16 May 2024
Operational Risk & Insurability Bulletin
Technical Director, Tom Falcon, of the Gallagher Specialty Financial Institutions team gives his commentary on the insurability of recently reported large, operational risk events. Each month Risk.net issues details of the top five events and we consider the relevance of insurance and the extent to which coverage is available.
A majority shareholder of Saigon Joint Stock Commercial Bank embezzles VND304.10 trillion with the assistance of board members and executives
LOSS AMOUNT
USD 12.53bn
BUSINESS LINE
Commercial Banking
EVENT TYPE
Internal Theft & Fraud
RELEVANT POLICIES
Crime Insurance
Majority shareholder Truong My Lan controlled up to 91.5% of the bank’s shares, allowing her to install relatives, friends, and associates in key leadership roles at the bank.
Fraudulent loans, approved by complicit bank management, were reportedly issued to thousands of fabricated companies or individuals, then directed to Van Thinh Phat, a property development group chaired by Truong. Most of the loans were awarded first, then retroactively supported by fake loan applications, it’s alleged. The scheme was reportedly further enabled by complicit officials at asset valuation companies — who also falsely increased the asset values cited and certified the loans without inspection.
Authorities said Truong and the bank also colluded to bribe members of the State Bank of Vietnam’s inspection team with money and gifts. While Vietnam’s Ministry of Public Security didn’t announce the charges against Truong until November, a run on the bank had already occurred in October 2022, when Truong and bank executives were first arrested. Truong was sentenced to death by a Vietnamese court on 11 April for her role in the fraud.
Crime insurance provides coverage for employees committing loan fraud, provided it is proved they, or persons colluding with them, made a financial gain from the fraud. However, if directors are involved in fraudulent behaviour, then coverage becomes challenging as most policies exclude losses caused by fraudulent acts by directors
Binance pays USD4.32 billion to US regulators for extensive US sanctions and AML violations
LOSS AMOUNT
USD 4.32bn
BUSINESS LINE
Retail Brokerage
EVENT TYPE
Improper Business or Market Practices
RELEVANT POLICIES
Professional Indemnity Insurance
Binance pleaded guilty to a host of violations after a lengthy showdown with US authorities.
It entered into parallel settlements with the US Department of Justice (DoJ), the US Financial Crimes Enforcement Network (FinCEN), the US Office of Foreign Assets Control, and the US Commodity Futures Trading Commission over many incidents of illegal conduct. These include breaches of US sanctions, anti-money laundering (AML) failures and unlicensed money-transmitting activities, to name a few.
Despite being the world’s largest cryptocurrency exchange, with most of its customers based in the US, Binance did not have comprehensive Know Your Customer (KYC) protocols or systematically monitor transactions. Nor did it adequately review its systems or have qualified employees to oversee AML or KYC compliance. The exchange processed transactions associated with known terrorist organisations, cybercriminals, money launderers, child sexual abusers, dark web narcotics dealers, and other illicit actors, but never filed a suspicious activity report with FinCEN.
Instead of attempting to comply with US laws, specifically the Bank Secrecy Act, Binance had announced in 2019 that it would block all US customers and launch Binance.US, a separate US exchange. According to the DoJ, the real aim of this entity was to insulate the exchange against all US-based enforcement action, by using it as a decoy for its continued US presence. The exchange also failed to prevent US customers from transacting in sanctioned jurisdictions, encouraging clients to use virtual private networks to circumvent the exchange’s own geofencing controls.
Fines are rarely insurable (due to public policy reasons and regulatory prohibition). However, a well-drafted policy should provide coverage for costs incurred in responding to non-routine regulatory investigations into the provision of professional services
FTX Criminal Trials: D&O Insurance Takeaways
The collapse of the FTX cryptocurrency exchange has ended badly for its main directors and officers, with Sam Bankman-Fried (SBF) sentenced to 25 years in prison and other key players awaiting sentencing.
The criminal trial of SBF revealed some interesting points around FTX’s D&O insurance, primarily because he sued one of FTX’s excess D&O insurers for non-payment of legal fees in October 2023. SBF’s complaint showed that FTX had purchased USD20mn of D&O insurance, comprising of four towers of USD5mn. The primary and first excess insurers had acknowledged coverage and paid out defence expenses as incurred, up to their full limit of liability, but SBF alleged that the second-level excess insurer had failed to pay his defence expenses as incurred. Shortly after that, the former General Counsel of FTX Trading, Daniel Freidberg, filed a motion to intervene in SBF’s lawsuit. In his motion, Mr Freidberg alleged that it was unfair he had received nothing under the D&O insurance programme, while SBF and others had managed to exhaust the first two USD5mn towers. He alleged that the ‘first come, first served’ way the insurers had been paying defence costs was wrong and that the remaining insurers should distribute the limits of liability under the principle of ‘equitable allocation’. In the event, SBF dropped his lawsuit in November 2023, so the underlying complaint was never resolved. It does, however, seem likely that the final two excess insurers paid out their full liability for defence expenses given the amount of defendants involved and the fact that insurers earlier in the tower had acknowledged coverage and paid in full.
