Case 5
Too Big to Know What’s Going on at Banamex?
As Much as I hate to say it, it appears that even now—five years after a crisis in which the financial services industry shouldered its fair share of blame, there are still some people who don’t get it …” Michael Corbat, Citigroup CEO’1
MICHAEL CORBAT, CEO OF CITIGROUP COULD ONLY SHAKE HIS HEAD. The news from Banamex, Citi’s large and highly profitable Mexican subsidiary kept getting worse. It was mid-April, 2014. A scandal had descended on Banamex in February. Over $500 million in Banamex loans to Oceanografía (accent over ‘i’), a local firm, turned out to be secured by fraudulent receivables from Pemex. The fraud knocked some $235 million off 2013 after-tax net income.2
Taking that hit had been the easy part. As Corbat looked into matters, a raft of bigger questions emerged. The first concerned the nature of the fraud. How had it happened that Banamex’ internal controls had failed to detect false invoices?
The second issue concerned the state of controls and ethics at the bank. If a major operation like Banamex could fail to detect something as basic as receivables fraud, what was the condition of controls elsewhere in the organization? Citibank had been stressing controls since the Financial Crisis. Indeed, Corbat gained the CEO position because of setbacks which convinced the Citi Board that Vikram Pandit, his predecessor, was not up to managing the bank’s sprawling operations. Corbat, a seasoned commercial banker, was promoted to set this right. Given this, developments at Banamex were an embarrassment. Corbat had reacted strongly in their wake, writing to all Citi employees:
“Only two weeks ago I wrote to you about the absolute need for everyone at this firm to act in accordance with the highest ethical standards … We now have a galling example of what happens when people fail this basic requirement.”3
Controls were a big deal at Citi for other reasons as well. Ever since the Financial Crisis, U.S. banks had been intensively scrutinized by the Federal Reserve. The banks, including Citi, were now subject to annual “stress tests” of their ability to remain solvent under adverse market conditions. A part of these tests is quantitative, e.g., does the bank have enough top-quality (Tier 1) equity capital to survive losses? Another is more qualitative—how do the regulators view the bank’s controls environment and risk management? Unless a bank passes its tests, it does not receive approval to distribute capital to shareholders as dividends and buybacks. Citi failed several of these stress tests. Last year, it had also received critical letters from the Federal Reserve, the FDIC, and the Controller of the Currency demanding improvements in money laundering controls and internal audit procedures. As a result, Citigroup’s dividend was stuck at a microscopic $0.01/share.4
A final concern involved the bank’s management system. Improved controls were needed. These had to be driven from the center, as control standards generally must be uniform. Good controls involve core principles, such as not allowing single individuals to open a Citibank account or alter a Master Vendor list. Exceptions open up holes in the system and invite noncompliance.
Thus, it is usually the head office which defines standards and then sees they are followed throughout the organization. Corbat saw that this approach clashes with the way in which Banamex historically has been managed. Banamex was not an original Citi operation; the bank acquired it in 2001. After the acquisition, Manuel Medina-Mora, a well-connected local executive, was placed in charge. Medina-Mora argued that it is necessary to play ball with politically powerful firms, business leaders and politicians to succeed in the Mexican market. Medina-Mora’s position was one of “I will take care of Mexico,” and he did.5 Results were excellent, so Citi Park Avenue didn’t ask too many questions. Medina-Mora eventually was promoted to head of the global retail bank while retaining his chairmanship of the Banamex Board. From the perspective of Citi’s home office, Banamex operated as something of a black box.
The Financial Crisis changed this arrangement. With regulators crawling over Citigroup looking for excessive risk, Banamex could no longer operate so autonomously. The regulators also were unforgiving of control breaches out in the provinces. This presented Corbat with a challenge. How much should he rein in Banamex? If he did so, would it end up driving away lucrative business that had made Banamex one of Citi’s crown jewels? Would it also end up alienating Medina-Mora and his protégées, i.e., the leadership which had produced a decade of stellar results? On the other hand, underworking the problem could result in more negative surprises, failed stress tests and possibly a forced exit for Corbat. What to do?
