First published in the Daily Maverick 168 weekly newspaper.

The six-year plan to hive off Postbank from the operations of the SA Post Office, which will pave the way for it to be a fully fledged bank that will offer loans to the poor and unbanked population, has run into a snag.

As Postbank races against time to approach the SA Reserve Bank (Sarb) for a full banking licence before the end of 2021, its past and current executives have been accused of running a “corruption” and “self-enrichment” scheme by awarding multimillion-rand contracts to service providers without following proper procurement rules.

They are former acting CEO Hannes van der Merwe, acting chief information officer Raymond Mashau, and the head of legal Benedict Khumalo. The executives are implicated in dodgy Postbank contracts with a value of about R320-million, spanning the next three years.

The company’s compliance department has recommended an external forensic investigation to probe the sullied contracts, which relate to the IT functions of the bank. It has also recommended that the executives undergo lifestyle audits to “ensure that they are not benefiting unduly from business generated in the business”.

The recommendations are contained in a report compiled by the department – obtained by DM168 – that details the series of allegations the executives face and the IT contracts awarded to questionable service providers since November 2020.

The report was compiled after Postbank insiders informed the compliance department initially in February 2021 and again in June about IT project contracts awarded by the bank’s executives without following procurement rules, including Postbank’s supply chain management processes.

The contracts have allegedly flouted requirements of the Payments Association of South Africa and Sarb. Postbank is regulated by the central bank because it takes deposits from the public.

Postbank’s compliance department said the bank might have been “defrauded by illegitimate projects” that necessitated IT contracts to be awarded. “[There is possible] stealing of company money under the guise of enhancement projects,” it said in its report. It said contracted service providers had possibly taken advantage of the bank by inflating their costs, with the help of Postbank executives “entrusted with the management of the bank” and who might have received “possible financial benefits”.

Response by Postbank and the executives

Van der Merwe, who retired from public service in March 2021, told DM168 he was not aware of the department’s report. He referred the request for comment to the Postbank. It commented on behalf of Van der Merwe, Mashau and Khumalo but ignored DM168’s list of questions about when the forensic investigation and lifestyle audits would begin and how the executives had pleaded to the allegations they face. Questions about whether Mashau (the acting chief information officer) and Khumalo (head of legal) will continue to serve in their respective positions while the investigations are running also went unanswered.

Postbank said: “Incidents relating to compliance with internal policies, industry regulations, or general laws are as a consistent standard attended to by Postbank management in accordance with internal policies and procedures. Likewise, Postbank’s applicable policies and procedures are utilised in relation to attending to allegations brought to our attention via anonymous sources, as is the point in case [sic].”

Following the publication of the article, Mthiyane reached out to DM168 to present his version of events. Mthiyane categorically stated that he doesn’t know Thato Abrahams or have a personal relationship with Thato Abrahams or members of the Abrahams family. Mthiyane further refuted allegations with “utmost contempt” that he parlayed a “non-existent relationship” with Thato Abrahams to win a Postbank contract.

 Mthiyane said that Electronic Connect has been part of the Postbank’s integrated grant payment system since 2018 and the system has “not been retired” as alleged on the internal Postbank compliance report. Therefore, he maintained that no new contract was awarded by the Postbank to Electronic Connect. The company was awarded the Postbank contract through an open and competitive tender system, he said. Mthiyane maintained that since Electronic Connect was awarded the Postbank contract, the bank’s integrated grant payment system has “never been compromised or caused any security breaches”.

Postbank is a subsidiary of the SA Post Office and has been piggybacking on the SA Post Office’s infrastructure such as technology systems and its more than 2,000 postal branches, some of which have Postbank ATMs. Postbank is also instrumental in helping the SA Post Office distribute social grants to 8.1 million beneficiaries.  

Since 2015, Postbank has been separating itself from the SA Post Office to offer a full suite of banking products. It wants to approach Sarb before the end of 2021 for a full banking licence.

The sullied contracts

Most of the sullied Postbank contracts relate to its social grants distribution system.

Before his retirement, Van der Merwe was accused of “pursuing and prioritising” US software company Oracle as a service provider “regardless of IT reasoning or justification”.

Postbank allegedly bought R5-million worth of Oracle software in November 2020 under the instruction of Mashau, according to the tip-offs provided to the bank’s compliance department by insiders. That is set to grow to R67-million, the budget set aside by the Postbank for the software. “The justification for the cumulative Oracle User Licence upgrade [the software] is not correct… [as it] was not endorsed by the IT modernisation project… and was purchased without the prescribed procurement process,” the complaint by Postbank insiders reads in the report.

The insiders said the purchase was a “self-enrichment attempt” by the bank’s executive as the budget for the software was initially set at R413-million, eventually dropping to R67-million.

A security breach bonanza

In a separate incident, Postbank was forced to replace more than seven million bank cards from 2020 after a security breach exposed the personal details of up to 10 million social grant beneficiaries, as well as other account holders.

It led to 25,000 fraudulent transactions between March 2018 and December 2019, in which R56-million was stolen from the cards of social grant beneficiaries. According to several internal Postbank reports, unnamed bank employees stole the bank’s encrypted master key, which would allow them to access the bank’s systems, read and edit account balances.

Following the security breach, Postbank executives retired the bank’s compromised integrated social grant payment system. To do this, Mashau allegedly signed a three-year contract with a new service provider to replace the grant payment system at a cost of R7-million a month starting in March 2021. Khumalo allegedly concurred with Mashau’s decision to switch the bank’s integrated grant payment system to another service provider, Electronic Connect. It stands to receive an estimated R252-million when its three-year contract with the bank ends.

Postbank insiders said the bank could have replaced the grant payment system at a far cheaper cost of R2.4-million by simply working with other commercial banks and using their banking infrastructure. Commercial banks are involved in the social grants payment system as some beneficiaries use their ATMs to withdraw their payouts.  

Postbank insiders told the bank’s compliance department that Electronic Connect director, Zamo Mthiyane, has a personal relationship with Thato Abrahams, the businessman husband of former communications and digital technologies minister Stella Ndabeni-Abrahams. As a former minister, Ndabeni-Abrahams oversaw the operations and governance of Postbank.

Mthiyane parlayed his relationship with Thato Abrahams to win the Postbank contract, according to the complaint by Postbank insiders. “[Postbank] staff members are bullied to follow instructions [to award the contract to Electronic Connect] although it is not in line with agreeable terms of reference… Many IT projects are not legitimate and are rooted in corruption because they do not align with the [bank’s] improvement plans,” the complaint by the insiders reads.

DM168 was not able to independently verify Mthiyane’s relationship with members of the Abrahams family, and whether this was the basis for Electronic Connect receiving the Postbank contract. DM168

• Article amended as specified in the text.

Following the publication of this article, Daily Maverick received a response from Raymond Mashau, who has disputed the contents of the forensic report cited in the article.

Mashau said he never had the authority to sign contracts worth millions of rands. Doing so, he said, would have been beyond his authority or powers at the Post Bank. Mashau further stated that he was not involved in procurement processes because this function is governed by the Public Finance Management Act and tender bid adjudication committees within the Post Bank. “I would not have been able to authorise such software procurement [the Oracle software cited in the article]. If it existed, it would have been beyond my delegation of authority. I did not authorise the purchase of any software for R5-million without procurement processes,” he said.

Mashau also denied that there were plans by the Post Bank to retire the integrated social grant payment system. 

This story first appeared in our weekly Daily Maverick 168 newspaper which is available for R25 at Pick n Pay, Exclusive Books and airport bookstores. For your nearest stockist, please click here.