Chapter 2Perth Mint operations and governance
2.1The committee notes that a number of issues have been publicly reported in relation to Perth Mint governance and operations over recent years. In summary, these concerns have included:
employment and procurement impropriety;
inadequate risk assessment processes, particularly in relation to suppliers and procurement;
the inadequacy of information technology management systems;
inadequate compliance with anti-money laundering/counter-terrorism financing (AML/CTF) reporting, customer due diligence and recordkeeping requirements;
non-compliance with United States (US) international gold and silver storage operation registration; and
higher than agreed silver content of gold bullion.
2.2Relevant matters which fall within the remit of Federal parliamentary oversight relate primarily to AML/CTF regime compliance. This chapter therefore examines the operation of Gold Corporation (Gold Corp, trading as Perth Mint) over recent years, particularly with regard to the entity's compliance with the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (AML/CTF Act) and Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1) (AML/CTF Rules).
2.3This chapter then examines the response of various state and federal regulators and oversight bodies to Gold Corp's operations, primarily:
the findings of the WA Office of the Auditor General (OAG), which conducted an AML/CTF compliance framework audit of Gold Corp between 2020 and 2022; and
the Australian Transaction Reports and Analysis Centre (AUSTRAC) compliance review initiated in 2019 and the November 2023 Enforceable Undertaking (EU) provided by Gold Corp to AUSTRAC.
2.4The chapter concludes by examining appointments made to, and the role of, Gold Corp's Board and executive when responding to identified shortcomings in Gold Corp's management of money laundering/terrorism funding (ML/TF) risks within its business.
Operational incidents and concerns with Gold Corporation
2.5This section details the numerous incidents and regulatory concerns raised about the operation of Gold Corp over recent years, especially from 2018 onwards. Below are examples of Gold Corp not properly adhering to regulatory frameworks both in Australia and overseas.
Events in 2018
Trading platform data breach
2.6In September 2018, a third-party technology provider data breach resulted in the leak of personal details of approximately 3200 customers of Gold Corp's Depository Online gold, silver and platinum online trading platform. A forensic investigation was undertaken, customers were notified and supported, and the breach was reported to the Office of the Australian Information Commissioner, the WA Police and the Australian Federal Police.
Gold Corp divests itself of Perth Mint Physical Gold Exchange Traded Fund
2.7In 2018 Gold Corp and Exchange Traded Concepts LLC established a physically‑backed gold Exchange Traded Fund (ETF) which was listed on the New York Stock Exchange. In 2020, Gold Corp agreed to divest itself of the ETF, selling it to Goldman Sachs Asset Management and gaining $3.306 million. Itsold its remaining shares in the trust on 28 January 2021.
Procurement impropriety and WA CCC referral
2.8It was reported that in late 2017, Gold Corp chose not to follow legal advice to refer allegations of impropriety relating to employment and procurement matters to the WA Corruption and Crime Commission (WA CCC).
2.9In July 2018, a procurement process involving Sapien Cyber led to a series of audits and governance reviews in 2019, including one by Mr Sam Walsh AO, Chair of Gold Corp, and a forensic audit by Stantons International. It was reported that Perth Mint officials held shares in Sapien Cyber at the time of the procurement process. The 2019 reviews found that conflicts of interest were appropriately declared, and made recommendations to improve procurement processes, board governance and conduct. These recommendations were subsequently implemented. A process of board renewal was also undertaken and resulted in four new directors being appointed.
2.10In March 2019, the Stantons findings were referred to the WA CCC. The Commission determined that 'there was an insufficient basis to form a reasonable suspicion of serious misconduct in the circumstances'. However, it did find that 'breaches of procurement policies and procedures and the organisation's code of conduct may amount to an allegation of minor misconduct and that these matters could be referred to the [WA] Public Sector Commission'. It is unclear whether such a referral was made.
Events in 2020
Visitor information data breach
2.11In January 2020 a visitor information data breach by local market insights company, Metrix Consulting, resulted in the leak of contact information for around 1480 visitors to the Perth Mint. The Mint activated its cyber incident response plan, customers were notified and supported, and the breach was reported to the Office of the Australian Information Commissioner, the WAPolice and the Australian Cyber Security Centre.
London Bullion Market Association incident review—supply chain
2.12In June 2020, the London Bullion Market Association (LBMA) invoked its Incident Review Process following media allegations that Gold Corp sourced gold from an aggregator in Papua New Guinea. Concerns were raised that child labour and dangerous chemicals were used in its supply chain. Whilst misconduct by Gold Corp was not identified, the LBMA identified areas where Gold Corp risk assessment processes could be strengthened, and the LBMA required Gold Corp to implement a 90‑day Corrective Action Plan, to be audited by an independent third party.
2.13The Hon Bill Johnston MLA, then-WA Minister for Mines and Petroleum; Energy; Hydrogen Industry and Industrial Relations appeared before the committee at a public hearing in Perth, on 3 November. During that hearing, the Minister indicated that the then‑Premier, as responsible minister for Gold Corp at the time, ensured that the issues raised by LBMA were dealt with.
2.14Gold Corp finalised the LBMA-imposed 90-day Corrective Action Plan, which 'focussed on enhanced gold supplier due diligence and overall gold supply risk management'. The completed Plan was confirmed by the LBMA and independent auditors.
2.15Gold Corp also voluntarily reported a Modern Slavery Statement under the Modern Slavery Act 2018, for the period 2019/20, as part of the Commonwealth Modern Slavery regime. The statement details the modern slavery risks and mitigation activities undertaken by Gold Corp and was developed 'as a sign of [Gold Corp's] strong and ongoing commitment to the principles it describes'. It also helps to address LBMA and Organisation for Economic Co-operation and Development (OECD) requirements for responsible sourcing of gold and due diligence. Gold Corp's most recent statement covers 2020/21.
Euro Pacific Bank ceases to be a Perth Mint client
2.16In January 2020, Euro Pacific Bank (Puerto Rico) became the subject of the world's largest tax evasion and international money laundering investigation—Operation Atlantis—as a result of fallout from the 'Panama Papers scandal'. In October 2020 media reporting identified the Bank as a Perth Mint client.