On his desk was a new report from the internal auditors Corbat had sent to Mexico City (Attachment 1). This report contained an account of the Oceanografía fraud and the condition of controls at Banamex. Corbat knew he had decisions to make: 1) what had to happen to repair the breach at Banamex; 2) who was responsible and who should be held accountable; and 3) what to do about the Banamex management system and leadership going forward?
Corbat picked up the report and began to read.
Oceanografía Defrauds Banamex
Once in command of Banamex, Citi set out to deploy its retail banking expertise in the Mexican market. Credit cards, ATMs, residential mortgages, these and other products basic to U.S. retail banking provided fresh opportunities in the underserved Mexican market. Banamex’ CEO Medina-Mora proved dexterous in expanding bank revenues and margins via these products.
The wholesale banking side presented a more complex story. The Mexican industrial market is typically dominated by one or a handful of local firms. As an example, Carlos Slim’s Telmex and América Móvil dominate the telecommunications and wireless industries respectively. In Mexico, such dominance is often achieved by establishing strong connections with powerful politicians or State-Owned Enterprises (SOEs) like Pemex. The means for establishing these connections often do not meet U.S. control standards or ethics.
Initially such concerns did not trouble Citi. That changed in the wake of the Financial Crisis. Regulators demanded that risk be reduced, and in response Citi sent an audit team to Mexico City. After a thorough review of Banamex’ books, the team “redlined” a substantial number of corporate credits.6 This meant the bank would not loan money to those firms out of concern for their credit quality, their operating practices, or both.
Oceanografía (OG) was one of the corporate clients that survived this purge. OG was an oil field services firm specializing in marine construction, maintenance and chartering. It gained prominence in 2002, rising from obscurity to capture major contracts from Pemex. At the time there were rumors of close connections between then-Pemex officials and OG CEO Amado Yanez. However, nothing illegal was ever proven.7
Banamex constructed its lending relationship with OG around that firm’s business with Pemex. The principal lending arrangement was a receivables financing facility. Banamex would advance cash to OG based upon that firm’s receivables from Pemex. In exchange for the cash, OG would “assign” these receivables to the bank. This exchange took place at a price where the cash paid reflected a discount to the receivables face value; this difference compensated Banamex for the time value of money, for taking Pemex and OG risk and for providing the collection service. When the receivables came due, Banamex collected directly from Pemex. If, however, Pemex failed or refused to pay, OG was still liable to repay the bank.
Receivables facilities are among the most traditional of bank lending products. They are deemed useful by both the client and the bank because the credit quality of the receivable is often superior to that of the primary borrower. Such was the situation in OG’s case. Attachment 2 provides an example of this facility in operation.
The efficacy of this arrangement depends on whether the receivables are valid. Receivables fraud is one of the oldest and most basic ways customers defraud banks.8 If the receivables assigned are overstated, or worse, completely fraudulent, the bank may end up writing off the loan. For this reason, a controls process usually surrounds receivables facilities. At a minimum, this process requires the bank to verify the legitimacy and value of a receivable with the company owing the money before advancing cash to the party assigning the receivable.
This controls process failed to work in the Banamex-OG case. As Michael Corbat got the story, Banamex lent OG $535 million against receivables worth $400 million less than that amount. An investigation soon raised the bank’s loss to over $500 million. It also established that somewhere along the line, Banamex stopped verifying the facilities’ receivables with Pemex.9
Corbat clearly felt changes were needed at Banamex. The extent of these changes was yet to be determined. How should the controls process be repaired? Who should be disciplined or even fired? To determine this, Corbat needed to decide whether controls failed because of poor design or were undermined by collusion within and outside the bank. If there was collusion, was that a product of the way Banamex was being operated?
This last question opened up a broader issue—did the root of this defalcation lie deeper in the culture of Citigroup? Corbat’s predecessors made a decision to hand Medina-Mora the keys to Banamex and let him “take care of Mexico.” Such autonomy was not uncommon at Citi before the Crisis. If allowing local leaders to play the game “their way” invited scandal, was this something Citi could still afford in a post-Financial Crisis world?
