Chapter 19
Derivatives Case Studies: SocGen, Barings, and Allied Irish/Allfirst
CASE STUDY ONE: SOCIéTé GéNéRALE1
Event Summary
In what the Wall Street Journal (1/24/2008) called a “singular feat in the world of finance,” Société Générale (SocGen) announced a €4.9 billion (US$7.2 billion) loss on January 24, 2008, as a result of the misdeeds of a single rogue trader. The bank characterized the largest rogue trading event to date as the result of “elaborate fictitious transactions” that allowed the 31-year-old trader to circumvent a series of internal controls. The trades in question involved the arbitrage of plain vanilla stock index futures.
The trader previously worked in a back office function for the bank and gained knowledge of how to circumvent the bank's systems through this prior position. He was initially characterized by the governor of the Bank of France as a “computer genius,” but over time came to be known as an unexceptional employee who worked very hard to conceal unauthorized trading positions. SocGen estimated that the value of Jérôme Kerviel's positions was €50 billion (US$73.26 billion). A report published by the French Finance Ministry said that Kerviel's rogue trading started in 2005; he was allegedly given a warning at the time concerning trading above set limits.
In addition to the €4.9 billion trading loss, the French Banking Commission levied a €4 million fine against Société Générale on July 4, 2008; this brings the total loss amount in this case to €4,904,000,000.
Event Details
Jérôme Kerviel was a 31-year-old trader with Société Générale's Paris office who earned approximately €100,000 per year in base salary. He joined the French bank in August 2000. He worked for three years in a middle office function before being promoted to the bank's Delta One proprietary trading desk. According to the Financial Times (1/25/2008), Mr. Kerviel was the beneficiary of the bank's initiative to promote talented back and middle office employees. He was tasked with futures hedging on European equity market indexes. His bonus for 2006 was €60,000. He requested a €600,000 bonus for 2007 and was granted €300,000; the bonus information was gleaned from an investigatory report published on February 20, 2008, by Société Générale entitled “Mission Green.”
The bank said that winding down the trades resulted in a €4.9 billion charge—the largest to date as the result of a rogue trading event. SocGen commented that the “exceptional fraud” involved the purchase of massive positions in futures that were beyond Kerviel's limits. At least one individual was identified as having known about Kerviel's trades, but the bank stated that it could not draw any suppositions concerning Kerviel's supervisors as a result of “judicial inquiries currently under way.” The individual is an unnamed trading assistant who helped execute the trades. In its second Mission Green report, published in May 2008, the bank characterized the trading assistant as someone who should have acted as an independent agent and who reported directly into the middle office.
The head of the Bank of France, Christian Noyer, said that Mr. Kerviel managed to breach “five levels of controls.” The controls were identified in the earlier Mission Green report and consisted of canceled or modified transactions, transactions with deferred dates, technical (internal) counterparties, nominal (non-netted exposures), and intramonth cash flows. In addition, the second and more detailed Mission Green report identified a host of supervisory lapses, organizational gaps, and warning signs that were never heeded.
A report released by French Finance Minister Christine Lagarde identified three areas where controls failed within the bank: the assignment of an employee to the trading floor who had spent time in the back office; security problems with the internal computer system; and the lack of an escalation process for alerting management of abnormal trades.
The Mission Green reports stated that Kerviel began taking “directional” (as opposed to arbitrage) positions starting in 2005 for relatively small amounts. These small unauthorized directional trades continued through 2006. The size of the directional positions had grown substantially by March 2007. Kerviel's trades lost money from March 2007 through July 2007, but turned profitable for the remainder of the year. They turned vastly unprofitable in early 2008. It is estimated that by July 2007 his trades resulted in €30 billion in unhedged exposure for the bank.
Kerviel was faced with a problem in early 2008; he had realized more than €1 billion in gains from unauthorized trading during the latter part of the previous year, and needed to find a way to report profits from trades that were beyond his allowed limits. He concocted a plan to enter a fictitious counterparty trade onto the books in an attempt to explain the gain. He listed a small German brokerage as the counterparty; the bank became suspicious because the size of the trade was larger than the market value of the German firm. A trader alerted the bank's management of this anomaly and, when questioned, Kerviel said that he had entered the wrong counterparty onto the book and that, in actuality, it was Deutsche Bank. Deutsche Bank was contacted in order to confirm the trade. It was quickly discovered that the trade did not exist. The bank interviewed and suspended Mr. Kerviel, who initially assisted with the investigation.
Mr. Kerviel told investigators that one of his earliest wins was a bet placed on insurer Allianz during the summer of 2005. He was betting that the European markets would fall. After the London transport system suffered a terrorism attack in July 2005, his trade earned the bank €500,000. He was interrogated before a special committee at the time and warned that if he overrode his limits in the future he would be fired. Kerviel, despite the warning, continued to break the rules during the next 18 months and placed increasingly larger bets. In one example, he placed a bet in January 2007 that the German DAX index would fall. Instead, the index increased, and he sustained a loss. He told prosecutors that the loss went unnoticed at the bank because during that period of the year “there is no cross-checking control within SocGen.”
In November 2007 the surveillance team at Eurex, the deriviatives exchange run by Deutsche Boerse, sent an inquiry to Société Générale concerning the volume of trades it was receiving from Mr. Kerviel. When confronted about the trades, he said that any comments would reveal his trading strategy to competitors. Société Générale responded to Eurex by saying that it had engaged in after-hours trading as a result of volatility in the markets. Eurex officers were unhappy with the explanation and contacted the bank a second time. Mr. Kerviel eventually produced a response that satisfied the bank and the exchange, and the matter was dropped the following month.