2.17AUSTRAC advised the committee that Australia's Serious Financial Crime Taskforce started to consider the Bank in mid-2018, including 'having a look at the interaction between that offshore entity and its relationship with the Perth Mint'. Mr John Ford, Deputy Commissioner at the Australian Taxation Office confirmed that 'tax evasion or tax crime is a predicate offence for money laundering' and it therefore becomes of interest to other agencies.
2.18Reporting suggested that the Perth Mint held more than $100 million of gold on behalf of Euro Pacific Bank clients and that the Mint relied on the bank's vetting processes, rather than conducting its own identity checks as required under AML/CTF requirements.
2.19A globally coordinated 'day of action' to stop 'suspected facilitation of offshore tax evasion' was undertaken in January 2020 by tax enforcement authorities and other agencies from Australia, Canada, US, UK and the Netherlands. The Australian Taxation Office confirmed 'actions included intelligence and information gathering, search warrants, interviews, production orders and subpoenas', with the actions focussed on stopping 'suspected facilitation of offshore tax evasion and money laundering' by the Euro Pacific Bank. MrShane Love MLA alleged, during the committee's 3 November Perth hearing, that the Perth Mint was 'raided' as part of this day of action, however the committee has not received corroborating evidence to support this claim.
2.20Gold Corp indicated that earlier internal audit processes had not identified any risks with the Bank. However, in November 2020 the Perth Mint ended its relationship with the Euro Pacific Bank 'as a result of the media speculation and commentary in relation to that … We didn't want to be dealing with anybody where there were any concerns or issues'.
2.21Minister Johnston indicated to the committee during the 3 November hearing that the minister responsible at the time, the HonMark McGowan MLA, then‑WA Premier, acted to deal with matters immediately.
Events in 2021
One-Future Enterprise Resource Planning Program
2.22Enterprise Resource Planning (ERP) systems are typically integrated business management applications, used to manage key business processes and track resources and commitments. The systems typically share data across various modules including human resources, accounting, procurement, purchasing, production and sales.
2.23An ERP system was to be developed for the Mint, to 'run financial accounting and metal accounts'. Media reports suggested the ERP project was given the 'green light in 2014, with a $16 million budget and an 18 to 24‑month timeline'.
2.24Evidence from Minister Johnston, however, indicated that after commencement of the project it became evident that the one‑for-one replacement of the ERP would not meet the Mint's requirements.
2.25As such, a revised One-Future ERP Program commenced in August 2016 and had a broader scope which included ERP replacement as one facet of the program.
2.26In November 2018 the Gold Corp Board agreed to replace its existing e‑commerce platform and digital experience to support its core business, as the existing system was no longer supported and could not accommodate future growth. Other benefits such as improved customer experience, and business process improvements were identified. The initial budget was $31.3to $33.3million, with go live planned for March 2020.
2.27Gold Corp's 2022 Annual Report confirms that in November 2021 it completed the 'introduction of a fit‑for‑purpose [ERP] solution'. The Annual Report stated that the ERP would be 'the foundation for the Corporation's core financial and front-end customer facing ecommerce platform'.
2.28Other documents indicate that the final cost of the ERP program was $55.31million. However, media reports indicated that the total cost of the six‑year project was over $100million. Further, it was reported that:
… the company classified the software upgrade as an intangible asset, capitalised some of it and amortised the rest over the six-year period.
2.29The same report in the Australian Financial Review suggested it had seen documents describing what happened when the ERP went 'live':
… the ERP system went live at the end of November [2021] but crashed the Perth Mint's systems, which were offline for at least 24 hours, restricting the Mint's capacity to accept, dispatch or check stock levels.
Gold Corp AUSTRAC registration and reporting failures
2.30In early 2021, Gold Corp discovered it had not registered with AUSTRAC as a remittance service provider as required under the AML/CTF Act. Registration had been outstanding since the legislation came into force in 2006.
2.31Providing remittance services without registration is a criminal offence under the Act.
2.32Gold Corp self-reported to AUSTRAC and registered as required in February2021, with the matter resolved the following month.
2.33At the same time, Gold Corp did not make any international funds transfer instructions (IFTIs) reports to AUSTRAC up to the end of June 2021. This occurred despite Gold Corp 'operating an international gold trading app[lication] and selling bullion to customers in 130 countries'.
2.34Minister Johnston advised that he became aware of this issue in August2022—well after March 2021 when it was resolved (and before he took responsibility for the Perth Mint).
2.35The issue became public in March 2023 when the ABC Four Corners program 'Tainted Gold' reported the Mint had failed to report more than 5000 international transactions.
Perth Mint goes cashless
2.36In July 2021, the Perth Mint discontinued cash transactions, including for the purchase of gold. The Mint went cashless in recognition of the higher risk of money laundering associated with cash transactions, with potential for 'know your customer' requirements to be circumvented.
2.37In November 2021, as a result of an AUSTRAC ML/TF Risk Assessment, Gold Corp considered further the risks of cash transactions to its business, noting that although it had stopped accepting cash payments in July, it appeared to still offer the ability for customers to submit cash deposits directly into Gold Corp bank accounts. The outcome of this review is unknown.
Shanghai Gold Exchange standard breached
2.38In September 2021, Gold Corp administration became aware that, while the purity of its gold bullion bars remained above 99.99 per cent, the silver content of the permitted 0.01 per cent non-gold component of the bars exceeded the Shanghai Gold Exchange specification of no more than 50 parts per million.
2.39As a result, the Mint reviewed its refining practices, and new processes were put in place to ensure that bullion bars would have an average minimum gold purity of 99.996 per cent versus the 99.992 per cent industry standard. These processes, which also comply with Shanghai Gold Exchange specifications, came into effect in December 2021.
2.40The Board was notified of the issue in October 2021, with the Minister advised of the issue and its resolution in January 2022.
2.41The Perth Mint continues to guarantee that its gold meets 99.99 per cent purity—as per the industry standards and standards set by the LBMA—with gold purity remaining at or above this guaranteed level at all times.
2.42The issue became public in March 2023 in the ABC Four Corners program. Experts attributed the failure to poor systems management and compliance at the Mint, and stated that up to 100 tonnes of gold sent to China might need to be replaced, although this was deemed 'extremely unlikely' by the then-Premier, the Hon Mark McGowan.
2.43In May 2023, the LBMA invoked its Incident Review Process in response to media reports about the Perth Mint's conduct. LBMA completed this process shortly after, and announced that Gold Corp would remain on the Good Delivery List, noting the credibility of Gold Corp's assay lab.
