Gold Leaf Tobacco Corporation’s (GLTC) multibillion-rand cross-border plunder network ground to a complete halt at times when “at least” five accused Sasfin Bank officials couldn’t sneak payments to offshore destinations, WhatsApp conversations and money flows attached to SA Revenue Service (Sars) court papers suggest.

About R3-billion in illicit tobacco money was surreptitiously and illegally washed through GLTC’s Sasfin accounts during the 2017 and 2018 financial years, Sars investigators found.

The backstory here is that on 26 August, Sars seized control of all bank accounts and assets of GLTC and its two directors, Zimbabwean citizen Simon Rudland and South African Ebrahim Adamjee. Investigators told the court it is in the process of clawing back at least R1-billion in undeclared taxes from GLTC – this could escalate to R3-billion, including penalties and interest.

Read more in Daily Maverick: “R3bn ‘fraudulent, intentional tax evasion’: An in-depth account of how Sars busted tobacco & gold plunder network”

A multi-year tax evasion investigation found the company was making a fortune in cash from illicit tobacco sales. GLTC laundered the money through cash-in-transit and gold companies and then allegedly paid off at least five Sasfin employees with cash to sneak more than R3-billion out of the country – without alerting the authorities.

Sars’ evidence in part relies on a voluntary search and seizure at Sasfin’s offices in March this year. Sasfin management also admitted to the deletion of banking transactions from its system, and told Sars in March this year that IT experts had to reconstruct the bank statements of GLTC.

Read in Daily Maverick: “Four steps to GLTC’s alleged money laundering, explained in an infographic”

These Sasfin officials ensured that payments were supported by incomplete or sometimes no documentation at all, and avoided flagging of the dodgy payments.

Worse, transactions reflecting incoming and outgoing payments on Sasfin’s system were deleted and daily forex reports to the Reserve Bank and Financial Intelligence Centre were wiped.

Any trace of the illicit transfers was further deleted from GLTC’s monthly bank statements, probably in an attempt to “conceal to the other GLTC employees that GLTC was involved in the illicit transfer of money abroad”, Sars said.

The accused Sasfin officials are head of trading desk Brandon Marshall, back office manager Hussain Choonara, Temenos Treasury application specialist Lulama Kene, Cheryl Simons in the financial surveillance department and Merica Kwinika at exchange control vetting.

Only Choonara’s lawyer, Yousha Tayob, replied to Scorpio’s request for comment, saying that his client does not know what the allegations against him are. 

Scorpio understands authorities gave notice to Choonara and others to testify at a Reserve Bank probe. When asked for comment, the Prudential Authority characteristically kept it tight: “The Prudential Authority has noted with concern the media reports related to Sasfin Bank Limited.”

Scorpio had several formal and informal conversations with Sasfin CEO Michael Sassoon in an attempt to understand what had happened. 

Bank managers only realised that disaster was looming when Sars kicked the doors down in March 2022, he said. Sasfin had at the time agreed to a voluntary search and seizure in which cellphones and laptops were cloned and banking documents copied.

Sasfin and GLTC parted ways in 2017 on Sasfin’s insistence, but there was no indication of any wrongdoing by their own employees, Sassoon claimed.

On Sassoon’s version, in 2017 neither top management nor Sasfin’s internal auditors, risk department, head of IT or compliance division heard so much as a rumour about any employee worming their way through the system, surreptitiously deleting R3-billion worth of incoming and outgoing payments – or reports to the authorities – in the space of about a year. 

Asked whether this is indicative of a serious lapse in internal control at Sasfin, Sassoon conceded, saying, “Clearly in 2017, for that to have happened, it does suggest that… there should have been more robust controls in place to pick up this earlier and to address these things more quickly… I would say, yes. A few things have changed since then…”

Sassoon mentioned that, “for other reasons”, the bank’s external auditors, head of risk, head of compliance and head of internal audit were some of the positions replaced in a broad restructuring process since 2017. 

