Due Diligence, Complex Fraud, and the KWAP-eFishery Lesson

Due Diligence, Complex Fraud, and the KWAP-eFishery Lesson

 

When news broke about the KWAP lost RM163.4 million in eFishery, naturally, Malaysians were angry. When a massive institutional investment goes sour, the public naturally asks: Did the fund managers do enough homework before writing the check? Was there any element of corruption?

 

DISCLAIMER: As this matter is still under investigation https://www.thestar.com.my/news/nation/2026/07/23/kwap-efishery-probe-10-witnesses-have-given-statements-so-far-says-macc-chief at the point of writing this blog, this blog will discuss possible scenarios based on best guesses, multiple senarios and available online information.

 

In corporate law, this “homework” is called Due Diligence. It is the absolute core of the Business Judgment Rule (BJR) under the Malaysian Companies Act 2016. But how deep must this homework go? And more importantly, what happens if the startup founders were actually running a highly sophisticated, complex fraud? Are the directors still protected, or are they on the hook for the lost millions?

 

Let’s break down the legal realities of due diligence and fraud in simple terms.

 

The “Informed Decision” Pillar of the Business Judgment Rule

 

To use the Business Judgment Rule as a shield against personal liability for a financial loss, Section 214 of the Companies Act 2016 requires directors to make an “informed decision.”

 

You cannot make an informed decision by just reading a glossy pitch deck and taking the founder’s word for it. You must conduct Due Diligence (DD).

 

Think of due diligence like buying a used car. You wouldn’t just look at the shiny paint and hand over the cash. You would check the engine, look at the service history, and perhaps hire a mechanic to inspect it. In the corporate world, due diligence is hiring the “mechanics” (auditors, lawyers, industry experts) to inspect the business before investing millions of ringgit.

 

How Deep Must Due Diligence Go?

 

The law does not expect directors to be omniscient, nor does it require them to guarantee that an investment will never fail. However, the depth of due diligence must be proportionate to the size and risk of the investment.

 

For a massive investment like KWAP’s into a foreign startup like eFishery, a superficial check is not enough. The due diligence must be deep and rigorous. Here is what “deep” looks like in practice:

 

1. Financial Verification: Directors cannot just accept the startup’s internal spreadsheets. They must demand audited financial statements, verify bank balances, and check for hidden debts.
2. Legal and Compliance Checks: Lawyers must verify that the company actually owns its intellectual property, that there are no pending lawsuits, and that they are complying with Indonesian and international laws.
3. Market and Operational Reality: Directors must verify if the startup’s claims about its market size and operations are true. If eFishery claims to have 100,000 active fish farmers, the investors need to see the data, the app analytics, and perhaps conduct site visits or independent surveys.
4. Management Background Checks: Who are the founders? Do they have a track record of success, or are there hidden red flags in their past?

 

The Golden Rule of Depth: The due diligence must be deep enough that a “reasonable person” sitting on the board would feel confident that they understand the true risks and realities of the business.

 

The Ultimate Test: What if it was a Complex Fraud Scheme?

 

Now, let’s take the KWAP-eFishery scenario a step further into a worst-case hypothetical. What if the financial loss wasn’t just due to bad market conditions, but because the startup’s founders were running a complex fraud scheme https://www.nst.com.my/business/insight/2026/07/1495175/kwaps-investment-indonesias-efishery-when-fraud-undermines#google_vignette?

 

For example, what if the founders forged client contracts, created fake bank statements, or hid massive personal debts? When the fraud is eventually exposed and the money is lost, the public will point fingers at KWAP’s directors. How could you let this happen? Are you liable?

 

This is where the intersection of the Duty of Care (Section 213) and the Business Judgment Rule (Section 214) becomes critical.

 

The answer to whether the directors are liable depends entirely on how the fraud was hidden and how the due diligence was conducted.

 

Scenario A: The Directors are PROTECTED (No Liability)

Imagine that KWAP’s directors hired top-tier, reputable auditing and legal firms to conduct the due diligence. The directors asked tough questions, reviewed the reports, and followed all standard institutional investment protocols.

 

However, the startup founders engaged in a massive, deliberate manipulation of the company’s financial data. The fraud was not a simple accounting error; it was a systemic deception included massive revenue inflation, dual accounting books and fabricated transactions https://www.businesstimes.com.sg/international/asean/indonesia-unicorn-efishery-allegedly-faked-almost-us600-million-its-sales?ref=article-see-also. They colluded with third parties and deliberately deceived the auditors. The fraud was so complex that even the top-tier professionals could not detect it using standard industry practices.

