then led them to the whole Jakarta thing. Um and when that failed,

I think everyone and they said you got to resign. I think that's where everyone kind of like thought that's the end of the whole thing. Wow, they really did, like you say, pull every every strategy out to to try and avoid this coming out. Yeah. Whistleblowers aren't always seen as heroes, right? And from your perspective, what differentiates those genuine whistleblowers, like you, from those harmful manipulation?

I think it's just motive, right? Cuz um genuine whistleblowers don't become whistleblowers by design, I would say. They often just are raising concerns hoping someone can deal with those things, um funnily in the interest of the company, because they think like look this person's trying to do bad stuff. Uh if the company doesn't deal with it, the company's going to be in issues, right? Or someone's trying to profit off uh some kind of wrongdoing by maybe pocketing funds and all those things or bribery bribery and stuff like that. So they're just really trying to

just like raise an issue, but then they often find themselves as you know like what else like me as a subject of investigation or harassment and all these other things uh and intimidation. So I think they then become this weird uh in this weird state where they don't understand why things are working in an upside down way, which is why like when, you know, the Sky documentary uh Wirecard a Billion Euro Lie, which was the only one I'm in and the day it was released, um which is a year after Wirecard crisis, I came publicly. I came

out publicly on the same day. So the opening lines in that movie uh is what I said. It reminded me of Macbeth, which is fair is foul and foul is fair, because that's exactly what whistleblowers find themselves in that situation, right? Where everything that's fair is deemed as foul and whatever is foul, which is what these people what the company's doing is deemed as fair. So very upside down situation. I think blackmail on the other hand are people that build leverage against a company. And these could be like compliance

officers who are senior going in any company. I mean, no company is perfect, right? Especially in like gray spaces like crypto or fintech and stuff like that. So, you know, you have people that just build leverage by finding slowly documenting all these flaws against to to to get themselves in a position of not being able to be fired or getting a payout. Cuz you can be like a compliance person just building all this leverage and one day you're you're in a fireable position or someone wants for performance reasons wants to get rid of you and you're like, "Oh, you really want to get rid of me?

Do you know all the material I have?" And if you don't pay me out, I'm going to go to the SEC who will, right? So, it's I think that's where it but and it's a real thing. Companies deal with this all the time. It's not novel. And you often see it. So, for for example, in my company like Confide Platform, we've had clients where when there's going to be a layoff situation, suddenly there's a whole influx of ethics complaints. And the reason why that's happening is because in certain jurisdictions, if that's raised as a complaint, a minimum

of 3 months needs to be given for that investigation. So, the employees are actually using that to buy time. Um so, obviously on one hand, I empathize because, you know, no one wants to be fired and sometimes people are desperate. But then falsely accusing people for these kinds of HR stuff stuff I mean stuff has a very bad consequence and it doesn't it's not a good look at all. So again, like how does a company navigate this thing? How does it document patterns and and trends

and bulletproof itself in the process is are some really important questions cuz no not all whistleblowers are heroes, right? But again, that doesn't mean you don't deal with the report. Yeah, absolutely. What do you think board should be doing to assess whether the the kind of credibility of those whistleblowers and to be fair to them. Well, boards should be looking at reports in terms of what happened, who dealt with it, how was it dealt

with, and what the outcome was, and also specifically unresolved cases. I think those are the real red flags and questions boards should be asking. There's a big tendency to just hide behind stats, which I think is an issue, and there's also For example, from a general Say the general counsel is a case manager, and the general counsel is reporting up to the board saying, you know, there are X number of issues, some of these are very controversial, and then the board is asking the

question, "What happened?" I think this is where things get messy because oftentimes if the dotted line actually gets exercised, which is very rare, right? >> [snorts] >> That's where the person finds themselves in a very difficult situation because if the dotted line is exercised and the GC is now going to tell the board that, "Look, the CEO is actually the subject of the report, and I'm having a very difficult time dealing with this." Then now 100% you're in the firing line

with the CEO, or he's going to hate you for life, and he's going to say, "Why were you insubordinate? How could you do this to me? How could you have, you know, overstepped the boundaries and stuff like that?" So, I think that's where these issues are. And also from a general counsel perspective, you know the dotted line exists, but the question is, does the board even know that? Or even if they knew it, are they exercising that, right? So, there's just a lot of these things which board can boards can do. Even from a whistleblowing perspective, yes, a whistleblowing process exists. Have you pen tested it? Have you actually tried to send in a report?

