The web of high-level rot exposed by top cop Khan’s seized devices

The Latin legal term “prima facie” translates as “on the face of it”. And, on the face of it, thousands of chats downloaded from Crime Intelligence Deputy Head Feroz Khan’s seized electronic devices appear damning, the landmark Madlanga Commission of Inquiry has heard.

Khan (57) remains unconscious in Milpark Hospital after undergoing surgery for wounds sustained during an apparent assassination attempt on 28 June before he was due to appear before the commission as a key witness.

However, a surgical dissection by evidence leaders of communications on these devices has now revealed an alleged sprawling empire of luxury properties around the country and at least 30 high-end sports cars parked snugly in garages.

Then there is a farm and a Rolex Submariner worth about R200,000 offered by VAT fraudster Feroze Essay to Khan, allegedly in return for insider tender information.

The communications situate Khan at the centre of what appears to be a sprawling network of corruption in the SAPS involving drug cartels, illegal surveillance and lucrative state tenders. A statement by “Witness M” has separately alleged links extending to still unnamed “heads of state” and individual political leaders. This is as close to the flame as it is going to get.

Khan himself had declared a R3-million income from his company, Spares Oasis, between 2021 and 2026, more than double his salary as a senior police officer, as evidence leader advocate Adila Hassim noted this week.

Khan’s evidence has not been put on ice while he remains “non-verbal” and hooked up to machines, and on Thursday, 9 July, President Cyril Ramaphosa extended the evidence deadline of the commission to
2 October, so Khan could still testify. The final report is now due on 16 November.

The Malema connection

Khan was arrested alongside the Gauteng Hawks head, Major-General Ebrahim Kadwa, and businessperson Tariq Downes in May for allegedly running an illicit precious metals syndicate.

The arrests followed a 2021 incident at OR Tambo International Airport in which Downes was found with 75.9g of unwrought gold. Khan’s devices were all seized during a raid on his luxury Houghton apartment, which is how these communications were secured by law enforcement.

They have revealed links to persons of interest including EFF leader Julius Malema, Carnilinx tobacco manufacturer Mohammed “Mo” Sayed, his partner Adriano Mazzotti, former police reservist Wiandre Pretorius, who provided security for Sayed, as well as former Special Task Force officer Matipandile Sotheni, who is facing 16 charges, including premeditated ­murder and conspiracy, related to the December 2025 drive-by shooting of whistleblower Marius van der Merwe (“Witness D”).

The commission has since communicated with Malema, seeking an explanation of his links to the men, to which Malema replied that the interactions were between Khan and Sayed and did not involve him.

Leveraging Khan

The inquiry also seeks to unpack allegations that Malema used an intermediary, his friend and benefactor Sayed, to obtain confidential information from Khan about issues affecting Malema’s political fortunes.

Khan appears to have helped Malema obtain sensitive and confidential information about a criminal case against him related to the VBS Bank scandal.

On 15 June 2021, Sayed messaged Khan saying, “Need to know the complaint in case no: SANDTON CAS 76/07/2019”, and clarified that the source of the request was “Juju bru”. Khan revealed that the complaint was made by VBS curator Anoosh Rooplal.

Additional accusations involve the potential manipulation of a police fleet tender as well as Malema’s expressed support for Khan when he faced a disciplinary hearing. Khan has attended EFF events.

Malema has also denied conspiring with Khan to have the Inspector-General of Intelligence, Dr Setlhomamaru Dintwe, removed from office by planting questions to “trap” him into lying in Parliament. Dintwe had not approved Khan’s security clearance.

Smoking guns

That these volumes of chats and documents have been made public is thanks only to Khan himself and what turned out to be a wrong-footed legal move to have the crucial information kept secret and for the inquiry to be held in camera.

However, Khan clearly hadn’t bargained on the legal agility of the Madlanga team of evidence leaders and investigators, who pounced on the material like honey badgers around a sweet treat.

As the clock ticks for the commission to conclude its work, officials found themselves with a treasure trove of evidence and smoking guns everywhere.

