Regulators are taking fraud more seriously

The Financial Services Authority (FSA) appears to be upping the ante when it comes to insider trading by seeking to prosecute two City lawyers who are accused of illegally trading shares based on non-public information.

A corporate partner of US law firm Dorsey & Whitney and a former partner at Will & Emery are both being prosecuted for trading shares related to the takeover of Neutec Pharma by Swiss conglomerate Novartis.

Police have also arrested two men over a suspected fund management fraud worth more than £50 million after the FSA earlier froze the operations of three firms - Business Consulting International, John Anderson Consulting and Kenneth Peacock Consulting - which are alleged to have mishandled millions in investors' money.

Criminal lawyers have also warned that the Serious Fraud Office is also taking the issue of corporate bribery and corruption more seriously and we understand that legislation is pending regarding the seizing of corporate assets in bribery and corruption cases.

Banks in the firing line for misleading investors

In the wake of the credit crunch a number of banks are in the firing line as investors allege that they were misled concerning the purchase of particular financial instruments or the true state of the bank's financial situation.

A class-action lawsuit was launched against the Royal Bank of Scotland (RBS) in the US earlier this year based on allegations that the bank misled investors by failing to disclose the damage caused by debt securities on its balance sheet, as well as the damage caused by the acquisition of ABN-AMRO, and its inadequate capital buffer to safeguard it against subprime losses.

RBS, which is now majority owned by UK taxpayers, suffered the biggest loss (in excess of £24 billion) in corporate history back in February, has been a high profile victim of the subprime meltdown. But it is not the only bank in the firing line over misleading investors.

Italian police are also reported to have seized $630 million worth of assets belonging to Deutsche Bank, UBS, Depfa Bank and JP Morgan as part of an investigation into an alleged fraud against Milan's city authority.

The alleged fraud dates back to 2005 when Milan's city authority was sold derivatives contracts linked to a bond issue. According to the allegations the banks failed to adequately inform the authority of the risks linked to the derivatives and "falsely claimed" the authority would save money.

Losses for the authority are estimated to be in the region of €300 million , although it could be more. The banks however pocketed more than €100 million in" illicit profits", according to the allegations.

It will be interesting to see if the authorities can prove that the banks deliberately misled the city authority, as the lack of suitable reference data surrounding some derivatives contracts and the subsequent emergence of a less favourable interest rate environment, may make it difficult to establish whether the banks intentionally set out to defraud the authority.

Corporate bribery

Former investment banks are in the spotlight again, this time relating to allegations of corporate bribery.

According to a report in the Financial Times, Morgan Stanley's global head of real estate investing has been suspended following disclosure of a Securities & Exchange Commission (SEC) filing that indicates a China-based employee violated the foreign corrupt practices act.

Morgan Stanley was a major investor in Chinese real estate, a sector which is believed to be plagued by bribery and corruption. A number of fraud and risk specialists I have spoken to in recent weeks have highlighted increasing reports of corporate bribery and corruption where business contracts are awarded on the basis of financial rewards.

In the US and the UK corporate bribery can attract substantial fines, which often exceed the initial bribe. According to Kroll's 2008-2009 Global Fraud Report, regulatory and compliance breaches increased from 19% to 25%.

Banks reveal exposure to alleged fraud

The financial papers are abuzz with the news of leading European banks' exposure to the alleged fraud committed by Bernard Madoff of Bernard L. Madoff Investment Securities, headquartered in the US.

HSBC, RBS, Spain's Santander and France's BNP Paribas reportedly have varying levels of exposure to Mr Madoff's "alleged $50 billion pyramid scheme", which according to the Financial Times, prosecutors allege operated on the basis of paying old investors with money raised from new investors.

RBS, a recipient of the UK government's bail out package in October, reported a potential exposure of £400 million to the alleged pyramid vehicle. According to the Financial Times report, HSBC's potential exposure may be considerably higher (approximately $1 billion). Not good news at a time when banks are already experiencing a significant reversal of fortunes thanks to their exposure to subprime assets. And with counterparty risk high on everyone's agenda, this revelation will come as yet another blow for an already beleaguered banking industry which is likely to face some pointed questions from investors regarding the due diligence they undertook before placing money with Bernard L. Madoff.

It appears that the regulators (in this case the US Securities and Exchange Commission) have also come under fire for ignoring early warning signs pertaining to Bernard L. Madoff Investment Securities. If there had been no credit crisis, then perhaps Madoff's alleged "pyramid scheme" would never have come to light. It also highlights the increasing number of links being made between fraud and the credit crisis.