There is no certainty, Sassoon said, that at “least five Sasfin people” were corrupted at all. In fact, Sasfin’s own “ongoing investigation” has, between April and now, only unearthed “evidence implicating one rogue former employee” who no longer works at Sasfin.

In a radio interview with Bruce Whitfield, Sassoon framed the alleged perpetrators as mere banking officials, one of whom had a position of some importance, but certainly did not count as people he would describe as “friends”.

Indications of wrongdoing arising from Scorpio’s first report on the GLTC plunder network, caused Sasfin to also suspend Merica Kwinika and Cheryl Simons, who were still working for the company.

Sasfin has not had sight of Sars’ court papers yet, and seems to question that R3-billion could have washed through its systems unnoticed. 

Incredulously, Sasfin could not answer questions like, what happened to the forex fees? The issue here is that, for every forex payment facilitated, Sasfin earns a fee. 

When around R3-billion in illicit transactions were sneaked across the border, the question is, of course, whether these fees were raised or deleted/removed as well? 

In other words, did Sasfin earn banking fees on the corrupt GLTC scam running through its systems?

Sassoon said: “…the investigation is also looking at the fees earned by Sasfin. We will leave no stone unturned until Sasfin is convinced that any issues surrounding this case are independently investigated and surfaced.

“Sasfin commits fully to cooperating with the authorities to ensure that justice prevails and will take rigorous action against any employees who may be identified as having participated in misconduct.

“We have expanded the scope of our investigation to ensure that we urgently address any other issues relating to misconduct that might come to light.” 

Yet there were some red flags.

Sasfin ended its banking relationship with GLTC, for example, in around November 2017. This came about when Sasfin’s head of forex operations in 2017, Amanda Gie, noticed something was off with the invoices linked to payments for GLTC’s offshore “suppliers”. Based on her advice to three colleagues, Sasfin closed GLTC’s bank accounts. Scorpio understands the necessary reports were made to authorities. This seems to be confirmed in Amanda Gie’s letter, attached to Sars’ court papers. 

In 2020, Gie was retrenched. Yet, Kwinika and Simons, who would two years later be identified by Sars as among the key wrongdoers, were not. (More about this later.)

Banking management only became aware of the scale and depth of corruption in about March 2022, Sassoon claims, when Sars requested a voluntary search and seizure procedure. This is when the internal investigation was launched. 

In this article we will explore:

• The manner in which Sasfin came to be inextricably linked to GLTC’s cross-border plunder network;
• How the network operated; and
• Why Amanda Gie was retrenched.

Based on Sasfin’s reconstructed bank statements, Sars reconciled the payments deposited into GLTC’s Sasfin bank accounts in the financial years of 2017 and 2018. GLTC claimed the smaller amounts were the legitimate deposits into their bank accounts. Sars says this is not true and found that about R2,900,706,183 in undeclared, illicit money was paid into the company’s Sasfin accounts. Traces of these incoming payments were deleted, Sars said. 

Based on Sasfin’s reconstructed bank statements, Sars reconciled the forex payments moving to foreign jurisdictions in the financial years of 2017 and 2018. GLTC claimed the smaller amounts were legitimate forex movements. Sars says this is not true and found that R2,900,704,634 and $537,233 in undeclared, illicit money was paid to GLTC’s “suppliers”. Traces of these forex payments were deleted, Sars said.

The money launderer

The link between the Sasfin officials and GLTC was money launderer Mohammed Khan. 

Khan and his company, SALT, managed the relationship between the tobacco manufacturer and the bank.

Read more in Daily Maverick: “R3bn in smuggled cigarette money, Test One: Sasfin’s IT guru deletes first transaction from its banking system”

Sasfin confirmed to Sars that Khan was linked to at least another 17 entities at the bank. This raises questions over whether Khan and his five Sasfin officials laundered money for other clients too. 

Sassoon said an expanded internal investigation had brought in external experts to help. There are, at the moment, no “concerns regarding any other clients or employees other than those associated with the Sars investigation”.

