A2.1 On 17 May 2017, the AFP publicly announced that over 290 AFP officers, assisted by ATO staff, had conducted a coordinated effort to execute 34 search warrants and seize approximately $50 million of cash and assets from co-conspirators of an alleged 'phoenix' arrangement connected with a company, namely: Plutus Payroll Australia (Plutus). This action was the ultimate result of combining three independently commenced investigations by the ACIC, the AFP's Operation Elbrus and the ATO's Operation Crocodile into a single undertaking.

A2.2 On the same day, the ATO announced that disciplinary action had also been taken against ATO staff, including service of suspension orders on five officers and commenced investigations into potential breaches of the APS Code of Conduct by three officers.

A2.3 Following these events, the Senate Standing References Committee on Economics requested that the IGT undertake a review, the terms of reference for which are reproduced in Appendix A. The outcomes of the IGT review are outlined in the main body of this report.

A2.4 The issues covered in this review and the underlying nature of outworkings of Operation Elbrus is multi-faceted and complex. Therefore, in seeking to provide insight and facilitate understanding, the analysis that follows is not a simple chronology of events.

A2.5 Furthermore, the specifics of Operation Elbrus and the Plutus arrangements are being considered by the courts as part of criminal prosecutions. Therefore, a degree of generalisation has been necessary to ensure that the latter are not prejudiced in any way. There are also certain confidentiality constraints imposed by the relevant tax, law enforcement, privacy and employment laws that need to be considered regarding disclosures. Publicly available material is referenced where that is appropriate. In this regard, this appendix was provided to the AFP and CDPP for comment and confirmation that it could be made public.

Structure of the analysis

A2.6 The following analysis provides an initial overview of the Plutus arrangement in a more general sense along with the related themes, including the allegations and laying of charges. Thereafter, the individuals who are directly or indirectly linked or associated with the operation are noted. Finally, a chronology of events is provided through the prism of action taken by the relevant government agencies at a given point-in-time.

The 'Plutus' arrangement

A2.7 The Plutus syndicate arrangement provided for a 'zero-fee, fully automated, all-inclusive contractor payroll management service'854 for a large number of companies. The client companies had made regular payments to Plutus on the understanding that those funds, estimated by some to total $1.3 billion855, would be used to pay the wages and superannuation of employees and also pay the ATO the required PAYG tax.856

A2.8 The syndicate arrangement had purportedly recruited 'straw directors' for a number of 'second-tier' or 'straw' companies whilst the management and operation of those companies was maintained by the syndicate members themselves. Plutus allegedly transferred payroll funds and a limited percentage of the PAYG tax to these second-tier companies. Accordingly, the PAYG commitments were only paid in part to the ATO.857 The AFP have alleged that the remaining funds had been transferred to the syndicate members through false invoices and the bank accounts of front companies. It was further claimed that the second-tier companies had kept records on the differences between the amount paid to the ATO and what the syndicate members received which, in May 2017, was thought to be $165 million.858

A2.9 It is purported that the intention was to evade detection by the authorities and to dissipate the assets through use of a complex process under the insolvency laws if detected. These arrangements are commonly referred to as a type of 'phoenix' arrangement. It has been publicly commented that the fraud was not unusual in concept but was ambitious in scale:

Such advisors would have seen or advised on similar schemes and therefore gave it a go on a big scale, which was their mistake,' … 'Too many people were involved with too big numbers and that is why they got caught this time.859

A2.10 Clients were told that Plutus made money from the short term money market and not the payroll services. Accordingly, Plutus did not need to earn commission or fees on the work that was obtained from clients:

We are a financial services provider. Our biggest source of revenue is our outsourced payroll and payroll-funding options for dozens of businesses around the country. Also on the list of revenue contributors is mortgage brokerage. We source competitive mortgage rates (or car loans, personal loans etc) for our extensive customer base. 'There is no obligation to our contractors to take out any of these products, though they are all available to be used, if the contractor so desires. It's a simple but effective business model that works for us, and for our contractors and clients.' The contractors' pay was supposedly invested on the overnight money market. The interest earned on the money market helped Plutus offer zero fees, the spiel went.860

A2.11 Furthermore, Plutus provided incentives to recruiters and contractors, including 'Plutus Points' — a monthly gift-card loyalty program equivalent to the amount contractors would have otherwise spent on other payroll agencies charging a two to three per cent fee.861

A2.12 Recruitment companies were also reportedly paid amounts up to $900 for each client they referred. Plutus was also reported to have wooed recruiters and government departments by inviting them to marketing events.862

A2.13 Plutus had offered contractors benefits as well, such as cheap mortgages, finance and insurance863 to persuade their recruiters to use Plutus' services.

A2.14 Where clients may have had doubts concerning the Plutus arrangements, they sought comfort from trusted third parties (well-meaning or otherwise) in assuaging their doubts. For example, contractors were assured by reputable third party recruitment firms that Plutus was part of the digital disruption in the contracting industry and could offer zero fees because the payroll business was just a very small part of a much larger business.

