Twelve chapters

Under the Financial Obligations Law No. 1 of 2014 (Art. 4), government entities withhold a percentage — around 7% — of payments to contractors and suppliers and transfer it to the GCT as advance tax security deposits (أمانات ضريبية). [S2][S4] A company that settles its taxes may reclaim its surplus deposits, but only through a rigorous internal process: a formal request, original receipts, proof of 100% project completion, tax settlement letters, and multiple layers of audit inside the GCT. [S2] Deposits unclaimed for five years become state revenue under the Federal Financial Management Law No. 6 of 2019 (Art. 6/1). [S5] The GCT held its main trust account, No. 60032, at Rafidain Bank's Tax Authority branch, opened on 18 September 2018; an older account of the same number existed at the al-Ahrar branch since 2004. [S1][S2] By the end of 2020, the newer account alone held about IQD 3.4 trillion. [S1]

The trust deposits had long attracted fraud, typically through forged powers of attorney. After a scheme was uncovered in 2017, the office of Prime Minister Haider al-Abadi issued directive م.ر.و/5/3047 (26 February 2017) instructing the Board of Supreme Audit (BSA) — Iraq's supreme public-audit institution — to pre-audit all tax and customs deposit refunds from 1 January 2015 onward, and to report the amounts refunded and their recipients. [S2][S4][S6] The pre-audit's purpose was explicitly preventive. Whatever its cost in delays, it worked: no large-scale theft of the trust accounts occurred while it stood. [S4] Removing it, therefore, was the indispensable first move of any new scheme. [S4]Testimony

On 13 July 2021, Haitham al-Jubouri, head of the Parliamentary Finance Committee, wrote to the Minister of Finance proposing that refund audits be confined to the GCT itself, citing complaints of delays. [S2][S4 Exh.8] On 27 July the BSA — remarkably endorsing its own removal — asked the PMO for its opinion. [S4 Exh.9] On 1 August the PMO's legal department replied with deliberately elastic wording — proceed "according to the law" — copied to Customs, the GCT and the Finance Committee, but not to the Minister's office. [S4 Exh.11][S11]Testimony Received alongside al-Jubouri's letters and the GCT's request, the reply created the appearance of a PMO endorsement without ever stating one. Testimony

Inside the GCT, events outran the paperwork. On 2 August, director general Shaker Mahmoud al-Zubaidi ordered his departments to stop involving the BSA — with no ministerial approval. [S4 Exh.12] On 3 August al-Jubouri reiterated his request. [S4 Exh.13] On 4 August, deputy director general Samir Abdul Hadi Qasim circulated the removal order to all departments; the same day, a ministerial order transferred Shaker to head the Customs Authority and installed Samir as acting head of the GCT. [S4 Exh.14][S11] Only on 10 August did the GCT formally ask the Minister to approve what it had already done. [S4 Exh.17] The Minister approved on 26 August — conditionally, "subject to the applicable regulations" — on the strength of what appeared to be the aligned positions of Parliament, the PMO, the BSA and the GCT. [S3][S4] On 5 August, sensing risk, he had already created a ministerial oversight committee for the GCT's refund operations (Ministerial Order No. 5). [S3][S4 Exh.16]

The sequence matters: the safeguard was dismantled from inside and below, then dressed in approvals afterwards. [S4]Testimony

Preparations began by June 2021, while Shaker al-Zubaidi still headed the GCT: internal GCT correspondence was already moving a CPECC refund. [S4 Exh.5] On 8 July 2021 a notarised special power of attorney was issued in the name of CPECC's authorised manager "GAO WEIHONG", granting one Ali Mohammad Isaa al-Jaff sweeping powers over the company's bank accounts and any amounts owed to it by the Iraqi state. CPECC later confirmed in writing that it never authorised anyone. [S8][S20] Cheques followed: No. 22758 (2 August 2021, IQD 31.2 billion) and No. 23051 (18 August, IQD 44,133,732,000) in CPECC's name, and a parallel cheque to Lukoil. [S7][S2] Rafidain Bank staff insisted the cheques could be deposited only into the named companies' own accounts. The holders refused — and the GCT cancelled the cheques. [S6][S7] A whistle-blower tip reached the Minister's office in early August; the Minister formed an investigation committee on 5 August, alerted the bank's management and its anti-money-laundering department, and a report was filed with the Federal Integrity Commission. [S4][S6]Testimony By mid-August the office understood the cheques were cancelled and the Integrity Commission was investigating. [S4]

In early September the perpetrators produced documentation transferring CPECC's supposed refund entitlement to al-Qanit General Contracting Co., a company with capital of IQD 5 million whose Rafidain account at the al-Wazireya branch was opened on 7 September 2021 — two days before the money moved. [S1][S2] The instrument was the same forged power of attorney; the Lukoil amounts were not part of this construct. Testimony Cheque No. 23253 cleared through the payments system on 9 September 2021. [S2][S7] The GCT's acting director general Samir Abdul Hadi Qasim signed the authenticity confirmation (صحة صدور) for al-Qanit's cheque on 22 September; more followed on 30 September. [S4 Exh.27][S7] This phase passed through the GCT's formal channels — the last part of the theft that did. [S4]

