78
3/20/2018 1 Presented By C.A. Pankaj R. Majithia Mobile: 98201 22218 email:[email protected]

Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

  • Upload
    others

  • View
    0

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

3/20/2018 1

Presented By

C.A. Pankaj R. Majithia

Mobile: 98201 22218 email:[email protected]

Page 2: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Banking Sector is rumoured to have INR 10 Trillion of StressedAssets.

PNB’s Case seems to have created the Perfect Storm – Is this theTIP of the ICEBERG?◦ Created by Lax Processes,◦ Inadequate Over-signt◦ SWIFT – did a swift job in wiping off the bank’s name and worth. Messages

routed and not routed through CBS allowed errant employees work out of thesystem

3/20/2018 2

380 crores

- Originally

Reported

11400 crores

- Revised 1

12600 crores

- Revised 2

20000

crores -

Rumours

Page 3: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

“The fraud in PNB is a case of operational risk arisingon account of delinquent behaviour by one or moreemployees of the bank and failure of internalcontrols.”

According to bankers, transactions on SWIFT, an inter-bank messaging facility, must go through a built-insystem of audit and reconciliation. These includeseeking approval from officials other than those havingbanking relation with the client, red flags for suddenspurt in transactions, and breach of sectoral and groupexposure limits, among others.

3/20/2018 3

Page 4: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

SWIFT was founded as co-operative society by 8 institutionsinitially in 1973, ABBREVIATION FOR ‘SOCIETY FORWORLDWIDE INTERBANK FINANCIALTELECOMMUNICATION”. Went live in 1977.

SWIFT’s messaging services are trusted and used by morethan 11,000 financial institutions in more than 212countries

SWIFT is the backbone of global financial communication.

Vision of creating shared worldwide financial messagingservices and a common language for international financialmessaging.

By creating and maintaining global financial messaging andreference data standards.

3/20/2018 4

Page 5: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Offering the most secure, cost-effective and reliableway of transmitting Financial messages relating toPayments, securities, treasury and trade.

SWIFT is a global member-owned cooperativemessaging services.

SWIFT provide finance community with a platform formessaging and standards for communicating,◦ To facilitate access and integration,◦ identification,◦ analysis and◦ regulatory compliance

SWIFT also brings the financial community together –at global, regional and local levels debate issues ofmutual interest or concern.

3/20/2018 5

Page 6: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Headquartered near Brussels in Belgium, has globaloffice network in all the major financial centres.

It has gained so much popularity now that dailymessages for transactions in Monetary terms are of $6trillion and yet it is not a payment felicitation orGateway but only Messaging platform.

Cross-border transactions are facilitated through theSWIFT infrastructure that works on a system of codesdivided in to 8 or 11 digits.

3/20/2018 6

Page 7: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Page 1

3/20/2018

SWIFTNet - Single window access to thefinancial world

Who is SWIFT?

A co-operative organisation serving the

financial services industry

A provider of highly secure

financial messaging services

The financial standardisation body

Slide 3

7

Page 8: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Common group message types

Page 4

IISACA 2007

Slide 30

Flow & acknowledgements

OutputInput

ACK/NAK UAK/UNK

Sende r Receive r

3/20/20188

Page 9: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

3/20/2018 9

Slide 32

IISACA 2007

Structure

What does a SWIFT message look

like ?

Screen

SWIFT

Network

Printout

Page 10: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Page 2

Slide 9

IISACA 2007

SWIFT Platform Overview

SA-Workstation

VPNbox

SWIFTAlliance Access / Entry

SWIFTAlliance Gateway

SW IFTNet

Financial application Service specific interface

Communication Layer Network Layer &SWIFTNet ServicesMessagingLayer

Application &

Desktop Layer

SAM

App WebServer

MT-MX

MT-MX

Browser

MT- MX

Financial Application

MT-MX-FpML

Automation

MT

SA-Webstation

Browse, FileAct, InterAct & SAG admin.

RMA

M T -M X

Fp M L

MT-MXFpML

SW IFTNet

Mail

E-mail

server

E-mail client

3/20/2018 10

Page 11: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

3/20/2018 11

Slide 10

IISACA 2007

SWIFTAlliance Gateway

Ex:Highly resilient config.

