One fact stands out starkly in the fraud committed on Punjab National Bank by Mr. Nirav Modi and his co-conspirators.
It is that such a fraud cannot be committed on this scale without the active connivance of a number of people, agencies, the banking regulator, RBI, and the Finance Ministry. To finally pin this fraud on two junior level officers is absolute rubbish. The facts tumbling out indicate that there was the tacit involvement of several political leaders, who rented out property to Nirav Modi or his co-conspirators, at exorbitant rents. (As I write this, one of the news channels says that some senior executives have been arrested.)
In my long career, as a banker and a consultant in the banking and financial services industry, I have been privileged to work with several seasoned bankers with fine minds. My Forex Guru is Shri Rajwade, who trained me in the nuances of forex and interest rate risks, and other risks in general, much before you could Google your way through life and obtain answers in a jiffy.
Later, about four and a half years back, in a bank in the Middle East, I worked on Operations Risk. I recall my boss asking me before I joined his team, about what I knew of Operations Risk and my reply was “Very little! But am sure I can learn!” My boss had worked with me earlier on another project in his bank and knew me and my abilities well enough to take me on board. (The previous project was considered ‘impossible’ by the powers that be in that bank. It was not only completed well on time but was closed out efficiently by my team.) He was willing to take a chance on me, a 60 year old with vast experience in all other aspects of banking but hardly any on Operations Risk.
As I got deeper into the finer aspects of Operations Risk, there was a realization that this risk could well consume a bank. When I wanted to learn more on the subject, one of the best references I got was on RBI’s site. Their circular on Ops risk is very lucid and fairly comprehensive. It appears that the circular was neither read by any of the RBI officials, nor by other bankers in India!
What exactly is Operations Risk? Here’s the officially accepted definition from the Basel Committee on Bank supervision: –
“Operations Risk is the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk.”
Note that the risk is in inadequate or failed internal processes, people or systems and external risks. Let us now link this with PNB’s fraud. The reason for the fraud, as per the bank, is that two employees sent out SWIFT messages authorizing Letters of Undertaking or LOUs. The bank also admits that the SWIFT system is not linked to the Core Banking System or CBS. Hence, these LOUs could not be verified by the higher ups within the branch. There are two failures here, one of failed internal systems and the other of people. Even if we, rather naively I must say, assume that these employees were the rogues, much like Nick Leeson who brought down Barings Bank with failed trades, there are the following questions: –
- Did huge credits to the NOSTRO account of the bank go unnoticed, or were they deliberately ignored? (Against the LOU, a bank extends a buyers credit to the Indian party to purchase goods, in this case gold and diamonds. The proceeds are credited to the NOSTRO account of the bank for disbursement to the party, in this case Nirav Modi and his co-conspirators.) The flowchart will illustrate the mechanism of how Buyers’ Credits are structured.
- The issuance of LOUs has purportedly been done without approval.
- The LOUs are usually issued for 90 days and buyers’ credit is given against them. If they were not repaid on the due date, why did the banks that had extended Buyers Credit not invoke the LOUs?
- The moment they did, it should have come to the notice of higher ups at the very top level, viz. ED, Chairman and MD and should have been reported to the PNB Board of Directors that includes representatives from the RBI and the Ministry of Finance.
- How did the fraud continue even after this happened? (which also begs the question of where was the fraud?)
- Am sure that there would have been some checks in the bank and in case these were not there, why were the regulators, the auditors and the statutory auditors silent
- Why did the same officials handling foreign exchange in the branch continue working in the same desk for over six years? (In a career spanning 25 years in SBI, I was posted in 12 different positions in 23 years. Am not counting the two years of probation which was essentially a training period.)
- My experience indicates that there are numerous audits conducted in any branch. We have internal audits, concurrent audit, bank’s own inspection department audits, Statutory audit at the end of the Financial Year, Risk audit, RBI audit and some I may have missed. Why did no one point out the unbridled misuse of SWIFT in the branch?