From late 2021 the operation industrialised. Five companies — al-Qanit, al-Mubdioon Oil Services, al-Hoot al-Ahdab, Badiyat al-Masa, and Riyah Baghdad — three of them incorporated only in July 2021 with capital of IQD 1 million each, opened accounts at three Rafidain branches. [S1][S2] Into these accounts flowed 247 cheques totalling IQD 3,701,380,882,000. [S2] The GCT held no transaction file for any of them; its own accounting department continued to report the trust account as intact — IQD 3.53 trillion on paper against IQD 145 billion in the bank by late September 2022. [S2][S46] The cheque amounts were round numbers — 7, 10, 20, 30 billion — utterly unlike genuine refunds, and they were withdrawn in cash immediately upon clearing. [S1][S2]Testimony Witnesses describe cheques being prepared and signed in after-hours meetings, including at Nour Zuhair's home in Baghdad's Mansour district, and cashed the following morning; Nour Zuhair himself moved openly through the GCT's corridors "like a director general", his car at the entrance, staff intimidated. Testimony The cash — some 185 tonnes of banknotes over the period — left Rafidain in vehicle convoys; in January 2022 the head of the state banking-services company complained in writing that unlicensed private vehicles, allegedly belonging to the Korek telecom group, were hauling large cash sums from the bank. His complaint went nowhere. [S4 Exh.42]Testimony

On 27 October 2021 the head of Rafidain's internal audit informally alerted the advisor to the finance minister, via WhatsApp, that new GCT cheques to a company called al-Qanit were being processed — in the same amount as the cancelled CPECC cheque. The advisor informed the Minister the same day. [S4 Exh.29]Testimony On 28 October the Minister summoned GCT director general Osama Husam Jawdat and Rafidain's acting director general Belal Sabah al-Hamdani. Both assured him the process was legal, compliant, and blessed by the Integrity Commission's August finding. The advisor was present; the assurances were false. [S4]Testimony Unconvinced, the Minister demanded a written report; on 1 November he formally requested the complete paper trail of all 2020–2021 refunds. [S17][S4 Exh.30] The GCT's 3 November reply listed refunds — with al-Qanit nowhere on the list. [S4 Exh.51] On 4 November the Minister issued an executive order: no tax deposit refund of any kind without his audit and signature. [S17][S4 Exh.31] He notified the Prime Minister's office on 5 November, pressed again on 7 November for the CPECC, Lukoil, al-Qanit and al-Mubdioon files [S17][S4 Exh.32], invited Lukoil's management to verify (20 December)[S4 Exh.37], and received on 6 December a reassuring GCT report implying nothing further was moving. [S4 Exh.36] Inside the GCT, the 4 November order was simply concealed from the cheque pipeline — issuance continued off the books, invisible to any audit because it existed in no ledger. [S2][S4]Testimony

Rafidain's AML department documented its concerns to the bank's new director general, Abdul Hasan Jamal, on 11 January, 25 January and 14 February 2022, and demanded an urgent meeting on 1 August 2022. [S12][S4 Exh.39] The GCT's director general answered the AML enquiry by asserting that endorsement of refunds to third parties was accepted practice. [S4 Exh.40] No effective action followed inside the bank, at the Central Bank of Iraq — the AML regulator — or anywhere else. The two Rafidain directors general met the Minister weekly and never mentioned withdrawals that were draining the bank's liquidity by billions. [S3][S4]Testimony The Rafidain statements of account 60032, which necessarily recorded every clearance, either never reached the GCT's accounts department or were suppressed there; the GCT's books continued to show an untouched balance. [S2][S4] The Federal Integrity Commission, which had cleared the suspect cheques on 31 August 2021 in report ت5/7079 — sent to the GCT, bypassing the Minister — issued a further comprehensive report on the GCT on 21 December 2021 that said nothing about refunds. [S18][S4 Exh.24] Every institutional tripwire failed — or was made to fail. [S4]Testimony