To resolve these questions, Corbat decided to review the bank’s management system under his two predecessors, Sandy Weill and Vikram Pandit. Only then would he return to the specifics of the OG investigation, decide what measures to take, and who, if anyone, should be punished.
Managing the Global Financial Supermarket
The story of Citigroup’s cultural evolution really dates back to the 1970s and its then CEO Walter Wriston. Citi was a New York money center bank with an extensive overseas branch network. Interstate banking was heavily restricted, so Citi did not possess branches in Texas or California. Branch banking in New York was mature, and most of Citi’s revenue growth came from overseas. There Citi took the lead in “recycling” petrodollars from OPEC countries into loans to importing countries.
Wriston was concerned that this growth model was not sustainable. He noted many of Citi’s corporate clients increasingly were turning to the bond market for funding. He also felt that investment banks enjoyed much better margins on their advisory and underwriting activities than Citi earned on retail bank products.
Wriston’s solution was to invade the investment banks’ turf. Technically, this was illegal. A Depression-era law, the Glass-Steagall Act, prohibited deposit-taking banks like Citi from underwriting securities or selling insurance. Wriston had an answer for this—the bank holding company structure. Under this framework, deposit-taking Citibank was just one subsidiary under a parent firm. That firm then owned other subsidiaries doing investment banking type business. One subsidiary did equipment leasing, another developed real estate, another underwrote securities outside the United States. About the only investment banking business foregone by Citi was the underwriting of securities in the U.S. Attachment 2 illustrates Citi’s Holding Company structure from the early 1990s.
Wriston also bequeathed to Citi a “find a way around the rules” culture. A good example was Citi’s development of the Structured Investment Vehicle (SIV). First developed in the 1980s, SIVs helped Citi warehouse assets in “off-the-balance sheet” locations. SIVs unburdened the balance sheet, allowing Citi to control more assets for a given amount of capital without giving analysts or regulators the impression of being excessively leveraged. Citi also marketed SIV structures to clients interested in projecting similar optics.
Citi’s “find a way” culture was valued by clients. They often turned to the bank to find “innovative” solutions for their financial problems. There is, however, a thin line between creative and deceptive finance. The more Citi succeeded in structuring ways around accounting, tax, or regulatory issues, the more clients expected there was no rule Citi could not find a way to circumvent. This slippery slope would come back to bite the bank in later years.
Meanwhile, Citi found itself besieged by other problems. Starting in the 1980s, many of Citi’s “sovereign credits” began to default. First Brazil and later Argentina and Mexico struggled to repay debts taken on to fund their balance of payment deficits. Citi also lost heavily when oil producers saw prices plummet below $10/b in 1986. The defaults ravaged Citi’s balance sheet. Citi saw its stock price fall below $2 share early in the 1990s and some analysts wondered whether the bank would survive.
While Citi struggled, Sanford Weill was moving along a parallel track. Rising from humble origins, Weill built a career consolidating financial firms. Weill’s takeover prowess was extraordinary. He merged many firms into the nation’s second largest brokerage firm, Shearson Loeb Rhoades. He sold this firm to American Express, where he became president. Stepping down in 1987, Weill then took over a series of insurance companies, including Primerica and Travelers. In the process, he also acquired the brokerage outlets of Drexel Burnham Lambert and investment banks Smith Barney and Salomon Brothers. All these he combined under the Primerica holding company.
Weill touted a vision of a financial “supermarket.” In his concept, customers should be able to shop for loans, insurance, securities and advice globally from the same firm. By 1998, Weill had in place almost all the pieces for his supermarket. All that was missing was a large commercial bank capable of taking deposits, issuing credit cards and funding mortgages.
Citi looked like an ideal target. Under CEO John Reed it had recovered somewhat from its early 1990s debacle. Reed had de-emphasized institutional and sovereign lending in favor of retail banking, ATMs and credit cards. Interstate banking was now allowed and Citi branches dotted many state markets. Weill could hardly hide his appetite for merging his Primerica with Citibank.