2.44However, the LBMA noted that there were elements of Gold Corp's 'management systems which need to be strengthened through a Corrective Action Plan, audited by a third-party auditor'.
2.45Although the Mint advertises that it continues to be accredited by the LBMA and meets the requirements of the Shanghai Gold Exchange, it is unclear whether it is still accredited by the Shanghai and other gold exchanges it was previously accredited with. The Shanghai Gold Exchange has since 'bought tonnes of gold' from the Perth Mint.
GoldPass app discontinued
2.46In 2018, Gold Corp launched its GoldPass application—a mobile app allowing investors to instantly and securely buy, sell and transfer physical gold via digital certificates, backed by gold held by the Mint, and guaranteed by the WAGovernment.
2.47The app required investors to register with only a driver's licence or passport and bank account under the same name, allowed trading without a maximum amount, and allowed gold and silver to be converted to cash or metal at any time.
2.48In late 2021, the Perth Mint decided to discontinue the GoldPass app—by March2023 for US customers and November 2023 in Australia—stating 'the decision was made as a result of a regular review of our products and is in line with our stronger focus on risk minimisation'.
2.49As of 28 March 2023, there were 8641 active account holders and as of 29August2023 the following transactions had been conducted in the GoldPass app:
Table 2.1Transactions in the GoldPass app to 29 August 2023
| | |
Buy/sell | 135 725 | |
Buy | | $180 295 363 |
Sell | | $123 500 611 |
Peer-to-peer transfer | 1442 | $19 360 139 |
Total (buy, sell, transfer) | 139 645 | $323 156 113 |
Source: Mr Johnston MLA, WA Legislative Assembly, Hansard, 10 October 2023, pp. 5211‑5212
Events in 2022 and 2023
US Model State Commodity Code non-compliance
2.50In March 2023, the media reported that by at least May 2022 Gold Corp was aware that it had potentially breached the US Model State Commodity Code1985 in nearly 23 states, affecting the ability of Gold Corp to trade in some states. Reports suggested the Minister was advised of the breach in June 2022.
2.51The media suggested that of the total 'depository metal' held by the Perth Mint on behalf of clients, around six per cent was held on behalf of US clients in Model State Commodity Code states—worth nearly USD$254million.
2.52In the WA Legislative Assembly, Mr McGowan advised that 'the US model state commodity code prohibits the sale and offer of commodities to persons for investment or speculative purposes unless a relevant exemption applies'.
2.53Then‑Minister Johnston advised that the potential non-compliance dated back to the late 1990s and affected 1305 accounts. Gold Corp acknowledged in September2022 that it was dealing with 'historic non-compliance issues', had self-reported to US regulators and noted the issue as a potential, unknown contingent liability.
2.54Gold Corp engaged a legal counsel in the US to assist in resolving the matter. Then-Minister Johnston noted in May 2023 that, to date, the US regulator had not prosecuted non-compliance where there was no fraud, as was the case with the Perth Mint.
Withdrawal of Perth Mint Gold Token
2.55In October 2019 InfiniGold (later Trovio), launched the Perth Mint Gold Token, 'the first digital gold token on a public blockchain backed by government guaranteed gold' physically stored at the Perth Mint. Tokens were able to be bought and sold through the GoldPass app.
2.56In March 2023 Trovio announced it would no longer support the digital tokens because of Gold Corp's alleged breaches of Australian and US laws. Around 1195 Perth Mint Gold Tokens, worth around $3.5 million, have been issued. Trovio confirmed that token holders can trade out over time.
2.57Minister Johnston confirmed that the Perth Mint had already commenced the process of withdrawing from the Perth Mint Gold Token in 2022 in order to simplify its business. The then-Minister argued that:
… the Perth Mint gold tokens were never a product of the Perth Mint, but rather of the commercial partner … the use of the branding of the Mint was for the commercial counterparty's benefit, and that is the reason that a licence fee was paid by the commercial counterparty to the Mint.
Office of the Auditor General (WA) and AUSTRAC findings
2.58This section outlines the engagement of the OAG and AUSTRAC, and the adverse findings that both bodies have made against Gold Corp over numerous years.
Office of the Auditor General
General views of the WA Auditor General
2.59The WA Auditor General, Ms Caroline Spencer, explained that her concerns about the operation of Gold Corp dated back to her commencement in the role of Auditor General, in 2018. MsSpencer told the committee:
When I became Auditor General five years ago, my office was dealing with a Perth Mint which was at times defensive and deflective and which exposed itself and, therefore, its owners—the Western Australian public—to unnecessary risk. Back then, broadly speaking, as an organisation it was doing okay. In fact, some things it was doing very well. My office's concern was that it had taken a detour from focusing on its core business. That core business of the Perth Mint, which is owned by the people of Western Australia, is to refine and market Australian gold and to run a museum in the heart of the city. My view is that it got a little adventurous, pushing into new markets, new products and new customers, but with a failure to fully appreciate the additional risks and obligations those changes brought and to appropriately manage all risks across the organisation. Perhaps most significantly, it did not build the momentum necessary to keep pace with the maturing regulatory obligations regarding anti-money-laundering and counterterrorism financing, which left it playing catchup with that particular regulatory framework.
2.60Ms Spencer further indicated that she first met with the then-Gold Corp CEO MrRichard Hayes in September 2018, to discuss introductory matters, the cyber breach and information system controls at the Mint. With this meeting in mind, Ms Spencer made some observations about how the Corporation was operating at that time:
The organisation in itself didn't necessarily sound or appear to me that it was a typical public sector organisation owned by the taxpayer and with the same level of scrutiny in regard to the risk and benefits that it would take on, always in the interests of the taxpayer. It was moving into other products and markets over this period. I would characterise it as: I didn't know precisely what the matters were in my first interactions, but something didn't seem entirely fitting in relation to non-financial audit questions. There was a level of defensiveness, as I say, and deflection. My first meeting with the then CEO, on a matter related to information system controls, cemented that in my mind.