Mr. Kerviel was in essence an arbitrage trader—he was tasked with exploiting differences in the prices of futures contracts based on European stock indexes. In this capacity he was supposed to match long positions in futures contracts with corresponding short positions. The price discrepancies are often small, but can result in significant returns when arbitrage trades are executed through volume. It is the volume and size of such transactions that some industry experts have targeted as problematic, as there are continuous backlogs in settling such trades at banks.
Mr. Kerviel bought bets on the direction of European stock markets through the purchase of futures on indexes tracking the U.K. and German markets and the Euro Stoxx 50. SocGen's head of investment banking said that “every two or three days, he was changing his position. He would input a transaction that would trigger a control in three days and before that happened he would replace it with a different one.” It was Kerviel's knowledge of how control processes worked that allowed him to understand the mechanics and timing of when they are triggered.
When SocGen's executives started examining what Kerviel had been doing, they were shocked to discover that he was not hedging his positions and had accumulated nearly €50 billion in exposure to European stock indexes. Instead, he was faking the hedging contracts and accumulating large unhedged positions. It appeared that he was taking a bet that the indexes would rise sharply. However, they started moving in the opposite direction and left Société Générale heavily exposed. Most of his unauthorized positions were executed through the purchase of securities with a deferred start date, futures transactions with a pending counterparty, or forward transactions with an internal counterparty.
Mr. Kerviel was able to circumvent internal controls by using passwords and accounts that belonged to other employees. He then logged into the bank's systems and approved his fictitious trades. He understood how this worked from his prior middle office position. Jean-Pierre Mustier, the head of SocGen's investment banking division, spent the weekend of January 19 interviewing Mr. Kerviel in an attempt to unravel what had happened. Mr. Mustier commented that Jérôme Kerviel seemed “confused” about the impact of what he had done and that he thought “he had discovered a new trading technique which was performing very well.”
Société Générale knew about the rogue trades over the weekend of January 19, 2008, but said that it waited to inform the markets until it completed unwinding the positions. By the time it discovered the fraud, Kerviel's losses were already in the range of €1.5 billion. However, it unwound the trades in very difficult conditions, and the losses continued to increase. By the time the trades were unwound, the bank's losses from the positions were €4.9 billion. SocGen said that it kept its trades to about 10 percent of the total volume on the exchanges where it traded, so as not to negatively impact the markets when it unwound the trades.
Société Générale unwound the trades on Monday, January 21, 2008—a day when global markets were sharply down on speculation of an economic slowdown and following Fitch Ratings’ downgrade of bond insurer Ambac the preceding Friday. The U.S. markets were closed that day for the annual Martin Luther King Jr. holiday. There was fear that the U.S. markets would open downward the following day—Tuesday, January 22, 2008—and continue to fall sharply as a result of mounting bad news concerning the economy, the housing sector, and the worsening subprime mortgage crisis.
The U.S. Federal Reserve announced, before the open of markets on January 22, the unusual decision to cut interest rates by three-fourths of a percentage point. This was the sharpest cut since the 1980s. It has been conjectured that the unwinding of the rogue trades may have contributed to the steep drop in world markets on January 21. Société Générale has said that the unwinding of the trades did not impact the direction of the market. The U.S. Federal Reserve said publicly that it did not know about the unwinding of SocGen's trades the previous day but that it remained comfortable with its decision to cut rates.
News of the rogue trading incident came on the same day that Société Générale announced a €2.05 billion write-down in assets related to subprime exposure. The news also came at a time when the banking sector was struggling to raise capital and was suffering from an implosion in the capital markets. Market conditions could not have been worse for the unwinding of such large positions. SocGen announced that it would turn to the capital markets in order to raise €5.5 billion in the following weeks.
Société Générale is considered a well-managed institution with strong risk controls and has won awards for the quality of its derivatives trading capability. Nicolas Rutsaert, an analyst who covers European banks for Dexia, said that Société Générale “was a leader in derivatives and was considered one of the best risk managers in the world.” SocGen was voted the best equity derivatives house by Euromoney in July 2007. It also won accolades for its equity derivatives trading strategy from Risk magazine in 2008.
The comparisons between this event and the quintessential unauthorized trading event that led to the dissolution of Barings PLC (discussed later in the chapter) are difficult to ignore. Both events involved traders that originally worked in back office positions and had knowledge of how risk and control systems worked. Both events involved derivatives and futures positions and relatively young and inexperienced traders. They both used their knowledge of bank processes to hide escalating trading losses.
There are also significant differences between the events. Kerviel's loss appears to have accumulated much faster than Leeson's (of Barings PLC), and he worked for a bank with very sophisticated risk management systems. Kerviel also worked on a trading desk at his bank's headquarters, as opposed to Leeson, who worked in the Singapore branch. There was a strong reporting structure at Société Générale, while at Barings it was uncertain who was in charge of directly supervising Leeson. Most importantly, Kerviel was not tasked with settling his own trades as Leeson was. However, by overriding the bank's systems and using his colleagues’ passwords and accounts, in essence that is exactly what Kerviel did.
One key difference between the two events is the possible impact on markets—especially during very volatile times. Société Générale's unwinding of such large positions could have possibly had an influence on the severity of the downward trajectory of the markets; Leeson did not have the same impact on the markets. Another key difference between the two events is that Barings did not survive its unauthorized trading event and was rescued by ING Group for the token amount of one pound. Société Générale, although weakened and mentioned as a takeover candidate, was expected to recapitalize and survive.
This case surfaced just a few weeks before a high-profile trial was scheduled to begin in France. SocGen CEO Daniel Bouton was scheduled to testify at a trial that accused the bank of failing to comply with money laundering regulations. At the same time, the U.S. Securities and Exchange Commission announced that it was investigating the sale of a SocGen board member's shares of the bank's stock just before the announcement of the rogue trading event and the bank's subprime losses.