SAG 2

Site 1 Site 2

FIN CLS SAB

Interface gateway

SAG 1

RA RARAMQ

DMZ

SAG

CLSgateway

FINInterface

SAB

RA RAMQ RA

DMZ

Dual-P Dual-P

Legend: Primary route(s)

Secondary route

Cold-Backup route

Page 12: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Page 3

IISACA 2007

Slide 27

Types of messages

• User to user messages

• System messages

• Service messages

3/20/2018

Categories of messages

0 System messages

1 Customer transfers & cheques

2 Financial institutions transfers

3 Foreign exchange, money markets & derivatives

4 Collections & cash letters

5 Securities markets

6 Precious metals & syndications

7 Documentary credits & guarantees

8 Travellers cheques

9 Cash management & customer status

IISACA 2007

Slide 28

12

Page 13: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

3/20/2018 13

Slide 31

IISACA 2007

Structure

Order Form

Please pay ....to ...

from ... on .....

at ...

for ......

--------------------Instance Type and Transmission------------------ Notification (Transmission) of Original sent to SWIFT (ACK)

Network Delivery Status :Network Ack Priority/Delivery :Normal

Message Input Reference : 1705 021115KWHKHKHHAXXX0135007653

------------------------------Message Header------------------------

Swift Input : FIN 103 Single Customer Credit Transfer

Sender : KWHKHKHHXXX

Citic Ka Wah Bank Hong Kong

: BNPAFRPPXXX BNP-PARIBAS SA

(FORMELY BANQUE NATIONALE DE PARIS S.A.)

Paris, France

Receiver

MUR : MC12

------------------------------Message Text--------------------------

20:Sender's Reference PAY/09

23B:Bank Operation Code CRED32A:Value Date, Currency and Interbank Settled Amount Date :18 November 2002Currency : EUR (EURO)

Amount : #65000,#

50K:Ordering Customer

/123001043212

MR LEE 10 QUEENSWAY HK-HONG KONG

57A:Account with Institution - BIC BNPAFRPPCAN

BNP-PARIBAS SA (FORMELY BANQUE NATIONALE DE PARIS S.A.) CANNES FR

59:Beneficiary Customer

/12345543210100001M02211 MR DUPONT 6 RUE LAFAYETTE FR-CANNES70:Remittance Information

/INV/5271A:Details of Charges SHA

------------------------------Message Trailer----------------------

{MAC:098446CF}{CHK:45946964876B}

Page 14: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

In order to use SWIFT’s Messaging Services,customers need to connect to the SWIFTenvironment. The messages are in 8 digit or11 digit characters, first 4 for Bank code next2 for country code 2 for location code and 3for branch code (which is optional) If H.O. orprimary office is to receive, it will have only 8characters. Swift messages are also codifieddepending upon various classification in 100series is for customers 600 for preciousmetals 700 for L/C – Guarantees LOUS, 800for Travelers cheques etc.

3/20/2018 14

Page 15: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Messages sent by customers are authenticated usingspecialised security and identification technology.

Encryption is added as the messages leave thecustomer environment and enter the SWIFTenvironment.

Messages remain in the protected SWIFT environment,throughout the transmission process - whilst they aretransmitted to operating centres (OPCs) where theyare processed - until they are safely delivered to thereceiver.

SWIFT’s overall Enterprise Risk Managementframework provides a consolidated view ofrisk management information across SWIFT.

3/20/2018 15

Page 16: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

SWIFT’s internal audit and external security audit is completed with information security risk management system by:

◦ Independently and objectively reviewing, assessing and reporting on SWIFT's risk and control functions on an ongoing basis

3/20/2018 16

Page 17: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

3/20/2018 17

• A typical SWIFT transaction involves checks atthree levels:• a maker,• checker and• a verifier.

• As recent as February 7, City Union Bank reportedto the stock exchanges that its SWIFT system, too,had come under a cyberattack recently.

• Three fraudulent remittances had gone throughSWIFT system to transfer nearly $2 million inthese transactions

Page 18: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Comprehensive SWIFT Infrastructure provides forSecurity Audit where Failure is not an option.

However after a series of security breaches in banksacross the globe, forensic experts believe malwareused in reported customer incidents was not a singleoccurrence, but part of a wider and highly adaptivecampaign targeting banks.

3/20/2018 18

Page 19: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

(1) The case of the Central Bank of Bangladesh: $81million was stolen from the account of the CentralBank at the Federal Reserve Bank of New York.

(2) Investigators found that a separate theft had movedmoney from the Federal Reserve Bank of New York toaccounts in the Philippines.

(3) Banco del Austro S.A. in Ecuador: The bank allegedin a lawsuit filed against Wells Fargo & Co. that hackersused the SWIFT banking system to steal $12 million.

(4) Vietnam’s Tien Phong Commercial Joint Stock Banksaid it stopped an attempted theft of 1 million euroslate 2015.