A2.15 Some of those with doubts had checked Plutus' credentials with peers on a chat forum which was frequented by IT contractors. Plutus was also reported to have engaged staff to assuage doubt.864

A2.16 It was not until the ATO began to garnish the bank accounts of some of the second-tier companies that doubts regarding Plutus' financial sustainability were publicly questioned. As this publicity threatened clients' confidence in Plutus, it was purported that the company took further measures to assuage the public and, behind the scenes, explore what they could do to avoid ATO action.

Overview of allegations

A2.17 During the investigations conducted by the agencies, it was revealed that two of the key participants in the syndicate were children of the ATO's Deputy Commissioner for the PGH business line who was also the Chair of the Government's Phoenix Taskforce865 and the public face of the 'crack down' on phoenix behaviour866.

A2.18 The PGH business line itself is the area in the ATO tasked with investigating 'those who criminally defraud the [tax] system or deliberately avoid their tax obligations' and, in doing so, collaborate with regulatory and law-enforcement agencies.867

A2.19 In Operation Elbrus, the AFP had also considered the potential involvement of an ATO Deputy Commissioner. However, immediately after the arrests, it was announced that, as a result of telephone intercepts, the AFP alleged that the Deputy Commissioner was not a party to the conspiracy and he 'was not suspected and is still not suspected of being involved in the syndicate and its activities of defrauding the Commonwealth'.868 The AFP further alleged, however, that the Deputy Commissioner's son had asked his father to make enquiries within the ATO regarding the status of ATO activities with respect to the Plutus arrangement and Mr Simon Anquetil.869

A2.20 The details of what actions were taken by the Deputy Commissioner are the subject of charges laid against him for two counts of 'abuse of public office' for allegedly obtaining information and exercising influence to obtain a benefit for his son. These charges are yet to be heard by the courts.

A2.21 Charges were also laid against eight other people on the basis that they were suspected of either participating as a 'controlling mind' or knowingly assisting the syndicate through the destruction of evidence and/or dealing with the proceeds of crime.870 The charges are outlined in more detail further below.871

A2.22 The initial announcement by the AFP had quantified the potential fraud as being $165 million in total. However, subsequent announcements reduced this figure to $130 million. Others parties have claimed the amount to be higher as they believe that some members of the syndicate had been involved in previous phoenix arrangements which had, in total, allegedly defrauded the Commonwealth of $191 million.872 The latest figures provided by the ATO, state that the potential fraud approximates $157 million in total.873

Main individuals of interest

A2.23 Having outlined the arrangements and the nature of the allegations raised, we now identify the main identities and how they are directly or indirectly linked with the arrangement or otherwise connected with each other as individuals.

Michael Cranston

A2.24 The Deputy Commissioner, Michael Cranston had started work for the ATO over 30 years prior and had risen through the ranks over that time. His first appearance in the senior management team occurred during 2005–06 when he had acted in the role of Deputy Commissioner, SME (Case Leadership) within the ATO's Compliance sub-plan and then permanently filled that position soon after.874

A2.25 In this role he had acquired considerable expertise in the practical and strategic application of deep technical knowledge to some of the more complex work in the ATO.875

A2.26 In the 2007–08 financial year, Michael Cranston was appointed as the Deputy Commissioner in charge of the SNC business line within the Compliance sub-plan.876 This followed publicity concerning a number of SNC officers who had allegedly engaged in corruption with one officer being suspected of having inappropriate links to the Melbourne underworld at the time.

A2.27 The SNC business line itself was formed several years earlier on 1 July 2003 by bringing together a number of different areas within the ATO that focused on tax audits involving an element of criminality, for example the 'Special Audit' unit which had focused on audits targeting organised crime. Through these early years each of the different areas were observed to have their own leaders and culture. During this period there had already been extensive efforts, including a number of internal reviews to address their structure, governance, management and culture as well as integrity standards. Notwithstanding those efforts, however, the prevention and detection of misconduct had remained incomplete.

A2.28 When Michael Cranston took charge of the SNC business line, he was met with substantial resistance from groups of disaffected staff who believed, for example, that the SNC Executive were incapable of understanding the work being conducted and were considered by them to lack understanding of the criminal environment. Officers of some of the other law enforcement agencies, at that time, had also expressed hesitation in sharing sensitive information with the ATO due to a number of events which had reflected poorly on the integrity of the ATO in dealing with the criminal element.

A2.29 In recent years, it has been said that Michael Cranston performed a key role in forging more cooperative relationships between the ATO and other law enforcement agencies. For example, when the AFP would ask for ATO officer assistance in operations, Michael Cranston would hand pick whom he considered to be the most suitable ATO officer, given their skills and experience. He also played a key role in joint operations, most notably Project Wickenby and the Phoenix Taskforce of which he was Chair. Over the past few years, he had become the ATO's public face in relation to initiatives addressing tax crime.877

A2.30 Michael Cranston remained in his role as Deputy Commissioner of SNC until moving to the Deputy Commissioner role for the SME business line during 2011–12. The ATP, SNC and PGH (formerly SME and High Wealth Individuals) business lines were amalgamated in 2013–14 and Michael Cranston was appointed the head of the amalgamated business line—Deputy Commissioner of the PGH business line.878 In these roles, Michael Cranston had forged strong relationships with many staff, sometimes on a social level, and following the execution of the search warrants it was publicly stated that Michael Cranston had "quite an illustrious [career] up until this point".879

A2.31 The suitability for, rotation of and concentration of responsibilities in senior roles, particularly those in high risk areas, are discussed in Chapters 3 and 5.