Control Failings and Contributory Factors
Lack of Internal Controls/Failure to Set or Enforce Proper Limits
Société Générale's co-chief executive, Philippe Citerne, said that Mr. Kerviel was able to place such large bets on stock index futures contracts through the circumvention of the firm's computer systems and controls. There was also a breakdown in processes that police limits, as he was trading above his allowable authority for several years. Mr. Kerviel said during the investigation that he regularly “flouted” rules concerning trading limits and that it was not unusual for his trading colleagues to do so.
Employee Misdeeds
The bank commented that Kerviel knew how to circumvent his limits because of knowledge he had of how controls operate, from the three years he worked in a middle office function. The bank said that one of the reasons he was able to succeed with overriding limits was because he “knew intimately the bank's risk controls, and swiftly shifted positions to evade detection at each level of control.” According to the bank, “Each time he [Kerviel] took a position one way, he would enter a fictitious trade in the opposite direction to mask the real one.” The bank identified 947 transactions where Kerviel “set the parameters of these transactions in such a manner as to use them to cover the fraudulent positions actually taken.” PricewaterhouseCoopers (PwC)'s final report on the control environment surrounding the incident listed three categories of concealment measures that were deployed by Kerviel: the entry and subsequent cancellation of trades ahead of the period when controls would kick in; entries of pairs of fictitious reverse trades; and booking of intramonthly provisions that would cancel out earnings from the concealed activities.
Inadequate Due Diligence
This fraud was unraveled once the bank detected a fictitious counterparty trade. The counterparty was contacted, and it was quickly determined that the trade did not exist. This act of manually checking a trade suggests that a process for confirming trades through a counterparty contact could result in more accurate and timely detection—particularly for transactions over a certain size or frequency.
Failure to Reconcile Daily Cash Flows
While it may have been possible for Kerviel to trick risk management systems by fraudulently approving his own trades, it is still unclear why the large number of unsettled trades were not detected earlier by the bank's accounting and finance departments. However, it is not uncommon for there to be a backlog in investigating unsettled trades, given the huge volume of the derivatives business. One unidentified trader said that the process to settle trades is laborious and conducive to being tampered with by someone who really understands back office processes. French Finance Minister Christine Lagarde said in her report on the event that the bank should have done a better job monitoring the nominal, rather than just the net, value of Mr. Kerviel's trades.
Failure to Question Above-Market Returns
The Financial Times (1/25/2008) asked whether the bank's accounting department had the authority or wherewithal to question the profitable derivatives trading desk. In addition, there is evidence that Mr. Kerviel's trades were profitable during the second half of 2007 and it appears that the source of his profits may not have been closely examined. In fact, at one point in late 2007 his trades were so profitable that he had to manufacture a transaction in order to account for a €500 million gain. Société Générale stated in its May 2008 Mission Green report that despite Kerviel's declared earnings, which constituted 27 percent of the earnings of Delta One in 2007, and 59 percent of the earnings of his assigned desk, there was “no detailed examination of his activity that was carried out or required by his hierarchy.”
Insufficient Compliance Measures
Mr. Kerviel was reported to have taken only four days of vacation during 2007; the failure of a trader to take a holiday, which is often in breech of banking rules that require a certain amount of consecutive days off, can be considered a red flag. When questioned by supervisors, Mr. Kerviel said that he was too depressed to take time off because his father had recently died. In reality, with all the effort required to regularly delete and reenter fake trades, it would have been difficult to continue covering up his activities if he took time off. This behavior is not unknown in unauthorized trading events; John Rusnak, who was responsible for a $690 million rogue trading event while with Allied Irish's Allfirst subsidiary (discussed later in the chapter), rarely took a day off and often traded from home.
Lack of Management Escalation Process
French investigators and Société Générale disclosed that Eurex, the largest European derivatives exchange, expressed concern in November 2007 of positions taken by Mr. Kerviel. The exchange did not comment on who at SocGen was notified of the problem, but the Mission Green report later said that Kerviel's direct supervisor failed to act on the information. The Paris public prosecutor commented that Mr. Kerviel said during the course of the investigation that after Eurex questioned his trades he produced false documents in order to document his positions. There is evidence that Kerviel's rogue trading behavior was flagged by the bank in 2005. The Finance Ministry mentioned in its report on the incident that the lack of a management escalation process was a key failing. The May 2008 Mission Green report cited “a lack of attention and reactivity when faced with numerous alerts, which denotes a lack of sensitivity to the risk of fraud at the Front Office Level.”
Corporate Governance
Often behind such events, which appear to be the results of one bad employee, is a corporate culture that encourages high-risk-taking behavior through compensation, incentives, pressure to deliver certain results, and idolization of star traders. Strong and sophisticated risk departments can exist in such organizations, but it is much more difficult to impact a bank's risk culture when it is at odds with an ethos to drive profits. The New York Times reported (2/5/2008) that the bank allowed a “culture of risk to flourish” which in turn “enabled the rogue trader's activities to go undetected.”
Undertook Excessive Risks
Société Générale was known for its appetite to take large risks with its own funds. Revenue from proprietary trading became an increasingly substantial share of profits realized by its investment bank. In 2004, proprietary trading (as opposed to market making) accounted for 29 percent of profits for the division; this grew to 35 percent by the middle of 2007.
Omissions
The trading activity that Kerviel engaged in was viewed as having relatively low risk by the bank. He was tasked with purchasing an index of stocks while selling, at the same time, a similar portfolio. The bank made a small gain from the price differentiation between the two. The supposition was that the portfolios offset each other through arbitrage trading and resulted in little underlying risk. This may have led to an underestimation by the bank of the risk inherent in the activities undertaken by the Delta One trading team, and a failure to fully consider the business unit's risk—particularly operational risk.