Glass-Steagall still stood in the way. Weill decided on an audacious tactic. He would persuade Reed to merge Citi and Primerica on the basis that Glass-Steagall would be repealed. This he accomplished in April 1998. Technically, the merger was illegal and would have to be unwound if Glass–Steagall remained in place. Weill, however, had enough private assurances from Treasury Secretary Rubin and Federal Reserve Chairman Greenspan to take the risk. One year later, the Gramm–Leach–Bliley Act was enacted, demolishing Glass–Steagall. Citigroup was now fully legal. Weill and Reed were initially co-CEOs, but Weill soon forced Reed to resign. He also recruited Robert Rubin to join the new Citigroup Board. The firm who pioneered finding a way around banking’s rules had in Weill a new CEO who had just taken the ultimate legislative scalp.
Weill’s new Citigroup was a global behemoth. Its 357,000 employees occupied 16,000 offices in over 140 countries while working with $750 billion in assets. Whether Weill could manage this empire was another question. Sandy Weill had never run a commercial bank or a global institution. His skill set lay in deal making, not administration. Moreover, he could brook no rivalries or powerful personalities in the CEO suite. Weill quickly dispatched Reed and also ran off Jamie Dimon, his talented protégé and a career commercial banker. As for Citigroup, it still had Citibank’s “find a way” culture, now reinforced by a CEO dealmaker who had built his career bending rules and laws to his will. This combination would eventually prove lethal.
The problems were not long in coming.
Not realizing it was crossing important lines, “find a way” Citi devoted itself to helping Enron and WorldCom mask deep financial woes. As an example, Citi devised the Whitewing transaction for Enron, a $1 billion loan structured to give an accounting result as if Enron had issued preferred stock. Citi also supported Enron CEO Andy Fastow’s LJM partnerships, which enabled Enron to book earnings on bogus asset sales to a related party. When Enron and WorldCom subsequently collapsed, their fraudulent transactions were exposed. Soon shareholders, the SEC and the Justice Department went looking for the banks that enabled the frauds to be structured. Citigroup was squarely in their sites. By 2005, Citi had agreed to pay almost $5 billion to settle just these two scandals.
On another front, Citi ended up paying $400 million to settle claims it had manipulated its stock research to capture banking business. CEO Sandy Weill was implicated in this affair. Reportedly he had urged telecom analyst Jack Grubman to “take another look” at ATT. At that time Citi was seeking a lucrative piece of ATT underwriting business and Grubman did not have a “Buy” recommendation on the stock. The recommendation was changed. Grubman’s child later gained entry to a prestigious Manhattan elementary school, and there were reports this happened with Weill’s assistance.
The settlements had a negligible effect on Citi’s culture. Instead, the bank shifted to another opportunity, the growing business securitizing subprime mortgages. Citi’s presence in the mortgage business positioned it to insource a high volume of mortgages. Combining these with what it could purchase from other originators and Wall Street, Citi was able to securitize an astounding volume of these products. The flow threatened to overwhelm even Citi’s balance sheet. The firm again turned to SIVs for relief, stashing over $100 billion of subprime securities in a series of vehicles. Ostensibly, these were “off balance sheet.” In fact, they were backed by a Citi pledge to buy the vehicles’ commercial paper if it proved difficult to market.
While this cloud was gathering, Citi’s controls grew increasingly byzantine. Repeat scandals resulted in patches grafted atop various cracks. The resulting structure showed layers of reviewers but little evidence of coherent controls. Who really was in charge of financial control at the end of the day? The indifference to controls at the top of Citi was inadvertently revealed by its CEO when, in response to questions about the riskiness of subprime mortgages, he commented that “as long as the music is playing, you’ve got to get up and dance.” Attachment 3 shows Citi’s controls structure in the Mortgage Lending business.
When the storm struck, Citigroup was unprepared. In 3Q 2007, subprime mortgage securities plummeted. The price drops forced Citi to book huge losses. Citi was also forced to admit the extent of its subprime exposure, a fact which it misrepresented in prior disclosures, and to acknowledge its backstops for the SIVs. Citi’s CEO and CFO would resign and the CFO would later be subject to an SEC fine and discipline.