In our view there are three notable D&O insurance takeaways from the FTX collapse. First, the USD20mn of D&O insurance purchased by FTX was very likely to have been inadequate, leaving several FTX defendants without coverage for legal defence expenses. Indeed, in addition to the criminal trials against the main protagonists, there are also civil actions against other ex-FTX directors and officers brought by FTX’s new management and the trustee and bankruptcy, amongst others. Therefore, whilst FTX is a very extreme case, D&O limits should still be purchased with one eye on the worst-case scenario. Second, insurers are unlikely to recover their costs from the defendants that have been found guilty in the criminal trials. A key principle of D&O insurance is that coverage applies for legal costs in defending allegations of dishonesty or fraud. However, in the event that the insured person is found guilty, the insurer can seek to recover amounts it has paid on their behalf. Unfortunately for insurers, defendants found guilty in criminal trials are often bankrupt leaving insurers with no recourse. Third, many D&O policies work on a ‘first come, first served’ basis. If there is a requirement to use an alternative method, then specific language will probably need to be added to the policy — a point that should be discussed with your broker.
Source: LaCroix, Kevin. "FTX Legal Drama Includes D&O Coverage Fight", The D&O Diary, 8 November 2023
Lloyds Banking Group provisions GBP450 million over historical motor finance commission arrangements review
LOSS AMOUNT
USD 568m
BUSINESS LINE
Retail Banking
EVENT TYPE
Suitability, Disclosure, and Fiduciary
RELEVANT POLICIES
Professional Indemnity Insurance
Lloyds Banking Group has made a provision of GBP450mn against the impact of a UK Financial Conduct Authority review of historic motor finance commissions. The FCA announced its review of historic discretionary commissions on January 11, following a high number of complaints to the Financial Ombudsman Service.
Lloyds customers claimed compensation over unfair commission models that predated the FCA’s 28 January 2021 ban on discretionary commissions. The regulator found that the models encouraged brokers to increase the interest rates they charged to clients. Lloyds recognised the provision in its results for Q4 2023, while maintaining it had complied with regulations. Professional indemnity insurance does not provide coverage for the repayment of commissions. Almost all professional indemnity policies will have an exclusion in that respect (often described as a fees exclusion or a disgorgement exclusion). If a settlement involves both compensatory payments and the repayment of commissions, then the compensatory element should be insured under a professional indemnity policy, subject to the policy's terms and conditions.
CaixaBank customers defrauded of EUR110 million in malware phishing campaign
LOSS AMOUNT
USD 119m
BUSINESS LINE
Retail Banking
EVENT TYPE
External Theft & Fraud
RELEVANT POLICIES
Crime Insurance
CaixaBank customers in Spain were defrauded of EUR110mn (USD119.2mn) after being targeted in a malware phishing campaign by criminals in Brazil.
The Grandoreiro malware was a banking Trojan programme, designed for users with a Windows Operating System. Reports first emerged in October 2023 of it being used for electronic bank fraud in Spain. The hackers sent CaixaBank customers emails masquerading as court summonses, overdue bill collections, invoices and more, infecting victims’ computers if they opened or downloaded the attachments. The malware was able to phish for victims’ credentials via pop-up windows, log keystrokes, and block local viewing to prevent being discovered.
Crime insurance for banks provides coverage for various forms of electronic fraud, including the fraudulent transfer of funds from customer accounts via hacking, so-called pull payment fraud. However, coverage for customers themselves transferring funds out of their accounts in reliance on fraudulent communications, pull payment fraud, is challenging.
Deepfakes Drive Rise in Fraud Fears
For the first time in two years, external fraud reentered Risk.net’s Top 10 Operational Risks in 2024, jumping in at 9th place.
The range of external fraud that worried the institutions surveyed by Risk.net varied from basic customer impersonation to some more elaborate schemes involving new generative artificial intelligence (gen AI) capabilities. Most operational risk managers that Risk.net spoke with, mentioned the rise of AI and fraudsters’ ability to use more complex tools and methods as a reason for growing concerns around external fraud. In February, a multinational firm in Hong Kong was defrauded of USD25mn, transferred by an employee supposedly at the behest of their chief financial officer on a video call. But the CFO turned out to be an AI-generated deepfake. Indeed, fraud losses arising from deepfake technology have been around for a while — in 2020 it was reported that a UAE bank was tricked into transferring USD35mn to fraudsters using AI voice cloning. The fraudsters had deepfaked the voice of a bank executive to dupe a bank manager. Crime insurance is designed to respond to various forms impersonation fraud, including the impersonation of trusted parties (e.g., customers) via telephone or electronic communications. Many policies will require an authentication process to have been carried out by the insured for coverage to apply. The policies providing the widest coverage will not include that requirement. Impersonation fraud via video utilising deepfake technology is undoubtedly a new development. We believe that crime policies should respond to such fraud via the coverage for impersonation via electronic communications. However, we are investigating the inclusion of specific coverage for impersonation fraud via video in our policies.
