19 December 2024
Insuring Operational Risks
Tom Falcon, Technical Director of Gallagher Specialty's Financial Institutions team, gives his commentary on the insurability of recently reported large operational risk events. Each month, Risk.net issues details of the top five events, and we consider the extent to which insurance coverage is available.
Reliance home finance defrauded of INR 92.95 billion in commercial loan scheme
LOSS AMOUNT
USD 1.1bn
BUSINESS LINE
Commercial Banking
EVENT TYPE
Internal Fraud
RELEVANT POLICIES
Crime Insurance
Senior executives at the firm, including the chairman of Reliance Group, Anil Ambani, perpetrated an 'elaborate and nefarious scheme' to extend a series of loans to 45 companies, most of which were financially unsound, according to a report by India’s securities regulator.
The borrowers subsequently defaulted on the loan repayments after distributing the funds to other entities connected to the Reliance Group. The regulator said the scheme, which took place from 2018 to 2019, was designed to systematically strip the company’s assets in defiance of the board, calling it a 'complete breakdown of governance'.
Crime insurance provides coverage for employees committing loan fraud, provided it is proved they or persons colluding with them made a financial gain from the fraud. However, if directors are involved in fraudulent behaviour, then coverage becomes challenging, as most policies exclude losses caused by fraudulent acts by directors unless they are acting in an employee capacity.
UBS sets aside USD900 million to repay investors in Credit Suisse funds linked to Greensill Capital
LOSS AMOUNT
USD 900m
BUSINESS LINE
Trading and Sales
EVENT TYPE
Clients, Products and Business Practices
RELEVANT POLICIES
Professional Indemnity Insurance
UBS sustained June’s largest operational risk loss with a USD900 million Greensill Capital-related provision.
The Greensill Capital-related set-aside provision will repay investors in Credit Suisse funds linked to the former supply-chain-finance firm. Greensill collapsed in March 2021, resulting in estimated losses of around USD2.3 billion for Credit Suisse. When UBS took over its Swiss rival in 2023, it inherited litigation brought by affected investors. On 17 June 2024, UBS offered to buy back units of these investors’ funds at 90% of their original net asset value. The provision will be covered from the amount UBS set aside for litigation or regulatory costs at the time of the acquisition.
Professional indemnity insurance could respond to a loss of this nature, given investors have suffered financial loss as a result of Credit Suisse's mismanagement of their money. It appears that the buyback of investors’ funds at 90% of their original net asset value amounts to a settlement, which is covered under Professional Indemnity insurance provided it is made with the insurer's consent.
Move Over Greenwashing, Here's AI Washing
In recent times the prominence of environmental issues led to greenwashing; now the skyrocketing popularity of artificial intelligence has engendered ‘AI washing’. In short, false claims around the use of AI to capitalise on investor trends.
In March, the US Securities and Exchange Commission levied penalties for AI washing on two investment advisers, Delphia and Global Predictions (for USD225,000 and USD175,000 respectively). Delphia falsely claimed it had been using AI and machine learning tools to analyse client data to inform its investment advice. In fact, no such data input or AI model usage had ever occurred. The company broadcast the misstatements across SEC filings, press releases, its website, and its social media posts. Likewise, Global Predictions touted itself as the 'first regulated AI financial advisor', although it was unable to substantiate this claim. It also stated in its marketing that its technology used 'expert AI-driven forecasts' when that was untrue.
The SEC first flagged AI washing as a risk to investors in January, when it issued a fraud alert about increasing scams involving the purported use of AI, and in recent years has targeted representations made by investment advisers. In March 2021 it published a new marketing rule for investment advisers with a compliance date in November 2022.
Nearly two months before this came into effect, the SEC announced it would begin investigating and enforcing the new rule immediately. Although the SEC did not explicitly state that the actions against Delphia and Global Predictions were a result of these investigations, both firms were penalised under the marketing rule. In addition to regulatory actions, shareholders are alert to misrepresentations made by financial institutions about their business activities, often resulting in them bringing claims in that respect (securities claims). D&O insurance protects against securities claims if Company Securities Claims coverage (aka Side C) is purchased. In short, this covers claims against the insured company alleging misrepresentations or non-disclosures in respect of securities.
