Black Hats, tax havens: Australia’s biggest insider trading probe revealed

On September 30, 2020, a car mysteriously pulled up at a postbox in Golden Four Drive in Bilinga, a tiny coastal town in Queensland, just over the NSW border. The driver, having mailed his missive, turned around and drove back south.

The letter, sent to the Brisbane home of Ronald and Wanda Doyle, was addressed to their elder son, Stephen. It contained a single ASIC document that outlined Stephen’s questionable transfer of Nuix shares to his Swiss-based brother Ross.

Stephen Doyle is under investigation for insider trading.

At the time Stephen was the chief financial officer of Nuix, a data analytics software company that boasted on its website that it helps clients such as the Australian Tax Office, the Australian Securities and Investments Commission and the Australian Federal Police “to find the truth from any data in a digital world”.

The unknown sender didn’t include an explanatory note with the document, but the message it was intended to convey was clear: people were watching Doyle and knew about the transfer to his brother.

That share transfer is now part of an ASIC investigation into whether Stephen Doyle, together with his brother and father, may have pulled off one of the country’s biggest insider trading heists using a labyrinth of companies in offshore tax havens to disguise their tracks.

Key to their transactions was a Singaporean company, with the apt name Black Hat - a term used for someone, often a hacker, who uses their skills for malicious purposes or personal gain.

ASIC is investigating whether the Doyles’ company Black Hat was used to secretly “dispose of 1.8 million Nuix shares” based on inside information which Stephen Doyle possessed through his position at Nuix, according to ASIC’s affidavit supporting a travel restraint order against Ross Doyle that was released this week.

The Doyle brothers, born eighteen months apart, both became accountants following their graduation from the University of Queensland and both share a passion for long-distance running.

Stephen, 50, became Nuix’s CFO in February 2011, having previously worked in smaller tech companies including a two-year stint in China.

Ross Doyle has been prevented from returning to Switzerland while under investigation for alleged insider trading.

His brother Ross, 49, worked at investment bank UBS and later as CFO of one of Australia’s largest coal producers Glencore Coal, where, according to his LinkedIn profile, he managed “over $30 billion of assets with large and complex workflows delivering billions of profit annually”.

For the past decade, Ross and his wife Rebekah have been based in Switzerland where he has been involved in a number of start-ups and resources companies. He is currently the managing director of renewable energy company GRID Powr (sic). “I’m also a crypto investor and advocate of blockchain and other disruptive mechanisms,” he says on LinkedIn.

Black Hat was set up by Ross on November 24 last year - six days after Nuix applied to list on the ASX. Nuix lodged a 320-page prospectus for potential investors containing rosy financial forecasts. It was then spruiked to investors as a glamorous tech stock that would grow by 20 per cent a year. They lapped it up in spades, pushing the share price 40 per cent higher on the first day of trading, December 4. Six weeks later, on January 22, the stock had almost doubled, hitting a high of $11.86.

In May, a joint investigation by The Sydney Morning Herald, The Age and The Australian Financial Review revealed huge staff turnover due to poor governance as well as disclosure failings at Nuix. The investigation found that Nuix had been tarted up for market day to enrich some of its executives and its main shareholder Macquarie Group, which made a profit of $550 million in the float.

Former staff were less exultant. “This is a story how a few people and Macquarie exploited hundreds of staff and kept most of the gold for themselves,” one said. “It is a story of bastardry.”

Since the media investigation, Nuix has unravelled spectacularly. Its share price crashed to record lows and investors now consider it Australia’s most disastrous sharemarket float in years.

After ignoring a tip-off from a whistleblower back in November, the corporate regulator is now investigating whether Nuix’s float prospectus - the key document outlining financial forecasts and future prospects for potential investors - may have contained false and misleading information. Possible contraventions of the Corporations Act, as well as earlier financial reporting by the company, are now the subject of a separate ASIC investigation.

To add to their woes, the AFP has launched a criminal investigation into Nuix co-founder Tony Castagna in relation to share transactions.

On June 15, the Nuix board informed the market that Stephen Doyle had been terminated by “mutual agreement.” Only 30 minutes later a second announcement detailed the retirement of the CEO, Rod Vawdrey.

The AFP launched a criminal investigation into Tony Castagna. Credit: Dominic Lorrimer

The rout on the shares continued after news that ASIC raided Nuix’s headquarters and Stephen Doyle’s apartment. But the stock’s all-time low came this week after The Herald revealed ASIC had sought an urgent travel ban to stop Ross Doyle leaving the country. An affidavit filed in the Federal Court revealed that the two men and their father were the targets of ASIC’s investigation into insider trading, and that Nuix is facing separate investigations into false and misleading statements in the prospectus.

Turning $326,500 into almost $18 million

Nuix, which before the float was 76 per cent owned by Macquarie, made its dazzling debut on the stock exchange on December 4. Ross Doyle was listed as Nuix’s 14th largest shareholder with 2 million shares, worth $10.6 million. He didn’t sell into the $5.31-a-share float and instead hung on for the ride, as pent-up demand pushed the stock higher and higher.

Nuix insiders, including Stephen Doyle, knew bad news was on the way which would seriously affect the share price. The half-yearly results to December 31 would reveal that Nuix was tracking at only 44 per cent of the full-year revenue forecast.

On February 26, prior to the market opening, Nuix announced a downgrade to its revenue forecasts. By the end of that day the share price had plunged by a third.

But over the previous five weeks Ross Doyle had been busy selling his Nuix shares. His selling spree commenced on January 22, when the shares hit a record high of $11.86.