OAG AML/CTF compliance framework audit
2.61In 2020, the OAG decided to conduct an AML/CTF compliance framework audit into the eight WA state entities with AML/CTF obligations under federal law, including the Perth Mint. This decision was informed by the Auditor General's concerns about the Perth Mint, and the results of an independent internal audit commissioned by Gold Corp in 2020, the results of which had been shared with the OAG (discussed later in this chapter). The OAG noted that while AUSTRAC is the regulator of AML/CTF obligations, its review 'was undertaken to gauge how well entities are addressing their compliance obligations through establishing appropriate arrangements to manage the risk their operations could pose to the community and the State'.
2.62The Auditor General advised that from July 2020 she and her office had contact with AUSTRAC 'around our forensic audit program more generally' and in relation to the compliance framework, to help the OAG understand the obligations and which entities had responsibilities under the AML/CTF regime.
2.63AUSTRAC information was shared with the OAG under a memorandum of understanding. AUSTRAC later provided 'minor suggestions' on the final OAG audit report 'relating to how the report characterised AML/CTF obligations, and confirmed the appropriateness of references to AUSTRAC in the report'.
2.64The OAG finalised and published its audit report in October 2022. The report did not provide individual results but found that compliance areas were deemed 'inadequate' across four unnamed agencies and across various areas, as illustrated in Figure 2.1.
Figure 2.1OAG findings for eight audited entities
Source: Office of the Auditor General for Western Australia, Compliance Frameworks for Anti-Money Laundering and Counter-Terrorism Financing Obligations (accessed 20 November 2023).
2.65The OAG further advised it found:
Entities have arrangements in place at varying levels of adequacy to address their key anti-money laundering and counter-terrorism financing obligations under the Act. Six of the eight need to upgrade elements of their programs to improve the likelihood they can detect and respond to suspicious activity effectively and manage their money-laundering, terrorism-financing and regulatory compliance risks. Two of these entities are missing key program elements and are at greater risk of non-compliance and money laundering or terrorist financing activity.
2.66All entities audited generally agreed with and accepted the findings of the OAG AML/CTF audit. Gold Corp responded to the audit as follows:
Gold Corporation thanks the Office of the Auditor General for their thorough review of its compliance with AML/CTF obligations. The Corporation has strategic initiatives planned around data, processes and technology and will continue to work with AUSTRAC as it has done throughout the year on ensuring its AML/CTF program is robust and appropriate.
Perth Mint and findings of the audit
2.67The OAG's audit of WA entities against AML/CTF obligations was directly relevant to the operations of the Perth Mint.
2.68In evidence to the committee, Gold Corp indicated it initiates cyclical independent assurance audits on a regular basis, every two or three years 'depending on the nature of the matter'. Gold Corp finalised such an audit in 2018, with the following regular audit conducted in 2020.
2.69The WA Auditor General advised that Gold Corp's Audit and Risk Committee brought internal audit matters relating to AML/CTF compliance to her attention in June 2020. MsSpencer met with Mr Walsh on 23 June 2020 to discuss her concerns about an earlier data breach and the internal audit, advising:
I met with him in June 2020 to specifically raise my concerns around anti‑money-laundering and other risks. I may have met with him before, and I found him very receptive to my concerns around risks.
2.70Ms Spencer thought that Mr Walsh clearly understood the risks to Perth Mint's business, including operational and reputational risks, as well probity concerns about a previous information technology contract. However, Ms Spencer advised Mr Walsh that emerging AML/CTF compliance obligations and risks were becoming much more significant.
2.71The Mint's internal audit was finalised in August 2020. It identified three minor, three medium and three 'significant findings', including 'concerns with the ability of the entity to adequately meet its AML/CTF reporting obligations'. Specifically:
inconsistent application of know your customer procedures;
the need to meet training obligations; and
shortcomings in transaction monitoring and retention of evidence of monitoring.
2.72Gold Corp provided the committee with further detail about the report's findings:
The design of the AML/CTF program 'broadly aligned with the requirements of the AML/CTF Rules'.
There was scope to strengthen, formalise and more effectively implement controls and procedures so they were better understood and more consistently applied.
Employee changes in the Risk and Governance team impacted the operation of the AML/CTF Program.
The Transaction Monitoring Program was largely manual and relied on employees exercising judgement to identify suspicious transactions.
Records of formal AML/CTF training were not available.
Gold Corp had taken action to address previous findings relating to AML/CTF training and customer due diligence but the controls were not consistently applied.
2.73The OAG reviewed the internal audit as part of its regular financial audit processes. Ms Spencer indicated that in 2020 her office was still in an 'exploratory phase' and that at this time she was not aware 'of the severity of these issues'.
2.74Likewise, Mr Walsh indicated that as no AML/CTF shortcomings had been identified prior to the August 2020 audit, the issue would not have been previously flagged with the minister.
Annual financial audits
2.75In addition to the independent internal audit, the media reported that in March2021 the Gold Corp Board were internally advised of concerns about the entity's ability to comply with AML/CTF obligations due to outdated computer systems.
2.76Mr John O'Connor, Gold Corp Board member and Chair of the Audit and Risk Committee, advised that in June 2021 the OAG, as part of its regular annual audit, 'also did some specific work in relation to AML/CTF compliance'. He further advised 'there were some recommendations from that audit, all of which were consistent with the issues that we ourselves identified'.
2.77In May 2021 the Auditor General briefed Minister Johnston about current audit matters, including those relating to Gold Corp.
2.78On 17 May 2021, Ms Spencer met with then‑Premier and Treasurer, MrMcGowan, the meeting having been delayed from late 2020 due to 'mis-scheduling'. The Auditor General discussed the 2020 state financial audit results and risks relating to Gold Corp, in particular the 'government guarantee of PerthMint ([including] related risks of precious metal inventories and AML/CTF risks and frameworks compliance gaps)'.
2.79MsSpencer expressed her concerns about the Perth Mint to the Premier and indicated that scrutiny of the Perth Mint would be increased, with the Gold Corp Chair and Board receptive to the additional attention:
I briefed the premier in late 2020 [later corrected to 17 May 2021] that I was concerned that there were risks in that entity, some of which the board was growing aware of … Regarding the risks relating to the entity getting adventurous—and I raised those with the premier in late 2020—I advised the premier that I had informed the board and I also was intending to do some additional work on the matter.
2.80Also in May of that year, the Auditor General attended the Gold Corp Audit Committee meeting and OAG staff met with the Minister's staff 'regarding AML/CTF legislative and compliance frameworks for State entities and Gold Corporation in particular'. The Auditor General continued to meet with Gold Corp through June and July to verify precious metal stock and discuss 'audit matters including AML/CTF compliance'.
