Billion Dollar Whale, by the Wall Street Journal reporters Tom Wright and Bradley Hope, tells the story of Jho Low, a Malaysian financier in his late twenties who, with a prime minister’s backing and a global bank’s bond deals, siphoned an estimated $4.5 billion out of a sovereign wealth fund called 1Malaysia Development Berhad and spent it on parties, paintings, a yacht and a Hollywood film about a fraudster. It is the largest kleptocracy case the United States Department of Justice has brought, and it ran through a chain of institutions, three Big Four auditors, a half-dozen private banks, Goldman Sachs, a Middle Eastern sovereign fund and the fund’s own board, each of which had the information to stop it. This guide summarises the book without reproducing it, sets out how the money moved, catalogues the controls that failed and the few that worked, maps the case to internal audit practice, and ends with a worked example of a bank audit team testing its own exposure to the pattern.
In this guide
- The book in one page
- Who the authors are, and how the book came about
- The timeline: 2009 to 2020
- How the money moved: the four diversions
- The gates that failed, and the two that worked
- The eight ideas worth keeping
- The vocabulary: twelve terms defined for practitioners
- What it means for internal audit: a failure-by-failure map
- The aftermath: prosecutions, settlements and reforms
- The criticisms, and what the book leaves out
- Editions, reading time and how to read it
- A one-hour discussion guide for an audit team
- Worked example: Thornwick Bank tests the pattern
- Frequently asked questions
- Related guides
The book in one page
| Question | The answer, in our words |
|---|---|
| What is it about? | 1MDB, a Malaysian state investment fund created in 2009, and Jho Low, the young intermediary who used his access to Prime Minister Najib Razak to control it, raise billions in its name and divert most of the money through shell companies in the Seychelles, the British Virgin Islands and the Gulf. |
| How much was taken? | The US Department of Justice put the misappropriation at about $4.5 billion between 2009 and 2015, which is the figure the book uses; the proceeds funded property in New York and Los Angeles, a $250 million yacht, Monet and Van Gogh canvases, jewellery for a model, and the financing of The Wolf of Wall Street. |
| How was it done? | In four main diversions: a 2009 joint venture with a Saudi company that sent $700 million to a Low-controlled account; a 2012 pair of Goldman-arranged bonds whose proceeds went partly to a look-alike of an Abu Dhabi fund; a 2013 Goldman bond for a “strategic partnership” from which more than $1.2 billion was diverted; and a 2014 bank loan of $1.225 billion, about $850 million of which was diverted to offshore shells. |
| Who enabled it? | A prime minister who chaired the fund’s advisory board and received $681 million into his personal accounts; a Goldman Sachs team that earned roughly $600 million in fees on $6.5 billion of bonds; private banks in Switzerland and Singapore that onboarded the shells; auditors who were dismissed when they asked questions, and one that signed and then resigned too late; and a board that did not ask where the money was. |
| How did it end? | A whistleblower’s documents, a London-based investigative site, the Wall Street Journal’s 2015 reporting on Najib’s accounts, the DOJ’s 2016 civil forfeiture action, and Malaysia’s 2018 election, which removed Najib and led to his conviction. Low remains a fugitive. |
| Why read it as an auditor? | Because it is a case study in how bond proceeds, joint ventures and “investments” become a pipe for theft; how politically exposed persons defeat bank controls; how a change of auditor is the loudest warning a board can ignore; and how a sovereign fund with a board, an auditor and a regulator can be run as a private account. |
| Reading time | About eleven hours for the paperback; it is a page-turner with a large cast, so keep a list of names. |
Who the authors are, and how the book came about
Wright and Hope were Wall Street Journal correspondents, Wright in Asia and Hope covering finance, and the Journal’s July 2015 report that nearly $700 million had reached Najib’s personal bank accounts was the moment the scandal moved from Malaysian blogs to the front page of the international press. The book, published by Hachette in September 2018, drew on leaked bank records, the DOJ’s forfeiture complaints, Singapore’s prosecutions of bankers, and interviews across Malaysia, the Gulf, Switzerland and the United States. It was a New York Times bestseller. Both authors later left the Journal to co-found Project Brazen, and Wright has continued to report on Low’s whereabouts. The book’s reporting has held up well: the later guilty pleas, convictions and settlements confirmed its account in almost every particular.