“One of our big challenges with the investigation is, because we replaced systems and this relates to information that was incorporated in the system in 2017 that we have to go back to, we obviously keep these records, and because there wasn’t enough local support on this system, it took a bit longer than we would have liked… I am confident that we are approaching this investigation appropriately.”

Sars says the plunder network basically aimed to launder and formally introduce into the banking system illicit cigarette cash through cash-in-transit companies like AMFS, using their FNB account. AMFS then, on instructions from mainly Howard Baker, EFT-ed the money to GLTC’s Sasfin bank account. These incoming funds would be deleted on Sasfin’s side, on instruction from Simon Rudland, Baker and Mohammed Khan. The outgoing payments to foreign jurisdictions like Dubai and Switzerland were also deleted, including reports to the authorities.

Sasfin: Inextricably linked to the GLTC transnational money laundering network

Without the assistance of the allegedly corrupt Sasfin banking officials, GLTC’s transnational plunder network ground to a complete halt, as suggested in reams of WhatsApp conversations and bank transactions. 

Sars officials told the high court in Pretoria that the instructions for these illicit payments came from Rudland and his close business associate, Howard Baker. Their contact was the money launderer Khan, who seemed to have managed and acted “in concert with various Sasfin bank officials”.

“These deletions were affected in order for the illicit financial flows to circumvent detection by the relevant authorities.”

Freedom Day weekend in April 2017 posed a particular problem for the plunder network. At the time, Baker seems to have had a growing cash crisis. There was some urgency in his messages around this time.

On 27 April, Baker asked Khan, “Can we do anything today?”

“Public holiday bud,” Khan replied, with three laughing emojis.

The next day, Baker asked again: “Any luck on a zar transfer deal?”

“Hi H,” Khan replied. “Guys not in. They all took a long weekend.”

First thing on Monday morning, Baker came knocking again.

“Morning Mo, can we do anything today?”

Khan explained that everyone at Sasfin was busy with month-end activities.

On 3 May, Baker asked again.

“I’m sure we can,” Khan said. “Just waiting on amount.”

Baker: “Perfect thanks. I have plenty available.”

Khan: “Ha ha ha I’m sure you do.”

A few minutes later, Khan confirmed that moving R30-million will be possible.

“Cool, that will help,” Baker said. “Any chance of some $ too?” 

The discussion about having “plenty available” – as in having plenty of cash available – is probably a reference to the massive cash problem generated at GLTC when it sold hundreds of millions of rands in illicit cigarettes. These cash boxes were stashed in warehouses across the country. 

The cash urgently needed to be moved into the formal banking system. An important cog in this network was the cash-in-transit and gold companies, and Sasfin (as shown in the graphic above). By using these companies, the cash was formally introduced into the banking system and Sasfin added another layer.

Referring to this transaction of 3 May, Sars investigators said in court papers, “This transaction could also not be traced on the original Sasfin statements and is a clear indication of the manipulation and deletion of records of GLTC in order to disguise the true financial status of GLTC. I point out that the above is only a few examples of numerous such transactions.”

Sasfin’s IT guru, Lulama Kene, seems to have been the pointsman on deleting these transactions on the Sasfin system.

Third party payments at other banks, along with their own Sarb forex reports and Swift documentation, were not deleted. These remnants of R3-billion in transactions washing through Sasfin’s accounts helped Sars to piece together what happened.

When the Sasfin officials were on leave, it seems, the plunder network had to take a rest, too. 

And when they made a mistake, the chances of detection were high.

Later on the same day, 27 April 2017, Baker sent Khan information on WhatsApp relating to a R2.4-million payment effected the previous day. 

“Your guys put Gold Leaf Tobacco Corporation on the last $ inward swift, now I have compliance department all over me. Please tell them [presumably the Sasfin officials] to make sure it is GLT Corporation,” Baker said.

Baker attached a message from an official at the Dubai-based Emirates Islamic Bank, stating “our payment team has advice to validate the accuracy of correspondent bank details in the provided Swift”.

