Sonny Luypaert has more than 20 years of anti-fraud experience as a financial director and consultant in various domestic and foreign companies. She founded her own company, CORP-D Solutions, a private investigation firm specialising in corporate fraud She has also been president of the Belgian branch of the Association of Certified Fraud Examiners (ACFE) since 2015, the world's largest anti-fraud organisation, with more than 90,000 members in 160 countries. She was also involved in the revision in our country of the law on detectives, who, incidentally, are now called private investigators.

Luc Vanheerentals

Although Sonny Luypaert had no immediate interest in private fraud investigations, she admired private investigators even in her youth. 'My aunt was the first female private investigator in Flanders. When I was a child, she told me fascinating stories about how, hidden in the back seat of a car with a blanket over her, she was smuggled into a private domain. Also through a youth series like Merlina in the 1970s, I experienced the detective profession as beautiful and positive.' She obtained master's degrees in Business Administration and Tax, bachelor's degree in Accounting Banking and several other certifications such as Judicial Expert, Data Privacy Officer, Positive Leadership, Whistleblowing IS037002... 'Initially, I wanted to do my job as a financial officer well, grow in that technical stuff, listen to the people behind the numbers and positively motivate them to work in a result-oriented way.' Getting started as a young accountant, however, she caught a manager committing fraud, which caused the company financial difficulties. With the necessary evidence, she reported it to the management and was subsequently questioned by the police. 'So I was already a whistleblower then and realised that I wanted to help companies better protect themselves against fraud, which is my current core business.'

Luypaert started her career as an accountant at a Belgian company and then worked in various positions for US multinationals such as BCG, Baxter Healthcare, Mastercard, Swift... At Accenture (born out of Andersen Consulting), she spent nine years as CFO, helping to set up the European Service Centre in Dublin and the IPO/ IPO of Andersen Consulting. In other companies, she acts as a consultant to help them mitigate fraud risks. 'The common thread throughout all these roles is that I have always strived to help hedge risks for companies. In doing so, I often use the COSO principles as a basis, alongside local corporate governance rules. I learned to analyse and optimise business processes and was able to investigate multiple fraud cases.'

In 2017, Luypaert was also involved in the publication by employers' organisation VOKA of a guide on fraud prevention in companies. 

Heavily underestimated problem

Currently, Luypaert combines her work in CORP-D Solutions with advising companies on how to prevent internal fraud. Luypaert prefers to leave the pure surveillance work to the expert in the team. 'Surveillance requires a lot of patience, vigilance and energy. Observation should not be underestimated. It was not really for me. Give me financial reporting, where I get to read the suspicious transactions between the lines. 'Follow the money' as a starting point.' 

'A private investigator must work critically, analytically, independently and beware of tunnel vision and conflicts of interest. During a visit as financial officer from headquarters to a subsidiary in Egypt, I was invited to dinner by the local Director. He took me on a dinner cruise on the Nile. That was a fantastic experience. But when he also proposed to me to take the whole family to his holiday home in Alexandria, it smelled too much like bribery. I put together a team and launched a fraud investigation. My initial "concern" was confirmed. Income for the company was paid into private accounts, etc...'

 Corporate fraud is a severely underestimated problem about which there is still a taboo in many corporate circles. 'Managers have to set the tone, have integrity themselves and exude a culture of integrity. How do you want employees to have integrity if executives themselves take home office material?' An open culture to report facts can be encouraged with a whistleblowing programme. 'After all, trust in the system stands or falls with the follow-up and processing of reports.' The ISO quality standard 37002 was developed for whistleblowing. 'Giving people trust is very important and making them feel part of a big family. There is also a need for control mechanisms and a deontological code that employees sign.'

Currently in our country, about 730 people are licensed by the Interior to operate as private investigators. Previously, detectives were often employed in the context of divorces, but since the reform of the legislation in that area, they are mainly active in the business world: the insurance sector, banks, governments, companies, the EU, ports... Taking a training course at Syntra is mandatory to obtain a licence. A new RD is currently being drafted to adjust and clarify the training requirements, for both all-rounder, corporate and insurance detective, and Certified Fraud Examiner.

Luypaert lectures on the new Private Investigation Act (WPO) at the training for detectives at Syntra Midden-Vlaanderen in Asse. Syntra West Flanders also offers such a course. She also attaches great importance to the Certified Fraud Examiner course organised by the ACFE worldwide. 'The course counts more than 2,000 pages. Moreover, one has to collect the necessary training points every year to keep the certificate. In Belgium, about 180 people have obtained it.' In her company CORP-D Solutions, she only works with freelancers who are certified and work according to the ACFE deontology.

Just before parliament was dissolved in the middle of last year, then Interior Minister Verlinden managed to get the new WPO approved. The previous law dated from 1991 and urgently needed to be adapted to the new rules on privacy and the evolution of new technological means and methods, such as cybercrime, phishing, randsomware, AI, etc. By analogy with what happened in the surveillance sector, the Data Protection Authority was also given more resources to carry out checks and can now also impose administrative fines.