Employee Omissions
An additional omission was the failure of the bank's management to question the documentation that Kerviel supplied when his trades raised red flags. The Mission Green report stated that the bank's internal control system generated 75 alerts by Kerviel starting in 2006. When questioned, Kerviel supplied documentation that was not scrutinized very closely. The report said that even when these reports “lacked plausibility,” Kerviel's supervisors were not alerted. The report credited this pattern of behavior to a “lack of initiative” on the part of its compliance staff. The report also said that the staff members were not thorough enough in their checks—including, in eight cases, where there were “anomalies” present in Kerviel's e-mail.
Failure to Test for Data Accuracy
The PricewaterhouseCoopers report on this incident targeted a failure by the trader's managers and supervisors to “perform the necessary analyses of existing data schedules (detailing positions, valuations, earnings, or cash flows) that would have revealed the true nature of the trader's activities.”
Organizational Gaps/Organizational Structure
PricewaterhouseCoopers highlighted gaps with the hierarchical structure of reporting lines above Kerviel's position. For instance, the report targeted a “fragmentation of controls between several units, with an insufficiently precise division of tasks, [and] lack of systematic centralization of reports, and of feedback to the appropriate hierarchical level.” This fragmentation led to a “lack of a systematic procedure for centralizing and escalating red flags to the appropriate level in the organization.”
Failure to Supervise
PricewaterhouseCoopers characterized Kerviel's immediate supervisor as lacking “trading experience” and a “sufficient degree of support in his role.” He was new to the role, but the bank allegedly failed to offer mentoring or proper support. The supervisor, whom the bank says it cannot interview directly because he is no longer an employee, allegedly failed to monitor interday directional positions of the department he managed. Société Générale echoed this sentiment in its Mission Green report published in May 2008: “Supervision of JK proves to have been weak, above all since 2007, despite several alerts generating grounds for vigilance or for investigation.” Jérôme Kerviel had no immediate supervisor during the period of January 12, 2007, through April 1, 2007, after the desk manager for the Delta One unit resigned. The bank identified this as a period when Kerviel began “to build up his massive fraudulent and concealed positions on index futures.”
Inadequate Technology Planning
At the heart of this event was the issue of volume and the bank's struggle to keep abreast of the rapidly growing volume of trading in its equities division. The PricewaterhouseCoopers report characterized this as a “difference between the growth in the means (including information systems) available to control and support services and the very strong growth in transaction volumes.” The consulting firm identified a “mismatch between the resources allocated to support and control functions and the level of front office activities.” In addition, PwC cited the bank's “information systems,” which were “unable to keep pace with the growing complexity of the general trading environment.” As a result, there was a “heavy reliance on manual processing.” The May 2008 Mission Green report said that the operating environment was “rendered difficult by strong, rapid growth in the division, with numerous signals revealing a deterioration in the operational situation, in particular in the Middle Office.” This rapid growth included a doubling of volume in a one-year period, front office employee numbers that grew from 4 to 23 in two years, and an understaffed compliance department.
Corporate/Market Conditions
The announcement of SocGen's rogue trading incident came on the same day that the bank announced a €2.05 billion write-down related to its subprime exposure. The trading loss was announced during extremely volatile conditions, with the markets swinging wildly on both an interday and intraday basis. CEO Daniel Bouton said that the loss from the unauthorized trade was exaggerated by market conditions. This is the second unauthorized trading event of notable size that has been publicly revealed in France since the start of the credit crisis in 2007. Credit Agricole also experienced a €230 million loss from such an event.
Corrective Actions and Management Response
The bank announced a decision to raise €5.5 billion in the capital markets and that it already had interest from potential investors. The rights issue for preferred shares was underwritten by J.P. Morgan and Morgan Stanley. The bank assured investors that “the capital increase is fully guaranteed, and will offset the loss generated by the fraud.”
SocGen's chairman and CEO at the time, Daniel Bouton, apologized to shareholders on January 24, 2008. He announced that he would forgo regular salary payments through June 2008. Mr. Bouton offered to step aside, but the bank's board of directors initially rejected his resignation. In March 2008 the bank's chief financial officer, Frederic Oudea, was promoted to deputy chief executive; this was the first shift in management since the announcement of the rogue trading incident. In a later shift, Daniel Bouton announced on April 17, 2008, that he would relinquish his role as CEO to Mr. Oudea. Mr. Bouton retained his chairman position.
Société Générale announced on May 2, 2008, that Michel Peretie has replaced Jean-Pierre Mustier as head of the bank's corporate and investment banking division. Mr. Mustier will take another position within the bank. Les Echos (6/2/2008) reported that the “departure of Mr. Mustier has been thought inevitable.”
Mr. Kerviel and up to five supervisors above him were terminated by the bank. Société Générale said that it lodged a complaint with French prosecutors against the rogue trader. The allegations include fraud, falsification of bank records, and fraudulent use of bank documentation and computer systems. The bank also said that the fraud remained undetected for some period of time because Mr. Kerviel had an “intimate and malicious” knowledge of SocGen's controls.
Société Générale formed a special committee that investigated the incident and released the first Mission Green report on February 20, 2008. A more in-depth report was later released in May 2008. The committee, which consisted of more than 40 employees, was tasked with uncovering the chronology of events, identifying relevant control failings, analyzing possible underlying motives, and searching for additional evidence of fraud. PricewaterhouseCoopers was hired to work with the committee and released a report of its own in May 2008.
The special committee also announced a three-pronged improvement plan that included strengthening of information technology (IT) security and adoption of a biometric identification system, reinforcement of the management of controls and the associated reporting process, so that relevant information can be shared among management and business units, and strengthening of the bank's operational risk function, so that it operates cross-functionally in an effort to better manage the risk of fraud.