The timeline: 2009 to 2020
| Date | Event | Why it matters |
|---|---|---|
| 2009 | Najib becomes prime minister and converts a state investment vehicle into 1MDB, with himself chairing its advisory board; the fund’s first deal is a $1 billion joint venture with PetroSaudi, of which $700 million goes to an account controlled by Low | The structure that made the fraud possible: a fund with sovereign borrowing power and a single political patron |
| 2010 to 2011 | Low spends lavishly in New York and Las Vegas; the money is explained as family wealth and Gulf backers | The spending is the first visible anomaly and is read as colour, not evidence |
| 2012 | Goldman Sachs arranges two bonds totalling $3.5 billion for 1MDB to buy power plants; the deals are guaranteed by Abu Dhabi’s IPIC, and part of the proceeds goes to a company with a name almost identical to IPIC’s subsidiary Aabar | The look-alike shell: a control defeat by naming |
| 2013 | Goldman arranges a third bond, $3 billion, for a strategic partnership with Abu Dhabi; much of it is diverted; $681 million lands in Najib’s accounts before the election | Peak theft; Goldman’s fees on the three bonds are about $600 million |
| 2013 to 2014 | 1MDB dismisses KPMG, which had refused to sign off the accounts over a $2.3 billion fund investment; Deloitte takes over and signs the accounts | The auditor-change warning, ignored |
| 2015 | A former PetroSaudi executive’s documents reach Sarawak Report and The Edge; the Wall Street Journal publishes the Najib accounts story; the Swiss and Singaporean authorities open inquiries; Malaysia’s attorney general is replaced, and his successor clears Najib in January 2016 | Exposure abroad, suppression at home |
| 2016 | The DOJ files civil forfeiture complaints to recover more than $1 billion of assets; Deloitte resigns and says its 2013 and 2014 opinions can no longer be relied upon; Singapore shuts a Swiss bank’s local branch | The institutional verdict, outside Malaysia |
| 2018 | Najib loses the election; he is charged; Goldman’s former Southeast Asia chairman Tim Leissner pleads guilty in the US; the yacht is seized | The political gate opens |
| 2020 | Najib is convicted in the first of his trials and sentenced to twelve years; Goldman reaches settlements of $3.9 billion with Malaysia and $2.9 billion with US and other authorities | Accountability, partial and late |
How the money moved: the four diversions
The fraud was not a single theft but a series of structures, each presented as an investment or a financing and each with a hole in it through which cash left the fund. The pattern repeats: 1MDB raises money on the strength of a sovereign connection, commits it to a joint venture, a bond-funded acquisition or a fund structure, and the counterparty or the custodian turns out to be controlled by Low or his associates. The table sets out four. The first three match the DOJ’s phases; the DOJ’s fourth phase was different, a 2014 bank loan of $1.225 billion, about $850 million of which was diverted to offshore shells.
| Diversion | The structure as presented | Where the money went | The control that failed |
|---|---|---|---|
| PetroSaudi joint venture (2009) | 1MDB invests $1 billion in a JV with a Saudi oil company to develop energy assets | About $700 million was wired to a Seychelles company called Good Star, controlled by Low, described in the paperwork as repayment of a loan | Board approval of a $1 billion investment on days’ notice; no independent valuation; the JV partner’s accounts never examined |
| Goldman bonds for power plants (2012) | Two bonds of $1.75 billion each, guaranteed by IPIC, to buy power generation companies | Roughly $1.4 billion went to Aabar Investments PJS Limited, a British Virgin Islands shell with a name mimicking IPIC’s real subsidiary | Payment to an entity whose name matched but whose registration did not; no verification of the guarantor’s actual subsidiary |
| Goldman bond for a strategic partnership (2013) | A $3 billion bond to fund a 1MDB–Abu Dhabi investment vehicle | Over $1.2 billion diverted through the Tanore account at a Singapore private bank; $681 million to Najib | Use of proceeds unmonitored; the bank’s own compliance questions overridden by deal pressure |
| Private bank fund structures (2014 to 2015) | 1MDB’s “investments” held through Cayman fund units at Swiss banks, later claimed as $1 billion in cash | The units were valued on paper; the underlying assets were largely gone | Existence and valuation of investments taken from the custodian’s statements, not from the assets |
Two features of the mechanics deserve emphasis for auditors. First, almost every diversion ran through a transaction with a plausible business story and real counterparties somewhere in the chain: a genuine Saudi company, a genuine Abu Dhabi fund, genuine power plants, genuine bonds. The theft sat in the gap between the genuine thing and the entity that actually received the money. Second, the money’s onward journey, to property, art and the film, was handled by banks that saw a young man with no declared source of wealth moving hundreds of millions through accounts tied to a head of government, and processed it anyway. The BSA/AML audit guide is about exactly the controls that should have stopped that.