A2.32 As publicly reported, Michael Cranston has two children, Adam and Lauren, who are alleged members of the syndicate facing charges for conspiracy to defraud the Commonwealth.880

Adam Cranston

A2.33 Adam Cranston (Adam) obtained a Bachelor of Commerce at the University of Western Sydney and began his career at Rodgers Reidy Chartered Accountants as an insolvency accountant. There, he is reported to have worked in various fields of insolvency ranging from voluntary administrations, official liquidations, corporate voluntary liquidations and receiverships. Adam's online biography described his area of expertise whilst at Rodgers Reidy as forensic accounting. Adam also later worked in debtor finance sales with Fox Syme's 180 Corporate (180 Group) which specialised in business financing and short term loans for working capital requirements, including payments to meet statutory requirements.881 At 180 Group he also performed a role as consultant to distressed businesses882 which was a role that Mr Larcombe had also performed at the 180 Group.

Peter Larcombe

A2.34 Like Adam, Peter Larcombe had obtained a Bachelor of Commerce at the University of Western Sydney. Unlike Adam, however, Mr Larcombe began his career as a quantity surveyor for projects throughout Europe and as a residential and commercial real estate valuer for assets throughout the Sydney basin. He was an investment manager for Rubicon's Trusts and, in other roles, was responsible for Japanese real estate investment opportunities. For the 180 Group, he was the Group Business Development Manager, specialising in business turnarounds.883

A2.35 Mr Larcombe has also been reported to have entered into some business ventures with Adam. For example, in 2010, Adam and Mr Larcombe joined a property developer, Mr Daniel Hausman (Mr Hausman), in a property development and financing business that Mr Hausman had established, called Aventis Capital (Aventis). Aventis helped companies struggling with liquidation and the CFO position was filled by a friend of Adam's, Mr Chris Guillan, who had worked with Adam at the insolvency firm Rodgers Reidy earlier in his career.884

Jason Onley

A2.36 Mr Jason Onley (Mr Onley) also worked at the 180 Group, performing the roles of Head of Sales and later as Business Development Manager until July 2014, when he left to start Northstar, a business and turnaround advisory specialist, which professed to be 'experts when it comes to ATO negotiations, [having] successfully come to agreement on numerous payment plans'.885 Mr Onley was later to describe himself as a businessman who specialised in business turnarounds.886

A2.37 It has been reported that through his work at 180 Group, Mr Onley had provided advice to many during liquidation proceedings, including Mr Simon Anquetil, regarding companies that he had established.887

Simon Anquetil

A2.38 Mr Simon Anquetil (Mr Anquetil) had set up the EStrategy Group of companies which were placed into administration and then liquidation by a financial institution in 2012. It has been reported that ASIC files allegedly show that Mr Anquetil had backdated by 15 months the replacement of himself as director of one of his companies with a 21 year old female, who allegedly had a fake address and could not be located.888 The liquidator's preliminary report on the EStrategy Group, which was sent to ASIC, is reported to have said that the EStrategy Group had failed due to alleged:

…'offences and frauds' in part by former employee, [Mr Anquetil], insolvent trading, and the creation of 'group enterprises' concurrently operating 'in order to defeat creditors and debtors and to make entities indistinguishable'; $117,712 owed on corporate credit cards, and the ATO, which was owed $101,752 from the company's failure to contribute Pay As You Go tax and GST.889

Other individuals allegedly involved

A2.39 It has also been alleged that the following people were connected with Plutus:890

  • Ms Lauren Cranston, who is Adam's younger sister, together with her friend, Ms Devyn Hammond, allegedly controlled the accounts and e-mails for the second-tier companies and managed the payments for the companies;
  • Mr Dev Menon, a tax lawyer, allegedly gave advice about how the Plutus arrangements should be managed;
  • Mr Daniel Rostankovski was alleged to have managed the directors of the second-tier and other companies to ensure banking tokens were collected, mail redirected and handed to Ms Cranston and Ms Hammond. Mr Rostankovski is also facing blackmail charges for allegedly extorting money from other alleged co-conspirators with the help of Mr Hausman and another person (who has not been charged); and
  • Mr Aaron Leo Paul, who allegedly helped to recruit people to act as directors for the second-tier and other companies.

Companies of interest are established

A2.40 It has been publicly reported that during April to August 2014, a number of companies were established which were later linked to Plutus. For example, in April 2014, Mr Anquetil was registered as director of a Hong Kong company, Solutions Mondiale Ltd, which was owned by an entity in the Seychelles. Mr Anquetil subsequently established Plutus Payroll Australia and another company which later traded as Zip Recruitment.891 The ATO's approach to transnational compliance is discussed in Chapter 7.

A2.41 During that same month, Mr Larcombe and Mr Willmott had established other companies which were later linked to Plutus, one of which later came to the attention of the ATO. The companies were involved in providing payroll services to IT and construction industry contractors. The directors of the companies were replaced and, in August 2015, two of the companies fell into liquidation.