The French Finance Ministry released a report on the rogue trading event on February 4, 2008. The Ministry made the following recommendations: enhanced surveillance of notional positions; a mandatory audit trail for every transaction; tracking, analyzing, and collating of information related to canceled transactions; trades verified through reconciling of accounts and contacting counterparties; documentation of terms and conditions reached with counterparties; and enhanced operational risk-reporting requirements. Société Générale responded to the findings in the Ministry's report by releasing a statement indicating that it would take the recommendations into account.
The bank announced in April 2008 that it intended to invest between €50 million and €100 million in order to improve its risk management systems, which included an investment in enhanced trade monitoring. The bank also established an independent internal fraud investigation unit comprising approximately 20 people.
The French Banking Commission fined Société Générale €4 million on July 4, 2008, and cited weak internal controls for the action. The commission mentioned poor supervision as a contributory factor in this event. The commission said that “failures, particularly in the hierarchical controls, continued over a long period and the control system neither detected nor corrected them. These shortcomings went beyond simple repeated individual failures. They enabled the development of the fraud and its grave financial consequences.”
The Banking Commission also cited problems with separation of duties between trading and control staff and said that as a result Société Générale “infringed several essential rules on internal banking controls.” According to the Financial Times (7/5/2008), the €4 million fine is the largest penalty levied by the Banking Commission for risk control lapses to date.
Lessons Learned
This outsized fraud resulted in the usual call for more regulation. It also raised some concern that the regulators themselves are unable to police such large potential events. The Bank of France said that it would examine how the “process malfunctioned and look into whether the internal controls were sufficient.” The bank said that once it determined what had gone wrong it would consider whether a tightening of regulations is necessary in France.
Christian Noyer, the governor of the Bank of France, commented: “We need to learn what happened at Société Générale to make sure this cannot happen again.” He also said that the Bank of France did not consider this event to represent a failure of control on its part to properly supervise SocGen. Mr. Noyer added: “We can't have a controller behind every trader at every bank in the country at every moment. Even the best laws and the best police can't always stop someone who is determined to defraud the system” (Moore 2008).
The European Central Bank called for stronger controls at all financial institutions. “The lesson to be drawn, as in the case of previous frauds of this magnitude [is the] … absolute necessity of substantially reinforcing internal controls and internal risk controls in all establishments,” said chief banker Jean-Claude Trichet. CEO Bouton himself said that while the derivatives business was growing so exponentially, the bank's risk systems could not keep up (2008).
SocGen is considered a well-run bank with a strong risk management department. One analyst commented that, given how strong the bank's derivatives and risk functions were, at first he thought news of the rogue event was a “joke.” A loss this large sparked debate on how effective risk management can be if, in the words of Mr. Noyer, you cannot put a controller behind every trader in every bank.
Axel Pierron, an analyst with Celent, said that one of the problems with risk management systems is that those who work with them eventually learn how to circumvent them. He commented: “Banks, despite the implementation of sophisticated risk management solutions, are still under the threat that an employee with a good understanding of the risk management processes can get round them to (hide) his losses.”
In the end, even the most robust controls will fail if one clever person with malicious intent manages to find loopholes in a bank's systems and processes. The lesson of unauthorized trading events is that in the end, severe losses can result from the misdeeds of a single individual.
CASE STUDY TWO: BARINGS2
Event Summary
Barings PLC, a venerable institution with roots going back 233 years, suffered a catastrophic loss in February 1995 that has become a benchmark case for operational risk. The bank's US$1.4 billion (£830 million) unauthorized trading loss was precipitated by a Singapore-based trader with a hotshot reputation who eventually pleaded guilty to two counts of fraud and was sentenced to a six-and-a-half-year jail term.
The $1.4 billion loss was larger than the bank's entire capital base and reserves, and created an extreme liquidity crisis. Barings was forced to declare bankruptcy and was later purchased by the Dutch bank ING Group for the token amount of one pound, and an agreement to assume the fallen bank's substantial debts. This event shook the world's financial markets, and ultimately led to an increased awareness on the part of financial institutions and regulatory agencies of inherent operational risks.
Event Details
When the Bank of England embarked on its investigation into the incident, it was seeking the answer to two questions: How did the massive losses at Barings happen, and why were the responsible trader's positions not detected earlier? The central bank eventually arrived at the following conclusion: The incident was caused by a series of concealed unauthorized derivatives trades, and those trades were not uncovered sooner due to “serious failure of controls and managerial confusion within Barings.”
Nicholas Leeson, the 28-year-old trader with Baring Futures Singapore who was held responsible for the unauthorized trading loss, was missing from his desk in Singapore on February 23, 1995, when Barings's senior management in London first realized the magnitude of the incident. Leeson, a trader from a humble background who had emerged as a star in the rough-and-tumble derivatives world, was granted a great deal of autonomy by Barings's management. He had worked in Singapore since 1992 and had registered significant profits on the bank's books by placing bets on the future direction of the Nikkei index.
The Bank of England discovered that Leeson had been acting in an unauthorized capacity in a variety of circumstances: He violated his intraday trading limits on a consistent basis and traded in futures and options despite the fact that he did not have the authority to do so. He ultimately hid his losses in a special account, numbered 88888, which was opened shortly after he showed up for work in Singapore. He engaged in options trading and breaches of his limits on a continuous basis, and by December 31, 1994, he was responsible for accumulating losses of $208 million. Throughout this entire period, he represented to his management that he was making profits on his trades and was characterized as a star.
The use of account 88888 played a central role in the concealment of Leeson's unauthorized trades. By February 27, 1995, he had rolled about £830 million of losses into this account. The existence of the account was “suppressed” from Barings's management in London and reported only in margin files that did not elicit scrutiny from the head office. In addition, falsified reports were submitted to the head office that misrepresented Leeson's trades and hedges.