The gates that failed, and the two that worked
- The board and the advisory board. 1MDB’s board approved the PetroSaudi investment and later transactions with minimal information and under political pressure. The prime minister chaired the advisory board and signed off on the fund’s borrowing.
- The auditors. EY was dismissed in 2010 after it could not verify the PetroSaudi asset; KPMG signed three years of accounts and was dismissed at the end of 2013 after questioning a $2.3 billion fund investment; Deloitte then signed the 2013 and 2014 accounts, including the Cayman fund units, before resigning in 2016 and withdrawing reliance on its opinions. Each change of auditor was a warning the board did not act on.
- Goldman Sachs. The bank’s compliance function raised Low’s involvement repeatedly and was told he was not part of the deals; the business pressed ahead on fees that were many times normal. Two bankers were later convicted or pleaded guilty, and the bank’s Malaysian subsidiary pleaded guilty in the US.
- The private banks. BSI and Falcon in Switzerland and Singapore onboarded the shells and moved the money; Singapore shut both local operations and jailed bankers; Switzerland’s regulator confiscated BSI’s illegally earned profits and ordered it dissolved.
- The Malaysian regulators and prosecutors. The central bank’s investigation was overruled; the attorney general who was preparing charges was replaced in 2015 and his successor cleared Najib.
- The gate that worked: the DOJ and foreign regulators. The 2016 forfeiture complaints laid out the money flows in public and made the case un-ignorable; Singapore and Switzerland acted against the banks while Malaysia’s own institutions were captured.
- The gate that worked: the whistleblower and the press. A former PetroSaudi executive’s copies of the company’s servers, published through Sarawak Report and The Edge and pursued by the Journal, were the evidence everything else followed from. He was later jailed in Thailand after pleading guilty to trying to blackmail PetroSaudi.
The eight ideas worth keeping
- Follow the money to the registered entity, not the name. The Aabar look-alike is the book’s cleanest lesson. A payee whose name matches the expected counterparty is not the expected counterparty until its registration, ownership and bank details have been verified independently.
- Use of proceeds is a control, not a disclosure. Billions were raised for stated purposes and spent on others. Any financing above a threshold should carry monitoring of proceeds to the point of final use, by someone who does not report to the person spending them.
- An auditor’s exit is the loudest alarm a board can receive. Two Big Four auditors dismissed in just over three years, each after questioning the valuation or existence of the fund’s largest asset, should have ended the management’s tenure. A board that replaces the auditor rather than the executive has answered the wrong question.
- Politically exposed persons are a control category, not a customer segment. Every bank in the chain had a PEP policy; the policies lost to revenue. The audit test is whether enhanced due diligence changed any decision, not whether it was performed.
- Fees that are far above market are a red flag, not a win. Goldman’s roughly nine percent on the 1MDB bonds, against a norm of a fraction of that, was itself evidence about the deals. Revenue anomalies deserve the same scepticism as cost anomalies.
- Compliance escalations that are overridden must be visible to the board. The bank’s compliance function asked the right questions and was overruled by the business. The record of overrides is the audit evidence; its absence is the finding.
- Captured institutions do not self-correct; outside ones do. The case was resolved by foreign prosecutors and regulators and by an election. An organisation’s assurance design should assume that some domestic gate may be captured and ask what external gate remains.