In creating a pretence of moving money out of the country, fake invoices on which the company logo didn’t match up with the payment details, were one way of scamming the system. It meant that a legitimate company in Switzerland could be used, but the banking details attached would be of an offshore company presumably managed by the GLTC network.

It seems that Emirates Islamic bank picked up on some of these discrepancies and queried them with Baker.

Khan replied with three angry emojis: “The full name not suppose to show. I’ll sort them out. Sorry H. We will sort out.”

Sars seems not to have cracked the offshore money flows yet. WhatsApp messages, however, suggest that Rudland and Baker had at least sight of what was happening at the other end. This reflects in messages where Khan asked Rudland to let him know if “Switzerland receives” the very first payment the network sneaked through the Sasfin system. 

Another such indication is Baker asking Khan about whether a specific payment was really effected, saying it “hasn’t reflected yet” – presumably in the designated offshore bank account.  

How the transnational plunder network operated

According to Sars, the Sasfin officials were paid in cash to ensure bank accounts were incomplete, inaccurate and manipulated.

These payments were done by Khan or a business partner.

There is some indication in the available WhatsApp messages that seems to support Sars’ finding of Sasfin officials being corrupted.

On 9 September 2016, a series of payments were sent to foreign jurisdictions and digital traces in Sasfin’s system were “pulled” and “removed”.

Kene reported to Khan: “The ones for today I have removed them…” and then lists three transaction codes “removed” for the day.

“Thank Bru,” Khan told Kene. “U will get something for this. Much appreciated.”

“Looking forward to it bud,” Kene replied.

Banking software experts consulted by Scorpio suggested all indications are that the GLTC payments may have been wiped from Sasfin’s database – an extraordinary feat, because this would need what is termed “superuser” clearance and “update rights”. To the banking software experts, this means either a senior banking employee was involved, a more junior employee had access to superuser passwords they should not have had, or Sasfin has experienced a stunning lapse in control and may have been extraordinarily negligent. 

Or all of the above.

In the initial stages of the scheme, in early 2016, the language used in WhatsApp messages between Khan, Kene and Baker was fairly vague. 

By 2017, the scheme ran on oiled wheels. With more than R2-billion having already been successfully moved abroad, they got careless. 

In one thread of WhatsApp discussions, Khan and Kene were openly strategising about the timing of transactions to be deleted.

On 25 April 2017, for example, Khan asked Kene to “check and remove the payment for the 21st [of April]”.

The payment of that particular day, Kene was told to “remove tomorrow afternoon”. 

“Cool bud, will do later,” Kene replied. Seconds later, he wanted to make sure: 

“For USD one, I will do FIC and BOPCus (sic) and live statement ryt?”

Under discussion here was GLTC’s two accounts at Sasfin – the one linked to the South African rand, and the second to the American dollar. 

“FIC” and “BoPCUS” refers to reports of threshold money flows to the Financial Intelligence Centre and forex reports to the Reserve Bank.

Khan corrected Kene, writing “yes sir. And for zar also. We do fic and bopcus for zar and usd.”

Kene: “For Zar I do.. FIC, BOPCUS, and later 2moro statement.”

Khan: “Usd we leave on statement.”

Kene: “We are on the same page.”

The next day, at 08:33 on 26 April 2017, Kene wrote “All was done bud.”

Khan replied: “Thanks my brother.”

Years later, Sars pieced together what happened by using information from third-party banks, the Swift system and reconstructed bank statements provided by Sasfin. 

Investigators concluded that they “could not trace this transaction on the [GLTC bank] statements despite the clear proof that the Swift transaction was effected…”.

It had been deleted.

A few days later, on 3 May 2017, Khan sent a picture of a transaction Swift code saying, “we need to remove this one also bud.”

Kene identified it as a payment in USD and asked “must it also go off statement?”

It seems that Kene referred here to GLTC’s bank statements, and asked whether the payment should be deleted there, too.

Khan replied: “We can remove later from statement.”

The next day, on 4 May 2017, Kene wrote: “SAM, FIC, BOPCUS done on todays stuff. I have also sorted the 25 and 26.” 