By December 1994, with $512 million in losses already under his belt, Leeson bet heavily on Tokyo's stock index. When it did not rise as expected, and Japan's post-bubble economy continued on its downward path, Leeson continued to buy Japanese futures contracts. The country was recovering from the devastating Kobe earthquake, and Leeson bet that the rebuilding effort would help boost the Japanese economy. Instead, Japan's economy continued to head downward. Over a period of three months, Leeson had bought more than 20,000 futures contracts in hopes he would recoup his accumulating losses. Three-quarters of the $1.3 billion that Barings eventually lost can be traced to these trades.
The Bank of England was unable to determine Leeson's motive, besides the obvious fact that he received over a million dollars annually in salary and bonus based on the revenue that he allegedly generated.
Control Failings and Contributing Factors
Failure to Question Above-Market Returns
No one looked very closely at the nature of Leeson's profits—either because derivatives trades appeared too exotic to be understood by senior management in the early 1990s, or because Barings was thrilled to register Leeson's spectacular trading gains. What has since become apparent is that Leeson was not a wunderkind; instead of generating substantial profits, he was losing money.
Lack of Dual Control/Lack of Proper Segregation
Leeson violated a central tenet of good operational risk best practices: the importance of dual controls and checks and balances. He was the acting settlement manager for both the back office and the front office, and was able to hide his accumulating losses for more than two years. It is speculated that Leeson was given these dual duties by Barings as a cost-cutting measure. The lack of segregation of duties was first identified in February 1994 as a serious problem by the group treasurer of the bank, and was included in an internal audit report that was sent to management; although the report made specific recommendations concerning separation of duties, they were not implemented.
Slow Reaction to Mandate
Senior management, including the bank's CEO, CFO, treasurer, head of risk, and chief operating officer, received the audit report. Yet the recommendations to segregate Leeson's control of both the front and back offices were never acted upon. Most of the individuals who received the report and were later interviewed by the Bank of England said that they considered it to be the responsibility of management in Singapore to implement the recommendations. This, of course, never happened, and by the time the massive loss was realized in February 1995, Leeson was still responsible for front and back offices in Singapore. The Bank of England determined that “the points raised by the report on segregation of duties were of such importance that we consider that it was necessary for checks to have been made to ensure that they had been implemented.”
Failure to Supervise/Organizational Gaps/Unclear Reporting Structure/Unclear Organizational Structure
An additional control failing cited by the Bank of England was lack of supervision and the failure of the head office to properly supervise Leeson's activities in Singapore. The Singapore office was operated almost entirely by Leeson alone, and his staff was relatively junior and simply followed most of his orders. There were no clearly defined reporting lines for Leeson, and although he was partially supervised by the bank's head of capital markets in Japan, this was not fully understood or delineated for any of the parties involved. In fact, the Japanese manager had very little knowledge of Leeson's trading positions. The reporting lines were determined by a complicated matrix structure, which the Bank of England contends can be effective only if proper controls are in place and a clear understanding of responsibilities exists with open hubs of communication; this, of course, was not the case here.
Management Actions/Inactions
While Leeson is the obvious culprit in this fiasco, Barings's management is also responsible. The internal audit report warned of the dangers involved with having Leeson manage both the front and back office settlement process. The Singapore International Monetary Authority (SIMEX) also cautioned Barings about the inherent dangers of this arrangement. There is no record of the bank having acted on this information—in fact, it continued to finance Leeson's trades. And many of those trades were not properly reconciled, nor were there controls in place governing the reconciliation process in Singapore.
Lack of Internal Controls
In its consideration of the role Barings's management played in this incident, the Bank of England concluded that the failure of controls was “absolute” in the Singapore operation. This is an opinion that was shared by Barings's chairman at the time, Peter Baring. The Bank of England concluded in its study that it was “this lack of effective controls which provided the opportunity for Leeson to undertake his unauthorized trading activities and reduced the likelihood of their detection.”
Omissions
The central bank further stated, “we consider that those with direct executive responsibility for establishing effective controls must bear much of the blame” (Eisenhammer and Brown 1995). What was remarkable about this case was that it demonstrated clearly and coherently that a lack of control structure and management omissions in terms of operational risk best practices were directly responsible for the failure of a business.
Corrective Actions and Management Response
Several months after ING took over as the owner of the failed Barings, the Dutch bank fired 21 executives who had “functional responsibility” for the trading of derivatives in Singapore, through either direct or indirect responsibilities. ING released a statement that called the unauthorized trading incident “extraordinary” and “not endemic.” The executives who were dismissed included the head of investment banking and the head of financial products, who were the most senior executives at the top of Leeson's reporting matrix. Additional officers who were dismissed included the chief operating officer, the finance director, the head of settlements, the head of futures and options settlement, the treasurer, the head of group treasury and risk, the head of the bank group, the manager of market risk, and the global head of equity derivatives. The two highest-ranking executives at the bank, the chairman and deputy chairman, had already resigned prior to the May 1995 dismissals.
Lessons Learned
Ultimately, Barings's losses left the banking community a noteworthy legacy in the form of lessons learned and the emerging attentiveness to operational risk issues. The general sentiment in the banking community is that a Barings type of event should never happen again.
Aftermath of Event
The uncovered loss of £830 million led to a liquidity crisis for the bank, and it was immediately placed in administration. The majority of its assets and liabilities were purchased by ING for the token amount of a single pound. This allowed for the protection of the bank's depositors and creditors. Shareholders, however, suffered the brunt of the loss.