A2.42 Plutus itself continued to trade. In June 2016, it was owned by a company called Synep Ltd who reportedly obtained a vendor financed loan of $5 million for the purchase. Mr Anquetil was replaced as Plutus' director.892 Synep Ltd itself was a public company that was established in March 2016 by Adam Cranston, Mr Hausman and Mr Onley and with Mr Onley and Adam Cranston being listed as the directors.

How matters came to the attention of the ATO

A2.43 A number of contractors, who had not received their SG entitlements into their fund, approached the ATO in August 2015. At the time the two relevant contributing companies were in liquidation. However, no action was taken by the ATO due to the low prospects of recovering any money. For example, with respect to one of the companies, the liquidator had found few assets which it could recover, there were no records for the company and the directors did not or claimed not to know anything of the business of the company.

A2.44 It was later found, however, that the companies had also not paid PAYG tax to the ATO — the contractors had lodged income tax returns and there was no matching PAYG remittance to the ATO. The officers who identified this mismatch lodged intelligence reports for analysis. Following this analysis, it was considered that the similarities between two seemingly unrelated companies may signal a phoenix arrangement. The information was then brought to the attention of the employers' obligations unit. After some initial delay in commencing initial profiling work by that area, links were drawn between the companies and one of the prior directors who was known to law enforcement agencies. At this point the matter was referred to the ATO's TEC area for consideration in February 2016.

A2.45 Refer to Chapter 6 for prevention strategies against external fraud risks and TERs, Chapter 7 for interagency cooperation to address tax evasion and Chapter 4 for capturing retrospective analysis of past events surrounding any significant fraud cases.

The investigation by the ATO's Tax Evasion and Crime area

A2.46 In February 2016, the TEC area commenced the detailed work of profiling those people and companies connected with the two identified liquidated companies. Ultimately, the financial position, tax compliance history, known expenditure and relationships of over 200 companies with a multitude of directors were profiled and analysed in an effort to piece together nodes of intersection in relationships and transactions to identify the 'controlling minds' or 'targets'. In one sense, the pattern slowly emerged from the data mist:

Over the year, we progressively uncovered a complex web of suspected tax evasion involving a multitude of entities and individuals. The identities and details of those involved are not all apparent to start with. As with many of these kinds of syndicates, their identities, roles, activities and arrangements are deliberately opaque, deceptive and complicated, and they take time to piece together. So far, over 200 entities in layered structures and complex transactional and business relationships have been identified.893

A2.47 One relatively minor part of this data mist concerned Adam Cranston, son of the Deputy Commissioner. Adam Cranston was identified as having a connection with a director of one of the liquidated companies — the latter's directorship predated the non-payment of PAYG tax to the ATO.

A2.48 The team continued its work in profiling the numerous connected entities and had reached a conclusion by 4 April 2016 that no further action need be taken with respect to Adam Cranston as his involvement was 'not considered significant' based on the material that was available to the ATO at that time.

A2.49 By contrast, however, the profiling work on others indicated connections may exist regarding other companies that were suspected of being part of a broader phoenix arrangement. Although the connections between named individuals and entities as well as the related tax risks and opportunities for recovery were identified, there was still a need to understand the source of the funds and their final destination. Further information was needed to do so and it was decided that the profiling work warranted a proposal to conduct covert audit action. According to ATO procedure, such audits must be approved by the PGH Tax Crime Referral Panel.

A2.50 The Tax Crime Referral Panel approved the proposal to conduct a covert investigation 'to target the key individuals and follow the money trail [and] also search for new start-up entities which may be carrying on this arrangement and attempt to disrupt [them].' The code name for this operation was 'Operation Crocodile' and soon after a case number was allocated.

A2.51 For an audit conducted by the ATO's Financial Crime unit, such as Operation Crocodile, access is restricted to the User IDs of the auditors in that case and their manager.

A2.52 Notwithstanding the ATO's electronic controls, there are always weak points in security arrangement of any organisation — often it is the employees. For example, an employee who has the access may obtain the protected information and provide it to another as a result of a superior's request. Also, an employee who has the access may allow another who does not have access to read the information on the screen. There are public examples of such occurrences such as the former Victorian Police Force's Media manager who had allowed an Assistant Commissioner to read the terms of reference for a covert Operation regarding a murder which had then allowed the targets of that operation to be alerted to covert surveillance which was being conducted on them.894

A2.53 Mindful of the risks present in such tax crime audits, including unauthorised access or inadvertent disclosure, the members of the ATO's Financial Crimes (FC) audit team divided up the work between each other such that each one was working on discrete elements.

A2.54 From July 2016, the FC audit team commenced enquiries and obtained information on entities linked to the liquidated companies. From this information the FC audit team analysed the source and destination of money transactions, consolidated bank statement data and began to understand the relationship between connected parties.

A2.55 On 25 August 2016, the FC audit team's enquiries revealed that Adam Cranston was connected to a company of which he was neither a director nor shareholder. In the light of other information that the ATO had uncovered, there was nothing to indicate that Adam Cranston was anything more than a 'mere employee as opposed to a controlling individual'.