2.81Then-CEO Mr Hayes further briefed the Minister about matters relating to GoldCorp in August 2021. MsSpencer and staff met with Mr Walsh, Mr Hayes and Mr O'Connor on 31August 2021 to:
… provide feedback on the financial audit and management letter responses ahead of the final financial audit exit meeting. Auditor General advised outcomes of deliberations on potential modifications to the audit opinion.
2.82MrHayes provided a briefing the Minister on 1September 2021.
2.83In October 2021, the Auditor General briefed the Minister regarding the annual financial audit results for Gold Corp, for 2021. MinisterJohnston advised the WA Legislative Assembly that he was told 'issues around the AML/CTF were "not going to blow up" and it was suggested that the CEO of AUSTRAC had acknowledged the Auditor General's rigorous interrogation of GoldCorporation'.
2.84The Auditor General and staff subsequently met with acting Gold Corp CEO, Mr John Collins in November 2021, and also met in March 2022 with the acting CEO, MsJaneKing, MrWalsh and Mr O'Connor to discuss the financial audit.
2.85On 5 April 2022, the Auditor General met with Mr McGowan to discuss performance audit work, including the forthcoming AML/CTF Compliance Frameworks audit. The following day she briefed Minister Johnston on audit matters, including an update on the Perth Mint.
2.86In May 2022 Minister Johnston advised a WA Parliamentary Committee that he anticipated a future routine AUSTRAC review, which had been delayed due to COVID-19.
2.87In August and October 2023, the Auditor General again met with Gold Corp and Minister Johnston in relation to the annual financial audit for 2023.
AUSTRAC
2.88This section outlines the interactions that AUSTRAC has had with GoldCorp about its compliance with the AML/CTF legislative framework.
2.89AUSTRAC is Australia's AML/CTF regulator and financial intelligence unit (FIU). AUSTRAC explained that it:
… provides financial transaction data and actionable financial intelligence to law enforcement, national security, human services and revenue agencies (AUSTRAC's partner agencies), as well as international counterparts. Partner agencies use this information to assist them to detect, prevent and disrupt money laundering and terrorism financing (ML/TF) and other serious crime.
As a regulator, AUSTRAC oversees the compliance of more than 17,000 Australian businesses with the AML/CTF Act and associated Rules. AUSTRAC's regulated population ('reporting entities') includes a broad range of businesses from across the financial services, gambling, bullion, remittance and digital currency exchange sectors.
2.90Relevant to Perth Mint, on 1 April 2020 AUSTRAC issued a public notification identifying the higher risks of criminal exploitation in some areas of Australia's financial system because of the COVID-19 pandemic, and the need for entities to monitor new and emerging threats and make suspicious matter reports. This included 'out of character purchases of precious metals and gold bullion'.
2.91Furthermore, throughout 2021–22 AUSTRAC conducted a ML/TF risk assessment of the bullion sector, with such assessments assisting 'reporting entities and partner agencies to develop and prioritise policy and operational responses to combat ML/TF'.
2.92The assessment drew on previous intelligence and suspicious matter reporting, as well as 'consultations and engagement with government partners and 15bullion sector reporting entities, including Perth Mint', rather than focussing on individual businesses. AUSTRAC assessed the overall risk associated with the sector in Australia as medium, and the threat of ML/TF facing the sector as low.
2.93In August 2020 the Perth Mint Board and management team commenced development of a remediation plan to address framework risk management and inconsistent 'know your customer' procedures and systems. The plan was developed in response to the independent internal assurance audit (finalised the same month), and was updated further as new information came to light.
2.94The plan included measures to address AML/CTF obligations, including:
process redesign and systems refresh, including consultants and specialist legal advice and a single customer relationship management system;
staff training;
transaction monitoring, including automated tracking and recording of customer transactions;
remediation and refresh of know your customer data for all of its 70000 customers;
review and renewal of banking relationships;
reputation repair and management; and
monthly implementation monitoring by Board.
2.95The plan commenced in March 2021 and was scheduled for completion by July2022. Gold Corp reassessed the scope of its program 'following an external review and receipt of the June 2022 Compliance Assessment Report from AUSTRAC' (discussed below), with the revised remediation program endorsed by the Board on 31August 2022.
2.96During 2022, Minister Johnston was advised by the Chair and CEO of broader, historical AML/CTF non-compliance issues. He requested advice from the PerthMint on the extent of historic non-compliance and the 'pathway to resolve those historic non-compliance issues'. This led to a funding application for the remediation program as part of the annual budget process through the Minister in 2022.
2.97The WA Expenditure Review Committee agreed to funding of $34million for the remediation plan through to 2025–26, agreeing to Gold Corp withholding its annual dividend.
2.98In addition to regular Gold Corp Board meetings, the Board met ten times between late 2022 and late 2023 to specifically consider the AML Remediation Program. A 24 August 2022 meeting included a workshop on the program, including PerthMint's compliance obligations and remediation.
2.99The external auditor's report for AUSTRAC:
… confirmed that the design and scope of the Remediation Program was appropriate to deliver effective remediation, however its ultimate effectiveness will depend on its implementation and the Gold Corporation DBG's [designated business group's] continuing commitment to uplifting its approach to AML/CTF.
2.100As of November 2023, GoldCorp advised that implementation of the remediation plan was more than 50percent complete.
AUSTRAC compliance review
2.101Concurrently with the OAG audit detailed earlier in this chapter, in late 2020 AUSTRAC started to consider 'the nature of what our compliance assessment would undertake from 2021 onwards', informed by the work of the Serious Financial Crime Taskforce, assessments of the bullion industry, intelligence and suspicious matter reporting, impacts of COVID-19, and knowledge of connected parties or customers of the Perth Mint (e.g. Euro Pacific Bank).
2.102AUSTRAC engages with Gold Corp on an ongoing basis, and had previously undertaken supervisory activity on targeted matters in 2009, 2012 and 2014. In relation to earlier AUSTRAC reviews, Mr Walsh advised that they resulted in 'minor findings' and 'didn't indicate reporting issues in relation to transactions'. They did find areas for improvement, including training, and these were addressed by Gold Corp.