Mr. Leeson spent several years in a Singapore jail for his fraud and published a memoir in 1996. He continues to owe £100 million to the liquidators of Barings. He returned to England in 1999 after serving about four years of his six-and-a-half-year sentence and after being diagnosed with colon cancer; he has appeared actively on the speaking circuit discussing “what went wrong” during his time in Singapore.
CASE STUDY THREE: ALLIED IRISH/ALLFIRST3
Event Summary
In what the Financial Times (2/7/2002) has called “another chapter in the cult of the rogue trader,” and the largest such case since Nick Leeson managed to topple Barings Bank, Ireland's largest bank revealed on February 6, 2002, that a currency trader had disappeared after defrauding a U.S.-based subsidiary of $691.2 million. John Rusnak was identified as the rogue trader who initially went into hiding after the event was made public. Mr. Rusnak pleaded guilty to one count of bank fraud on October 24, 2002, and was sentenced to a prison term of seven and a half years in January 2003.
Event Details
John Rusnak was employed by Allied Irish Bank (AIB)'s Allfirst subsidiary in Maryland, and earned a base salary in the US$100,000 range, with annual bonus payments ranging between $122,000 and $220,000 during the years 1998 to 2001. Eugene Ludwig, the former U.S. comptroller of the currency, completed an internal investigation over the course of a month. The bank released his findings to the public in early March 2002 via its web site (www.aibgroup.com).
Mr. Rusnak was charged with seven counts of fraud on June 5, 2002, one of which he pleaded guilty to four months later. The indictment claimed that Rusnak was paid $850,000 over the course of five years as a result of fraudulent trades and confirmations. The indictment also provided an indication of the great lengths he went to hide his trades. For instance, he rented a postal box from Mailboxes Etc. in New York under the fictitious name of David Russell. He had Allfirst send trade confirmations to this address, where he would retrieve the notifications, sign David Russell's name, and return them to his employer.
Eugene Ludwig found no evidence of collusion in his report, except for mild criticism of two U.S. banks over their prime brokerage arrangements with Allfirst. However, Rusnak has agreed to cooperate with prosecutors in determining whether others were involved in the fraud. There is also no evidence that Mr. Rusnak undertook any of these trades for personal gain—except perhaps to the extent that they contributed to his annual bonus number. Rather, it appears from the Ludwig report that the trader was caught in a downward cycle of trying to veil trading losses and of accumulating ever-increasing losses as he tried to compensate for his losing trading strategy.
What is clear is that Rusnak was in significant violation of his trading limits, and that this lapse went undetected within the bank for five years—with most of the losses and trading violations occurring during the years 2000 and 2001. Rusnak transacted trades as large as $150 million, even though his assigned limit was $2.5 million. It took a great deal of close attention to complex details in order to perpetuate this sham for over five years.
The long litany of transgressions that Mr. Rusnak enacted, and the bank itself failed to uncover, are remarkable in terms of their number and complexity. Mr. Rusnak employed various techniques. One involved the use of a strategy that a committee of currency market executives and representatives of the Federal Reserve Bank of New York had warned against as early as 1991. This practice is known as “historic rate rollover” and involves the extension of a currency contract when it comes due.
A 1991 Federal Reserve document warned that “a dealer who routinely offers to roll over his customers’ maturing contracts at historical rates could unwittingly participate in efforts to conceal losses, evade taxes, or defraud his or another trading institution.” It is still unclear why the alleged use of such a large number of rollover contracts—and a multitude of other items—did not trigger the attention of the bank's management. Rollovers allow a trader who might have realized losses to extend the terms of a currency contract in hopes that the exchange rates will improve in the trader's favor during the extended terms. The downside is that the losses can deepen, as they apparently did in Rusnak's case.
At the heart of this remarkable loss is a losing trading strategy: Mr. Rusnak bought a large quantity of yen and other currencies under the assumption that they would rise in value. Instead they fell in value and resulted in significant losses for trades that were already above his set limits. Common practice would have required Mr. Rusnak to purchase contracts that hedged against the possibility of currency price movements. These are typically options contracts that give a trader the option of buying or selling a currency at a targeted future price.
According to passages of the Ludwig report, Mr. Rusnak was so protected by his management that irregularities were often not questioned as they surfaced on a variety of occasions. And to further ensure the veil of respectability, his trades were backed by agreements from both Bank of America and Citibank in their capacity as prime brokers. Under the prime brokerage relationship, when Rusnak made a trade with other banks these agreements would appear in Allfirst's computer system as a Bank of America or Citibank trade. This meant that there were fewer banks to deal with during the trade confirmation process, and Mr. Rusnak had more credibility in the markets in order to execute large trades. At one point, his managers were questioned about the nature of these prime broker agreements, but the arrangements were explained away as being “cost effective.”
Control Failings and Contributory Factors
Lack of Dual Control/Lack of Proper Segregation/Failure to Question Above-Market Returns
Mr. Rusnak entered false hedges into the books that were never consummated and offered no coverage against accumulating losses. It is standard practice to have all trades reviewed by someone else at the bank. Not only did this not happen, but when Mr. Rusnak's strategies—including the size of his trades and the use of the bank's balance sheet—were questioned, he was aggressively defended by his managers. His management, in fact, out of fear that bank profits would walk out the door with Mr. Rusnak, expressed on more than one occasion that any scrutiny of his behavior and strategies might encourage him to leave.
