18 February 2023
Operational Risks Bulletin
Operational Risks and Insurability November / December 2022 Operational Losses Bulletin
Technical Director, Tom Falcon, of the Gallagher Specialty Financial Institutions team gives his commentary on the insurability of recently reported, large, operational risk events. Each month Risk.net issues details of the top five events and we consider the relevance of insurance and the extent to which coverage is available.
Wells Fargo to pay and remediate USD 3.89bn over consumer abuses across product lines
LOSS AMOUNT
USD 1.7m
BUSINESS LINE
Retail Banking
EVENT TYPE
Suitability, Disclosure and Fiduciary
RELEVANT POLICIES
Professional Indemnity
A USD 1.7 billion fine has been levied against Wells Fargo for violations across numerous product lines and widespread management failures in relation to car loans, mortgages and deposit accounts. The fine is the largest ever imposed by the US Consumer Financial Protection Bureau. According to the CFPB, from at least 2011 to 2022, the bank engaged in unlawful activities affecting more than 16 million customer accounts. These included: repeatedly misapplying loan payments; incorrectly assessing fees and interest; charging unexpected overdraft fees; freezing more than 1 million accounts based on a faulty automated fraud filter; improperly denying thousands of mortgage loan modifications, which led to wrongful foreclosures; and unlawfully repossessing borrowers’ vehicles. In addition to issuing the USD 1.7 billion penalty, the CFPB ordered Wells Fargo to provide USD2.19 billion in redress to customers who had suffered harm.
The bank has already paid billions to settle class actions and to reach a deferred prosecution agreement with the US Department of Justice (DoJ).
Fines are rarely insurable (due to public policy reasons and regulatory prohibition). However, a well drafted policy should provide coverage for costs incurred in responding to non-routine regulatory investigations into the provision of professional services. Redress payments to customers will not be covered under professional indemnity insurance if such payments constitute disgorgement: almost all professional indemnity policies have some form of disgorgement exclusion.
Danske Bank to pay USD 1.39bn penalty to US authorities over AML measures in Estonia
LOSS AMOUNT
USD 1.39m
BUSINESS LINE
Commercial Banking
EVENT TYPE
Improper business or market practices
RELEVANT POLICIES
Professional Indemnity
Danke Bank must pay USD 1.39bn in forfeiture, fine, disgorgement and confiscation levied by the DoJ, the US Securities and Exchange Commission and Denmark’s Special Crimes Unit for anti-money laundering (AML) failures at its Estonia subsidiary. Between 2008 and 2016, the bank offered banking services through Danske Bank Estonia, whose non-resident portfolio generated more than 50% of the subsidiary’s profits. These customers conducted dollar transactions that were processed through US banks. Danske knew by December 2013 that the portfolio was high-risk – the Estonian subsidiary addressed Danish, Estonian and Russian regulators’ concerns by confirming that it had a deliberate policy of attracting high-risk customers and had established corresponding AML practices.
The investigations found that Danske Bank Estonia’s compliance programme was inadequate, and allowed customers to transfer large sums with little oversight. The bank’s staff assisted customers in concealing beneficial ownership by establishing accounts and even creating shell companies for them.
Danske had misrepresented the state of its subsidiary’s AML compliance programme and risk profile to the US banks with which it held dollar accounts – this enabled the subsidiary to facilitate USD160 billion in transactions on behalf of customers between 2007 and 2016. Danske carried out a review of the subsidiary in 2013 that identified red flags, but which nevertheless concluded that the non-resident portfolio’s compliance processes were excellent. Although the bank began to wind down the non-resident portfolio, it still processed USD40 billion of additional transactions through the US between 2014 and 2016, when the portfolio was finally closed.
Fines are rarely insurable (due to public policy reasons and regulatory prohibition). However, a well drafted policy should provide coverage for costs incurred in responding to non-routine regulatory investigations into the provision of professional services.
