How a bank’s IT systems allowed £100m a day of fraud

NatWest, formerly Royal Bank of Scotland (RBS), is a good example of a bank with rubbish IT. This was illustrated when I spotted the headline: NatWest fined $300 million for money laundering.

They didn’t do the money laundering, but a number of accounts – specifically a jeweller, Fowler Oldfield – did. How did this happen? Well, it was two-fold. First, the relationship manager didn’t do the right checks and, second, the IT systems messed up.

This came to light in a report from the FCA, who had told the bank to sort it out. In fact, they’re spending a billion dollars on the issue. But is it working? The Telegraph claims not.

A product that allowed customers to pay notes directly into cash centres wrongly recognised the deposits as cheques between 2008 and 2017. Fowler Oldfield* used this to disguise cash payments worth £165m. An analyst at the bank concluded the faulty system meant £100m a day was misrepresented as cheques … the bank then set about trying to fix the issues in a number of programmes, but the FCA found in January 2020 that NatWest was still failing to finish a programme of work assessing risky customers. The FCA wrote a letter to Alison Rose in October 2020 to complain about delays correcting its records and demand NatWest fix the issue, according to court documents. It launched criminal proceedings against NatWest in March 2021 ... documents reveal the lender's remediation work on the files of risky customers is ongoing and will not be finished until 2023.

The thing is that this was called out by NatWest’s auditors. KPMG spotted the computer failings eleven years ago:

Court documents reveal that KPMG first identified failings in NatWest's money-laundering controls back in 2010 - a year before it took on Fowler Oldfield as a client.

What this shows is that issue I keep coming back to: core systems are hard to change. To put this in context with NatWest:

• 2010: Issues highlighted by KPMG
• 2023: Issues resolved

Thirteen years to identify how to deal with a money laundering issue, where computer systems record cash as cheques, and a cost of $1 billion to fix. That strikes a chord with me but then NatWest are not unusual. It’s not unusual:

• It's not unusual to be laundered by anyone
• It's not unusual to have fraud with anyone

Oh dear, I’m slipping back into FinTech karaoke mode, but the gist is that it’s the system – both the physical and digital system – that composes a bank. In this case, the physical system – the relationship manager – failed; and the digital system – archaic computers that cannot tell the difference between cash and a cheque – failed.

Bearing in mind that NatWest is not the exception but the rule (in banking), there are many lessons to learn here and, all in all, it’s the layers of technical and process debt for you.

 

* Postnote: Fowler Oldfield was run by James Stunt, the former husband of Petra Ecclestone, Bernie Ecclestone's daughter