Failure to Supervise/Failure to Reconcile Daily Cash Flows/Omissions/ Lack of Internal Controls
There were early signs that there was something amiss with Mr. Rusnak—particularly in terms of his behavior toward the compliance staff, who are characterized in the Ludwig report as inexperienced and unsupervised. In a remarkable instance, it was discovered by a supervisor that Rusnak's Asian trades were not being confirmed even though it was the policy at Allfirst to confirm all trades. It had been argued—and accepted by the compliance staff—that Rusnak's trades offset each other and thus did not require confirmation. No one seemed to pay attention to the fact that the trades had different expiration dates and hence could not offset each other, until a supervisor inadvertently spotted unconfirmed trading tickets on a junior staff member's desk in early December 2001. This policy of not confirming such trades had been going on for at least 18 months before this date. The supervisor directed the employee to confirm all trades. And yet, when he checked back in late January 2002—almost eight weeks later—Mr. Rusnak's Asian trades continued to be unconfirmed.
Strategy Flaw/Staff Selection and Compensation/Failure to Comply with Established Policies and Procedures
The failure to routinely confirm Mr. Rusnak's trades—which has been explained by his alleged “bullying” of the inexperienced back office staff and a general lack of understanding on the part of his managers of what he was actually doing—is an example of how one control after another failed Allfirst. In fact, the Ludwig report described an institution whose entire trading and risk control architecture was flawed—including the fact that it was involved in proprietary trading activities that could not have been profitable for an institution the size of Allfirst, with its limited resources and market clout. Aggressive compensation schemes and the fact the Mr. Rusnak was allowed to trade alone were all cited as problems inherent in the bank's structure. And although he applied devious methods in his circumvention of the bank's controls, many of those controls were dysfunctional in the first place.
Employee Misdeeds/Inadequate Stress Testing/Failure to Test for Data Accuracy
Mr. Rusnak himself is characterized in the Ludwig report as “unusually clever and devious.” He devised elaborate schemes for hiding his accumulating losses, including downloading and manipulating historic foreign exchange prices. This was exacerbated by the fact that the bank ignored its own rules for independent sources of market prices, because it did not want to pay Reuters an estimated $10,000 for its service. Rusnak also manipulated the inputs into the bank's value at risk (VaR) models and minimized the visible riskiness of his trading strategy. In fact, the Ludwig report cited Allfirst as being too reliant on VaR measures in lieu of utilizing additional strategies, such as stress testing and scenario analysis, which might have alerted the bank to the inherent risk in so-called long tail events.
Corrective Actions and Management Response
This incident created an enormous public relations crisis for Allied Irish Bank. Its management team flew over to the United States from Dublin in order to assure worried analysts that it could continue to operate as a viable entity and was not in danger of going under as Barings Bank had done in 1995. In addition, the bank's risk management procedures and controls came under attack, and the bank's Tier 1 ratio fell to a less desirable level. The Irish bank's stock price was hammered in the markets, with a $1.66 billion reduction in its market value on February 6, 2002. It was believed after the Barings event that this sort of rogue trading incident could never occur again and that the banking community had tightened its controls in general. Now there was expected to be increased scrutiny of the industry's controls and supervisory procedures.
The Allfirst incident led Allied Irish to dramatically overhaul its risk management structure. Fitch Ratings credited Allied Irish in the aftermath of the event with significantly improving its risk culture. In a July 2004 report, the rating agency concluded that the fraud “led to a re-evaluation of AIB's risk management structure.” Fitch further reported that the bank was expected to “further strengthen existing systems to reinforce its conservative approach to risk.”
On April 24, 2006, the U.S. Federal Reserve prohibited two former AIB executives from working in the U.S. banking industry. David Cronin, the former treasurer at Allfirst and former boss of Rusnak, and Robert Ray, a former senior vice president of treasury funds management and Rusnak's immediate superior, were both barred from “participating in any manner” with an insured depository institution, bank, or savings association holding company. According to the Federal Reserve, the orders were based on “alleged unsafe and unsound practices in connection with [Cronin’s] supervision of a subordinate.” However, the orders do not constitute admissions of guilt by Mr. Cronin or Mr. Ray. AIB fired Mr. Cronin, Mr. Ray, and several others in early 2002, after Rusnak's activities were revealed. The Federal Reserve determined that Mr. Cronin was the “key weak link” in the control process and that both he and Mr. Ray had “missed the big picture” in their failure to understand the details of Rusnak's activities.
Lessons Learned
The fact that trades could have occurred at a small regional subsidiary of Allied Irish Bank that must have been in the billions of dollars, as indicated by the size of the actual loss, has stimulated awareness of how the over-the-counter markets regulate themselves. These losses usually occur when there are inadequate dual controls in place, or lack of separation of responsibilities between the traders and settlement staff. After Barings, the general feeling in the industry was that these types of controls were applied uniformly across all trading organizations. These assumptions were questioned by analysts and investors at a time when the markets were suffering from a lack of confidence on the part of individual and institutional investors.
The lessons learned in this case also include the realization that organizations have to scrutinize the risk profiles of their nontraditional or noncore business lines very carefully. They will need to undertake assessments of businesses, such as proprietary trading, and determine whether they have the appetite for potential losses, and the deep pockets for the required investments in risk systems and risk experts. Another major lesson is one that also emerged from the Barings case: A rogue trader can succeed in his over-the-limits dance only if he is partnered with an institution with lax or absent risk controls.
Aftermath of Event
In an aftermath to this case, Allied Irish sold the Allfirst unit to M&T Bank in September 2002 for $3.1 billion. It retains a 22.5 percent stake in the combined operations.
NOTES
* This information is the sole property of Algorithmics Software LLC and may not be reprinted or replicated in any way without permission.
1. Algo First database of operational risk case studies.
2. Ibid.
3. Ibid.
ABOUT THE AUTHOR
Algorithmics Software LLC (www.algorithmics.com) is the world leader in enterprise risk solutions, dedicated to helping financial institutions understand and manage risk. Its innovative software, content, and advisory services provide a consistent, enterprise-wide view of risk management to help firms make better business decisions and increase shareholder value.