In addition, professional indemnity insurance can respond to legal costs incurred by financial institutions in responding to non-routine regulatory investigations into alleged AI washing or greenwashing (provided Investigation Costs coverage is purchased).
Source: Risk.Net
DMM bitcoin loses approximately CNY 48.2 billion in unauthorised transfer
LOSS AMOUNT
USD 306m
BUSINESS LINE
Clearing
EVENT TYPE
External Fraud
RELEVANT POLICIES
Crime Insurance
A virtual smash and grab on Japan’s DMM Bitcoin exchange resulted in CNY48.2 billion of cryptocurrency being stolen from its wallets.
On discovering the incident, the exchange made moves to control the damage by restricting its various services. It subsequently planned a capital increase by borrowing CNY50 billion from its parent company, e-commerce group DMM, to cover losses related to the event. The looted bitcoin made up the majority of the exchange’s deposited assets and is, to date, the eighth-largest crypto theft globally.
Crime insurance provides coverage for various forms of electronic fraud, including the theft of funds or electronic assets via hacking. Many crime policies for financial institutions will exclude the loss of cryptocurrency. However, specific crime coverage is available for cryptocurrency exchanges, custodians, prime brokers, and investment managers and responds to losses involving cold and hot storage.
H2O AM holding pays EUR250 million for control failures linked to illiquid Windhorst Investments
LOSS AMOUNT
USD 278m
BUSINESS LINE
Asset Management
EVENT TYPE
Clients, Products and Business Practices
RELEVANT POLICIES
Professional Indemnity Insurance
France’s H2O Asset Management agreed to pay EUR250 million in compensation to investors who suffered losses from illiquid holdings in investment firm Tennor Group.
The payment is part of an agreement between H2O and the UK’s financial regulator, which also sees the asset manager shutter its UK operations. A regulatory probe into H2O uncovered manifold risk management control failures at the company, despite the obfuscatory efforts of H2O senior staff.
Professional Indemnity insurance provides coverage for compensatory payments to clients, where they have suffered financial loss due to the actions of the insured during its provision of professional services. Therefore, a loss of this nature could be covered under Professional Indemnity insurance.
The Perils of WhatsApp
Sending a message to a business colleague on a private messaging app may seem harmless, but the practice has cost financial firms in the US more than USD3.3 billion and counting.
In September 2021, the US Securities and Exchange Commission launched an investigation into Wall Street banks for failures to keep records of business communications, including on unapproved devices or third-party platforms. Three years later, the so-called WhatsApp probe has snared 54 major financial institutions.
The probe began after the SEC found evidence of record-keeping malpractice at JP Morgan during an unrelated enquiry. Its findings prompted fellow regulator Commodity Futures Trading Commission to launch its own investigation into how banks monitored and recorded employees’ work-related communications, especially during the COVID-19 pandemic, which saw many employees working remotely. JP Morgan duly faced fines of USD125 million from the SEC and USD75 million from the Commodity Futures Trading Commission (CFTC) for record-keeping failures in December 2021, in the first enforcement action arising from the WhatsApp probe. The regulators’ sweep expanded to encompass broker-dealers and then investment advisers in 2022. Fines in relation to the probe totalled USD1.82 billion in 2022 and USD738 million in 2023, with USD554 million in 2024 so far.
As we have detailed many times in this bulletin, fines and penalties are unlikely to be insurable due to public policy or regulatory prohibition. Therefore, we presume that the fines in these cases were not insured. However, if Investigations Costs coverage is purchased, professional indemnity can provide coverage for legal costs incurred by financial institutions in responding to non-routine regulatory investigations into alleged misconduct in the provision of professional services, including the misuse of private messaging apps by staff.