Have you spoken to any of the, you know, anonymous or whatever people? So, yeah, I mean, there's just a lot of things boards can do, but I don't know if they do them. Yeah, but things to think about, I guess. Who, when you had those conversations, was in the room? And how did they react to what was unfolding? Who Who did you speak to initially, and then what happened thereafter? It was always following protocol. So, when the whistle internal whistleblower came to

me, my job was to protect that person. So, I until today never revealed who it was. You know, I get it was a female staff on the finance team. I called her Bobby uh so couldn't be identified. And my job was to protect this person all the way, right? Keep her safe, keep her anonymous, and then deal with the investigation um and coordinate it. So, who was involved in the investigation straight away was the Deputy General Counsel, eventually the General Counsel, and then it went to the board level. The board wanted to do it themselves because clearly, you know, one of the person the main guy

that wanted to investigate and take over everything is Jan Marsalek, who's the CEO uh who was the CEO and is now the most wanted man in Europe, you know, former Russian spy for the last 20 years. He's been keeping himself very busy with the Bulgarian spying uh that was in the in the press in the UK a couple of months ago. Um so, that was a person that actually wanted to deal with the investigation. So, where the real difficulty lies in that from a practical standpoint is how

do you tell such a powerful person in the company that you shouldn't be investigating yourself because you're one of the or you shouldn't be investigating this case because you're one of the persons of interest. Like, there's is no way to write an email that's not going to upset him. And but you have to, right? Uh so, that's I think a defining moment, if you want to call that, uh where yeah, I mean, it was really from that moment that things went downhill. And had you had correspondence interactions before

um with the CEO? Were you aware of the characters that were likely to be assessing the whistleblowing? No, because Wirecard didn't even have a whistleblowing channel. In fact, they put the whistleblowing channel in place in the middle of my investigation or after I was being investigated and they called it a anonymous whistleblowing channel, but when I asked who this channel actually went to, they said it went straight to Jan Marsalek, the COO. So,

they were actually trying to create a whistleblowing channel to fish out people that knew information and then punish them. So, that was a crazy way to abuse a legitimate process, so to speak, and use it as a fishing tool instead, which is quite scary if you think about it. >> [snorts] >> Um So, yeah, I mean they there's just so many of these crazy things that happened in those four months, I would say. Yeah, and do you do you think that if you were talking to other whistleblowers, you say that

people come and talk to you every other week you get someone that's been a whistleblower or is a whistleblower or is thinking about whistleblowing and they're coming to kind of get your advice and guidance on what you should do. Do you think that where do those people kind of come from with regards to wanting to blow the whistle? Are they fearful? Are they defensive? Are they angry? What's what sorts of mindset are people in when they kind of get to that sort of stage to contact you? Yeah, you

never know because, you know, sometimes someone just wants you to listen to them um or kind of confirm some of the things that they're saying in terms of which direction to take. Uh are they overreacting or, you know, and I always ask them to work backwards. So, that's usually my advice. What is it that you want to achieve or what is it that you want as an outcome, right? Do you want to expose the company? Um do you in external routes? Like, do you want to go to regulators? Do you want to go to the police?

Uh I mean the the media like what is it that you want? Or do you just want to get a settlement and you want the company to just listen to you and settle you and just get out of there? Like what is it you need to That is the biggest question because from then you can I mean once you identify that you can work backwards. And you then kind of know what to do. But if you're just sitting there and you're just wondering how to battle these things or how to navigate now because you don't want to resign. You want to stay as you can but yet protect yourself within the company.