Losses worsened in 2008. Following Lehman’s September bankruptcy, concerns developed that Citigroup’s capital was so impaired that the firm was insolvent. Citi ended up taking over $65 billion in funding help from TARP, the Federal government’s bank bailout program, for which the government received a 36% ownership position and half of the Citi Board seats.
Vikram Pandit, a Morgan Stanley banker, became the new Citi CEO. Pandit promised a return to responsible finance. However, his background as an investment banker ill-equipped him to either manage a global commercial bank or correct its controls deficiencies. Embarrassing events continued to occur with alarming frequency.
In 2011, Citi agreed to pay $158 M to settle a False Claims Act suit that it had continued fraudulent subprime securitizations throughout 2009–10. Citi did not dispute the substance of the suit. This was followed by accusations that Citi had participated in manipulating both foreign exchange markets and LIBOR. On the former, Citi agreed to pay a total of $1.66 billion in fines to various U.S. agencies and private investors. The settlement agreement stated that Citi and the other banks were fined for “attempted manipulation of, and for aiding and abetting other banks’ attempts to manipulate, global foreign exchange benchmark rates to benefit the positions of certain traders.”10
Much of this suggested that CEO Pandit’s pledge to return Citi to responsible banking was not being met. Pandit spent the early months of 2012 talking up Citi’s improved risk management, only to see Citi become one of the few banks to fail the Federal Reserve’s stress tests. With Citi’s plans to return capital to shareholders blocked, Pandit was ousted and Michael Corbat made CEO a few months later.
Corbat Confronts the Banamex Scandal in a Post-Financial Crisis World
Michael Corbat laid down the auditor’s report (Attachment 1) after reviewing it for the third time. Several messages therein bothered him greatly. First, there was an indication that the fraud went back to 2012. Apparently, a key control had been changed from within at that time. How could this have happened without management becoming aware and taking action?
This raised the question of whether Banamex’ management was active in supporting sound controls. The audit report implied that the most basic receivables control procedures were not being followed. Where were the first line supervisors when it came to assuring good control procedures were followed? Why was this not discovered by audit? Corbat was especially dismayed that it was Pemex who reported the fraud.
Second, the audit report suggested there were more than a few reasons to have regarded OG as a risky client. Right now the Mexican authorities were coming down heavily on the firm. Indeed, it appeared that OG’s CEO might be indicted. Was that a function of belated discovery of OG malfeasance, or had OG just fallen out of political favor? Regardless of the answer, OG’s behavior was a reminder of the corruption risks Banamex ran in the Mexican market. There were plenty of well-connected but dodgy clients with whom the bank could do business. So long as the client connections stayed strong, loans got repaid, rich fees collected and Banamex made big profits. But when the client fell out of favor, as OG just demonstrated, watch out below.
How should Banamex navigate in this mine field? There were decisions to be made about who should be disciplined, who to put in charge of repairing Banamex’ controls and what repairs needed to be made. Those decisions started with what to do about the Banamex CEO. Medina-Mora had argued that you needed your own well-connected local to “take care of Mexico.” There is just not enough lily-white business in Mexico, Medina-Mora argued, to support the Banamex footprint. Clamp down too hard and you risk throttling one of the earn-ings crown jewels within all of Citigroup.
Was Medina-Mora right or only self-serving? Even if he was partly right, could Citigroup afford to follow this approach right now? The bank would shortly face another stress test. The regulator letters received last year touched on corruption issues, like money laundering, as a concern. Attachment 4 summarizes the key points of the Foreign Corrupt Practices Act.
Corbat was increasingly confident that Citi’s capital account was now strong. If the bank failed the stress test, it would be because the authorities decided its controls and ethical culture were still not up to par. The current Banamex scandal was not welcome news on this front. Corbat certainly felt he had to avoid similar follow-on events. To accomplish this, Corbat concluded his actions now on Banamex had to send the right signals to the rest of Citi and to the regulators.
With these cross-cutting issues in mind, Corbat turned to the decisions he needed to make. His list began with who needed to be disciplined within Banamex and how severe should that discipline be? Next, he needed to decide how to repair the controls culture within Banamex. Did that just involve fixing the controls themselves, or did the culture, and by extension the leadership, have to change too? Finally, what business strategy should Banamex adopt going forward? Said differently, was there still a growth option available to Banamex, or did fixing the bank’s controls essentially mean hunkering down and getting smaller?
