Public procurement, corruption proceeds and state capture

I begin every procurement-fraud training with a blunt proposition: a tender file is a narrative document, and like any narrative it can be fabricated, but fabrication leaves style. Bid rigging is the foundational typology, and it comes in a small number of recurring forms that any tax auditor or FIU analyst should be able to name on sight. Cover biddingCover biddingCompetitors submit deliberately uncompetitive or non-compliant bids to create the appearance of competition around a pre-arranged winner. occurs when a designated winner arranges for competitors to submit bids that are deliberately non-compliant or priced above the winner's figure, creating the appearance of genuine competition while the outcome was fixed before the tender closed. Bid rotationBid rotationA cartel takes turns winning tenders across a series of procurements, only visible when award data is aggregated across time. occurs across a series of tenders rather than within one, where a cartel of contractors takes turns winning, each accepting an inflated allocation of tenders in exchange for standing down on others, a pattern only visible when an investigator aggregates award data across years rather than examining a single procurement in isolation. Market or customer allocation divides contracts geographically or by client so that colluding firms never actually compete for the same business, which is why South Africa's Competition Commission has repeatedly found cartel conduct in construction, an industry the Competition Tribunal's 2013 fast-track settlement process addressed through admissions from more than a dozen major contractors covering projects including World Cup stadium construction.

Specification steeringSpecification steeringTender specifications are drafted, before publication, narrowly enough that only a pre-selected supplier can comply. is a subtler and, in my experience, harder-to-prosecute typology because it operates upstream of the bid itself. Here a corrupt official, often working with the intended contractor before the tender is even published, drafts technical specifications narrow enough that only one supplier's existing product or proprietary system can comply, while the specification reads as generic and defensible on its face. I have seen this in IT procurement repeatedly: a requirement for a particular certification, a specific software licensing architecture, or an unusually short delivery window that only a supplier with pre-positioned stock could meet. The forensic signature is a specification document whose drafting history — track-changes metadata, email correspondence between the procuring entity and the eventual bidder predating the tender's publication date, or specification language that mirrors a particular vendor's marketing material verbatim, establishes collusion even where the bid process itself was formally compliant.

Shell subcontractors are where procurement fraud converts most directly into money laundering, because the subcontract layer is typically subject to far less scrutiny than the prime contract. A prime contractor wins a legitimate tender, then subcontracts a substantial share of the value; commonly 20 to 40 percent in the cases I have reviewed, to an entity that performs no genuine work, controlled by or related to a procurement official, a politically exposed person, or the prime contractor's own principals operating through a nominee. The subcontract invoice is the laundering instrument: it converts what is functionally a bribe or a profit-skim into an apparently ordinary business expense, deductible for tax purposes and defensible on the prime contractor's own books. Inflated variation orders serve the same function after contract award — a genuine, modestly priced original contract is followed by a sequence of "change orders" or "variation orders" that are individually small enough to avoid the re-tendering threshold but which cumulatively multiply the contract value, often for scope changes that were foreseeable and should have been specified at the outset, indicating either incompetent original specification or deliberate lowballing to win the tender before recovering margin through variations.

The paper trail each of these leaves is distinct, and part of what I try to instil in trainee investigators is fluency in reading procurement documents as evidence rather than as administrative artefacts. Cover biddingCover biddingCompetitors submit deliberately uncompetitive or non-compliant bids to create the appearance of competition around a pre-arranged winner. and bid rotationBid rotationA cartel takes turns winning tenders across a series of procurements, only visible when award data is aggregated across time. are detectable through screening techniques borrowed from competition-law enforcement: analysing bid-price clustering, the frequency and rotation pattern of winners across a category of tenders, and unusually consistent price differentials between a winning bid and the "covering" bids that lost. Specification steeringSpecification steeringTender specifications are drafted, before publication, narrowly enough that only a pre-selected supplier can comply. requires document forensics — metadata analysis, correspondence timelines, and comparison of specification language against vendor product literature. Shell subcontractorShell subcontractorA subcontracting entity that performs no genuine work, used to convert bribe payments or profit-skims into deductible business expense. schemes require piercing the subcontract relationship itself: verifying that the subcontractor has employees, equipment, premises and a tax compliance history consistent with the work it purports to have performed, cross-referenced against the beneficial-ownership register maintained under South Africa's Companies Act 71 of 2008 as amended, which since 2023 requires companies to file beneficial-ownership information with the Companies and Intellectual Property Commission. Variation-order inflation requires comparing the awarded contract's original bill of quantities against the final paid amount and testing whether the pattern of variations was foreseeable at tender stage, a test South Africa's National Treasury instruction notes on irregular expenditure increasingly require accounting officers to document.