A2.56 Whilst the FC audit team was progressing enquiries for some of the 200 companies linked to the liquidated companies, they were also required to finalise covert audits of other related companies in a manner that would recover the liabilities raised. Accordingly, on 8 December 2016, the FC audit team had finalised the first eight audits of individuals who allegedly had peripheral links to the main entities of interest. Default notices of assessments were issued to those taxpayers and, as the ATO considered that there was a real risk of dissipation of assets, garnishee notices for the debts arising from those notices were issued at the same time.

A2.57 On 20 December 2016, as a result of the FC audit team's enquiries, information was received which indicated to the team that Adam Cranston had a significant role in the arrangements under investigation. He had now become a target and the FC audit team informed their manager.895

A2.58 Any information on the FC audit team's case file was restricted to the case team and their manager. If there was any disclosure whilst the audits were on foot, inquiries may be initiated with resultant delay which would heighten the risk of asset dissipation and destruction of evidence. Similar risks of delay may have arisen if the information was shared with other law enforcement agencies at that time.

A2.59 Accordingly, all communications about Operation Crocodile, outside of the FC audit team, did not contain any identifying information and work progressed with the aim of issuing assessments to the next round of entities in late January. As the covert audits were progressing, it was unlikely that the targets would seek to contact the ATO. Once these audits were almost finalised, the FC audit team notified the Assistant Commissioner of the FC unit of their findings on 31 January 2017. The Assistant Commissioner of FC, then, requested corroborative evidence so that complexities could be explained in a simple way.

A2.60 The Commissioner has subsequently made public comment in support of the ATO officers' decision:

When officers in the ATO working on the investigations were certain that one of the principals of the [Plutus] syndicate had a personal connection with Deputy Commissioner Michael Cranston, they took steps to further isolate and lock down the casework. This was in addition to the extra security and compartmentalisation already in place for such tax crime cases. 896

… the criminal investigation was held very tight. As soon as Michael Cranston's son's name appeared, they overlayed that tightness with a very strong layer of strict need-to-know basis.' … 'I found out through the (Australian) Federal Police,' he said. 'Not through my own people (but through) Andrew Colvin, the Commissioner of the AFP'.897

A2.61 Management of conflicts of interest is discussed in Chapter 3, the risk of possible convergence of internal and external fraud risks is in Chapter 4, governance of the fraud and corruption risk is in Chapter 5 and internal reporting of suspected external fraud is discussed in Chapter 6.

Commencement of the ACIC and AFP's investigations

A2.62 The ATO was unaware that the ACIC had commenced an investigation at the beginning of August 2016 into the same targets who were the subject of the ATO's investigation in Operation Crocodile. Unknown to the ATO and the ACIC, the AFP also had commenced an investigation, namely Operation Elbrus, into the same targets later that month. Shortly thereafter the ACIC became aware that the AFP was investigating the same targets. In coordinating their efforts the ACIC handed over the financial data and other intelligence they had gathered to the AFP.

A2.63 In October 2016, the AFP began intercepting telephone communications on identified targets (wiretaps). Excerpts from the transcripts of these telephone intercepts have since been reported publicly and have been used by many in the public to indicate the alleged co-conspirators' level of involvement and knowledge of the Plutus arrangements. This issue, however, is a matter for the Courts to determine. Accordingly, these publicly released excerpts have not been reproduced in this report.

A2.64 As a result of the above wiretaps, the AFP became aware of the garnishee notices that the ATO had issued on some of the entities peripherally associated with the targets. However, the AFP did not advise the ATO of these investigations at that time because of the familial relationship between Michael Cranston and Adam Cranston.

AFP discloses Operation Elbrus to the Commissioner

A2.65 On 11 January 2017, however, Commissioner Colvin of the AFP met the Commissioner of Taxation Chris Jordan to advise him of the subject matter of Operation Elbrus and of the link to Michael Cranston:

AFP Commissioner Colvin visited me … to make me aware of their investigations and of the personal relationship between one of the principals they were interested in and [the Deputy Commissioner]. Commissioner Colvin was clear to me that [the Deputy Commissioner] was not suspected … of being involved in the syndicate and its activities of defrauding the Commonwealth.

… I was not asked by the AFP to intervene. In fact, the ATO was asked to leave things as they were, and to keep all existing arrangements in place … while further information continued to be gathered about the syndicate and its operations.

A2.66 On 17 January 2017, two senior staff members from the FPII unit attended a briefing on Operation Elbrus at the AFP's headquarters. The FPII's investigative team was briefed, by senior FPII members, later on 20 January 2017 at which time roles were identified and tasks allocated. The ATO's IT forensics capability was also contacted to assist with the preservation of evidence. It was also agreed, as an added precaution, that all records of ATO assistance with Operation Elbrus were to be maintained offline from the ATO's integrated systems.

A2.67 FPII's role was to monitor ATO staff whilst the AFP continued their investigation and provided assistance where needed. Accordingly, FPII investigators began work in scanning the environment to determine whether there was a need to commence investigations. However, such preliminary inquiries did not reveal anything suspicious to warrant deeper analysis.

A2.68 The AFP also needed an ATO officer to assist them to understand the tax issues. AFP could not follow the usual channels to request such assistance without risk of compromising the operation as Michael Cranston may have become aware of the investigations. Accordingly, the AFP and FPII investigators selected a suitable tax officer with proven financial skills in an operational environment.