Source: Risk.Net
ETB6 billion loss after glitch allows withdrawals exceeding account balances
LOSS AMOUNT
USD 106m
BUSINESS LINE
Retail Banking
EVENT TYPE
Technology and Infrastructure Failure
RELEVANT POLICIES
Crime Insurance / Cyber Insurance
The Commercial Bank of Ethiopia (CBE) suffered a systems glitch that enabled customers to withdraw or transfer funds in excess of their actual account balances.
CBE reportedly lost ETB6 billion (USD105.8 million) in 25,000 transfers over the course of six hours. Reports circulated of a 'centralised ledger system glitch', possibly triggered by a software update or a configuration issue. News of the glitch spread quickly on social media, and students reportedly formed queues in front of cash machines on university campuses. The bank did not initially confirm the incident but froze branch-level banking services and online and mobile banking. It later confirmed the system failure had enabled the unauthorised transfers and it had formed a task force, with the security forces and representatives from the National Bank of Ethiopia, to recover the funds.
Crime insurance responds to certain forms of ATM crime, either via specific ATM coverage or computer crime. However, a loss of this nature may be challenging to cover as there is often a requirement in crime policies that computer failures resulting in the loss of funds must be caused by criminals. Therefore, losses caused by a non-malicious glitch are likely to be challenging. Beyond crime insurance, cyber insurance provides coverage for costs of the third-party professionals to rectify computer systems that have been impaired (by a non-malicious glitch or otherwise).
Zurich Insurance Group to pay USD80 million over wrongful termination of three employees
LOSS AMOUNT
USD 80m
BUSINESS LINE
Non-Life Insurance
EVENT TYPE
Employee Practices and Workplace Safety
RELEVANT POLICIES
Employment Practices Liability Insurance
Zurich was ordered to pay a total of USD80 million to three former employees who claimed that they had been wrongfully terminated over time theft allegations.
The employees worked in Zurich’s workers’ compensation division, and, from January 2015, their manager at the time used ‘off-the-record’ paid time off (PTO) as an incentive for high-performing employees. This was not put into the official PTO system so workers’ official vacation allowance would not decrease. However, when the manager was dismissed in October 2017, his replacement prompted an internal investigation into PTO usage. In December 2017, the three employees were fired for alleged time theft before they had the opportunity to submit their responses to the lead investigator.
Employment Practices Liability Insurance (EPLI) covers employment claims, including wrongful dismissal. Coverage applies for legal costs in defending such claims and any damages awards or settlements. Therefore, claims of this nature should be covered under EPLI.
Macquarie pays USD79.8 million to SEC for overvaluing MBS in funds and cross-trade violations
LOSS AMOUNT
USD 79.8m
BUSINESS LINE
Asset Management
EVENT TYPE
Clients, Products and Business Practice
RELEVANT POLICIES
Professional Indemnity Insurance
Macquarie Investment Management Business Trust (MIMBT) was charged by the US Securities and Exchange Commission with overvaluing securities and executing cross-trades that benefited some of its clients over others.
MIMBT used price marks that a vendor provided for institutional lots to overvalue small ‘odd lot’ positions. It then cross-traded the positions using inflated prices to meet investors’ redemption requests at the expense of its retail mutual funds. The loss included disgorgements of over USD7.6 million. Professional Indemnity insurance does not cover disgorgement payments, as almost all policies will have an exclusion in that respect (often described as a fees exclusion or a disgorgement exclusion).
If clients have suffered financial loss as the result of the actions of the insured financial institution during its provision of professional services, then policies should respond. However, settlements with regulators may be challenging from a coverage standpoint, as they are likely to involve a punitive element, are not paid directly to clients and may involve an admission of dishonest conduct. However, it may be possible to cover the compensatory element of such settlements. Beyond that, a well-drafted policy should provide coverage for costs incurred in responding to non-routine regulatory investigations into the provision of professional services.
The Walbrook Building 25 Walbrook London, EC4N 8AW
Let's talk
Arthur J. Gallagher (UK) Limited is authorised and regulated by the Financial Conduct Authority. Registered Office: The Walbrook Building, 25 Walbrook, London EC4N 8AW. Registered in England and Wales. Company Number: 119013.