Then those are different discussions. Then you're talking about how you documenting everything. You know, it's so tempting to send stuff to yourself to your personal email to do it on USB sticks and stuff. But these are the very things that will kill you, right? Because right away you're committing crimes for example. >> [snorts] >> And it's it's easy to feel that you have truth on your side that oh yeah, I know my company's doing wrong stuff or so and so is doing wrong stuff. But then do you have the resources and capability as an

individual to prove that versus a company with that kind of resources. And also if a company's like Wirecard and like many fraudulent companies, they're in the business of forging documents. Then what makes you think they can't do the same against you? Saying yeah, this is our person. He was involved. He was actually signing off on all these things and here's the proof, right? And you're going there going like what in the world is this? I wasn't part of these documents. I never signed this thing. Yeah, sure. Now it's he said she said. Now you know, so how are you going to prove

otherwise? So I think these are the real practical concerns and challenges and I think it's also why it's so difficult because you know, you it's one against one against a corporation. Some uh big big topics. Were there ever moments that you felt that you before you resigned, that you shouldn't have started what what you kind of started, that kind of snowball effect? No, because, I mean, I was the

head of legal for Asia Pacific. That was my job. Right. So, it's uh I took real pride in it in a way. Uh I actually thought there was just a few individuals, some bad eggs, and you know, they were they were kind of duping the poor Germans uh from Asia, and you know, my job was to try to identify these people um and get rid of them because they're spoiling Wirecard's good name. So, I never in my wildest dreams thought that the fraud extended all the way to board level to that extent, that it was really

a criminal enterprise. Um so, I think that was why I was so driven to I mean, I didn't question what I was doing, so to speak. And also, people uh people like to tell whistleblowers like, "Oh, why didn't you just resign and find another job?" You know, that's a very as a commonly asked question, I would say. Um The problem with that question is practically, it is not easy to just walk into another job, especially the more senior you get. And I think fundamentally, the why should you do

that if you haven't done anything wrong? So, and in my case at Wirecard, you know, the law firm that I was dealing with was saying, "Just don't resign because the more that we are looking into the evidence, the more it's becoming super obvious. So, you at some point you'll be validated. So, therefore, hang in there, like, you know, fight those fires, withstand them." Um so, it's really it really was a case of a race against time. And I think at some point the company after 4 months was getting more and more frustrated. Um and that's why they got

increasingly desperate to want to deal with me in the fastest and most painful way possible. And reflecting on other scandals like 1MDB, what governance practices failed, and how could they have been prevented in your view? I think for these kinds of, you know, scandals which are clearly powerful in terms of stakeholders that are involved. Uh I mean 1MDB's case obviously it was there were government aspects in there.

Uh in Wirecard's case I wouldn't say it's too dissimilar. I'm not saying Germany was involved in the fraud per se, but clearly the BaFin for example uh as a regulator was trading Wirecard stock until the very last day. So and refusing to investigate the company, right? And on top of that instead they were investigating the FT. And on day one of the FT's article that came out, they said this is not a Wirecard problem. This is a short selling problem with rogue journalists involved and all that stuff down the line. And they also were so protectionist that they even banned

short selling on Wirecard stock for like 3 months. So clearly the company was being protected within institutions in Germany. They also like 1MDB had auditors uh from big big four for example um that were very deferential to to these uh to the client. Um so I think those are similar parallels. Um and you know, this this Wirecard um had powerful people on their supervisory

board as well. You had sons of prime ministers in neighboring countries on the board. Um 1MDB clearly had, you know, direct government officials there uh in that scandal. But what's the most interesting connection between the two I would say is that my mom actually went to Clare Brown who was the journalist that exposed um initially started writing about 1MDB. So Clare Rewcastle Brown was a journalist. So my mom somehow made friends with her. Um and it was Clare that actually said,

"Look, uh I know the Financial Times has been working on this case for the last 5 years and getting nowhere. So I'll let me put you in touch with them. So, finally there is that 1MDB connection between me and and the Wirecard case as well. What do you think could all those early warning signs that leaders should be thinking about but they're often ignored? I mean, there are just so many. Uh >> [sighs and gasps] >> early warning signs could be ex- hyper

growth that doesn't really make sense. Um especially if you compare it to industry peers. For example, why is this particular company doing so well? Especially if they don't have like a super exceptional mind-blowing product. Right. That was the case in Wirecard, for example. It always like to pride itself as a fintech company. I always used to laugh when they said that because the tech was horrible. You had companies like Alipay and and all these other firms that were doing way better tech. Um but yet it was getting it was so powerful. It's like the PayPal of