Before the Madoff incident, a couple of Bear Stearns hedge fund managers were arrested on securities fraud charges and since the subprime meltdown, the US Federal Bureau of Investigation has launched investigations into the collapse of Lehman Brothers, the insurer AIG, and mortgage providers Fannie Mae and Freddie Mac.

According to newspaper reports, the FBI is investigating whether these firms unduly influenced agencies to "inflate" their ratings. It is also looking at whether these firms misled investors about the true state of their assets. The FBI is also believed to be investigating a number of firms over what it terms "subprime lending practices".

The following is taken from a Financial Crimes Report published in 2007 by the FBI and alludes to the potential for fraud in light of the subprime meltdown:

"As publicly traded subprime lenders have suffered financial difficulties due to rising defaults, analyses of company financials have identified instances of false accounting entries, and fraudulently inflated assets and revenues. Investigations have determined that many of these bankrupt subprime lenders manipulated their reported loan portfolio risks and used various accounting schemes to inflate their financial reports. In addition, before these sub prime lenders' stocks rapidly declined in value, executives with insider information sold their equity positions and profited illegally."

The FBI's 2007 Financial Crimes Report shows that the incidence of pending cases related to corporate and securities and commodities fraud has been steadily increasing every year since 2003. The Serious Fraud Office in the UK is also reported to be targeting corporate fraud in the wake of the crisis, calling on bankers and City "whistle blowers" to come forward with any information.

A rogue trader's view on the credit crunch

Posted by Anita Hawser

Ex-rogue traders have a habit of crawling out of the woodwork in the midst of one of the worst collapses of the global financial system. Former rogue trader, Nick Leeson whose "unsupervised speculative trading" resulted in the collapse of the UK's Barings Bank in 1995, was speaking at a conference of European corporate treasurers in Barcelona recently.

Reminiscing about the good old days as an unsupervised derivatives trader in Singapore, Leeson leveled significant blame for the global credit crisis at central banks and the regulators, who he says don't understand the markets or risks they are supposed to be regulating.

"There is plenty of risk, but no one managing it," said Leeson. "After Barings there were new regulations by the Bank of England and they spoke about responsible lending, but it clearly hasn't happened."

As the financial system now has to grapple with the concept of heightened global regulation, Leeson suggests that central banks may not be the best candidates for enforcing these regulations. "Central bank understanding is very poor," he said. In his days as a derivative trader for Barings in Singapore, Leeson said the Singapore Monetary Exchange did not have people that understood the business.

"The monetary exchange knew my position. They had a process of non-disclosure but all they had to do is look up the rates on Bloomberg and see what my [total] position was. If they had done that they would have seen that I risked the capital of the bank." In 1994 Barings was capitalised at $250 million and Leeson had $500 million in Singapore.

Although the subprime crisis, which triggered the credit crunch has been attributed to the lack of transparency and complexity of mortgage-backed collateralised debt obligations, Leeson says it is not the instruments that are the problem. "It is the people operating them. Some of the biggest banks employ the best mathematicians, but their risk calculations haven't worked."

Leeson said he got away with so much during his time at Barings because management of the bank did not deem themselves to be in a position to challenge him - in other words they did not understand the markets he was investing in so he was pretty much given free reign as long as he was bringing in profits for the bank.

While rogue traders have not been directly linked to the credit crunch, the exposure of the $7 billion in losses Jerome Kerviel racked up at Societe Generale came at a time when the crunch was starting to bite and highlighted the precarious risk-taking counterculture within investment banks - some traders were literally betting the bank and getting away with it if those bets paid off. " Jerome Kerviel was a shock to me," said Leeson. "He was given far too much autonomy for a junior trader."

An 'inside' job

Posted by Anita Hawser
It's official. As we have all suspected for some time the "external bogeyman" is not the biggest fraud threat companies face. It is internal fraud, which is resulting in the largest losses, says the Association of Certified Fraud Examiners (ACFE).

Research company, Financial Insights, highlights some interesting findings from a 2004 ACFE study which found that more than 80% of internal fraud cases were committed not by "career criminals" but by first time offenders. No surprises then given recent incidents at banks like Société Générale, and a host of others, that subsequent ACFE studies have found that banks are the biggest victims of internal fraud.