Dr Ali Allawi resigned as Minister of Finance on 16 August 2022 over the Ishtar Gate affair, knowing nothing of the theft. [S3][S4 Exh.45] Ihsan Abdul Jabbar, the Oil Minister, became acting finance minister and sought a briefing from the advisor to the finance minister — then out of contract and abroad — through the Prime Minister's private secretary, Ahmed Najati. Testimony Asked about rumours of corruption at the GCT, the advisor recounted the 2021 events and advised a formal audit. The acting minister's first committee examined the GCT's accounts and found them in perfect order — because the theft had never been written into them. Testimony[S2] Still suspicious, he called the advisor in Stockholm. The advisor's reply became the key that opened the case: if money is being stolen, it is being stolen from the bank account — audit the account, not the books. Testimony At the acting minister's insistence he flew to Baghdad on 18 September 2022 at his own expense, working unnamed and undercover — the danger was understood. Testimony A committee of trusted auditors and lawyers was created under a deliberately generic mandate (Ministerial Order 3235/33158 of 6 September 2022 makes no mention of the GCT). Testimony At the advisor's instruction the committee extracted from Rafidain the complete printout of account 60032 — thousands of dot-matrix pages. Two anomalies were visible almost immediately: withdrawal after withdrawal in impossibly round figures, and a chasm between the opening and closing balances. The trillions were gone. Testimony[S16] Understanding what they were holding, the committee members asked to be excused. Testimony[S6] The advisor delivered a memo to the acting minister on 24–25 September; within a day, Prime Minister Mustafa al-Kadhimi's instruction came back: get to the bottom of it. Testimony

With the GCT's refund archive already seized by the Integrity Commission [S1] and open enquiry impossible, the advisor obtained — through trusted GCT-branch insiders — copies of every transaction processed at Rafidain's Tax Authority branch, and matched cheques and RTGS records to the account statements, one by one, until 247 cheques to five companies were reconstructed in full. Testimony[S10] The perpetrators sensed movement without finding its source; pressure, threats and offers converged on the acting minister, and Parliament — under Speaker Mohammed al-Halbousi — prepared to remove his signature authority. TestimonyPress record The report was finished in time, reviewed with the acting minister, and taken that evening to the home of the GCT's deputy director general Abdul Sattar Hashim Ali — its acting head, Osama Husam Jawdat, having been suspended. He read it and signed: "It is my patriotic duty." Testimony[S2] On 10 October 2022 the report went officially to the Council of Representatives, the Prime Minister's Office and the Federal Integrity Commission, with boxes of cheque copies, RTGS printouts and bank statements. [S2][S15] The same day, the Ministry engaged Cleary Gottlieb Steen & Hamilton to validate the findings and trace assets abroad. [S14] On 11 October, Parliament voted to remove the acting finance minister. Press recordTestimony The advisor left Iraq the next day and has not returned. Testimony

The report leaked within days and dominated Iraqi and international media. [M1][M2][M7] On 24 October 2022 businessman Nour Zuhair Jassim was arrested at Baghdad airport attempting to leave by private jet. [M4] In November the new Prime Minister, Mohammed Shia al-Sudani, displayed recovered cash: IQD 182.7 billion plus $125 million as a first tranche, stating that Nour Zuhair had received roughly 43% of the stolen funds — about IQD 1.6 trillion. [M6][M20]Press record The Karkh investigative court, under Judge Diaa Jaafar, then approved his release on bail against a pledge to repay in instalments; the judge publicly defended the settlement. Press record Nour Zuhair subsequently left Iraq. In November 2024 a Baghdad court sentenced him in absentia to 10 years, alongside Raed Jouhi (6 years) and Haitham al-Jubouri (3 years); a former tax authority head received 10 years. [M12][M13] In early 2025 he was covered by the controversial General Amnesty Law's settlement provisions. [M14] Reports followed of seizures lifted from dozens of his properties [M40] and of a staged accident in Beirut [M19]Unverified allegation. The remaining billions are unrecovered; the Cleary Gottlieb asset-tracing assignment was never pursued by the incoming government. Testimony[S14]

From early 2023, arrest warrants and asset freezes were issued against former minister Ali Allawi and members of former PM al-Kadhimi's circle — Raed Jouhi, Mushriq Abbas, Ahmed Najati — on charges of "facilitating" the theft. [M8][M10] Dr Allawi, who had issued the very order whose observance would have stopped the theft, rejected the charges as scapegoating and published a documented dossier of the ministry's actions. [S3][S4][S13] He later returned to Baghdad, faced the court and demanded the evidence; none was produced, the charges were dropped, and he now travels to Iraq freely. Testimony Meanwhile: Shaker Mahmoud al-Zubaidi, identified in this investigation's assessment as the scheme's co-mastermind, was never charged and lives outside IraqTestimony; no official of Rafidain Bank or the Central Bank has ever been charged TestimonyPress record; the principal beneficiary was bailed, amnestied and is abroad [M12][M13][M14]; and the case files themselves became the object of a public conflict between the judiciary and the Integrity Commission, with reports of files inaccessible or missing. Press record Testimony in this investigation further records: the political protection of Shaker by Hadi al-Amiri's Badr Organisation Testimony[M1]; the deliberately engineered ambiguity of the PMO's 2021 letterTestimony; the post-resignation call from Supreme Judicial Council head Faiq Zaidan urging Dr Allawi to stay — read, in hindsight, as a bid to keep a blindsided minister in placeTestimony; and allegations — unverified — of enormous payments to secure the release and the parliamentary vote. Unverified allegation The pattern the documents draw is stark: those who stole were protected; those who exposed were pursued.