- Lifestyle is evidence. Low’s spending was public, extravagant and inconsistent with any declared wealth, years before the documents emerged. The fraud triangle’s opportunity and rationalisation are hard to observe; the spending is not. The fraud risk guide treats behavioural indicators as part of the assessment for this reason.
The vocabulary: twelve terms defined for practitioners
| Term | What it means in the book | What it looks like in an audit |
|---|---|---|
| Sovereign wealth fund | A state-owned investment vehicle; 1MDB was a development fund with sovereign guarantees | Governance that mirrors a listed company’s is the expectation; the political chair was the design flaw |
| Kleptocracy | Rule by theft; the DOJ’s Kleptocracy Asset Recovery Initiative brought the case | The frame for state-linked counterparties: assume the state’s controls may be the thief’s |
| Politically exposed person (PEP) | A person with a prominent public function, or their family and associates | Enhanced due diligence, senior approval, ongoing monitoring; the test is whether any of it changed a decision |
| Look-alike entity | A shell whose name mimics a legitimate counterparty | Verification of counterparties by registration number and bank details, not by name |
| Use of proceeds | What borrowed or raised money is spent on | Monitoring to final use; reconciliation of disbursements to the stated purpose |
| Joint venture diversion | A JV in which the partner or its “loan repayments” carry the money out | Independent valuation; examination of the partner’s accounts; tracing of every outflow |
| Auditor change | An auditor’s dismissal or resignation, often after a disagreement over the accounts | The audit committee should obtain and minute the reason; a replacement auditor should ask the predecessor |
| Withdrawal of reliance | An auditor stating that past opinions can no longer be relied upon | A restatement trigger and a signal to every lender and regulator |
| Civil forfeiture | Government action to seize assets as proceeds of crime without a criminal conviction | The DOJ’s route in 2016; the complaints are the best public source on the flows |
| Deferred prosecution | A settlement in which charges are suspended subject to conditions | Goldman’s 2020 resolution; the parent avoided a guilty plea, the Malaysian subsidiary did not |
| Private bank | A bank serving wealthy individuals with discretion | The onboarding and transaction monitoring controls are where this case was lost |
| Fund units (Cayman) | Investment units whose value depends on underlying assets held elsewhere | Existence and valuation must be tested at the assets, not the units |
What it means for internal audit: a failure-by-failure map
The book is a public-sector governance failure, a banking compliance failure and an audit failure at once, and each failure maps to a test that an internal audit function at a bank, a fund, a government entity or any organisation with large financings can run. The corporate governance audit guide, the BSA/AML program audit guide and the corporate scandals guide provide the surrounding frameworks.
| Failure in the book | Control the audit function should expect | Test that produces evidence |
|---|---|---|
| Board approved $1 billion on days’ notice | Investment approval policy with minimum information, independent valuation and cooling-off for transactions above a threshold | Select the five largest approvals of the year; compare the board pack with the policy’s minimum; note the elapsed time from paper to decision |
| Payment to a look-alike entity | Counterparty verification by registration and bank-account ownership before first payment; name-similarity screening against known counterparties | Reperform verification for the ten largest new payees; run a name-similarity check across the vendor and counterparty masters |
| Bond proceeds unmonitored to final use | Use-of-proceeds monitoring for financings above a threshold, reported to the audit committee | Trace the disbursement of one financing from receipt to final use; compare with the stated purpose |
| Two auditor dismissals ignored | Audit committee protocol on auditor changes: reasons minuted, predecessor consulted, management explanation challenged | Read the minutes for the last auditor change; confirm the predecessor was consulted |
| PEP policy defeated by revenue | Enhanced due diligence with senior approval and a record of declined relationships | Sample ten PEP relationships; identify any that were declined or exited on due-diligence grounds; if none, ask why |
| Compliance overrides invisible | A log of compliance objections overridden by the business, reviewed by the board risk committee | Obtain the log; if it does not exist, the finding is its absence |