Europe. Why is that Why is that? So, similar similar you have hyper growth companies. Recently we saw it in Indonesia with a startup called eFishery. Um just blew up was a scandal. So, that's the biggest red flag. Also, I would say practically extremely powerful influential founders uh could also be a red flag because, you know, they are able to dominate shout um kind of coax influence the the

the checks and balances. Like even if you are if they're dealing with say like an audit firm, right? Could be like, "Okay, you don't want to deal with my company? That's okay. I'll go to another audit firm that would." So, putting that kind of pressure, that kind of thing, I think that's also a red flag in its own way. Which is ironic because um I don't want that red flag to be in my company now, for example. I don't want what I just said to work against me. But uh yeah, and also I think number of resignations. If the turnover is so high, the question

is really like what's going on, right? Why is it that people keep leaving your company? Um, and is it is it restricted to a specific departments? I think that's also something to look at. Yeah, so I would say there's just so many, uh, red flags that one could come up with. Uh, but at the end of the day it's it goes back to board level, right? Are they really looking into this? Are they really asking the right questions? Um, are they conducting their own kind of, uh, Q&A and audits and checks

into these things? Um, you know, really going be behind the reporting, asking those tough questions, which is easier said than done because, you know, I also have board members coming to me like NEDs and stuff, uh, non-independent direct I mean, independent directors, non-executive directors and all that saying, "Look, >> [sighs] >> it's, uh, difficult being one. And and funnily what they say is also a red flag now based on their experiences is they don't want to join boards if the

existing board members have been there for like many years." Because that is a red flag, uh, especially if they are coming in trying to be like this independent, um, you know, non-executive director. Uh, how do you then get into that back and not be seen as the new troublemaker? I think these are, uh, things that people should, um, just look into. >> Do you think that the role of non-executive director has its benefit? You kind of talk about, um, about that

particular role and new new NEDs coming in. Obviously, the whole point of it is to bring external perspective in, but if if they are in any way silenced or felt like they have to be silenced, obviously they have the exit option of not not staying in that organization anymore. But how how do you think that that supports kind of the whistleblowing process and the opportunity for some of these things to maybe be heard by somebody that isn't

conflicted by the ex- the internal workings because sometimes things that go wrong can just even if they don't directly relate to the CEO or the CFO, they're operational challenges that just say that something hasn't been managed right. So, even if it just casts shadow on their abilities to lead. Um even if it's nothing they've actually done wrong. So, non-exec directors, do you Yeah, do you feel that they have value and what value do they add and how do they Well, do what they do? Yeah, I mean if they're truly independent, then sure,

right? Um a lot of times that's also questionable because you have NEDs that know the directors uh that already are there. They're like kind of like golfing buddies or whatever, right? Um and then you have those that are very happy with just being NEDs because this is just another income stream. It's like, "Yeah, great. I'm the NED. Like you guys just tell me what's going on. All good. I get my uh salary and stuff." Um Um so, if you are actually a NED that

wants to do what's right, I think yes, you would definitely have a powerful um ability to influence processes. For example, whistleblowing. If you say, "Look, any whistleblowing cases that the company is operationally managing, I want to be able to question those cases and and resolutions." Right? "I want to have uh I want to have the ability to actually question and see what was going on in those things. I don't want to be blocked out from the process because my job, if you really want me to be a check and balance, is to be a check and

balance." Uh and if there's nothing to hide, then what's the issue, right? I think I think that would be a powerful strategy. Um Yeah, but it's it's again like very theoretical. It's very difficult to be in that situation because you get all kinds of pushback. And also, I think operationally from from teams within company within the companies, the different departments, they don't want to be There's always that fear that we don't want to look bad to the board. We don't want the board to be asking too

many questions. We want to always present a positive picture upwards because otherwise we get into all kinds of issues. Um and then every There's so many heads involved that it would have to also answer those questions. And And again, funnily, would it cascade down to whoever made that negative-sounding report? Uh why did you do this? Why did you have to phrase it that way? Um so, I think these are So, if you're a good NED, I think you could also sniff those out um by actually putting in the effort and