A2.69 On 24 January 2017, the FC audit team finished its third round of covert audits, including six of the second-tier companies. Notices of assessment and garnishee notices were issued. As a result of the garnishee notices, no wages could be paid to the contractors using Plutus' services as the FC audit team had targeted the second-tier companies, which were the companies that were subcontracted to manage the payroll of Plutus' clients.

A2.70 Once the AFP became aware of the garnishee notices, it caused concern that any further audit activity may interfere with Operation Elbrus. Accordingly, the AFP asked the FPII unit to find out what action the FC audit team was taking.

A2.71 The FPII investigators took covert measures to identify the FC audit team's activities as any enquiries may have signaled the existence of Operation Elbrus to PGH officers. The FPII investigators soon identified that the garnishee notices were part of a number of audits being undertaken by the PGH Financial Crime area under Operation Crocodile. By this time, however, the AFP had asked the FPII unit not to stop the tax audits as the garnishee notices allegedly prompted Adam Cranston to contact Michael Cranston. Accordingly, the AFP provided the FPII investigation team with information which assisted FPII in conducting an investigation into whether the relevant ATO systems and records had sought to be accessed and, if so, by whom and for what reasons.

A2.72 As a result of its investigations, the FPII unit is claimed to have identified two ATO officers who attempted to access records relating to the Plutus arrangements on the ATO's case management system.898 The attempts were unsuccessful due to the ATO's IT systems controls. In fact, the controls also operated to prevent the FPII investigators from accessing that file.

A2.73 FPII's initial inability to access the FC audit team's file was a challenge. Without such access, FPII investigators could not ascertain the FC audit team's knowledge of events and relationships given it was a protected case file. FPII could not ask the network administrator to provide them with access because it would identify their interest in Operation Crocodile. It took them until 14 February 2017 to obtain access to the protected case file.

A2.74 Once the FPII investigators had reviewed the records for Operation Crocodile, they identified the FC audit team's awareness of Adam Cranston's alleged role in the arrangements and that the FC audit team had taken steps to minimise risks of the disclosure of this information. The FPII investigation team commented favourably on the measures the FC audit team had taken.

A2.75 As a result, the FPII team engaged in discussions with the AFP as to whether the FC audit team should be briefed on Operation Elbrus. Subject to the Commissioner's approval, the AFP agreed to do so as it was considered there was little risk that the FC audit team would disclose the existence of the Operation to others within the PGH business line.

Commissioner agrees to coordinate investigation with AFP

A2.76 By 14 February 2017, the Commissioner was informed of the FC audit team's awareness of Adam Cranston's alleged role in the arrangements. On 16 February 2017, the Commissioner formally agreed to the AFP's request that the Assistant Commissioner of FC be made aware of the AFP operation. The Assistant Commissioner of FC was briefed by the AFP on 24 February 2017 and a coordinated investigation was negotiated, including information sharing arrangements.

A2.77 The coordinated investigation was proposed to operate under a tiered system, whereby the AFP worked with the FC audit team to understand the tax issues in pursuing their targets for any criminal liability, the FC audit team would separately conduct an administrative investigation focusing on compliance with the tax laws and FPII would oversee ATO officer involvement and investigate any staff issues.

A2.78 Following the briefing to the Assistant Commissioner of FC, it was agreed that he or his senior officers would discuss operational issues with the AFP on a weekly basis. As it was important that no suspicions be raised, such communications were to be limited to telephone and face-to-face meetings and any travel by these officers was kept to a minimum and not put on the system until after the search warrants were executed.

A2.79 Fortuitously, the FC audit team themselves were not located in the same office as Michael Cranston and the AFP briefed that team on 3 March 2017. Once again, the importance of confidentiality was impressed.

A2.80 Towards the middle of April 2017, the FC audit team was ready for the next round of assessments and garnishee notices to issue. The AFP was alerted, given they had previously raised concerns regarding the issue of such notices on subjects of their investigations. The FPII team was also put on alert to monitor any staff issues.899

A2.81 On 26 April 2017, the FC audit team had finalised their fourth round of covert audits which involved five entities including Plutus. When the ATO had garnished funds from the company's bank accounts (reportedly for $46.6million900), payments of wages to 2,000 of Plutus' clients were stopped.901

A2.82 The above garnishee notices prompted contact with Michael Cranston that resulted in actions being taken by other ATO staff. This contact and the actions of six ATO officers has been the subject of ATO disciplinary investigations and is the subject of pending legal proceedings. It should be noted that no information held on the Operation Crocodile case file was accessed by these officers. However, it has been reported that some of these officers had been requested to make internal inquiries.902 As a result, they had found out that the garnishee notices issued were the result of a covert investigation by the PGH Financial Crimes Unit.