This seems to refer to payments in late April and 4 May 2017. 

Khan: “Thank you my brother. Stay blessed.”

Scorpio compared the series of WhatsApps with a section of reconstructed bank statements Sasfin managed to salvage for Sars. Available evidence here suggests that between 21 April 2017 and 3 May 2017 – the dates in the discussions above – at least R170-million was sneaked out of the country. Tax free.

Amanda Gie: The star Sasfin employee and how GLTC’s accounts at Sasfin got closed

Amanda Gie was the head of forex operations at Sasfin, and she was on to GLTC’s shenanigans.

Gie realised some things were off with GLTC’s invoices. A stretched logo. Details that looked all too similar in two different invoices. Odd calculations. Spelling mistakes. When she checked, some companies didn’t exist. 

Some extensive googling suggested the invoices claimed to order products the relevant company didn’t sell. She made the connection to Khan after noticing that his “name appears on some invoices”. 

On 15 September 2017, Gie sent a letter with her findings on about 10 dodgy GLTC-linked offshore payments to three colleagues at Sasfin – Robert Rebuzzi, Maston Lane and Howard Brown. (The letter is now attached to Sars’ court papers.)

She signed off her letter with this line:

“Based on the current findings listed above, business is of the opinion that it would be in the best interest of Sasfin Bank to exit the relationship with the client with immediate effect as the bank faces image, financial and serious regulatory repercussions.”

GLTC’s accounts were consequently closed.

In a strange twist, GLTC told Sars they were unaware of Gie’s letter and closed the Sasfin accounts out of their own volition.

In any event, the balance was transferred to GLTC’s Absa account on 18 December 2017.

In 2020, Gie was retrenched. Yet, Kwinika and Simons, who were part of Sars’ identified wrongdoers, were in their jobs until recently, when Sasfin suspended them.

Asked whether it was suspicious that the only employee in this entire saga who made Sasfin look good was retrenched, while the others were still around, Sasson said, “I feel that your point is a bit tenuous.”

Gie “did a very good job in identifying these issues”, according to Sassoon, and he was “upset” when she left.

But he wasn’t about to praise a fish for swimming.

“That was her doing her job. It wasn’t like she… did something above and beyond.”

According to a new manager’s assessment, Gie didn’t have the “necessary regulatory requirement to fulfil” an elevated role. She declined to take up a more junior role and in the end left Sasfin.

And that was the end of that. 

On Kwinika and Simons, Sassoon said that the bank managers hadn’t known what was going on under their noses since 2016. 

On Sassoon’s version, it was only when Sars came knocking in March 2022 that the managers became aware they may have had some moles.

But even an internal investigation couldn’t unearth “actionable evidence” or even the names of four of the suspected five. (Lulama Kene was apparently identified immediately, because his fingerprints were left on the Sasfin system.) 

Based on legal advice, Sasfin had to accept that “to dismiss a person on the back of an investigation we are not privy to the outcome of … that is not due process”, Sassoon said.

How a money laundering scam works

The goal: Make heaps of illicit cash by selling illegal cigarettes. Introduce it into the banking system by laundering it through cash-in-transit (CIT) and gold companies. Move it to GLTC’s Sasfin bank account where, with the help of five corrupt Sasfin officials, it was sneaked out of the country based on a WhatsApp instruction and not much else in terms of supporting documents.

The unimaginable feat: Sasfin officials deleted the payments moving into GLTC’s Sasfin bank account, as well as the corresponding payments moving out of GLTC’s Sasfin account. These payments were sent to companies mostly in Dubai, Switzerland and Mauritius. The Balance of Payment Customer (BoPCUS) reports to the Reserve Bank – alerting the watchdog of forex movement – were also deleted.

The end result: The money trail simply evaporated somewhere between the CITs and companies in Dubai, Switzerland and Mauritius. No taxes were paid, the South African citizen was robbed and the plunder network was enriched. With neither Sars nor the Reserve Bank being any the wiser. DM