How a $1.8 billion Indian bank fraud lasted seven years

Bloomberg

The story of how India’s biggest bank fraud went undetected for seven years includes an $81 million cyber-heist in neighbouring Bangladesh, penny-pinching lenders and a series of missed opportunities.
In 2016, after revelations that hackers had infiltrated the Bang-ladeshi central bank’s computer systems to siphon off money, its cou- nterpart in India sensed a danger to its own banking system. The Reserve Bank of India reminded all the country’s lenders to ensure their computer networks were properly integrated with Swift, the global system used to transmit payment instructions in the Bangladesh theft.
Unknown to the RBI at the time, a rogue employee at state-owned Punjab National Bank had allegedly been taking advantage of precisely that flaw in the Indian lender’s computer systems for five years, perpetuating a fraud that would eventually balloon to $1.8 billion, according to PNB’s account. “The biggest thing that didn’t happen was the linkage between Swift and the bank’s back-end software — they didn’t talk,” said Abizer Diwanji, a financial services partner in India at the accountancy firm EY. “The ball was first dropped” when PNB missed a chance to reconcile the two systems, he said.
As the fallout from the incident spreads and various government agencies move to investigate, one thing stands clear: the financial damage was exacerbated by a combination of inferior technology, weak risk management and insufficient regulatory oversight. Had the fraud been discovered a year earlier, the total amount would have been about $800 million lower.
PNB alleges its former employee Gokulnath Shetty provided billionaire jeweler Nirav Modi and his associates with guarantees to obtain loans from abroad. Between 2011 and early 2017, guarantees worth 65 billion rupees ($1 billion) were issued without any collateral, followed by another 49 billion rupees over March to May last year, when Shetty retired, according PNB’s complaint that has been made public.
Because the computer systems of many Indian banks weren’t compatible with Swift, the RBI didn’t make it a requirement to integrate the two, according to R. Gandhi, a former RBI deputy governor who oversaw the central bank’s risk operations at the time of the Bangladesh hack. However, banks like PNB that hadn’t integrated their systems were required instead to perform daily manual checks to reconcile the Swift messages with internal records, Gandhi added.
Given the prevalence of fraud involving global trade finance transactions, it’s critical for banks to ensure automated or manual reconciliation with Swift, said Tim Phillipps, an Asia-Pacific financial crime specialist at Deloitte. It isn’t hard to build an interface between Swift and the bank’s own software, he said.

Regional bank recalls perpetual debt amid bad loan woes
Bloomberg

One of India’s biggest regional lenders is recalling 15 billion rupees ($231 million) of perpetual bonds as it seeks to retire expensive debt and replenish its risk buffers.
Mumbai-based Bank of Maharashtra will call back the notes on March 17, ahead of their call dates in 2020 and 2021, a person familiar with the matter said.
The two securities carry a coupon of 9.48 percent and 11.6 percent, respectively, data compiled by Bloomberg show. Other mid-sized state lenders may follow suit as rising bad loans and falling profits make it harder to service interest on such notes, according to India Ratings and Research.