A2.83 On 27 April 2017, the AFP signaled to the FPII team that it intended to execute search warrants on 17 and 18 May 2017. Importantly, the AFP required assistance of the ATO's FC audit team and FPII unit as well as IT forensics officers to preserve data from devices which were to be seized. The Commissioner was briefed and the arrangements included the following:

  • confirming the locations where the 34 search warrants were to be executed on 17 and 18 May 2017, the numbers of personnel needed to assist and their roles as well as coordinating actions with the AFP's CACT so that identified funds and assets can be seized;
  • confirming the charges that the AFP intended to lay, suspension notices that will be issued to ATO officers as well as the location of the targets and interview strategy;
  • developing the strategy to manage staff with close ties to Michael Cranston, secure staff access to buildings and systems as well as more broadly informing staff of events;
  • briefing the ATO's media area to prepare a media strategy in consultation with the AFP and resolving the question of whether transcripts of the telephone intercepts may be used;
  • engagement of an external party to investigate the 'administrative actions' of identified ATO officers for the purposes of determining whether ATO employees had breached the APS Code of Conduct and the imposition of sanctions (Code of Conduct investigator); and
  • finalising the fifth round of covert audits which involved 14 entities, including those who were alleged to have conspired to defraud the Commonwealth.903

AFP's searches and seizures actioned

A2.84 On the morning of 17 May 2017, search warrants were executed by 290 AFP officers, assets were seized and within the hour nine targets were reported to be in custody. Work property that Michael Cranston was carrying at the time was also seized. Following this, FPII investigators began interviews with him and other ATO staff.

A2.85 The ATO also served five ATO officers with suspension notices pending further investigation and revoked building access. Those with close ties to Michael Cranston were told not to go to work or access ATO systems.

A2.86 The AFP also released information to the media. Operation Elbrus had now become public and the AFP confirmed that Michael Cranston was not party to the alleged conspiracy to defraud the Commonwealth.904

A2.87 Since that time senior ATO officers have made public comment on the events.905 The Code of Conduct investigations have also been finalised. As a result, sanctions were imposed on two officers.906

Charges laid

A2.88 As a result of Operation Elbrus, six people were charged with conspiracy to defraud the Commonwealth, one person was charged with conspiracy to defraud the Commonwealth and blackmail, two people were charged with dealing with proceeds of crime, one person was charged with blackmail and Michael Cranston, the Deputy Commissioner, was charged with abuse of public position. Civil proceedings to recover the proceeds of crime were also commenced against nine people.

A2.89 The charges laid against the ten defendants in this matter were originally adjourned to 29 August 2017907 and the brief of evidence was expected to be delivered by 8 August 2017.908 However, extensions to file the brief of evidence were provided to the prosecution until 13 July 2018.909 Additionally, on 9 March 2018, the Magistrate set the trial date of the charges against Michael Cranston for 21 January 2019.910

Follow-up ATO initiatives

A2.90 The above events led to a number of ATO initiatives. As mentioned in the body of this report, on 8 June 2017, the Chief Internal Auditor and the Assistant Commissioner of the FPII unit commenced a joint review into the ATO's conflicts of interest and security clearance policies and processes.911

A2.91 The ATO also engaged two contractors who specialised in corruption resistance and integrity framework design to evaluate the ATO's areas of corruption risk.912 This evaluation is discussed in more detail in Chapter 4.

A2.92 Substantial developments also took place during insolvency action regarding the entities connected with Plutus. These events are ongoing and include ATO efforts to address concerns with relevant creditors and liquidators.913

854 Chris Pash, 'What we know about Plutus Payroll, the company allegedly at the centre of Australia's biggest tax fraud', Business Insider Australia (online) 18 May 2017; See also archived website of Synep (2 November 2016) <>.

855 Fleur Anderson, Neil Chenoweth, Joanna Mather, and Geoff Winestock, 'The inside story of the $165m scam on the ATO', The Australian Financial Review (online) 19 May 2017.

856 Nick Hansen, 'ATO scam: Tax boss Michael Cranston's alleged phone call to fraud accused son', The Daily Telegraph (online) 24 May 2017.

857 Daniel Peters, 'Tax Office boss Michael Cranston, 58, 'tried to cut a deal with senior colleagues to stop his son, 30, being investigated for his role in record $165 MILLION fraud syndicate', Daily Mail (online) 18 May 2017.

858 Above n 856.

859 David Marin-Guzman, 'Plutus accused Simon Anquetil had phoenix activity form', The Australian Financial Review (online) 22 May 2017.

860 Above n 855.

861 ibid.

862 ibid.

863 Geoff Winestock, 'Plutus Payroll's $165m scam highlights risks of recruiter kickbacks', The Australian Financial Review, (online), 23 May 2017.

864 Above n 855.

865 Riley Stuart, 'ATO official Michael Cranston facing charges over son's alleged involvement in $165m fraud', Australian Broadcasting Corporation (online) 18 May 2017.

866 See, for example, ATO, 'Phoenix Taskforce cracking down on dodgy business behaviour', (Media Release, QC 49745, 29 July 2016); Simon Benson, 'ATO raids 12 major firms for fraud evidence', The Daily Telegraph (online) 10 June 2015.

867 Above n 7, p 59.

868 Above n 353, p 13 (Commissioner of Taxation).

869 AFP, Joint press conference with Acting ATO Commissioner of Taxation, AFP Headquarters, Canberra (17 May 2017); <>, 'AFP hold Press Conference to Discuss Bust of Tax Fraud Syndicate'.

870 Joanna Mather, 'The school buddies who became embroiled in $165m ATO tax fraud', The Australian Financial Review (online) 24 May 2017.