- Every day, in any medium sized branch, the copies of SWIFT messages are scrutinized and anything unusual get flagged and investigated by the BM. Was this never done or was it done only to ensure that the BM did not miss his cut?
If someone had done just the above simple checks, no fraud could have taken place. It would appear to me that the credits extended to Nirav Modi may well have been paid on time or would have been replaced by another LOU for a larger amount. In such a case why did not the financing banks raise a red flag with PNB for not honouring the LOU? Such disputes invariably end up with the RBI. What was the RBI doing? From my not so limited experience, the RBI officials have only a general idea of banking and the nuances are not something they know very well. However, as a Central bank, they do not really have to get into the nitty gritty. This is not to say that the RBI officials are a set of ignoramuses. Far from it, they have done a great job of monitoring inflation, keeping a tight control on the value of the Rupee and on so many other matters at a macro-economic level.
The operations risks in a bank are mapped out and monitored through a process that starts with preparing what is called a Risk Control Self Assessment or RCSA by culling out the risks in the process and noting down these risks and the mitigants available for these risks. These risks are then given a rating on a five point scale. Later the KRI or Key Risk Indicators, and later, a heat map is prepared. The heat map will tell you how the risks stack up by the numbers. From the heat map, which uses a system of classifying the number of high risks, medium risks and low risks, the highest risks are monitored by high level executives and a KRI report has to be submitted very frequently, say once a fortnight. Medium risks are monitored by personnel at a lower level. Low risks are monitored by people lower still on the totem pole. I do not think this ever happened in PNB.
From all the above points it should be fairly clear that the inflection points were ignored and PNB went about its merry ways. There is absolutely no way that the management of the bank would not have known that this kind of activity was going on in a key branch of the bank. That they chose to ignore it till they could not do so any longer indicates a cesspool of corruption that has caused major damage to the bank.
Risk assessment and control does not need sophisticated systems, just a few honest and well trained employees in key places. But if the bank has a bad reputation for a corrupt management and employees go with the flow, disaster follows as it has done. Let us pray that this is just one instance and not the tip of the proverbial iceberg.
I have not covered the risks of financing diamonds It is a business about which no one outside the diamond industry has the faintest idea. In addition, the assessment of credit is part of credit risk and not operations risk. Diamonds are not like gold where it is possible to use specific gravity and touchstone tests to measure purity. It requires tremendous expertise to detect fakes. Let us admit that bankers are not the best judges of real and fake diamonds. In addition, even if the diamonds are real, the assessment of value based on carats is beyond ordinary people.
I still remember the late 1980s when banks jumped into the business financing huge amounts to this industry, with eyes closed, as per my assessment. SBI had even opened a Diamond Branch near the hub of the diamond trade in Mumbai. The branch was headed by a DGM ranked official, very big those days. My discussions with a few people in the bank dealing with the business indicated a general cluelessness. To me, a person who had spent a fair bit of time in the finance of small businesses and one who would sign on the recommendation or sanction only after proper due diligence, this whole business should never have been taken up by the bank. The bank was probably motivated by the possibility of financing exports, fee based income and the existence of branches in the diamond centres of the World that depended on this business for their sustenance. Since I never was in the field of diamond financing and was so far down the totem pole, I did not break my head beyond a point.
However, the bank officials who permitted this kind of financing, the RBI and anyone and everyone in the Credit Committees needs to be hauled up for being foolhardy. Be that as it may, the entire episode has highlighted the fact that banks are clueless and have jumped with both feet first into deep waters without a lifebelt! Banking is a risky business but all risks need to be evaluated and mitigants should also be in place.
In the case of businesses that are considered high risk, banks should insist on adequate collateral security in the form of title to immovable property, term deposits, shares and insurance policies and whatever else they can lay their hands on to secure their loans or non funded exposures. That this did not happen is a sad story of greed and stupidity. One of the risk evaluations I did was on fraud risk. Every indication was that the diamond trade was fertile ground for fraud.
However, no fence can save crops if it starts feeding on them. No amount of risk assessment and study can do anything when officials of the bank are bent and are corrupt. Thank God that RBI has put a ban on financing Bitcoin!