This has provided the commission with the material to bridge a gaping hole when it comes to piecing together a complicated puzzle of criminal behaviour intersecting with powerful state players.

It has been a year since the KwaZulu-­Natal provincial police commissioner, Lieutenant-General Nhlanhla Mkhwanazi, held his unexpected and game-changing press conference in July 2025. The country has not been the same since.

A long road to disclosure

Back in August 2021, Daily Maverick wrote about Khan, the mysterious millionaire top cop, his considerable assets, including his properties and interests in the motor spares industry, his close proximity to various persons of interest and his lack of security clearance.

We also covered other aspects of Khan’s controversial career of more than 30 years in the SAPS, where he jumped rank to become a major-general without the proper security clearance all the way back to 1997.

He was, we noted, a director of no fewer than eight active businesses at the time, including Spares Oasis, said to be worth R21-million.

The SAPS spokesperson at the time, the now retired Brigadier Vish Naidoo, disclosed that Khan did have permission from SAPS top brass, regardless of the fact that it was not a good look.

A face-to-face

In September 2021, Khan contacted this journalist via a trusted third party requesting a face-to-face meeting. This took place on 25 September 2021 and was scheduled for 3pm at a “small Asian restaurant” in Woodstock, Cape Town.

The third party was part of this meeting. Khan arrived about an hour late, introduced himself and began by saying he was taking Daily Maverick to the Press Council for the article about his wealth.

A second issue he was unhappy about was Daily Maverick’s publication of a disciplinary report, titled “Inquiry Into Impropriety of Use of Delegated Powers No 7182077-9 Major ­General F Khan”, after a hearing held on 16 September 2021.

Khan had signed off on at least five tenders for Covid personal protective equipment (PPE) during his three months as acting head of the Crime Intelligence (CI) Division between December 2020 and February 2021, it was learned at the time.

The commission heard this week that Sayed and Ismail Vally, owner of a car spares business, had congratulated Khan on being appointed to the acting position and were, by that time, already discussing inside information with Khan, who was now in charge of the secret Crime Intelligence fund.

The disciplinary inquiry concluded that the powers “exercised by Maj General Khan were exceeded in so far as they were delegated beyond the delegation of the National Commissioner and therefore lack legal standing”.

The inquiry report was signed off by the Limpopo provincial police commissioner, Lieutenant-General Thembi Hadebe, who retired in June this year.

Hadebe added that “it is my view that Maj Gen Khan was acting in good faith without malice intent [sic] focusing on ensuring that the administration of the Division CI is effective [sic] so as to prevent any maladministration taking into account the prevailing situation at the time he was entrusted with the responsibility of an overseer”.

Hadebe recommended that all Khan’s actions taken above the level of divisional commissioner “be reviewed”.

There was a proviso higher up in the report: “There is little doubt in this instance that both the national commissioner and the minister can be exposed to litigations should those transactions be challenged.”

Enter Sindile Mfazi

The death of General Sindile Mfazi, deputy national commissioner for crime detection, was bumped up from an inquest into a full-blown murder investigation, the SAPS announced this week.

Although initial SAPS communication suggested Mfazi had died on 8 July 2021 of Covid complications, his body was exhumed and an autopsy later discovered he had been killed through the use of the toxin ricin.

The use of ricin is significant as it is a well-known method used by intelligence services, the most famous being the 1978 killing of Bulgarian dissident journalist Georgi Markov, who was administered the poison with a modified umbrella on Waterloo Bridge in London. To prepare the poison, the killer needs expert knowledge and a lab.

Mfazi died while investigating the CI Secret Services Account linked to R1.6-billion in expenditure on Covid-19 PPE. His notebook – retrieved by his family after his death – indicates his focus was on this and a meeting he had with the Office of the Inspector-General.

Meanwhile, the commission heard that Mfazi had been in contact with the bespectacled “ethical hacker” Tumelo Nku – linked to a R286-million cocaine bust at a shipping container warehouse at Aeroton, south of Johannesburg, on 9 July 2021.

