Southeast Asian investors now underwrite governance before they price growth.

Southeast Asian investors now underwrite governance before they price growth.

Founders keep asking the same question: what controls do VCs expect by funding stage? The short answer, before the long one.

Each stage assumes the one before it. Install controls at the stage they belong to and diligence moves in weeks. Bolt them on under diligence and you signal the one thing an investor cannot unsee: the founder treated governance as paperwork.

Most governance advice for founders stops at the noun — "install a whistleblower policy" — and skips the mechanism. This piece is about the mechanisms. For each control, the useful question is not do we have it but what would this catch, and how.

The collapse that moved the line

eFishery reported $752 million in revenue for the nine months ending September 2024. FTI Consulting's forensic review put actual revenue at $157 million. That is roughly $595 million of fabricated revenue on a number investors had priced a $1.4 billion valuation against. Over a comparable nine-month window the company reported a $16 million profit against an actual loss of $35.4 million.

The fraud was not a rounding error that grew. FTI found a dual reporting system running since 2018 — one set of books for investors, one for the company — supported by shell companies issuing fake invoices. eFishery claimed 400,000 fish feeders deployed in the field. Investigators found 24,000.

A whistleblower alerted a board member in December 2024. Of roughly $415 million raised, at least $300 million was gone. FTI estimated as little as $50 million of raised capital remained in cash, and put investor recovery at around 9.5 cents on the dollar in the optimistic case. The founder was sentenced to nine years for fraud, embezzlement, and money laundering; an appeal reduced the term to six.

The damage did not stay inside one company. Indonesian startups disclosed $161.3 million in funding across the first half of 2026, down 43.5% year over year, against $355.7 million across 91 deals for all of 2025. Capital did not leave the region. It repriced the cost of trusting a founder's numbers.

Five Southeast Asian VC associations responded. The Singapore Venture and Private Capital Association coordinated with Malaysia's MVCA, Vietnam's VPCA, Thailand's TVCA, and Indonesia's Amvesindo to publish the Maturation Map: Corporate Governance in Southeast Asia Private Markets in April 2025. It sets five pillars: active due diligence with on-the-ground checks and stronger internal audit, performance dataflows verified through technology, external-advisor ecosystems, governance frameworks including whistleblower policies, and cross-border enforcement.

The name matters. A maturation map is a build order, not a checklist. Read plainly, it moves governance from a Series B afterthought to a seed-stage underwriting criterion.

The stage-by-stage mechanics are below.

Pre-seed: cap-table truth and a second signature

Governance at pre-seed costs a weekend and prevents the most expensive problems later.

Start with the cap table. Keep one source of truth in a real equity tool rather than a spreadsheet three people edit. The reason is not tidiness. A spreadsheet has no audit trail, so it cannot answer the question diligence actually asks: who agreed to what, and when. Side letters live in email. Verbal promises live in memory. At Series A, a lawyer reconstructs your ownership from incorporation documents, every SAFE, every option grant, and every board resolution, then reconciles that against what you claim. Where the two disagree, the round slows.

Do the cheap version now. Vest founder equity over four years with a one-year cliff. Assign all intellectual property to the company in writing, including work done before incorporation. Convert every handshake equity promise into a signed instrument or kill it explicitly, with the other party's written acknowledgment. An unresolved promise is a claim waiting for your first liquidity event.

Then the bank account. Open a company account fully separate from any founder's personal account, and add a second signatory for payments above a set threshold — low enough to matter, high enough not to stall operations.

Here is the mechanism, because this is the control founders dismiss as bureaucracy. eFishery's fraud required shell companies issuing invoices the company then paid. That works when one person can move money alone. Add a second signatory and every fraudulent payment needs a second person to knowingly release it. You have not made fraud impossible. You have made it require a conspiracy, which is an order of magnitude harder to sustain for seven years. The same control catches the honest failure mode too: the founder who pays a vendor twice because nobody else looked.

Board composition here is simple. Founders control the board, which is correct at this stage. Write down who sits on it and why, and keep minutes for real decisions.

Seed: the first independent voice and a monthly proof

Seed is where governance stops being self-policing.

Add one independent director who answers to neither the founders nor the lead investor. Their job is to ask the question everyone else is too invested to ask. The Maturation Map names external-advisor ecosystems as a pillar for a structural reason: eFishery ran for seven years because no party with standing had both the information and the incentive to challenge the founder. An investor director carries a portfolio interest in the story holding up. A founder-appointed friend carries a relationship. An independent director with a finance background and a term that does not depend on your goodwill is the cheapest source of real dissent you can buy.

Then stand up monthly management accounts and reconcile them against your bank feed every month.

This is the single highest-leverage control on the list, and its mechanism is worth understanding precisely. Fabricated revenue has no cash behind it. Every peso of fake revenue you book creates a gap between recognized revenue and cash received, and that gap has to be explained by something — receivables, deferred collection, timing. A real business closes that gap on a predictable cycle. A fabricated one cannot, so the unexplained residual compounds every month it goes unexamined.

Reconcile monthly and the gap is thirty days old and small enough to explain. Reconcile annually and you have given the discrepancy a year to grow and a year of narrative to hide behind. A founder who reconciles honestly every month cannot casually inflate a number at year-end, because eleven prior reconciliations already contradict it.