2.103On 14 January 2021, AUSTRAC issued a compliance notice to Perth Mint advising that it 'would undertake an assessment of their compliance with the AML/CTF obligations'. This was the first indication to Gold Corp that an assessment would be conducted. Information sought in the notice included:
AUSTRAC's supervision reviews of reporting entities: organisation chart; anti-money laundering and counter-terrorism financing (AML/CTF) program; money laundering/terrorism financing risk assessments; AML operational policies and procedures; transaction monitoring program; AML training programs; and customer lists for a specified period.
2.104Minister Johnston was notified on 27 January 2021, indicating that this was when he first became aware that AUSTRAC had identified potential AML/CTF compliance issues. The then-Minister advised the Premier at the time and advised Gold Corp 'that they should take all reasonable actions to ensure compliance with AML/CTF rules'.
2.105On 29 January 2021 AUSTRAC commenced several 'virtual' online assessments of Gold Corp (due to COVID-19 lockdowns). It considered Gold Corp's independent review and 'know your customer' procedures, including a review of Gold Corp's AML/CTF program, processes, procedures, training documents, emails and various meeting minutes. AUSTRAC also considered the independent auditor's internal audit report from August 2020 (see earlier in the chapter).
2.106On 23 June 2021 the Minister's office requested a briefing from AUSTRAC on any investigation into Gold Corp, a request which was declined on 28 June. AUSTRAC stated it 'does not publicly disclose or discuss matters it is or may be investigating'.
2.107AUSTRAC sought and received further information from Gold Corp about its operations on several occasions, including in March, June, August and October2021, including through a second virtual assessment in June and a virtual meeting in September.
Mr Walsh confirmed that he continued to meet monthly with the Minister, with the meetings considering the AUSTRAC review and contingent liability implications, 'amongst other things'. The committee is aware that the AUSTRAC review was included in Ministerial briefings held on 5 May, 26August and 28October 2021.
Review extended
2.109In December 2021 AUSTRAC determined that its review of Gold Corp would continue, and cover a wider range of provisions in the AML/CTF Act and Rules. This decision was informed by information AUSTRAC had seen as part of its review, with 'regard to public information outlining customers of Gold Corporation, and intelligence from our law enforcement partners' including the Serious Financial Crime Taskforce.
Regulatory action: appointment of external auditor
2.110On 16 June 2022, AUSTRAC met with Gold Corp to discuss the findings of its compliance review, and share its compliance assessment report. At the meeting the CEO indicated the report would also be shared with the Board. At the same time, AUSTRAC notified Gold Corp that it was considering appointing an external auditor. It noted:
Where the AUSTRAC CEO has reasonable grounds to suspect that a reporting entity has contravened, is contravening, or is proposing to contravene the provisions of the AML/CTF Act, the CEO may require the reporting entity to appoint an external auditor.
2.111Then CEO, Mr Jason Waters, spoke with Minister Johnston prior to the meeting, and also rang him after the meeting, and on 27 June provided a briefing on the AUSTRAC review to the Minister, including the intention to appoint an external auditor and details of the Mint's remedial actions.
2.112On 14 July 2022, Gold Corp requested that it be permitted to voluntarily appoint an external auditor, however this was rejected by AUSTRAC. AUSTRAC considered this submission and 'determined it was appropriate to issue a formal notice to appoint an external auditor'. The notice was issued on 30 August with the audit to cover:
the AML/CTF program;
compliance with applicable customer identification procedures;
compliance with enrolment obligations;
compliance with IFTI reporting obligations; and
compliance with ongoing customer due diligence.
2.113On issuing the notice, Mr Brown, Acting CEO of AUSTRAC confirmed 'we will use the powers and the legislation where we think it's appropriate. It's also not something that we will do willy-nilly. It is a consideration as to where we think there's a depth of inquiry to be undertaken', and that:
The external audit power that we have provides that greater level of oversight, and perhaps control in some respects, as to the ongoing nature of that process, as opposed to the entity itself taking care of it.
2.114Gold Corp appointed an external auditor in late November 2022, with the auditor required to examine Gold Corp's compliance with AML/CTF obligations and a review of the remediation plan to ensure AML/CTF non-compliance would be addressed. The external auditor was required to report to AUSTRAC within 180days.
External auditor report
2.115In March 2023, the external auditor advised it would not be able to complete the report by the 15 May deadline, and requested a two-month extension. GoldCorp cited a number of factors impacting on the ability of the auditor to complete the report on time, including:
impacts of COVID-19 and a fatigued workforce;
Christmas and January leave period and limited staff availability;
the 'breadth and complexity of the audit';
the need for manual extraction and processing of data to meet information requests by the external auditor; and
the desire of Gold Corp to meet all AUSTRAC review requirements and ensure 'a better result overall'.
2.116AUSTRAC agreed to receiving an initial report by 15 May, with a final report due by 21 July 2023. AUSTRAC received the initial report on 16 May, with the final report received on 21 July.
2.117In early September 2023 the OAG met with AUSTRAC and viewed the final independent external auditor's report in connection with the finalisation of the Gold Corp financial statements audit. Minister Johnston confirmed that as of 3November 2023 he had not seen the report.
2.118AUSTRAC confirmed that the report contains 'recommendations that relate to the matters that AUSTRAC necessarily asked the external auditor and PerthMint to consider'.
2.119Perth Mint confirmed that it continued to 'engage regularly with AUSTRAC in relation to a range of matters, including progress on our AML Remediation Program'. The Mint, the Auditor General and AUSTRAC drew attention to Gold Corp's willingness to engage with review processes, rectify issues and ensure compliance into the future.
2.120As part of an Enforceable Undertaking (EU) provided in late November 2023 (discussed below) by Gold Corp to AUSTRAC, the findings of the external auditor are made clear.
Enforceable Undertaking
2.121On 23 November 2023, AUSTRAC announced that it had accepted an Enforceable Undertaken (EU) from Gold Corp, to 'uplift its compliance with' AML/CTF laws. AUSTRAC issued a media release about the EU, which explained the details:
Following careful consideration of the audit findings, including the nature and seriousness of the non-compliance and Gold Corporation's willingness to cooperate and proactively work to comply with its AML/CTF obligations, AUSTRAC has determined that an EU is the most appropriate regulatory response.
The EU will ensure that Gold Corporation commits sufficient resources to adequately implement its remediation program promptly, or risk further enforcement action. This can include seeking court orders to enforce the EU, or cancelling it and taking further action which may include commencing civil penalty proceedings in the Federal Court of Australia.