None of these typologies operates in isolation in real cases; a captured tender typically layers several together, with specification steeringSpecification steeringTender specifications are drafted, before publication, narrowly enough that only a pre-selected supplier can comply. securing the award, shell subcontracting extracting the corrupt margin, and variation orders topping up the take once the contract is running. The investigator's task is to work backward from whichever anomaly is visible, an unusual price cluster, a subcontractor with no verifiable operating history, a suspiciously specific specification, and to test whether the other typologies are present in the same file, because in my casework experience they very often are.

Once a procurement official or politically exposed person has extracted a corrupt benefit, the practical problem for both the corrupt party and the investigator is the same: the money must move from the paying contractor's accounts into the recipient's control in a form that survives scrutiny. I teach this stage as the point at which a corruption case and a money laundering case become formally indistinguishable, because UNCAC's own architecture treats them that way. The United Nations Convention against Corruption, adopted in 2003 and in force since 2005, requires states parties under Article 23 to criminalise the laundering of proceeds of the corruption offences the Convention itself defines, and Article 20's provision on illicit enrichment, encouraging states, where consistent with their constitutional principles, to criminalise a significant increase in a public official's assets that the official cannot reasonably explain — is precisely the provision investigators reach for when the underlying corrupt transaction itself cannot be proven but the wealth accumulation can.

The consultancy invoice is the workhorse integration mechanism in this space, and it deserves close attention because it is deceptively simple to construct and deceptively difficult to unwind. A contractor who has won a tender through improper means routes a portion of the contract value to a consultancy entity, often incorporated in a low-disclosure jurisdiction or simply as a domestic close corporation with a nominee director, ostensibly for "advisory," "facilitation" or "business development" services rendered in connection with winning the tender. The invoice is real in the sense that it exists and is paid; it is fraudulent in the sense that no advisory service of commensurate value was actually rendered, and its true function is to move a bribe to the official or PEP who controls or benefits from the consultancy, often through a further layer of related-party loans back to the ultimate beneficiary structured to look like ordinary intercompany financing. Agents' commissions in cross-border procurement and defence-related contracting serve an almost identical function and have been the subject of some of the most significant corruption prosecutions globally, precisely because "agent" or "local representative" commissions are a long-recognised historical vehicle for concealed bribery in international business, addressed at the multilateral level by the OECD Anti-Bribery Convention of 1997 and, domestically for South African purposes, by the Prevention and Combating of Corrupt Activities Act 12 of 2004 alongside the proceeds-of-crime confiscation regime under POCA 121 of 1998.

Related-party loans deserve particular attention because they are the mechanism by which corruption proceeds, once inside a consultancy or shell structure, are moved to the ultimate beneficiary's personal control while retaining a paper appearance of an arm's-length financial transaction. A loan from the consultancy to a family trust or a spouse's company, on terms that are never enforced, that carry no realistic expectation of repayment, and that are periodically "rolled over" or written off, is functionally equivalent to a distribution of the underlying bribe, and I instruct analysts to test every related-party loan they encounter in a PEP's financial profile against three questions: was the loan documented contemporaneously with commercial terms, has any repayment actually occurred, and does the lender have an independent, verifiable source of the lent funds consistent with legitimate business income.

