Internal controls

There have been recent lapses in bank internal controls that make it inappropriate for banks and the BSP to claim the incidents are isolated. The latest case at Metrobank is the most shocking since the RCBC money laundering case happened.

Metrobank and the BSP must explain to the public: What happened to Metrobank’s internal controls? Are other banks just as vulnerable? Should banking laws be tightened?

And with due respect to the point raised by newly installed BSP Deputy Governor Chuchi Fonacier that the banking system is “well-capitalized” anyway, frequent breaches of bank internal controls indicate something is wrong and begs for attention.

The Metrobank case was discovered just a week after a similar case at Union Bank. Even if the amount in the Union Bank case is a lot smaller, it also involves a bank officer fiddling around with bank rules involving “unauthorized cash transfers.”

One of my Facebook friends wondered if it is time to have resident regulators in bank premises. Writing from New York, he said “here regulatory agencies have permanent posts physically located within the bank and have entitled access to all critical systems. IT/Ops systems are regularly tested for fraud and breach. That’s not available there in Manila and probably won’t be intentionally.”

NBI spokesman Ferdinand Lavin summed up my feelings rather well: “The biggest loss on this is the integrity of the banking system and the internal control system of the bank.”

I am not sure if I am typical of bank clients, but I was unnerved by the ease by which the Metrobank and Union Bank officers managed to commit their transgressions. My bank accounts are puny but that does not exempt me from being targeted by a bank official up to no good.

The Metrobank case is all the more worrisome because it involves a highly placed officer who has been with the bank for some 30 years. One wonders, how long has she been doing this? Is she a “lone wolf” or did she have accomplices within the bank? Are figures mentioned, possibly in the vicinity of P2.5 billion, all that’s involved?

The NBI findings are serious. By forging signatures and breaching bank protocols, the Metrobank official was able to establish two bogus corporate loan accounts worth P950 million and P850 million.

 The Metrobank official supposedly tried to mask the fraudulent loans as drawdowns from a legitimate P25-billion credit facility available to a true corporate client, Universal Robina Corp. (URC), according to the NBI.

She was caught after allegedly directing the issuance of a manager’s check to an individual, a “red flag” because such checks are issued only to corporate clients, the NBI agent on the case revealed.

 “There were irregularities in the documents itself, indicating falsification such as different fonts, dubious signatures. The bank conducted an internal inquiry, confirmed that much to their dismay, such loans were unknown to the client,” he said.

 In the Union Bank case, Rappler reports that Union Bank itself, during its routine check, found out that a bank officer made an unauthorized cash transfer last June 30 amounting to P17.03 million from its cash center in Ortigas, Pasig City to its cash center in Caloocan City.

The BPI case, while it also involved inadequate internal controls, at least didn’t have any criminal intent on the part of the bank officer. It was plainly a mistake an overeager systems officer made that caused the bank’s system to go down.

In the RCBC case, for which the bank was fined P1 billion, there appears to be criminal intent in the creation of fictitious accounts by a lower level bank officer a year before the crime happened. Senior officials from the bank president to the vice president in charge of treasury operations lost their jobs for failure to catch the anomaly. Again, systems failure… inadequate internal controls.

Ironically, all these bank systems problems are happening as new BSP Governor Nesting Espenilla assumes control. Supervising the banking system has been Gov Espenilla’s life work. If there is a regulator who can fix the system, it will be Nesting. A new Monetary Board member who had been a long time Metrobank official has also just taken office.

But for BSP to fix things, they must recognize the system failures are not isolated cases. The Bankers Association of the Philippines (BAP) has to do a lot better than to say, as the BSP did, that what happened at Metrobank is an isolated case.

One case is isolated. Two, three and four cases are not. And no one knows if there are undiscovered fraud cases going on elsewhere. These seem serious enough to require an industry wide review of our banking system’s internal controls.

Motherhood statements about how “banks have established internal controls and systems to help prevent crimes of this nature from happening” sound hollow once a crime of this nature has happened. Issuing this statement as they did is funny, if only it isn’t pathetic.

 The BSP and the banking industry must work together to institute an honest review of their internal control systems and fix what ought to be fixed.

Indeed, there may be a need for resident BSP auditors empowered to constantly test the internal control systems of the banks. In this digital age, we all have to be steps ahead of digitally inclined criminals as we all saw in the Bangladesh Central Bank case.

Trust in our banking system is very important. And by choosing to keep discussion of problems in their internal controls quiet, the public can only let their imaginations run.

We don’t want to hear motherhood statements. We want to hear credible assurances, backed by actual things being done to earn our continued trust.

Should bank officials be subjected to lifestyle checks? Should their private accounts be open to the AMLC for regular evaluation? That should be a small price to pay for the privilege of being a banker the public can reasonably trust.

The announcement that AMLC may review the accounts of the MetroBank official is too late… the damage has been done. A high living bank officer receiving a mere P250,000 a month salary should have rung alarm bells in a properly set AMLC monitoring system. That case seems to tell us that tough measures are called for.

Boo Chanco’s e-mail address is [email protected]. Follow him on Twitter @boochanco.