Bankrupt FTX suffers alleged hack, resulting in losses of up to USD 477m
LOSS AMOUNT
USD 477m
BUSINESS LINE
Cash Clearing
EVENT TYPE
External Theft and Fraud
RELEVANT POLICIES
System Security External – Wilful Damage
During FTX's recent bankruptcy proceedings, which started on November 11, reports surfaced that it had been hacked for up to USD659 million – later revised downwards to USD477 million. The sudden outflow of cash was tangled up with its attempt to transfer all funds into offline storage as part of its bankruptcy. FTX’s woes came to light on November 2, with news of potential conflicts of interest and transfers of client funds between FTX and trading firm Alameda Research – both owned by former billionaire Sam Bankman-Fried. Combined with a failed takeover attempt by the Binance exchange, the news sent the FTT token, upon which both firms relied, into a downward spiral and ultimately led to the collapse of FTX.
In place of Bankman-Fried, John Ray, who oversaw Enron’s bankruptcy as chief executive officer, was appointed to perform the same task for FTX. In a statement filed on November 17, as part of the bankruptcy proceedings, Ray said that he had never encountered “such a complete failure of corporate controls and such a complete absence of trustworthy financial information”. The circumstances surrounding the hack and FTX’s collapse have prompted extensive speculation that Bankman-Fried and his associates may have orchestrated the transfer for their own benefit.
Crime insurance for cryptocurreny exchanges and custodians is available in the London market. The core coverage focuses on the theft of physical codes (aka 'cold storage') and the theft of digital assets that are held online (aka 'hot storage').
FTX Failure: what does it mean for the insurance market?
The failure of FTX has seemingly had a profound impact on investor confidence in cryptocurrencies. One big question in an insurance context is whether insurers in the space will suffer a similar loss of confidence, resulting in the cryptocurrency insurance market contracting. For almost a decade insurance solutions have been available for the cryptocurrency industry. Policies have mostly been written in London and usually provide coverage for Crime and D&O and, to a lesser extent, professional indemnity. FTX’s collapse is a fast moving story. However, what seems almost certain is that its directors have incurred significant legal fees in responding to the various legal challenges they are facing. We presume that FTX had purchased some form of D&O insurance. If so, it is likely that the insurance will be responding to the payment of legal fees, notwithstanding any allegations of fraud. In such circumstances, significant limits of liability can be exhausted in short time. In addition, there appears to a real risk of contagion for other cryptocurrency businesses, which may result in their insurance policies being impacted. Therefore the FTX collapse has the potential to result in a significant loss for cryptocurrency insurers.
To date we are not aware of a significant loss of confidence on the part of insurers. Indeed we do not expect there to be a significant withdrawal of insurer capacity from the cryptocurrency space. However, it is very likely that insurers will be significantly more wary of certain risks. With that comes greater scrutiny and, in some cases, increased pricing. So, going forward we expect insurers to be particularly stringent in their underwriting criteria for certain types of cryptocurrency businesses and premium increases may be inevitable for some.
Glencore to pay GBP 162.3m to UK regulator over African bribery and corruption scheme
LOSS AMOUNT
USD 197.2m
BUSINESS LINE
Global Markets
EVENT TYPE
Improper Business or Market Practices
RELEVANT POLICIES
Directors' and Officers' Liability Insurance
Swiss commodity trader Glencore has been fined GBP 281 million by the UK Serious Fraud Office. The firm was charged with running a bribery scheme spanning multiple African countries, for which it had already settled with US regulators in May this year. US authorities credited a portion of the May penalty against that of the SFO, reducing Glencore’s recorded UK fine to GBP 162.3 million. After a three-year investigation, Glencore admitted to and was convicted on seven counts of international bribery on June 21. The investigation revealed that Glencore’s London-based West Africa desk operated a USD 29 million bribery scheme in Equatorial Guinea, Côte d’Ivoire, Nigeria, Cameroon and South Sudan. Glencore used local middlemen to make payments into state-owned oil companies and government ministries, and variously recorded the withdrawals as either a ‘service fee’, a ‘signing bonus’ or a ‘success fee’. Some of the funds were recorded as operating expenses for the firm’s South Sudan office, despite limited evidence of any office existing there.