Whichever way he went, Michael Corbat knew he had little room for error if he wanted to stay CEO of Citigroup.
Attachment 1
Historical Recreation
| To: | Mr. Michael Corbat, CEO |
| From: | Special Audit Investigative Team (SAIT) |
| SUBJECT: | BANAMEX RECEIVABLES DEFALCATION |
This memo will serve as the Executive Summary of the SAIT sent to Mexico City to investigate losses incurred on fraudulent receivables assigned by Oceanografía (OG, the Client) to Banamex (the Bank). The full report will be forwarded by separate cover.
Amount of the Defalcation Loss: SAIT now estimate the OG receivables fraud to have resulted in before-tax losses slightly in excess of $500 million ($M). This sum is $100 M higher than our initial estimate, and is the result of additional invoices being disputed by Pemex. SAIT also believe that fraudulent Pemex receivables were assigned to Banamex going back to at least 2012. However, these invoices were paid in full by Pemex, so their fraudulent nature was not apparent to the Bank.
Banamex has a further $33 M in direct loan exposure to OG, the repayment of which must now be questioned given Pemex prohibiting further business with OG for the next two years. The SAIT also was made aware of other Banamex losses unrelated to OG. The Bank has to write off $300 M in loans made to real estate developers whose permits were recently canceled by the government. SAIT also discovered $65 M of other losses related to a smaller client fraud.11
Finally, SAIT would note that internal audit has two other investigations underway at Banamex. The first concerns a security firm operated by the bank which provides protection for senior Banamex executives. Audit recently uncovered evidence suggesting this firm is doing unrelated work that includes wiretapping third parties, but charging these expenses to Banamex. Audit’s initial estimate is that $15 M in such false claims have been charged by the firm to Banamex. Audit started this investigation when Frederico Ponce, a former official in the Mexican Attorney General’s office and head of the security firm since 1993, stepped down at the end of 2013. The second investigation, in its early stages, concerns reports of rogue trading by two Banamex traders.
Nature of the OG Fraud: The Banamex/OG facility worked as follows. OG provided marine services to Pemex, and issued invoices for those services. Copies of these invoices served as evidence of OG’s receivables from Pemex. OG would then present an estimate of total invoice amounts plus the invoice copies to Banamex along with an agreement “assigning” the receivables to the Bank. Banamex would apply an appropriate discount to the face value of the receivables estimate, execute the assignment agreement and advance OG cash equal to the discounted value. Pemex would receive notice of the assignment and make payment directly to the Bank on the receivables due date. Should Pemex not pay, the Bank would pursue the collection, but in the end had the option to return the receivable to OG and receive cash equal to its face value.
The fraud came to light when Pemex refused to pay certain receivables. Banamex officials attempted to obtain payment and were advised that the receivables in question did not match Pemex records for amounts owed. A further investigation has shown that some OG invoices were overstated versus contract terms while others were not supported by underlying work documentation. Pemex adamantly refuses to pay the disputed amounts.
The Bank returned the questionable receivables to OG and demanded full payment. However, Pemex and the Mexican government have taken strong actions against OG in this affair. In February, Pemex announced a 21 month moratorium on its doing business with OG. Later that month, Mexican authorities seized OG’s assets and appointed an administrator to salvage what remains of the business. This month, a Federal prosecutor indicted OG CEO Amado Yanez. He is now out on bail awaiting trial. Given these events, OG has indicated it is unable to pay the disputed receivables.
Nature of the Banamex Controls Breach: We have been able to determine that a Banamex employee tampered with a key control procedure. However, there is reason to believe that this tampering alone would not have been sufficient to allow a multi-year assignment of fraudulent Pemex receivables to the Bank. There is a strong possibility of collusion between one or more Banamex officials and personnel inside OG and Pemex.