 

Are the directors liable? No.

Under the Business Judgment Rule, directors are not expected to be forensic detectives or mind readers. If the directors acted in good faith, conducted a reasonable and proportionate due diligence process, and relied on the advice of qualified experts, they have met their legal duty. The fact that they were the victims of a brilliant, complex fraud does not make them legally liable for the loss. The BJR shield holds strong because their process was flawless, even if the outcome was disastrous.

 

Scenario B: The Directors are LIABLE (Breach of Duty)

Now, imagine a different scenario. The KWAP directors were so excited about the high returns of the eFishery investment that they rushed the process. They relied solely on the unaudited financial slides provided by the founders. They didn’t hire independent auditors to verify the cash in the bank. They ignored a warning from a junior analyst who noticed that the startup’s claimed revenue didn’t match its cash flow. Or, they skipped several critical and important steps that would have raised doubt and concerns.

 

When the complex fraud is later discovered, the directors try to use the Business Judgment Rule as a shield.

 

Are they liable? Yes.

In this scenario, the BJR shield shatters. Why? Because they failed the “informed decision” requirement. The law states that you cannot claim the protection of the Business Judgment Rule if you were negligent. By doing shallow due diligence, ignoring red flags, or failing to verify basic facts, the directors breached their Duty of Care, Skill, and Diligence.

 

The court will rule that a reasonable director would have caught the fraud, or at least asked the right questions to uncover it. Because their process was flawed, they are personally liable for the losses caused by their negligence.

 

To understand this simply, think of purchasing a used car.

 

You decide to buy a used car. You take it to a certified, independent mechanic. The mechanic puts the car on a lift, runs a full computer diagnostic, checks the engine compression, and reviews the vehicle history report. Everything comes back clean, and the mechanic gives it a thumbs-up. You buy the car. A month later, it is discovered that the previous owner used a highly sophisticated, temporary engine-flush chemical and a specialized device to roll back the digital odometer, hiding a deep internal crack that only fails after 10,000 km of specific driving stress. Are you to blame for not tearing the engine apart yourself? No. You did your due diligence.

But, what if you decided to save money, skipped the mechanic, just took the car for a quick five-minute test drive, noticed the air conditioning worked and the exterior paint was shiny, and bought it? When the engine inevitably blows up a week later, you are entirely to blame. You failed to do your due diligence.

 

Directors of institutional funds like KWAP are in the exact same position. The law protects them if they hire the right “inspectors” and do the work, but it punishes them if they just look at the “nice paint.”

 

Lessons for Directors and Institutional Investors

 

The scrutiny surrounding KWAP and its regional investments serves as a masterclass in corporate governance. For directors and fund managers, the lessons are clear:

 

1. Process is Your Only Shield: When things go wrong, the court will not look at your intentions; they will look at your board minutes and due diligence reports. If it isn’t documented, it didn’t happen.
2. Don’t Follow Trends: The trend of investing in “sexy” businesses that are tech or AI based like eFishery can create “FOMO” (Fear Of Missing Out). Directors must ensure that the excitement for growth never overrides the rigor of due diligence.
3. Independence is Key: Do not just rely on the information provided by the startup’s founders. You must have independent, third-party experts verify the claims.
4. Follow the Red Flags: If something doesn’t look right during due diligence, do not ignore it. Dig deeper. Ignoring a red flag is the fastest way to lose the protection of the Business Judgment Rule.
5. Diversify Director Appointments: Having a board full of Oxford and Cambridge graduates with zero business experience or consultants who have never started or managed a business in their lives is a certain formula for failure. Diversify the board by appointing proven entrepreneurs and operators who understand the messy, on-the-ground realities of running a business, ensuring that strategic decisions are based on practical experience, not just textbook theory.

 

Conclusion

 

Investing in high-growth startups across borders, as KWAP did with eFishery, is inherently risky. Financial losses can happen simply because a business model didn’t work out in a tough economy.

 

However, the Malaysian Companies Act 2016 draws a hard line between business failure and director negligence. Remember: just because an investment fails or makes a loss does not automatically make the director liable for negligence, nor a sign that there was any criminal element involved.

 

If the investigation proves that KWAP’s directors hired top-tier experts, asked the right questions, and followed all standard institutional protocols, the Business Judgment Rule would protect them from personal liability, as they were victims of a sophisticated, concealed fraud. However, if the investigation reveals that red flags were ignored, due diligence was rushed, or governance protocols were bypassed, the BJR shield will be lifted, and the directors could be held liable for negligence.

 

In the corporate world, you are not paid to guarantee success, but you are absolutely legally required to do your homework.