Anti-Fraud Controls of Private Bank

Private banking has long been perceived as a high risk area. Inherent risk (client profile, transaction nature, etc.) is one thing, control risk (lack of management oversight, inadequate procedures, etc.) is another thing.

FSA recently fined BNP Paribas Private Bank (BNPP Private Bank) £350,000 for weaknesses in its systems and controls which allowed a senior employee to fraudulently transfer £1.4 million out of clients' accounts without permission.

This is the first time a private bank has been fined for weaknesses in its anti-fraud systems. The 13 fraudulent transactions were carried out between Feb 2002 and Mar 2005 using forged clients' signatures and instructions and by falsifying change of address documents.

During its investigation, FSA found that BNPP Private Bank did not have an effective review process for large transactions, over £10,000, from clients' accounts. The bank's procedures were not clear about the role of senior management in checking significant transfers prior to payment. As a result, a number of fraudulent transactions were not independently checked.

In addition, a flaw in the bank's IT system allowed the senior employee to evade the normal Middle Office processes. This meant that basic authorisation and signatory checks were not carried out on internal cash transfers between different customer accounts.

The bank's failings were serious because they enabled significant fraud to take place and failed to detect subsequent transfers to cover it up for a long period of time. It also failed to improve its procedures for monitoring large transactions or carry out remedial action on a timely basis. This was despite the bank being aware that certain of its procedures required improvement as a result of an FSA visit in relation to money laundering systems and controls in Aug 2002 and subsequent internal reviews.