According to ACFE’s 2008 Report to the Nation on Occupational Fraud & Abuse, the internal rate of fraud loss has increased to 7% of annual turnover for all companies. FinInsights cites two examples of internal fraud: SME Bank in Thailand, which included 27 loan cases involving fraud and corruption; and the rogue trading incident at Société Générale where more than 1,000 fraudulent transactions, dating back to 2004, were concealed.

The fact that these transactions at both banks bypassed internal controls and procedures, not only suggests that internal fraud controls are inadequate, but that firms have spent far too much time safeguarding the enterprise from "external bogeyman" and not from Joe Bloggs in accounts.

FinInsights then went on to outline some best practices in internal fraud control:

• Establishing controls that reduce the opportunity for unauthorised use of organisational resources (firewalls, email scanning, ID access - most banks already have these)

• Providing sufficient employee monitoring, segregating duties for operational processes, and regularly rotating staff in key positions
  

• Thorough recruitment screening and educating employees about the legal repercussions of being involved in illegal activities to act as a deterrent (not so sure about this one as in the case of traders, it is known that they are not out to make money for themselves necessarily but for their company. Are they the kind of people investment banks want to screen out?)

• Automated detection systems and advanced analytic technologies that look for suspicious behavior and anomalous patterns (problem with this is that technology can only do so much. If no one responds to the alerts, the technology is useless)

• Financial institutions need to define and understand the layout of internal data and the business process data flows in order to determine the necessary sources of and data feeds for fraud solutions (highly complex given that data and business processes tend to be 'siloed' within most banks)
  

• Educating both employees and upper management on security

• Establish accountability and ownership for lax security procedures

• Reprimand staff for breaking or failing to follow security protocol, even minor violations
  

• Providing confidential and easy-to-use channels of communication for whistle blowers

So in other words, fighting internal fraud is not easy. It is not simply a case of putting up a perimeter fence and installing software that recognises unusual behaviour patterns. That is only the tip of the iceberg, and in the end educating people is likely to be more effective than a piece of technology on its own.

Is rogue trading endemic?

Traditionally, most companies at the frontline of fighting fraud secured their 'perimeter fence' using firewalls, secure passwords and access tokens. All of these measures were largely designed to thwart an external threat or attack.

However, in recent years, the threat from within or from employees, be it accidental or malicious, is increasingly keeping company CEOs, risk managers and security experts awake at night. Recent rogue trading incidents only serve to remind companies, particularly banks, that often the greatest threat when it comes to fraud is from a 'trusted' employee.

French bank, Société Générale, made headlines earlier this year when fraudulent trades totaling $7.1 billion were racked up allegedly by a single trader. There have been other rogue trading scandals, most notably Nick Leeson and Barings Bank in 1995.

But incidences of rogue trading are not as isolated as company CEOs would like to think. Recently, Morgan Stanley announced that a London-based credit derivatives trader hit them for $120 million, and just last week the subprime mortgage crisis in the US resulted in two former Bear Stearns' hedge fund managers being arrested on securities fraud charges.

According to anti-fraud and compliance vendor, Actimize, there have now been five major(more than $100 million)rogue trading incidents reported in 2008? According to its Rogue Trading Peer Review, 50% of respondents estimated that thousands to millions of dollars of rogue trading activities go unreported every year at their firms and 24% said that they had experienced a case of trading fraud at their firms in the last year.

The reputational risk from such events appears to be such that financial services firms are not even reporting these incidents. That makes it difficult for fraud, risk and security experts to do their job properly if there is not recognition at boardroom level that internal fraud is occurring.

The threat from within is perhaps the greatest challenge the financial services industry faces, and combating it is not as straightforward as thwarting an external attack. No amount of firewalls and secure passwords can prevent a determined bonus hungry trader from overriding internal controls to perpetrate a fraud, nor is it going to help prevent the rise of a corporate culture that has a tendency to turn a blind eye to traders looking to boost theirs' and the company's profits by 'gambling' with investors' money.

One company I spoke to recently about internal fraud, pointed to multi-factor authentication as a means of combating it. They said users could set up a policy that says once a user has securely authenticated to a network, or once they launch a particular application, it may ask for another form of authentication such as a fingerprint or biometric. So in this example, a trader would need to swipe their fingerprint whenever a trade is conducted. Even if the trader was able to create “multiple accounts,” the fingerprint would provide an audit trail.

That may be one way of combating rogue trading, but the question is how far do companies go in implementing effective anti-fraud measures that do not make it more difficult, time consuming or onerous for employees or traders to perform legitimate business activities. It is a delicate balance to strike.
Posted by Anita Hawser