AUSTRAC considers that the EU is a necessary step to ensure that Gold Corporation addresses these AML/CTF deficiencies through its remediation program. The EU binds Gold Corporation to complete this remediation program under enhanced oversight from AUSTRAC and an independent third party expert, with the remediation to be completed by April 2025.
2.122Under the EU, Gold Corp will complete actions laid out in a Remediation Program, which has three project streams:
(a)Customer Process Uplift;
(b)Customer Data Remediation; and
(c)Customer Lifecycle Technology and Data Uplift.
2.123The EU provides further information on the steps taken to date between AUSTRAC and Gold Corp, and the views of AUSTRAC on the operations of Gold Corp. For example, the EU states that the AUSTRAC CEO is:
… concerned that the Gold Corporation DBG needs to take specific actions:
(a)in order to comply with the AML/CTF Act and the AML/CTF Rules; and
(b)directed towards ensuring that it does not contravene the AMUCTF Act or the AML/CTF Rules, or is unlikely to contravene the AML/CTF Act or the AMUCTF Rules, in the future.
2.124The EU goes on to note that on 16 June 2022, AUSTRAC issued a Compliance Assessment Report to Gold Corp, which identified the following compliance issues of the Gold Corp DBG relating to:
(a)Failure to carry out ACIP on customers;
(b)Failure to consider the ML/TF risk posed by its customers, including beneficial owners and politically exposed persons;
(c)Failure to include in its Joint AML/CTF Program appropriate risk-management systems to determine whether a customer or beneficial owner is a PEP [Politically Exposed Person(s)];
(d)Failure to monitor its customers with a view to identifying, mitigating and managing ML/TF risk, by failing to have in Part A of its Joint AML/CTF Program appropriate risk-based system and controls to meet OCDD requirements of the Rules, including by failing to include an appropriate transaction monitoring program;
(e)Failure to comply with multiple sections of Part A of its Joint AML/CTF Program;
(f)Failure to include in Part B of its Joint AML/CTF Program risk-based systems and controls to determine when any other additional KYC information will be collected and verified in respect of a customer;
(g)Providing a designated service without applying in writing to the AUSTRAC CEO within 28 days after commencing to provide the designated service;
(h)Providing a registrable designated service while not registered as an independent remittance dealer; and
(i)Failure to report IFTls to the AUSTRAC CEO.
2.125The EU continues that on 21 July 2023, and following the requirement of Gold Corp to appoint an external auditor:
… AUSTRAC received the external auditor's final report. The report identified compliance issues that reflected or confirmed findings in the 16June 2022 Compliance Assessment Report. For example:
(a)The application of Gold Corporation's Part A Program was not compliant in respect of the AML/CTF Rules regarding further KYC information and beneficial ownership, transaction monitoring and ECDD.
(b)Sample testing showed that the Gold Corporation DBG was unable to demonstrate it had undertaken necessary ACIP before the provision of a designated service to fifteen individual and non-individual customers.
(c)Gold Corporation did not include Remittance Services (Items 31 and 32 of Table 1 - Financial services) in its enrolment details with AUSTRAC.
(d)The Gold Corporation DBG failed to report 3,322 IFTls in respect of at least four separate value-transfer scenarios.
(e)The Gold Corporation DBG was unable to demonstrate it had completed appropriate OCDD, primarily because it did not complete individual risk ratings for any customers.
(f)The transaction monitoring rules were not designed or applied such that the Gold Corporation DBG could appropriately monitor high ML/TF risk activity by its customers.
In light of these findings, AUSTRAC remains concerned that reporting entities in the Gold Corporation DBG may have failed to comply, and may remain non-compliant, with provisions of the AMUCTF Act, being:
(a)Section 81 - failure to adopt and maintain a Joint AMUCTF Program within the meaning of section 83 of the AMUCTF Act;
(b)Section 82 - failure to comply with Part A of its Joint AMUCTF Program;
(c)Section 36 - failure to conduct OCDD;
(d)Section 32 - failure to undertake ACIP prior to the provision of a designated service to a customer;
(e)Section 45 - failure to report IFTls to the AUSTRAC CEO; and
(f)Section 51F - failure to advise the AUSTRAC CEO of change in enrolment details.
2.126As part of the EU, Gold Corp has made the following undertakings:
27Gold Corporation undertakes to appoint an individual who is:
(a)authorised under section 164 the AML/CTF Act; and
(b)agreed to by the AUSTRAC CEO in writing -
-to act as an Authorised External Auditor for the purposes of this Enforceable Undertaking by 31 January 2024.
28Gold Corporation undertakes to engage the Authorised External Auditor to complete a report on the Remediation Program every six months from the date of this Enforceable Undertaking, and continuing until each work stream of the Remediation Program has been completed. Gold Corporation undertakes to provide this report to AUSTRAC within 20 business days of the end of each six-month period.
…
30Gold Corporation undertakes to engage the Authorised External Auditor on the basis that:
(a)the Authorised External Auditor will notify the AUSTRAC CEO in writing within seven (7) days of identifying any breach of the Remediation Program including the nature of the breach;
(b)AUSTRAC will have access to and correspond with the Authorised External Auditor at any time and in any manner which it deems appropriate for the purposes of monitoring or ensuring compliance with this Enforceable Undertaking during its currency.
Possible contingent liabilities from potential non-compliance
2.127Mr Walsh and Mr O'Connor advised the committee that Gold Corp became aware, in June 2022, of possible contingent liabilities arising from potential AML/CTF non‑compliance. This was subsequently raised with then‑Minister Johnston.
2.128An alert to possible unquantifiable contingent liabilities was also published in Gold Corp's annual financial statements in 2022 and 2023.
2.129Mr Timothy Lear from AUSTRAC elaborated on the purpose and calculation of penalties where AML/CTF obligations are breached, advising that each non‑compliant transaction is a 'civil penalty provision transaction'. He advised:
… the theoretical penalty could be billions or trillions of dollars for a lot of institutions. Instead, the act directs us to particular considerations in relation to how to calculate a penalty which is of sufficient deterrent value. The focus, thanks to the High Court, is very much on specific and general deterrence. There are processes that we go through and advice that we consider to determine what an appropriate penalty should be in each instance. That's in circumstances where you are dealing with a potential pecuniary penalty which is astronomical and obviously could not be ordered without bankrupting every institution. It's a process, instead, of considering what the appropriate deterrent effect would be of a penalty, having regard to all the circumstances in that particular case.