Source: Top 10 op risks: deepfakes drive rise in fraud fears - Risk.ne
TD Bank settles USD95 million with victims of TelexFree ponzi scheme
LOSS AMOUNT
USD 95m
BUSINESS LINE
Commercial Banking
EVENT TYPE
Sustainability, Disclosure, and Fiduciary
RELEVANT POLICIES
Professional Indemnity Insurance
TB Bank agreed a USD95mn settlement, approved by a Massachusetts court, to compensate victims of the TelexFree Ponzi scheme, which defrauded approximately 2mn supposed investors worldwide.
The USD3bn scam is believed to be, by sheer number of those affected, one of the largest frauds ever carried out. TD Bank first opened a deposit account for TelexFree in September 2012. The operator was immediately flagged for suspicious activity because its activities did not match its business profile. On top of which, media coverage at the time described TelexFree’s activities as fraudulent. And even though TD closed the firm’s initial account in July 2013, it opened a second and even a third and fourth account. Through its due diligence, TD was aware of legal claims against TelexFree in Brazil, and expressed its concerns to the company. Yet the bank still opened the new accounts in August and September 2013, and processed large transactions between them. TD eventually closed the third account, and refunded USD18mn to TelexFree — but, even then, it broke the payment down into smaller sums at TelexFree’s request to avoid red flags.
Professional indemnity insurance may be able to respond to a loss of this nature, given the core coverage applies to claims in respect of failures in the provision of professional services. However, policies can be restricted to coverage for claims brought by customers of the insured. If that is the case, a policy will not respond to claims by non-customer third parties impacted by the insured's failures (as appears to be the case here).
Prudential Financial settles for USD35 million for inflating stock price by misstating mortality trends
LOSS AMOUNT
USD 35m
BUSINESS LINE
Retail Banking
EVENT TYPE
Selection, Sponsorship, and Exposure
RELEVANT POLICIES
D&O Insurance
Prudential Financial has reached a USD35mn settlement with investors who purchased its common stock in the summer of 2019, but claimed the insurer had overstated its results in regulatory and quarterly filings throughout early 2019, resulting in the stock trading at artificially high prices.
In 2013, Prudential had purchased around 700,000 life insurance policies from Hartford, for which it had struggled to accurately reserve. This was due in part to extreme deviations in mortality experience. In February 2019, the insurer began a review of actuarial assumptions, which it failed to disclose. On 31 July 2019, Prudential announced that changes in mortality assumptions would reduce life insurance earnings by USD25mn a quarter for the foreseeable future, and that it would institute a one-time reserve increase of USD208mn. Investors claimed that by not disclosing the review, Prudential had omitted material facts pertaining to its reserves, its assumptions and reserve adequacy from its financial results and future prospects. Corporate Securities Claims coverage (aka Side C) can be purchased under Directors' and Officers' (D&O) policies. In short, it provides coverage for claims against the insured company by its shareholders and bondholders in connection with its shares or bonds. Claims of the type against Prudential are common under Side C coverage, i.e., claims by shareholders alleging misstatement of financial information which has resulted in the insured company's shares trading at artificially high prices (and therefore causing financial loss to shareholders who bought shares at the top).
Motor Finance Mis-selling: A Gathering Storm for UK Banks
The UK Financial Conduct Authority is currently undertaking an investigation into financing deals in the UK car market (as detailed in the Lloyds Banking Group loss in this bulletin).
The issue is discretionary commissions on car financing deals dating back a decade, which the FCA say gave lenders and dealers an incentive to charge customers higher interest rates. It seems very likely that the FCA will find against various banks who provided car finance loans during the relevant period. Analysts estimate that the fall out could cost the UK banking industry up to GBP16mn. Some banks are particularly exposed, with car finance loans representing 20% of one bank’s gross loan book.
As is the case with most instances of financial mis-selling, the FCA will probably order the relevant banks to make redress payments to affected customers and may impose fines. As highlighted in this bulletin, insurance coverage for such redress payments and fines will be very challenging. Moreover, we understand that any fine imposed by the FCA can never be legally insured — as the FCA has outlawed the insurance of any fine it imposes. Furthermore, any payments to affected customers are unlikely to be covered under professional indemnity insurance as they are likely to be caught by disgorgement exclusions, i.e., exclusions applying to the repayment of fees or commissions. However, if there is a compensatory element to such payments, it is possible that coverage could apply under professional indemnity insurance. Additionally, coverage may be available for legal costs incurred by the affected banks in responding to the FCA investigation.
Source: The Financial Times, 19 March 2023
The Walbrook Building 25 Walbrook London, EC4N 8AW
Let's talk
Arthur J. Gallagher (UK) Limited is authorised and regulated by the Financial Conduct Authority. Registered Office: The Walbrook Building, 25 Walbrook, London EC4N 8AW. Registered in England and Wales. Company Number: 119013.