According to ASIC’s court documents, on Friday February 12, Ross Doyle offloaded the rest of the shares. He knew his brother was going to inform the market on Monday morning that Nuix would announce its half-year profit on February 26, the last day of reporting season. For experienced investors, delaying an announcement to the last day can be a sign of a bad result, which would affect the share price.

So eager was Ross to offload the remaining 1.5 million shareholding that he was willing to forego up to $464,000 in profit by instructing the broker to sell the shares at below market price, ASIC alleges. This loss was nothing compared to the $5.7 million the Doyles would have lost had they sold on the day the half-yearly results were announced. By holding on to the stock post the IPO, they made more than $7 million.

The family turned $326,500 into almost $18 million by exploiting Stephen Doyle’s privileged position at Nuix, ASIC alleges. This was a position not afforded to ordinary investors who saw $3 billion wiped off the stock after a series of downgrades.

Nuix’s price crashed to record lows and investors now consider it Australia’s most disastrous sharemarket float in years.Credit: Facebook

The Herald has previously revealed that in September 2012 Stephen lodged documents with ASIC reporting he had acquired 50,000 Nuix shares for $301,500.

However, three years later, in December 2015, he notified ASIC he had sold those same 50,000 Nuix shares to Ross for $326,500 in July 2012. This was six weeks before he owned the shares.

Stephen Doyle’s share transfersCredit: Michael Howard

Even though the finance chief apparently sold the shares to his brother for $326,500 some three years earlier, booking a small capital gain, Nuix continued to produce internal and external documents which showed Stephen Doyle still owned the shares up until 2015, when their value had jumped to $4 million. In 2017, those share numbers ballooned to 2 million after a one-for-50 share split and buyback.

Even though ASIC had been informed he no longer owned the shares, in 2018 Stephen Doyle was deemed the owner in an internal document. But when the company debuted on the ASX on December 4, 2020, Ross Doyle was listed as owning the 2 million shares.

However, five days earlier Ross Doyle had transferred 1.8 million shares to Black Hat, the company he had recently set up in Singapore on November 24. He traded the remaining 200,000 shares in his own name.

Black Hat had one shareholder: the Black Knight Foundation. According to ASIC, the foundation consists of Stephen Doyle, his father Ronald, and a Liechtenstein tax services company using the same business address as one of Ross Doyle’s companies.

Ronald Doyle, seen leaving his Brisbane house, is alleged to have helped his sons deal with proceeds of share sales. Credit: Dan Peled

The corporate regulator has traced the proceeds from the Black Hat share sale. In February, $1.55 million was sent from the Doyle parents’ CBA account to Ross’s Swiss bank account with the description “loan.” That same day $400,000 went from the parents’ account to Stephen’s bank account.

Almost $12 million ended up in a Liechtenstein bank account belonging to Ross Doyle.

ASIC’s affidavit, filed as part of emergency action to stop Ross flying to Switzerland on June 27, said it believed Stephen had a financial interest and was a beneficial owner of the Black Hat account and stood to benefit from instructing his brother to sell the shares in the weeks leading up to the company’s disastrous half-year results.

Ross had flown out of Zurich landing in Brisbane on March 13, 2020 and was due to fly back a month later but COVID-19 prevented his departure.

He has been staying at his parent’s Brisbane home and more recently has leased a three-bedroom penthouse at the Regis Towers in Sydney’s CBD. In a statutory declaration dated June 1 he asked for a travel exemption to fly out of the country on June 27, saying, “my permanent address is overseas and I need to return home to Switzerland as soon as possible. I’ve been stuck in Australia during COVID.“

Without his knowledge, ASIC went to court on June 23 to obtain orders preventing him from leaving the country on the grounds that if he knew he was facing possible imprisonment and financial penalties, he might not come back.

At the confidential hearing, ASIC told the court while Ross and Stephen were aware of the separate investigations by the AFP into Nuix transactions, the brothers were not aware that they were the subject of an explosive insider trading investigation.

The very next day, June 24, the reality of their situation would become only too apparent with search warrants executed on all their premises, including the $4.6 million penthouse in Pyrmont that Stephen Doyle had splashed out on the very same day as the Nuix float.

Stephen Doyle and his wife Liza Choa-Doyle bought a $4.6 million penthouse on the day Nuix listed on the ASX.Credit: Facebook

A month earlier, the brothers found themselves in the spotlight when the Herald and The Age reported Stephen’s share transfer to his brother. Nuix insiders were reporting that, following the May 24 article, he had cleared his desk and not been sighted.

His obsession with posting his fitness details on his Strava app showed him arriving in Runaway Bay on Queensland’s Gold Coast on May 31, the day of the company’s second downgrade to revenue forecasts that pushed its shares to a record low.

While the company was engulfed in turmoil, the CFO stayed in Runaway Bay sharing details of his daily runs around the local sports complex. Doyle was “terminated” on June 15.

But his departure didn’t cause many tears inside Nuix. Current and former workmates describe Doyle as aloof and arrogant.

In one text message sighted by The Herald and The Age, he described a senior employee as a “f.....g useless, cackling, mess” and that “I can’t stand the sight of her.” In another text message he disparagingly described an HR manager as a “mummy” whose direct reports needed to “check with mummy every minute... mummy can I piss... mummy did you know [names person] said something naughty... f..k me.“

Meanwhile, shareholders who have seen Nuix lose close to three-quarters of its value can only shake their heads at the company’s initial response to this masthead’s questions.

Nuix has “a strong corporate culture and a high calibre leadership,” a spokesperson said.

The Morning Edition newsletter is our guide to the day’s most important and interesting stories, analysis and insights. Sign up here.