| Fees far above market | Pricing exceptions reviewed and justified; revenue anomalies in the fraud risk assessment | Extract transactions with fees above twice the median for their type; read the justifications |
| Existence of investments taken from custodian statements | Existence and valuation tested at the underlying assets for material holdings | For the largest fund-type holding, obtain evidence of the underlying assets, not the units |
The aftermath: prosecutions, settlements and reforms
The consequences arrived in layers. Najib was convicted in July 2020 on charges related to SRC International, a former 1MDB subsidiary, and sentenced to twelve years; he began serving the sentence in August 2022 after his appeals failed, and in 2024 a pardons board halved the term. In December 2025 he was convicted in the main 1MDB trial on four counts of abuse of power and 21 of money laundering and sentenced to a further 15 years, which he is appealing. Goldman Sachs’s Malaysian subsidiary pleaded guilty in the United States in October 2020 and the group entered a deferred prosecution agreement with penalties and disgorgement of about $2.9 billion to American and other authorities, having settled with Malaysia for $3.9 billion three months earlier. Leissner pleaded guilty in 2018; his colleague Roger Ng was convicted in New York in 2022 and sentenced to ten years in 2023. Singapore jailed bankers and closed the local operations of two Swiss private banks; Switzerland dissolved BSI. The DOJ recovered and returned more than a billion dollars of assets, including the yacht, the art and the film proceeds. Low, believed to be in China, has not been tried. 1MDB was left insolvent, its debts fell on the state, and the governance of state investment vehicles became an election issue. The whistleblower, Xavier Justo, served a prison sentence in Thailand before being released. For an auditor the lesson of the aftermath is the asymmetry between the speed of the theft, six years, and the speed of the accountability, a decade and counting.
The criticisms, and what the book leaves out
The book’s weakness is also its appeal: it is told as a story of one extraordinary young man and his parties, and the institutional failures that made him possible are the background against which the yacht and the film star appear. A reader who wants to know what the 1MDB board actually saw at each meeting, or how Deloitte reached its 2014 opinion, will have to go to the Malaysian parliamentary committee report, the DOJ complaints and the auditor’s own later statements. The authors are also stronger on the Western institutions, Goldman and the Swiss banks, than on the Malaysian political machinery that protected the scheme, which the local press covered more closely. And the book predates the trials, so its account of culpability is the reporters’ reconstruction, since confirmed in most respects by guilty pleas and verdicts. None of this is a reason not to read it; it is a reason to read the DOJ complaints alongside it, which are free, public and written for exactly the kind of tracing an auditor does.
Editions, reading time and how to read it
| What | Details | Best for |
|---|---|---|
| Hardback | Hachette Books, September 2018, about 400 pages | The first edition |
| Paperback | Hachette, October 2019; it predates the 2020 Goldman settlements | The edition to read |
| Audiobook | Unabridged, about twelve hours | Commuting; keep the cast list to hand |
| Reading plan | Chapters on the PetroSaudi deal and the 2012 bonds for the mechanics; the 2015 exposure chapters; the epilogue | An auditor who wants the money flows before the parties |
| Companion reading | The DOJ civil forfeiture complaints of 2016 and 2017, free online; the Smartest Guys in the Room summary for the corporate version of board capture | Turning the story into tests |
A one-hour discussion guide for an audit team
- Ten minutes: the look-alike. Ask whether the organisation’s payee verification would have caught a payment to “Aabar Investments PJS Limited” in place of “Aabar Investments PJS”. If the answer depends on a person noticing, write that down.
- Fifteen minutes: proceeds. Take the organisation’s largest financing or grant of the last three years and reconstruct, from the records available to the team, where the money went. Note how long it takes and what cannot be traced.
- Ten minutes: the auditor changes. Recall every change of external auditor, actuary, valuer or other independent expert in the organisation’s recent history and what the committee minuted about the reasons.
- Fifteen minutes: overrides. Discuss where in the organisation a compliance or risk objection can be overridden by the business, and whether the override is recorded anywhere a board member could see it.
- Ten minutes: the plan. Decide which of the eight tests the function has run in the last three years and whether the gaps belong in the next plan, using the method in the risk assessment guide.