Our investigation centered on Jose Ortega, a Banamex manager responsible for lending to service companies doing business with Pemex. Ortega had authority to edit the controls manual for this business. Sometime before 2012 Ortega changed the manual, eliminating the requirement that Bank personnel call Pemex to verify receivables assigned by OG. This change made it easier for OG to assign fraudulent receivables to the Bank.11
However, the full story is likely more complicated. The complications begin with Ortega having been fired in 2012. Banamex fired him after it came to light that Ortega had received $200,000 from OG CEO Yanez. At the time Ortega claimed the payments were for his wife, a fine arts dealer, who had sold Yanez art and other property. Ortega went to work for OG as a consultant after being fired by the Bank.12
The curious aspect of this episode is that the OG fraud continued after Ortega was fired. Whatever role his alteration of the controls manual played, it is clear that no one in the Banamex receivables factoring organization raised any red flags about the weakened procedure. Neither did anyone on their own take the initiative to call Pemex, on a spot or sampling basis, to verify the OG receivables. The simple elimination of a manual’s requirement is not the same thing as a prohibition on Banamex employees taking the most basic kind of initiative to assure the overall process remained sound. This was recognized in part when the Banamex employee directly involved in processing the OG receivables estimates was terminated last February. In SAIT’s view, more Banamex personnel were likely involved for a fraud of this magnitude to have flourished for more than two years.
While we cannot yet prove it, SAIT strongly suspect collusion among OG, Banamex and Pemex personnel. Our hypothesis is as follows. OG’s Yanez was in collusion with a person or persons in Pemex, possibly at a high level. They agreed that OG would over-invoice Pemex and OG would kick back part of the overstated amounts to these persons in Pemex. Because OG is not well capitalized, a financing arrangement was required. This led to the receivables facility being sought from Banamex. However, a strong Banamex controls process would soon uncover the fraud. Hence it was necessary to bring Ortega, and possibly other Banamex personnel, into the collusion. Ortega’s wife was given a lucrative art deal and Ortega may have received other considerations. In return, he altered the controls manual and guided the ensuing process such that nobody in Pemex outside the collusion ring ever was asked to verify an OG receivable. To keep this going, Ortega likely involved others within his department. They continued the no verification process after Ortega’s firing. Ortega’s continued presence inside OG as a consultant likely enabled him to look after the necessary connections with Pemex and Bank parties involved in the fraud.
We further suspect that a political dispute inside Pemex resulted in some faction moving against the persons involved in the Pemex/OG part of the collusion. The swiftness of Pemex’ turning on OG and the follow-up by Federal legal authorities all point to a high-powered effort to bury something or someone.
Finally, SAIT would note that Banamex has resisted requests from Citi New York to implement automated control systems rather than continue to rely on paper documentation processes. Automated systems would likely have spotted this fraud more quickly. Banamex stands out within the Citigroup organization as a laggard in updating its controls, and this position has had support at the highest management levels within that subsidiary.13
Recommended Actions: While we do not have access to Pemex records and cannot prove the above, the circumstantial evidence is such that we should operate on the assumption that more Banamex personnel were involved in this fraud.
To determine the full nature of this collusion, we recommend the strongest, most intensive investigation possible. To facilitate this investigation, immediate disciplinary actions are also recommended. These actions, up to and including terminations, should focus on personnel whose positions of authority were such that they should have spotted the weakened controls and/or caught the altered manual during self-assessments or internal audits.
By taking these actions and terminating some management, the Banamex organization will be put on notice that these behaviors will not be tolerated. We also believe such disciplinary actions will encourage other employees to come forward and share what they know. SAIT are especially interested in motivating those who had some awareness but were not directly involved in the fraud to now share what they know. Only then will the full extent of Banamex cooperation with the OG/Pemex collusions be determined.
Special Audit Investigative Team
Manuel Guardia, Head of Team
Attachment 2
OG/Pemex Receivables Assignment with Banamex
Attachment 3
Citigroup Mortgage Business: Organizational + Controls Structure
Attachment 4
Essentials of the Foreign Corrupt Practices Act (FCPA)
Enacted into law in 1977, the FCPA outlaws bribery and related acts undertaken for the purpose of winning business outside the United States. It further requires publicly traded companies on U.S. exchanges to keep accurate records of payments made to foreign nationals and the purposes of those payments. Firms and individuals who violate the FCPA may be subject to civil or criminal penalties, or both.