Pair it with accounting software that keeps an immutable audit trail — every journal entry timestamped against a user ID, no silent overwrite, no deletion without a reversing entry. This is what makes a second set of books expensive to maintain. Two versions of a spreadsheet take five minutes. Two versions of a system that logs every edit takes sustained falsification by multiple people, which is exactly the pattern a forensic reviewer finds.

Write a whistleblower policy: a one-page channel that lets any employee raise a concern without it passing through the founder's inbox. Route it to your independent director. Note what actually happened at eFishery — the concern reached a board member informally in December 2024, and that is what ended the fraud. The channel worked by accident, seven years late. Formalizing it costs a document and an email address.

Last, engage a real accountant and a fractional CFO — someone who has closed books that survived an audit. The point of hiring early is not the bookkeeping. It is that a professional with a reputation at stake will refuse to sign what a friend of the family waves through.

Series A: the diligence team assumes you are lying

Series A is where your controls meet a team paid to break them.

The Maturation Map's first pillar is active due diligence with on-the-ground checks, and post-eFishery that phrase has teeth. A Series A diligence team no longer reads your data room and trusts it. They pull your bank feed and rebuild revenue from cash in. They call your customers and confirm the contracts exist and the terms match. They count the physical assets you claim to have deployed. Someone eventually went and counted eFishery's feeders, and that is how 400,000 became 24,000.

Surviving that reconstruction requires three things.

A written revenue recognition policy, so a stranger applying your stated rules to your raw data arrives at your reported number. Without one, every judgment call looks like a choice made to flatter the metric.

An internal audit function, even part-time or outsourced. Someone whose job is to test the controls rather than operate them.

Source-system dataflows — the Maturation Map's second pillar, performance data verified through technology. Every headline metric traces to a system a third party can query independently. If you deploy hardware, maintain a serial-number registry and telemetry, so your deployed-unit count is a database query rather than an assertion. If you run transactions, the count comes from the ledger, not a slide. A hand-assembled number is unverifiable by construction, and diligence now treats it that way.

Board composition tightens as investor directors join, and the independent seat from seed carries real weight. Cap-table hygiene gets tested against every instrument you ever issued. Undisclosed terms discovered here poison the round.

Founders who installed these controls at seed pass Series A diligence in weeks. Founders who bolt them on now spend months in reconstruction, and every gap reads as a red flag rather than a growing-pains footnote. The speed of your raise is set two stages earlier.

Series B: the board that can fire you

Series B governance assumes the company has outgrown founder self-policing. The founder is no longer the only check on the founder.

Stand up an audit committee with independent members and a direct line to the external auditor, including sessions the executive team does not attend. Engage an auditor with regional credibility. Then give the board — in its composition and its charter — the genuine power to remove a founder who fails the company.

This is the control eFishery never had. A board that cannot act against the person committing the fraud is not a governance body. It is an audience. Test yours honestly: count the votes required to remove the CEO, then count how many of those votes the CEO controls or personally selected. If the arithmetic does not work, the charter is decoration.

The whistleblower channel from seed now reports into the audit committee. Cross-border enforcement, the fifth pillar, becomes concrete at this scale, because your investors, entities, and customers span jurisdictions and governance has to hold across all of them.

The external-advisor ecosystem is complete here: auditor, legal counsel, independent directors with finance backgrounds, a CFO who has run this playbook before. Each is a party with standing to say no. That is the entire point.

Where founders misallocate

Founders over-invest in the investor narrative — the board deck, the monthly update, the metrics dashboard. These are the artifacts investors see, so they get the attention.

Founders under-invest in the controls investors now verify. Bank reconciliation. Cap-table truth. A whistleblower channel with no founder in the loop. An independent director with standing to dissent. These are invisible until diligence, which is why they get skipped and why skipping them now ends rounds.

The subtler failure is decorative compliance. A whistleblower policy routing to the founder's inbox. An independent director who is a former colleague. An audit committee that has never dissented. Each satisfies a checklist item and catches nothing. Real controls share one property: they create a moment where someone other than the founder can refuse. Anything without that moment is theater, and diligence teams have gotten good at telling the difference.

The last misallocation is timing. Founders treat governance as a Series B project and arrive at Series A with nothing to show. Post-eFishery, the seed founder who hands a diligence team clean books raises on better terms. The flashier founder who cannot no longer wins the round. Governance became a fundraising advantage, and most founders have not repriced it yet.

What this means for operators

Treat governance as a build order, not a compliance event. Install each control at the stage it belongs to, because every later stage assumes it is already there.

At pre-seed, spend the weekend on your cap table and your bank signatories. At seed, buy the independent voice and the monthly reconciliation before you think you need them. At Series A, walk in with revenue a stranger can rebuild from your bank feed in a day. At Series B, give your board the power to fire you and mean it.

The eFishery collapse did not create new rules. It made investors enforce the ones they already held. The founders who internalize that raise faster, on cleaner terms, with fewer months lost to reconstruction. The founders who wait for diligence to force the issue face a harder room. The diligence team now assumes the numbers are wrong until the controls prove otherwise.

Build the controls first. Growth is easier to price when the numbers are trusted.

Sources: FTI Consulting forensic findings as reported by DealStreetAsia and Indonesia Business Post; SVCA et al., "Maturation Map: Corporate Governance in Southeast Asia Private Markets" (April 2025); Indonesian court sentencing and appeal, July 2026; Indonesian funding totals via ecosystem reporting for H1 2026.