On occasion, Glencore executives would even fly cash over in private jets to pay local government officials and national oil and gas companies. The conviction includes the first-ever use of substantive bribery offences for a company, indicating that senior individuals at Glencore had authorised the bribery. A number of individuals, including business ethics officers and members of Glencore’s business ethics committee, were still under investigation as of November 3.
Fines are rarely insurable (due to public policy reasons and regulatory prohibition). D&O insurance will provide coverage for legal costs incurred by directors and officers in responding to criminal investigations into their conduct. However, no coverage will apply for an individual where established by a court or other decision making body that his or her conduct was dishonest or fraudulent.
Santander fined GBP 107.8 million by UK’s FCA over AML failures affecting business customers
LOSS AMOUNT
USD 131.6m
BUSINESS LINE
Retail Banking
EVENT TYPE
Monitoring and Reporting
RELEVANT POLICIES
Professional Indemnity Insurance
UK authorities have fined Santander for failures in AML controls between 2012 and 2017. The bank demonstrated difficulties with identifying money service businesses (MSBs), which often pose higher money-laundering risks, in its portfolio. Its system was unequipped to manage AML responsibilities with regard to MSBs as functions were divided between various teams that struggled with information sharing. Santander had weaknesses in its due diligence and onboarding processes. It failed to obtain sufficient information from customers, and the bank’s risk ratings were often inaccurate. The bank’s automated transaction monitoring system was insufficiently sophisticated and failed to consider important information for customer accounts, such as predicted annual turnover.
Santander’s suspicious-activity reporting unit was also ineffective due to resourcing pressures. Although it took action to monitor any transactions its system had deemed high-risk, it considered all business banking customers to be medium-risk. The UK’s Financial Conduct Authority (FCA) conceded that there had been attempts to improve account closure processes during the period in question, as Santander had been aware of its AML issues since December 31, 2012. The bank made changes to its AML operating model and processes, but these also proved insufficient, and the underlying weaknesses persisted.
Fines are rarely insurable (due to public policy reasons and regulatory prohibition). However, a well drafted policy should provide coverage for costs incurred in responding to non-routine regulatory investigations into the provision of professional services.
Academy Mortgage pays USD 38.5 million to settle claims of improper mortgage underwriting
LOSS AMOUNT
USD 38.5m
BUSINESS LINE
Retail Banking
EVENT TYPE
Improper Business or Market Practices
RELEVANT POLICIES
Professional Indemnity Insurance
Academy Mortgage Corporation has agreed to pay USD 38.5 million to resolve allegations by the DoJ that it had violated the US False Claims Act by improperly originating and underwriting mortgages insured by the Federal Housing Administration. The FHA insures mortgages, and pays the lender if a homebuyer defaults on one. The settlement resolved a lawsuit filed in April 2016 by Gwen Thrower, a former Academy underwriter, on behalf of the DoJ under the False Claims Act’s whistleblower provisions. Thrower alleged that, from January 2008 to April 2017, Academy had encouraged employees to disregard FHA rules and falsely certify compliance with underwriting requirements – this, she claimed, resulted in the US government paying insurance claims on loans that Academy knew were improperly written.
Thrower said Academy pressured its underwriters to approve ineligible loans via false annual and loan-level certifications and to ignore risks for certain applicants who were likely to default. She also claimed it paid commissions to underwriters for approved loans, thus creating a toxic culture. The regulator repeatedly tried to dismiss the suit, which was eventually settled on December 14. Thrower received USD 11.5 million of the proceeds.
Fines are rarely insurable (due to public policy reasons and regulatory prohibition). However, a well drafted policy should provide coverage for costs incurred in responding to non-routine regulatory investigations into the provision of professional services.
