BY now, the chain of events that ended with $81 million in funds belonging to the Bangladesh Bank vanishing in the Philippines by way of RCBC bank and the Solaire casino seems to be fairly well understood, but is raising as many questions as it does answers.
The investigation, such as it is, has focused primarily on one Maia Deguito, the branch manager of the Jupiter St., Makati branch of RCBC, a couple of her subordinates at the Jupiter St. branch, and a couple of mysterious Chinese individuals, William So Go and a certain Weikang Xu.
It is clear, however, that the case involves a much larger conspiracy, and has some frightening implications for not only the Philippines, but other countries as well.
The conspiracy’s choice of countries – Bangladesh, the Philippines, and Sri Lanka – is not surprising. All three countries have a large volume of cross-border financial transactions in the form of remittances, and all three countries are accustomed to moving large individual transactions in the form of development funds and loan receipts and payments. All three also have a reputation for being rather porous in terms of defenses against money-laundering.
Some have expressed surprise that the thieves would target a “poor” country like Bangladesh, but because of remittances – about $15.8 billion in 2015 – and export receipts from its garment industry, Bangladesh actually has large foreign reserves, about $28 billion. The Philippines, with about $81 billion in foreign reserves, would be a much more tempting target, but compared with Bangladesh, whose central bank has had a number of corruption and technical problems throughout the years, Philippine reserves are generally perceived as being more secure. Sri Lanka’s central bank, which has made a number of improvements since the end of that country’s civil war, probably falls somewhere between the other two in terms of its perceived security.
Investigators should consider the commonalities among all three countries, because it is obvious that the conspiracy, whatever it is, has actors in all three places.
One of those commonalities is very likely to be one or more business interests, whether companies or individuals, with a presence in all three places, and the clues to that might start here in the Philippines. Putting together conversations with a number of people either currently or formerly involved in the local banking industry with the growing volume of investigative reporting being done on the scandal – primarily from the Wall Street Journal, the Dhaka Tribune and other media outlets in Bangladesh, Reuters, the Associated Press, and an excellent report from the Financial Times (FT.com) over the weekend – leads to an interesting hypothesis.
In order to carry out that theft, the conspiracy needed three things: Access to the central bank, which would be the source of the funds; access to a commercial bank to facilitate the transfer of the funds through secure systems, and collectors with the capability to launder large sums quickly. Bangladesh satisfied the first requirement; according to the network security firm FireEye, its central bank’s systems were penetrated sometime around January 16. Whether that was a pure hack from outside or had the assistance of someone inside the central bank is something the Bangladesh authorities are still trying to work out. The Philippines and Sri Lanka both satisfied the second requirement through RCBC here and Pan-Asia Bank in Sri Lanka, and also satisfied the third requirement; Sri Lanka, like the Philippines, also has a large network of remittance and foreign exchange dealers, as well as casinos.
The choice of RCBC has mystified some here, as the bank, at least since about 1998 when it did run into various problems largely as a consequence of the sort of widespread recklessness that led to the Asian financial crisis, has had a perfectly ordinary, clean reputation up until now. Banking insiders, however, have pointed out a rather interesting development in RCBC’s recent history: After Lorenzo Tan was named the head of RCBC in early 2007, the bank went to considerable lengths to cultivate business among the Filipino-Chinese commercial crowd in Binondo (that was supposedly about the same time the Chinese characters above the “RCBC” on the bank’s signage began to appear). While the vast majority of the people in that community are completely honest, respectable businesspeople, it is no secret that there are a number who are not, which can put someone in a high-risk business like banking in a delicate position, having to balance the highly-personalized Chinese manner of doing business with keeping people and transactions sufficiently at arm’s-length and within the bounds of accepted procedure.
People who have worked with or are otherwise well-acquainted with Mr. Tan have pointed out two things about the man that are not necessarily bad characteristics, but could be highly problematic in the wrong environment: He is said to excel at personalizing business relations, and he is described as having a somewhat loose, delegative style of management. Again, these are not necessarily flaws and are actually great advantages in many ways, and certainly do not imply any guilt on his part in the current scandal.
But they do highlight how a very plausible scenario of how things broke down at RCBC might have played out. Anyone who has done business in the Philippines has had the same experience; getting things done is greatly helped by ‘knowing the boss,’ who can cut through a lot of procedural hassle with a mere word to his subordinates. A sharp operator can take advantage of this; it might begin with a small favor here and there—a transaction that might be just a little bit irregular or on the edge of propriety is smoothed over by the president—and then another, and another, until soon enough, the subordinates don’t even bother to clear it with the boss, because the client in question has always been endorsed.
And then at some point comes the money shot, the big and completely off-the-gauge transaction that would raise all sorts of red flags somewhere else. It might even make the functionaries uneasy; but because the boss has always cleared this guy, he must have okayed this, or would anyway if asked about it, and in fact, might even get upset if his underlings question the propriety of his ‘good friend’ again. And so a lowly branch manager, who in any other situation would not even be close to having the authority to clear $81 million worth of fund movements (as one of my investment banker contacts pointed out, it was actually $320 million or more, as the money moved at least four times), simply pushes it through, believing that it has the blessing of the man at the top, when in reality the man at the top may be completely unaware of it, and might be horrified if he knew.
They’re still out there
To what degree the conspiracy might have actually infiltrated the Bangladesh Bank, RCBC, and Pan-Asia—whether or not people on the inside are actually a part of it—is something investigators will still have to figure out; but as can be seen, all they needed was access and not an actual physical presence, and despite the uproar of the scandal, that access really hasn’t been curtailed yet. Properly connecting the dots in RCBC’s part in the scandal will map the relationships that made the theft possible, and the chances are very good that map will connect all three countries at a number of different points.
The concerned authorities better do that soon, because even though the bulk of $951 million the thieves attempted to steal was blocked, $81 million by any definition is still a successful outcome to the operation. Seeing how the authorities responded simply helps the conspiracy hone its tactics – if it were me, I would be very encouraged by the fact it took Bangladesh Bank almost four days to even discover the theft, three weeks for the Philippines to move to freeze the questionable accounts, and more than a month for network experts to figure out how the Bangladesh systems were compromised. I would try it again, and I’d be willing to bet the conspiracy, whoever they are, will as well; and if they do, $81 million is likely to look like bus fare compared with what they could steal the next time.
* * *
A correction of a point in my previous column (“Uncomfortable truths about the RCBC scandal,” March 19): I had written that Roberto Ongpin had been removed from a position at Development Bank of the Philippines because of accusations—which were the basis of a case that was eventually thrown out due to lack of merit —over a questionable loan deal. Mr. Ongpin did not have a position at DBP, but was simply named as having a part in the behest loan case. He instead relinquished his stake at PBCom (his group had acquired the bank in 2011) in 2013 due to an unfavorable decision by the central bank—technically, his election to the board was “deferred” by regulators—which was made because the DBP case was not yet resolved at that point. I apologize for the error and any confusion it may have caused.