following your gut feel. I think a lot of these things do come down to gut feel. And I've heard it said many times on TV documentaries and others that it when it just doesn't feel right, you need to do something. Is that Is that kind of where you where you kind of got to of like this cannot continue? Yeah. I mean, the biggest question, I guess, that it comes down to for directors, for example, is would you be Would you be able to stand behind your decision if this blew up in

the papers tomorrow? Right? So, I think that's that's a great guiding factor and question to ask. Um And I frankly, like every department head, whether it's legal or compliance, should be asking themselves in control functions as well, like that question. What happens if something blows up? Can you stand behind in this thing that you've signed off on? Uh you know, one of the things I like to say to people in legal legal and compliance, especially internal audit as well, is that especially if you're in a

startup uh particularly, and And got a very um very you know what do you call that? Uh >> [snorts] >> very crazy eccentric CEO. Right? If anything goes wrong in the business, which didn't which seemed weird to begin with and it exploded, uh the CEO can always leave the company and say that it was a crazy idea, it didn't work out. So, what key governance changes would

you recommend to ensure boards are more resilient and ethical? I think the only way to force these things through, being honest, is if the penalties for not doing the jobs are increased and made harsher. And currently, I think that's not happening. Um even in multi-billion dollar frauds in several countries, you know, directors just get away with it uh like a slap on the wrist. Even when it's proven that they kind of like were negligent in not asking the right questions or whatever it. So, I think if

the penalties, the uh liabilities are actually increased, I think that is the most effective way to force people to do their jobs better. Yeah, absolutely. And all the all the tools like uh the software that you have created, Confide, that you believe should be standardized? Yeah, I think every every uh company, obviously I'll say this, but every company should be using Confide platform. Uh and the reason why is because you know, it's the single source of truth, which currently doesn't exist in

any company. So, in most companies, if you ask them did some if something bad happens, do you have one place to find out how it started, who dealt with it, and what happened at the end? The answer is probably no. You may have different softwares doing different things, different meetings, Jira tickets, Slack conversations. It's not consolidated, the audit trail is missing, it's messy. Um and Confide platform solves virtually all these issues because everything's in one place and you can't modify try You can't change the logs, you can't run to the IT team and delete stuff. So, if

you're a board member and you put this in place, it's great because you actually if you do demand access to it or at least some kind of limited access to see what's going on, yeah, then it's great. It's the most powerful check and balance from a software perspective that could exist. And you have one source of the truth essentially. Yes. If listeners could adopt one kind of governance practice to strengthen ethical decision-making, what would you suggest? Well, I think before every

every significant decision, you know, the question needs to be asked, "What would someone need to believe for this to go wrong?" Because if you can't, you know, you can't steel man the opposition side of that argument, then you don't understand the decision well enough to make it, right? Cuz as I posted on LinkedIn today, like most governance disasters happen when intelligent people convince themselves that they can't be wrong. So, you know, asking that question kind of forces intellectual humility into rooms full of successful people who aren't

used to being wrong. So, I would say that's what I would do. So, it's it's very much I suppose about speaking truth to power. Yeah. Well, thank you very much Pav for sharing, you know, the truths behind the headlines and for helping boards to understand what real accountability looks like. It's been great speaking to you today. Thank you. Thank you for having me. That's it for this episode of Grit in the Boardroom. Thanks to Pav for sharing

his story with honesty and insight, and thank you for listening. If you found this conversation valuable, please follow the show and share it with someone who leads through complexity. Until next time, stay thoughtful, stay brave, and stay in the room. I think as a result of the conversations I had with Pav, it's really given me an opportunity to reflect on what needs to be better, what needs to change, and

some things need to stay the same. Particularly in the UK setting of of governance. I think that with whistleblowing it's so important to make sure that whoever is the person that those reports go to, they are able to act with objectivity. Because otherwise those discussions and conversations and that person's brave bravery of coming forward [music] is completely wasted. And I think for those organizations that find themselves faced with problems, challenges,

whistleblowing, they need to see this as an opportunity for change, reflection, and perhaps improvement. And to adopt that sort of approach >> [music] >> and the organization will be stronger as a result of it.

Mhm.