Denmark records zero bank robberies in 2022
At first glance that is a startling statistic, given back in 2000 there were 221 bank robberies in Denmark. However, when various factors are considered it is perhaps unsurprising. According to Finance Denmark, only about twenty bank branches across the country have cash holdings. Further, cash withdrawals in have been dropping by about three-quarters every year for the past six years. Whilst bank robberies are undoubtedly declining in certain parts of the world, they are by no means a thing of the past. For example, 1,724 were recorded in the USA in 2021, albeit that is down from a peak of 9,338 in 1991. Indeed research suggests that bank robbery is simply not as lucrative as it once was. The typical bank robber in the USA made away with about USD 5,200 in the late 1960s. That's around USD 40,000 today. But in 2019, the average was just USD 4,200. Perhaps the biggest reason for the decline is that cyber heists are now far more lucrative, do not involve physical risk and the prison sentences are lighter. Indeed a 2016 USA government report showed that convicted credit card offenders took in over USD 60,000 on average and were given a prison sentence of just over two years (compared to an average sentence of fifteen years for armed robbery).
Crime insurance has always responded to the robbery of cash and other valuable physical items and continues to do so. However, over the last twenty years there has been a greater emphasis on the coverage for theft of funds via electronic means. Indeed most crime policies will now cover a range of electronic theft and fraud, including impersonation fraud via email and telephone and various forms of hacking and malware resulting in the misappropriation of funds.
Commonwealth Bank of Australia agrees to pay AUSD 50m to settle class action claims it mis-sold consumer credit insurance
LOSS AMOUNT
USD 33.5m
BUSINESS LINE
Retail Banking
EVENT TYPE
Suitability, Disclosure and Fiduciary
RELEVANT POLICIES
Professional Indemnity
Commonwealth Bank of Australia (CBA) has settled class actions over the sale of consumer credit insurance. On June 10, 2020, Slater and Gordon filed a class action lawsuit against CBA, alleging the bank had misled customers over the value of the policies, and had led them to believe that consumer credit insurance (CCI) was compulsory. Specific details of the allegations were unclear as the complaint was under seal as of November 14, 2022. But, according to the law firm, many CBA customers were unaware they would be ineligible to make claims on such insurance as they were unemployed or had pre-existing health conditions at the time that they signed up for CCI.
The repayment of premiums for consumer credit insurance will not be covered under professional indemnity insurance as such payments are very likely to constitute disgorgement: almost all professional indemnity policies have some form of disgorgement exclusion. If part of the settlement of the class actions represents compensatory payments, then it is possible for that element to be covered under professional indemnity insurance.
Australia and New Zealand Banking Group agrees to pay AUSD 42m to settle class action claims it mis-sold consumer credit insurance
LOSS AMOUNT
USD 28.1m
BUSINESS LINE
Retail Banking
EVENT TYPE
Suitability, Disclosure and Fiduciary
RELEVANT POLICIES
Professional Indemnity Insurance
Australia and New Zealand Banking Group (ANZ) has settled class actions over the sale of consumer credit insurance.The bank’s credit card insurance policies offered numerous benefits covering inconvenience, family trauma, total and permanent disability, critical illness and accidental death. But the bank set strict eligibility criteria for claiming these benefits that resulted in a claims ratio of 6.9% for ANZ credit card insurance policies. In some instances, customers were in fact unaware they had consented to the policies or that they would be charged.
The repayment of premiums for consumer credit insurance will not be covered under professional indemnity insurance as such payments are very likely to constitute disgorgement: almost all professional indemnity policies have some form of disgorgement exclusion. If part of the settlement of the class actions represents compensatory payments, then it is possible for that element to be covered under professional indemnity insurance.
Former Radiotechbank chairman charged with embezzling 1.8 billion rubles through fictitious loans
LOSS AMOUNT
USD 26.2m
BUSINESS LINE
Commercial Banking
EVENT TYPE
Internal Theft
RELEVANT POLICIES
Employment Practices, Liability Insurance
From an unspecified date in 2018 until January 2019, Radiotechbank's then chairman, Alexander Stepanov, approved 1.8 billion rubles of irrecoverable loans. According to Russia’s Federal Taxation Service, Radiotechbank issued the loans to shell companies with nominee managers who agreed to sign relevant documents in exchange for monthly fees of 5,000–20,000 rubles. The bank entered into loan agreements with companies controlled by Stepanov’s co-conspirators. The loans’ ostensible purpose was to finance the purchase of equipment or replenish working capital. However, investigators found the companies had not submitted any tax returns and did not occupy the addresses at which they were registered. The borrowers did not have sufficient collateral to receive the loans, so Radiotechbank allowed other opaque companies to enter into surety agreements with them. The bank then assigned rights of claim to the guarantor companies, which enabled the borrowers to increase their credit limits, and approved the loan agreements.