Nku has told the inquiry he had tipped off Mfazi about the consignment of drugs months before it was intercepted. Mfazi died the day before the bust.

Nku also revealed he had alerted the Gauteng traffic head, Chief Inspector Samuel Mashaba, about the drug movements from Durban to Johannesburg. Khan was placed at the scene of the Aeroton bust and, according to Nku, ordered Nku’s arrest after discovering he was the whistleblower.

Mashaba has since been suspended after his grilling at the commission about links to late former deputy president David Mabuza.

The commission has also heard evidence that Mashaba failed to follow protocol in not alerting the SAPS to the drug consignment and had impersonated a member of the Directorate for Priority Crimes Investigation.

A South African Narcotics Enforcement Bureau member, “Witness I”, supported allegations that Khan had “hijacked” the operation while not being part of the investigating team. “Khan pulled rank on me,” the witness told the commission.

After Khan’s controversial appointment as acting head of CI from December 2020 to February 2021, the senior officer was shipped back to counterintelligence until his dramatic arrest this year. He was replaced by Lieutenant-General Yolisa Mokgabudi.

There has been no evidence connecting Khan to Mfazi’s death.

Insider trading

This week, reading Khan’s chats with Vally, the car parts businessman, advocate Hassim took hours to pull together the threads of how the two men colluded on a specific SAPS tender for car spares and tools worth R54-million.

Then there are the messages between Khan and Vally detailing the hot pursuit of a government tender for “automotive supplies” by a company called Kaizen MSD.

They reveal a concerted effort by Khan to influence the National Treasury’s bidding process through insider contacts and other intermediaries.

Hassim said these communications provided prima facie evidence that Khan had shared internal SAPS and Treasury documents about confidential bids not only for automotive supplies, but also Covid PPE and other tenders.

Vally and Khan also discussed various mechanisms for concealing financial gains while maintaining the anonymity of “partner” companies and keeping profits “outside” the official system.

Ultimately, these chats reveal a high-stakes attempt to leverage clandestine relationships to ensure the successful awarding of lucrative state tenders.

The tobacco kings

Evidence suggests that Sayed and Mazzotti’s company, Carnilinx, was allegedly involved in “ghost smuggling”, in which cigarettes meant for export are illegally sold inside South Africa to evade taxes.

Evidence also suggested Khan improperly tried to manipulate procurement for his and Sayed’s benefit.

Chats also suggest Khan and Sayed conspired to use SAPS resources to neutralise competitors of Carnilinx and that Khan was aware of the company’s alleged tax evasion.

The Madlanga Commission has been one of the most effective inquiries South Africa has ever experienced, with more than 30 arrests made since its first public hearings in mid-September 2025. DM

The rise and rise of Feroz Khan

When former police minister Fikile Mbalula tried to seize control of the Crime Intelligence Division back in 2017 – issuing a ministerial directive rescinding the promotion of Feroz Khan – the senior SAPS officer was already in the media spotlight.

In 2017, City Press revealed that Khan, who was photographed with former president Jacob Zuma, had been working since 1997 without high-level security clearance.

Khan, who jumped ranks from colonel to major-general (skipping brigadier altogether), was controversially appointed acting head of Crime Intelligence after the suspension in 2020 of divisional commissioner Peter Jacobs.

This skipping of rank was one of the reasons that then police minister Bheki Cele refused to sign off on the “continuation of Secret Services Account application” by Khan while he was in the hot seat. In May 2021, Cele wrote to the national police commissioner, General Khehla Sitole, noting it had come to his attention that Khan’s delegation by the late Lieutenant-General Sindile Mfazi had been illegal.

Khan has survived various internal inquiries and disciplinaries over the years despite his vast business interests, his proximity to alleged tobacco and drug smugglers, politicians and, now, compromised fellow police officers, tallying around 30, who have been suspended or arrested as a result of the Madlanga Commission.

This story first appeared in our weekly Daily Maverick 168 newspaper, which is available countrywide for R35.