Worked example: Thornwick Bank tests the pattern
Thornwick Bank is a fictional $62 billion regional bank with a wealth management arm, a corporate banking business that lends to state-linked entities in two emerging markets, and an internal audit function of twenty-four people. After the audit committee chair read the book, the function added a short “1MDB pattern” review to the 2027 plan, applying the eight tests to the businesses most exposed.
| 1MDB question | What Thornwick found | Result |
|---|---|---|
| Would payee verification catch a look-alike? | New payees were verified by a call-back to a number on the invoice; no registration-number check; no similarity screening | Finding: verification moved to registry and bank-account ownership checks; a similarity screen added to the vendor master |
| Are proceeds of large facilities monitored to use? | Corporate loans above $25 million carried use-of-proceeds covenants; monitoring consisted of a borrower certificate | Finding: for state-linked borrowers, disbursement to be made against invoices and traced for the first drawdown |
| Is the PEP process changing decisions? | Enhanced due diligence was performed on all 41 PEP relationships; none had been declined or exited in five years | Observation: the committee asked for the decline and exit record to be reported annually, so that a zero becomes a question rather than a comfort |
| Are compliance overrides visible? | Overrides of AML escalations required business-head approval and were logged; the log had never been presented to the risk committee | Finding: quarterly reporting of the override log |
| Are fee anomalies in the fraud assessment? | Revenue analytics flagged cost anomalies only | Observation: fee-rate outliers added to the fraud analytics suite |
| Are investments tested at the assets? | Wealth management’s fund holdings were valued from custodian statements; the top ten were reconciled to fund administrators’ records annually | No finding |
The review took three weeks and produced three findings and two observations. The bank had no 1MDB; it had a payee check that would have paid the look-alike, a loan monitoring process that trusted the borrower’s certificate, and a PEP process whose perfect record of approvals was the thing the committee most wanted explained. The chair’s comment in the minutes was that the review had been worth the book’s price many times over, which is a fair summary of what case studies of this kind are for.
Frequently asked questions
Is Billion Dollar Whale accurate?
The guilty pleas, convictions and settlements that followed publication confirmed its account of the money flows and the roles of the principal figures. Where it reconstructs private conversations it says so, and those are the parts to read as journalism rather than evidence.
What did Goldman Sachs do wrong?
In the US resolution, the bank’s Malaysian subsidiary pleaded guilty to conspiring to violate anti-bribery law, and the group accepted that its controls failed to prevent two senior bankers from participating in the scheme despite compliance concerns about Low. The fees, about $600 million on $6.5 billion of bonds, were many times the market rate.
What should an auditor read alongside it?
The DOJ civil forfeiture complaints, which trace the flows in detail and are free; and the Bad Blood summary and Smartest Guys in the Room summary for the pattern of board capture in private companies.
Does the case apply outside banking?
Yes. The look-alike payee, the unmonitored proceeds, the ignored change of auditor and the overridden compliance objection occur in corporates, charities and public bodies. The procurement and treasury versions are in the cash management audit guide and the third-party risk guide.
Why was it resolved abroad rather than at home?
Because the domestic gates were captured: the attorney general was replaced, the central bank’s inquiry overruled, the parliamentary committee constrained. The DOJ, Singapore and Switzerland acted on their own jurisdiction over the banks and the assets.
Where does the book sit in the reading list?
In the fraud and scandal group of the internal audit reading list, beside Money Men, Bad Blood and The Smartest Guys in the Room.
Related guides
- How to Audit the BSA/AML Program — the controls the private banks had on paper
- Fraud Risk Management: Assessment, Controls and Analytics — behavioural and revenue indicators in the assessment
- How to Audit Corporate Governance — the board that approves in days
- Corporate Scandals and the Internal Audit Lessons — 1MDB beside the other cases
- Money Men: The Wirecard Fraud, Summarised for Auditors — the other great fraud of the decade, with the same captured regulator
- Bad Blood: Summary and Review — board capture in a private company
- The Best Books for Internal Auditors — where this book sits among the others
- All book summaries — the full set of summaries for auditors
- Dark Towers by David Enrich: Summary and Lessons for Auditors — a bank whose growth outran its controls.
Leave a Reply