In some other cases, outstanding debt was simply written off as part of the fraud. Stepanov was sentenced to one year in a penal colony for orchestrating the embezzlement. The Russian Deposit Insurance Agency attempted to retrieve 5 billion rubles from him and a group of former managers and shareholders, although a court rejected its lawsuit.
Crime insurance provides coverage the misappropriation of funds by employees. However, where senior individuals are involved, coverage can be challenging as most policies exclude theft by directors (unless they are acting in an employee capacity). This particular loss involves a Russian bank - insurers in the London market now require policies to include a specific exclusion applying to any assets, entities or persons located in Russia. In addition, insurers will not make payments that breach international sanctions.
Julius Baer fined GBP 18m for control failures concerning improper fees paid to finders
LOSS AMOUNT
USD 21.9m
BUSINESS LINE
Global Markets
EVENT TYPE
Improper Business or Market Practices
RELEVANT POLICIES
Professional Indemnity Insurance
Julius Baer had a finder’s policy to compensate those who introduced clients to the bank, which was exploited by several bank employees to establish ties to companies in the Yukos Group. The group comprised several holding companies that owned the residual non-Russian assets of a Russian oil group that went bankrupt in 2006. Dimitri Merinson, a financial executive for several Yukos companies, acted as finder, liaising with Louise Whitestone, former relationship manager on Julius Baer’s Russian and eastern European desk. The two designed a finder’s agreement that would pay an outsized commission to Merinson, to be funded by charging Yukos commissions far in excess of the standard rate. Julius Baer’s relationship with Merinson lasted from 2009 to 2014, generating over USD3 million in finder’s fees for him.
The deals were done under the supervision of Whitestone’s managers, Gustavo Raitzin and Thomas Seiler, who enabled the relationship to continue in spite of the flags raised by the bank’s compliance function. The final decision notice against Julius Baer was issued on February 10, offering the firm a 30% early settlement discount. Whitestone, Raitzin and Seiler, by contrast, referred their decisions to the UK Upper Tribunal.
Fines are rarely insurable (due to public policy reasons and regulatory prohibition). However, a well drafted policy should provide coverage for costs incurred in responding to non-routine regulatory investigations into the provision of professional services.
Cyber ranks as the number one risk for businesses in 2023, according to major insurer
Cyber incidents rank as the top risk facing businesses around the world in 2023 for the second year in a row, according to Allianz’s 2023 Risk Barometer. In addition to ranking as the number-one risk globally, cyber events like IT outages, ransomware attacks, and data breaches captured the top spot in 19 different countries including the United Kingdom, Canada, India, France, Japan, and Spain. Cyber ranked as the second-most concerning peril after business interruption in the United States, Germany, Brazil, Singapore, and South Africa. 53% of respondents highlighted data breaches as their main concern, followed by ransomware at 50%. Allianz attributed this to the rising cost of breaches and tougher regulation around the world – a breach of sensitive information can result in significant notification costs, regulatory fines, litigation, and reputational damage. Rounding out the top 10 risks ranked by businesses around the world after cyber were business interruption, macroeconomic concerns; energy crises; legislative/regulatory changes; natural catastrophes; climate change; shortage of skilled workers; fire/explosion; and political risks and violence. Cyber ties into many of these risks, Allianz pointed out, particularly business interruption, regulatory changes, and shortage of skilled workers.
Cyber insurance is designed to respond to a wide range of cyber events, including ransomware attacks, data breaches and certain IT outages.
The Walbrook Building 25 Walbrook London, EC4N 8AW
Let's talk
Arthur J. Gallagher (UK) Limited is authorised and regulated by the Financial Conduct Authority. Registered Office: The Walbrook Building, 25 Walbrook, London EC4N 8AW. Registered in England and Wales. Company Number: 119013.