2.130However, Mr Lear warned that AUSTRAC would first need to form a view as to whether non-compliance contravened the AMT/CTF Act, and if it formed a view that it did, penalties would then need to be sought through the FederalCourt.
2.131The Auditor General expressed the view in November 2023, that:
… civil penalty orders of the quantum that have been levelled at Westpac and Commonwealth Bank … would be extremely unlikely because of the behaviour of the regulated entity [i.e. Perth Mint], being incredibly responsive to address the gaps identified, diligently work through the backlog and demonstrate to the regulator their willingness to rectify and comply in the future.
2.132AUSTRAC has publicly stated that it 'has determined that an EU is the most appropriate regulatory response'. Furthermore, it advised:
The EU will ensure that Gold Corporation commits sufficient resources to adequately implement its remediation program promptly, or risk further enforcement action.This can include seeking court orders to enforce the EU, or cancelling it and taking further action which may include commencing civil penalty proceedings in the Federal Court of Australia.
2.133On the basis of these statements, it appears that Gold Corp may have avoided financial penalties at this point.
Gold Corporation: Board and Executive
2.134As shown in Chapter 1 of this report, since 2017 there has been considerable turnover in executive management and Board membership at Gold Corp, as well as several changes to ministerial responsibility for the Corporation. This section details the engagement of the Gold Corp Board and Executive with its AML/CTF obligations, including the implications of executive and ministerial turnover for regulatory compliance.
Board appointments
2.135In January 2019 Mr Walsh was appointed as the new Gold Corp Chair by the then-WA Premier, Mr McGowan. In evidence to the committee Mr Walsh confirmed that he was brought on to address governance and Board conflict of interest issues at the Perth Mint. Mr Walsh told the committee that he was:
… approached by Premier McGowan to consider joining the board. Hedescribed that he wanted to strengthen the government's compliance within the board. I also brought refining or foundry expertise, and obviously mining expertise …
It was board behaviour but also how the organisation was handling the governance. Quite frankly, you had directors with a conflict of interest sitting in on discussions of the sourcing of our cybersecurity protection.
2.136Since his appointment to the Board, Mr Walsh has led the Board to 'strengthen governance and regulatory compliance' including in relation to matters outlined in this chapter.
2.137In February 2020, Mr Richard Watson, Under Treasurer, was appointed to the Gold Corp Board by Mr McGowan as the WA Government's representative, as provided for by the Gold Corporation Act 1987.
2.138On 10 August 2021, Mr Neil Roberts was nominated by the Minister and subsequently appointed to the Gold Corp Board by the WA Government as a non-executive director.
CEO appointments
2.139Mr Hayes, CEO of Gold Corp resigned in October 2021, taking leave before finishing with the organisation. There were a series of acting arrangements before Mr Waters was appointed and commenced in April 2022.
2.140On 30 May 2023 Gold Corp announced that Mr Waters had resigned after nearly 18 months on the job, finishing on 19November 2023. The appointment of his successor, Mr Paul Graham, was announced on 28 August, and he commenced on 20November 2023.
Gold Corp governance meetings
2.141During financial years 2020, 2021 and 2022 the Gold Corp Board continued to meet regularly five or six times a year. During the 2023 financial year the frequency of meetings increased, with the Board meeting on 11 occasions. Meetings were concentrated in August-September 2022 and March 2023, appearing to reflect more intense Board activity ahead of the release of the OAG report in October 2022, and increased media attention following the Four Corners program in March 2023.
2.142Data going back to 2015 shows that the Gold Corp's Audit and Risk Management Committee met regularly five times per year between 2015 and 2016, with meetings averaging six times per year from 2017. These meetings are also attended by Gold Corp's internal and external auditors. Meetings of the Audit and Risk Management Committee typically occur one to three weeks before a Board meeting.
Ministerial briefings and reviews
2.143On the matter of ministerial briefings, Mr Walsh confirmed that he and the CEO have had regular monthly meetings with the Minister, including MinisterJohnston, who took over responsibility for Gold Corp from MrMcGowan between March 2021 and December 2023. MrJohnston indicated that at the time he took on ministerial responsibility he received a 'very brief' handover from Mr McGowan, as well as briefings from the Premier's staff, and 'a very extensive incoming ministerial brief' about matters relating to the Perth Mint.
2.144Mr Walsh advised that items on the agenda for ministerial meetings have included the Mint's operations, safety, finance, recruitment, with ad hoc contact as required. Matters relating to the AUSTRAC compliance review and contingent liability implications were raised with the Minister once the Chair became aware of the issues, in August2020.
WA Government—Gold Corp review
2.145In September 2022 Minister Johnston announced a 'root-and-branch' review of Gold Corp, with a reporting date of December 2022, later revised to December2023. The Minister confirmed that the review will not be made public, but the outcome of the review will be publicised.
2.146In April 2023, the WA Government announced that it would spend $1 million on external consultants who would undertake an 'options analysis' on the future of the Perth Mint. The WA Government will consider the performance of GoldCorp and how the state may be able to reduce its risk, including through the Mint's structure, selling the Mint, sharing its ownership with the gold industry, or keeping it within government.
Committee views
2.147The Perth Mint is owned by the Western Australian taxpayer. Further, everyone who has dealings with the Mint is ultimately dealing with the state of WA. The Perth Mint provides a significant financial return to the state, and this unique ownership structure makes it even more important that the Mint adheres to the highest standards of probity and regulatory compliance.
2.148This interim report highlights the shortcomings with the operations and governance of the Perth Mint over recent years. Of particular concern is GoldCorp's failure to properly adhere to Australia's AML/CTF regime, which may have allowed for forms of money laundering or serious crime financing via the Mint's operations.
2.149This report lays out the facts of how Gold Corp has operated in recent years. As the committee continues its work and in its final report, it will further explore the regulatory compliance and governance of Perth Mint against the AML/CTF framework, and the work of Gold Corp as it implements its remediation program and continues to be monitored via the November 2023 Enforceable Undertaking.
Senator Dean Smith
Chair
Liberal Senator for Western Australia