Cooperating with justice

Luypaert regrets that there is so little cooperation between the judiciary, police and private investigators in our country. 'Just like any citizen, the private investigator has an obligation to report to the public prosecutor if he or she discovers violations of criminal law. In such cases, however, the chances are that the file will be taken over by the court or police. It would be good should the private investigator be trusted to carry out some of the further work together with the judiciary or police. The current staff shortage in these services could thus be compensated by private investigators,' says Luypaert, who points out that these services sometimes use security firms for certain tasks. 'Private investigators could also, for example, take over surveillance tasks and, with their good financial knowledge, provide substantive input into certain files.' The way reporting is done also needs to be optimised. According to Luypaert, private investigators are also asking to be given access to certain confidential data, if properly substantiated and verified, which would save them a lot of money and time. With her own detective agency, Corp-D Solutions, she often collaborates with client lawyers in order to be more focused and save costs for the client. By working with other CFEs abroad, international crime can be tackled faster and more efficiently. Fighting fraud and crime together with public and private forces combined across borders !

On Friday, December 6, 2024, the new Private Investigation Law was published in the Belgian Official Gazette, replacing the Detective Law of July 19, 1991 and its implementing decrees, regulating the profession of private investigator. 

The main drivers for this new law are the modernization of the legal framework for private investigators and the adaptation to current technological, societal, and legal realities.

The following brief overview gives an idea of the main considerations that you, as a client of a private investigator, should take into account:

• As a client, it is your responsibility to ensure that the private investigation firm you contract holds the necessary licenses, both at the company level and for each individual private investigator involved.

• Privacy legislation (General Data Protection Regulation) is referenced in several parts of the new law, including regarding the locations where observations can take place and the types of information that may be gathered or disclosed about individuals (for example, political views, biometric data, health data). 

The above points must be complied with under penalty of invalidity, meaning that the collected evidence may be considered invalid.

Another very important aspect of the new Private Investigation Law is that companies wishing to conduct investigations into their employees must establish a general and transparent internal regulation. This could be done, for example, through a collective labor agreement, employment regulations, or a decision by the works council.
The government has provided a two-year transition period for this rule to be practically implemented. 
To make this rule practical, the government did provide a transition period of two years. 

These reforms strike a balance between the effectiveness of private investigations and the protection of citizens' fundamental rights. They offer a more modern and clearer framework for private investigators and their clients.

The head of the research department at CORP-D is also an instructor in the private detective training program and teaches the new Private Investigation Law, among other topics.

Of course, Corp-D Solutions commits to conducting private investigations and guarantees legally responsible evidence collection with licensed private investigators, in compliance with the provisions of this law. 

A previous article discussed the Belgian Whistleblower Legislation (transposition of EU Directive 2019/1937). 

Within the European BRIGHT project, a self-assessment tool was developed: SUSA - Speak Up Self Assessment, a free online tool that allows you to assess the quality of your reporting channels. SUSA was developed according to the ISO37002 guideline on whistleblower management systems and the relevant EU directive.


The self-assessment is entirely anonymous and covers all aspects of whistleblower systems: channels, reporting, investigations, data management, security, etc.

The driving force behind this initiative is Professor Wim Vandekerkhove, EDHEC, co-founder of the ISO37002 guideline.

You can access the free tool via this link.

For reports received under the whistleblower legislation where the investigation goes beyond the jurisdiction of the HR department, CORP-D is pleased to offer professional support in line with the Private Investigation Law and the General Data Protection Regulation (GDPR). Our extensive expertise in large corporations ensures that we respect your corporate culture and can act swiftly, always in consultation with the relevant internal department.

On December 15, 2022, the Belgian legislator published the Whistleblower Act (transposition of EU Directive 2019/1937). The law is designed to protect employees and other stakeholders who report serious misconduct within companies and public institutions, and applies to all companies with more than 50 employees and public authorities.

The law protects anyone who reports information about wrongdoing in a professional context, such as:

• Employees (currnet and former)
• Self-employed individuals
• Shareholders and directors
• Freelancers and subcontractors
• Interns and applicants

It also extends protection to those who assist a whistleblower (such as colleagues or trusted persons).

Possible reports may include financial fraud and corruption, product safety, public health, data protection (GDPR), and more.

A report can be made in three different ways:

1.     An internal report within the company or organization

• Large companies and public authorities must set up a secure internal reporting channel, with the possibility for anonymous reports.
• The report can be made in writing, orally, or through an anonymous system.
• The company must confirm receipt of the report within 7 days and follow up within 3 months.

2.     An external report to an official body

• The Federal Ombudsman for government-related matters
• The Federal Public Service (FPS) Economy, the National Bank, or other regulators for the private sector.

3.     A public report (e.g., through media or social networks)

• This can only happen if there is immediate danger or if the above steps do not lead to action.

The law provides legal protection for whistleblowers, including a ban on retaliation (e.g., dismissal or sanctions). Companies that do not comply with these rules can face fines of up to €24,000 for failing to provide a reporting point, and up to €120,000 for companies that harm whistleblowers.

For reports received under the whistleblower legislation where the investigation goes beyond the jurisdiction of the HR department, CORP-D is pleased to offer professional support in line with the Private Investigation Law and the General Data Protection Regulation (GDPR). Our extensive expertise in large corporations ensures that we respect your corporate culture and can act swiftly, always in consultation with the relevant internal department.