This is exactly where PEP due diligence earns its place in the compliance architecture rather than functioning as a box-ticking exercise. FATF Recommendation 12 requires enhanced due diligence for politically exposed persons, their family members and close associates, including establishing the source of wealth and source of funds involved in the business relationship, obtaining senior management approval, and conducting ongoing enhanced monitoring. South Africa's FIC Act 38 of 2001, as amended by the General Laws (Anti-Money Laundering and Combating Terrorism Financing) Amendment Act 22 of 2022, extended and clarified these PEP obligations for accountable institutions in the run-up to and following the FATF's February 2023 greylisting of South Africa, a listing driven substantially by findings on beneficial-ownership transparency and the effectiveness of the country's response to state-capture-era corruption; the delisting in October 2025 reflected the FATF's assessment that the identified deficiencies, including PEP screening and beneficial-ownership implementation, had been substantially addressed. In practice, effective PEP due diligence for procurement corruption requires accountable institutions — banks, but increasingly also the accountants, attorneys and estate agents brought within the FIC Act's accountable-institution net, to look past the named account holder to family members, known associates and the entities those associates control, because the corrupt official rarely receives the proceeds in an account bearing their own name.

The persistent difficulty, which I emphasise strongly in training because it is where good analysts go wrong, is that source-of-wealth verification for a senior public official is not a single data point but a reconstruction exercise: comparing declared assets against declared salary and known family wealth over time, identifying the years in which asset growth diverges from any plausible legitimate income, and only then testing whether specific related-party transactions in that window correspond to identifiable procurement awards to entities connected to the PEP. Source-of-funds and source-of-wealth are frequently conflated in practice but are analytically distinct: source of funds asks where the specific money in a specific transaction came from, while source of wealth asks how the PEP's overall net worth was accumulated, and a due diligence file that answers only the former while ignoring the latter will miss precisely the illicit-enrichment pattern Article 20 of UNCAC anticipates.

State captureState captureThe systemic capture of state institutions themselves — boards, executives, procurement policy and internal controls, to route public funds to a durable private network, as distinct from opportunistic individual corruption. is a different order of problem from the individual procurement fraud or kickback scheme, and I am careful to draw the distinction sharply for students, because treating state captureState captureThe systemic capture of state institutions themselves — boards, executives, procurement policy and internal controls, to route public funds to a durable private network, as distinct from opportunistic individual corruption. as simply "corruption at scale" understates what actually happened in the South African case and misdirects the investigative approach. Ordinary procurement corruption is opportunistic: an official exploits a discretionary decision point for private gain within an otherwise functioning institution. State captureState captureThe systemic capture of state institutions themselves — boards, executives, procurement policy and internal controls, to route public funds to a durable private network, as distinct from opportunistic individual corruption., as the Judicial Commission of Inquiry into Allegations of State CaptureState captureThe systemic capture of state institutions themselves — boards, executives, procurement policy and internal controls, to route public funds to a durable private network, as distinct from opportunistic individual corruption.; universally known as the Zondo CommissionZondo CommissionThe Judicial Commission of Inquiry into Allegations of State Capture, chaired by Raymond Zondo, whose final report parts were published through 2022 and whose evidentiary record documents SOE-level capture., chaired by then Deputy Chief Justice Raymond Zondo and reporting in a series of parts between 2022 and 2022, with its final report parts published through mid-2022, documented across state-owned enterprises including Transnet, Eskom and Denel, is systemic: it involves the deliberate capture of the institutions themselves, including the appointment of compliant boards and executives, the redirection of procurement policy to favour a defined network of related companies, and the disabling of internal controls, so that what results is not a series of individual fraudulent transactions but a durable operating architecture through which public funds are routed to private benefit as a matter of ordinary business.