Essential features of the FCPA are as follows:
- Applicability: The law pertains to any U.S. citizen, national or U.S. resident, any corporation or business entity organized under U.S. law or having its principal place of business in the U.S., and any U.S. or foreign firm with a class of securities registered under the Securities and Exchange Act of 1934.
- Prohibited conduct: The anti-bribery provisions of the FCPA make it unlawful to make a payment to a foreign official for the purpose of obtaining or retaining business, or to direct business to any person. The Act, as amended, also prohibits similar behavior inside the U.S. by non-U.S. individuals or firms.
The Act focuses on intent rather than the amount of any bribe. There is no “materiality” standard for bribery, meaning that any amount, or non-cash favor, is proscribed by the Act if the purpose is to obtain, retain or direct business.
The FCPA deems it illegal to direct payments through agents or middle men if the purpose of such payments is proscribed under the Act. Thus, the FCPA proscribes, for example, the retention of law firms in foreign countries where those firms act to pay money to foreign officials for the purpose of obtaining, retaining or directing business.
The Act distinguishes between bribes and “facilitating payments.” The latter are described as payments made to foreign officials for the purpose of encouraging them to perform their routine duties. Such payments may also be acceptable if they are legal in the local country. To be considered a facilitating payment, the payments should be nominal in amount. They also must be fully documented in the accounts of the entity making the payments. - Accounting Provisions: The FCPA requires companies whose securities are listed in the U.S. to keep books and records that accurately reflect all corporate transactions and to maintain an adequate system of internal accounting controls.
Author’s Note
This case is a companion piece to the original Ken Lay case involving Enron Oil Trading. Both cases involve serious control breaches at an important subsidiary. Both challenge the CEO to decide what disciplinary actions to take and what signals to send to the rest of the organization. Both CEOs feel their actions may influence whether they survive in their position. Both CEOs must decide whether taking tough action now will “kill the golden goose” in a business sense.
Michael Corbat’s situation is complicated by residing in the aftermath of the Financial Crisis. Corbat has to deal with regulators in a way that did not concern Ken Lay. He also has to face Citigroup’s history of legal and ethical violations. These violations provided a basis for the Federal Reserve to fail the bank on stress tests and deny its plans to distribute dividends and make stock buybacks.
A further complication is the element of foreign corruption. Is Corbat dealing with an isolated controls breach, or are OG’s fraudulent receivables the tip of the iceberg? Is it possible that a great deal of Banamex business model relies on turning a blind eye or even being a party to systematic Mexican political corruption? If so, Corbat may need to make deeper changes at Banamex. If he does, can it still function as Citi’s top profit generator in Latin America?
To make these assessments and decide on a course of action, students should pay special attention to Attachment 1, the audit report on the Banamex defalcation. While preliminary, this report provides Corbat with important clues regarding the nature and severity of the control issues at Banamex.
This case relies heavily on news reports of the scandal, documented in the Notes below. It also reflects the Author’s experience as a finance executive in non-U.S. locations where FCPA issues were important. Attachment 1, the SAIT audit report, is a Historical Recreation. No such public document exists. The report reflects public information which came to light between February and October 2014 regarding the defalcation, Jose Ortega’s amendment of Banamex’ controls manual, his relationship with OG, and the actions of Mexican authorities towards OG and its CEO Yanez. That information is collapsed here into a preliminary report such as Corbat may have received. Corbat did send investigators to Banamex and much of Attachment 1’s information was later made public by these sources.
The case asks a final question—is Citigroup simply too big and complicated for any management team to administer soundly? Size and complexity are obvious issues. Culture is also a factor here and the case documents Citi’s history as a “find a way around the rules” organization. Corbat is attempting to run a somewhat smaller version of Citi by placing more emphasis on proper ethical conduct. He seeks to improve controls and modify culture. When considering this case, students have an opportunity to weigh size, complexity and culture as factors in sustaining an ethical firm. When standing in Corbat’s shoes, they also have a chance to determine what price Citi should be prepared to pay to correct its history of serial violations.