871 Paragraphs A2.88 and A2.99 in Appendix B outline the charges laid.

872 Neil Chenoweth and David Marin-Guzman, 'Plutus payroll the $191m Gen Y crime wave and the tax officer', The Australian Financial Review, 4 July 2017.

873 ATO communication to the IGT, 24 April 2018.

874 Commissioner of Taxation, Annual Report 2005–06 (2006) p 19; Commissioner of Taxation, Annual Report 2006–07 (2007) p 167.

875 ibid.

876 Commissioner of Taxation, Annual Report 2007–08 (2008) p 110.

877 ATO, 'Phoenix Taskforce continues to put pressure on pre-insolvency industry' (Media Release, QC 51654, 4 April 2017); Andrew White, 'Tax fraud scandal: Michael Cranston's 'illustrious career' shattered', The Australian (online) 19 May 2017.

878 See the annual reports of the Commissioner of Taxation for the 2006–07 to 2015–16 financial years.

879 Rachel Olding, 'Illustrious career on hold: Cranston suspended probe', The Guardian (online) (13 June 2017) <>

880 Paul Farrell, 'ATO fraud investigation: federal police freeze assets of 60 parties', The Guardian (online) 9 June 2017.

881 Archived website of (10 May 2006), <>.

882 Aventis Capital website, <>.

883 ibid.

884 Rachel Olding, 'Australia's largest tax fraud syndicate had its origins in modest Menai', Sydney Morning Herald (online) 19 May 2017.

885 Archived website of (13 October 2012) <>; Archived website of (11 November 2013) <>; Peter Gosnell, 'Insolvency Referrer Charged in ATO Fraud Bust', Sydney Insolvency News (online) 19 May 2017.

886 Archived website of Synep (22 May 2017) <>.

887 Above n 872.

888 ibid.

889 ibid.

890 Ava Benny-Morrison, Rachel Olding and Nick Ralston, 'The close calls that almost derailed a $165 million 'tax fraud' syndicate', Sydney Morning Herald (online) 18 May 2017.

891 Above n 872.

892 Neil Chenoweth, 'Plutus ATO fraud Part 2: Part 2: Sex, tax and Instagram', The Australian Financial Review (online) 4 July 2017.

893 Above n 353, p 12 (Commissioner of Taxation).

894 The Sydney Morning Herald, 'Trial by media', The Sydney Morning Herald, (online), 13 June 2010; Office of Police Integrity (Victoria), Exposing corruption within senior levels of Victoria Police, (February 2008) p 33.

895 ATO PGH business line, IGT review team interviews, 19 December 2017 and 19 January 2018.

896 Above n 353, p 12 (Commissioner of Taxation).

897 Nick Tabakoff, 'Cranston scandal my most difficult case', The Australian, (online), 9 December 2017.

898 These allegations have been the subject of an ATO disciplinary investigation and are also likely to be an issue considered by the NSW Supreme Court in the upcoming hearings concerning the charges laid against the Deputy Commissioner.

899 ATO PGH business line, IGT review team interview, 18 January 2018.

900 Rachel Olding, 'Michael Cranston captured in phone taps on '$144m ATO tax fraud'', The Sydney Morning Herald, 21 June 2017.

901 Rachel Baxendale, 'ATO tax fraud: IT link prompts review of records', The Australian, 24 May 2017.

902 Neil Chenoweth, 'Plutus ATO fraud Part 3: Michael Cranston and the AFP bug that caught him', The Australian Financial Review (online) 5 July 2017.

903 ATO FPII business area, IGT review team interviews, 19 December 2017 and 18 January 2018.

904 Above n 353, p 13 (Commissioner of Taxation).

905 Fergus Hunter, 'Tax commissioner Chris Jordan says 'staggering' $165m Plutus scandal tarnished ATO reputation', The Sydney Morning Herald (online) 5 July 2017; Above n 897.

906 Doug Dingwall, 'ATO assistant commissioner returns after being stood down', Canberra Times (online) 28 July 2017.

907 Nick Hansen, 'Michael Cranston reveals fears for heavily pregnant daughter as she faces jail term for alleged tax scam', The Daily Telegraph, 14 June 2017.

908 Rachel Olding, 'ATO Deputy Commissioner Michael Cranston suspended during criminal probe', The Sydney Morning Herald (online) 13 June 2017.

909 Nine news, 'Cranston doesn't appear in NSW court', Nine News (online) 29 August 2017; Kelly Fedor, 'Former tax chief's lawyer says case is 'a disgrace', Nine News (online) 19 December 2017.

910 Anthony Klan, 'Former ATO deputy commissioner Michael Cranston's trial date set', The Australian (online) 9 March 2018.

911 Above n 304.

912 Above n 10, p 4.

913 Noel Chenoweth, 'ATO overturns 'last minute' bid to control tax fraud company Plutus Payroll', The Australian Financial Review (online) 9 June 2017; Peter Gosnell, 'Liquidator Facing 10 Year Ban', Sydney Insolvency News (online) 18 October 2017; Peter Gosnell, 'Tax Boss v Liquidator – where's ASIC', Sydney Insolvency News (online) 20 October 2017 and Peter Gosnell 'PPB Preparing To Tread on Deloitte's Plutus Patch', Sydney Insolvency News (online) 15 November 2017.