The Zondo CommissionZondo CommissionThe Judicial Commission of Inquiry into Allegations of State Capture, chaired by Raymond Zondo, whose final report parts were published through 2022 and whose evidentiary record documents SOE-level capture.'s evidentiary record is unusually valuable for teaching purposes precisely because so much of it is now public: testimony transcripts, forensic reports commissioned by the Commission itself, and the six-part final report are available through the Commission's published record, and they document with granular specificity how the network operated at Transnet and Eskom in particular. A recurring pattern across the SOE evidence was the use of consulting and advisory contracts — often awarded to firms with international brand recognition, whose scale and reputation made their invoices appear presumptively legitimate to boards and auditors — to legitimise large fee flows to intermediary entities that then paid kickbacks onward to a defined network of politically connected individuals and family members. The Commission's findings regarding the role of certain global consulting and audit firms operating in South Africa during this period were significant precisely because they showed that state captureState captureThe systemic capture of state institutions themselves — boards, executives, procurement policy and internal controls, to route public funds to a durable private network, as distinct from opportunistic individual corruption. required, and obtained, the active or negligent participation of professional service providers whose institutional role is normally understood as a check on this kind of conduct rather than a facilitator of it; several of these firms subsequently faced regulatory and reputational consequences domestically and internationally.

A second structural feature the Commission's record makes clear is the centrality of procurement policy manipulationProcurement policy manipulationSystemic misuse of thresholds, single-source justifications or localisation requirements to steer major contracts toward a captured network. as the enabling mechanism, rather than one-off bid rigging. At Transnet and Eskom, evidence before the Commission described how procurement thresholds, single-source justification provisions, and localisation or empowerment-credential requirements were used or misused to steer major contracts, including, prominently, locomotive procurement contracts at Transnet; toward entities connected to the captured network, sometimes at prices substantially above comparable market benchmarks, with a portion of the inflated margin then flowing back through the consultancy and related-party mechanisms described in the previous lesson. This is the sense in which state captureState captureThe systemic capture of state institutions themselves — boards, executives, procurement policy and internal controls, to route public funds to a durable private network, as distinct from opportunistic individual corruption. is procurement corruption's systemic form: the same typologies, specification steering, shell intermediaries, inflated variations — recur, but embedded in and protected by a captured institutional structure rather than executed against a resistant one.

For the working investigator or analyst, the practical discipline the Zondo record teaches is network reconstruction from public and quasi-public data rather than reliance solely on whistleblowers or leaked documents, valuable as those remain. Company registry data — increasingly including the beneficial-ownership filings now required under the amended Companies Act, allows an analyst to map shared directors, shared registered addresses and shared auditors across entities that received large SOE payments; procurement award registers, where published under public finance management legislation, allow award value and timing to be tested against the entity's apparent operating capacity, and asset-forfeiture and civil-recovery proceedings brought since 2018 under the Asset Forfeiture Unit's mandate and POCA's Chapter 6 civil-forfeiture provisions provide a further public data layer, since forfeiture applications typically set out, in affidavit form, the state's own reconstruction of a specific transaction chain and can be cross-referenced against an analyst's independent network map to validate or extend it.

I ask students, as a closing exercise for this module, to resist two opposite temptations that recur in state-capture analysis. The first is treating the phenomenon as unknowable or too politically fraught to analyse rigorously, which under-serves the discipline and cedes the ground to advocacy rather than evidence. The second is over-claiming certainty from incomplete public data; inferring corrupt intent from a shared director or a single large payment without testing alternative innocent explanations, which is exactly the kind of overreach that damages the credibility of otherwise sound investigative work. The correct posture, which the Commission's own final report modelled reasonably well despite its scale and the political pressure surrounding it, is to build the network map from verifiable data points, state explicitly what remains inferential rather than proven, and design the recommended next investigative or prosecutorial step, a subpoena, an account freeze application, a referral to the National Prosecuting Authority's Investigating Directorate — around closing the specific evidentiary gap rather than resting on suspicion alone.