The Context
Cambodia’s Senate approved a new anti-cybercrime law. The date is irrelevant. The numbers are not. Ringleaders of cyberscam compounds now face up to 20 years imprisonment and fines of $500,000 USD. Operators whose activities result in death face life imprisonment. This is a new variable in the equation. Prior to this, the prosecution rate for compound operators was zero. Between 2023 and 2024, human trafficking investigations rose from 164 to 197. 2,695 Chinese nationals were deported. The government identified the Kingdom as a base for “covert operations”. The audit trail of impunity has been long. The liability ledger is now open.
The Risk
The strategic angle is a governance gap. State-tolerated hubs enable fraud and human rights abuses. For a New Zealand director, this is a third-party risk calculation with catastrophic coefficients. Your supply chain, your joint ventures, your remote contractors—any node operating in such a jurisdiction is a liability vector. The Companies Act 1993 imposes a duty to act in good faith and in the best interests of the company. Knowingly or negligently allowing the company to benefit from, or be exposed to, criminal enterprises abroad may constitute a failure of that duty. The Health and Safety at Work Act 2015 extends a duty of care to all workers, including those overseas in your operational control. The financial risk is not just the $500,000 fine. It is the sum of regulatory penalties, asset seizures, and the complete erosion of shareholder value. Your reputation is a balance sheet item. It is now being discounted by the impunity of others.
The Control
Conduct a forensic-level audit of all third-party engagements in high-risk jurisdictions. Map the financial flows. Validate the ultimate beneficial ownership. Treat any entity with opaque structures or connections to sectors known for cybercrime as a material finding. This is not a compliance checkbox. It is a financial safeguard.
The Challenge
These are the critical questions you should be raising at the board table:
| What is the quantified exposure of our revenue and operations to jurisdictions with documented state-tolerated cybercrime, and what is the contingency valuation for a full write-off? | |
| Can our current due diligence process trace the full audit trail of funds and ownership for our key suppliers in Southeast Asia, and where are the gaps in the ledger? | |
| If a major partner were prosecuted under laws like Cambodia’s new statute, what is the mathematical probability of our directors facing personal liability actions under the Companies Act, based on our current governance records? |