3/20/2018 19

Page 20: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

In all these instances, Investigations found: The attackers have exploited vulnerabilities

in:◦ banks funds’ transfer initiation environments, prior

to messages being sent over SWIFT.◦ The attackers have been able to bypass whatever

primary risk controls the victims have in place,thereby being able to initiate the irrevocable fundstransfer process.

They have found ways to tamper with thestatements and confirmations that bankswould sometimes use as secondary controls,thereby delaying the victims’ ability torecognize the fraud.

3/20/2018 20

Page 21: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Security must be an essential element of theSWIFT Infrastructure, this area includes

password management

physical security

user profile setup

encryption

SSL setup

Firewall rules

certificate management.

3/20/2018 21

Page 22: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

“At the end, technology is only anenabler and the concept of maker andchecker will only work when processesare followed.

If people involved undertookunauthorised trades than and only thenthere will be failure to track it”.

3/20/2018 22

Page 23: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

AUDIT AND DILIGENCE AREAS

3/20/2018 23

Page 24: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Regular Cyber, Admin and Financial audit to confirmthe immunity of their swift infrastructure is must toprevent such attacks.

It is also necessary to INTEGRATE WITHCBS/PAYMENT/CONTROL ACCOUNT SYSTEM AS WELLAS NOSTRO RECONCILIATION & BIOMETRICauthentication system rather than 3 or 5 passwordsystem.

3/20/2018 24

Page 25: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

IISSAACCAA 22000077

Slide 54

3/20/2018

Summary elements of a SWIFT audit

Check SWIFT system configuration for links, back-up,

contingency Reports on contingency and BCP tests

Physical access procedures to SWIFT room

Release management

Match HR lists to operators in SWIFT interface

Check operator permission lists with SWIFT Security

Officers Check procedures for delivery monitoring

Archiving procedures

MIS statistics of average number of messages IN/OUT, average

value

25

STANDARD & SECURITY PROTOCALS IN SWIFT – SOME COMMENTS

Page 26: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Assess validation controls, data integrity programs, Anti-Virus and the installed operating systems’ security patches.

Verify the integrity of the Swift Alliance database to ensurethere is no evidence of data tampering, errors, oromissions.

Monitor application/system performance, to make sureperformance logs are analysed in real time, to detect andrectify any availability issues, active attacks,application/system and network slowdowns or crashes.

Evaluate employee training and readiness, relative toemergency, disaster, and contingency plans.

AUDITORS ALSO MUST VERIFY CUSTOMERSINFORMATION FILE AS WELL AS USER APPLICATION ANDLIABILITIES STATEMENT.

3/20/2018 26

Page 27: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Introduction:RBI, the regulator of banks in India, defines fraud as “Adeliberate act of omission or commission by any person,carried out in the course of a banking transaction or in thebooks of accounts maintained manually or under computersystem in banks, resulting into wrongful gain to any person fora temporary period or otherwise, with or without anymonetary loss to the bank”.

PNB in the fiscal ending March 31 had made a provision ofRs.18,366.83 crore towards bad loans that led to a net loss ofRs.3,974.39 crore for the fiscal. The Bank had shown turnaroundin the current year but now entire picture will go for Toss due tohuge scam unearthed in Nirav Modi/Gitanjali scam.

3/20/2018 27

Page 28: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Until the PNB declared its fraudulent transactions onMonday, the Winsome Diamond Group scam wascountry's second largest banking fraud after KingfisherAirlines.

Winsome Group promoter Jatin Mehta is alsoconsidered one of the biggest corporate defaulters.

Amount of Fraud:

The Winsome Diamond Group had taken a loan ofRs.6,800 crore from a consortium of banks led by theStandard Chartered Bank.

Of the total loan amount, PNB has the highestexposure of Rs.1800 crore.

3/20/2018 28

Page 29: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Even though the case is with the CBI, the banks in Indiahave not been able to do much to force the WinsomeDiamond Group to pay up.

That's because Winsome Group won the case in UAE inwhich the Group claimed it had suffered a $ 1 billion(Rs 6,500 crore) loss due to non-payment from 13 UAE-based firms.

Following the Winsome Diamond's legal victory, UAEauthorities have reportedly refused to provide Indiangovernment agencies with information on the UAE-based firms to take their investigation forward.

3/20/2018 29

Page 30: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Like the Nirav Modi case, PNB hadreported the transactions to theCentral Bureau of Investigation (CBI)which is still investigating the case.

Since then, Mehta's - the family whichfounded Winsome - never visitedIndia, with some of them settling inSingapore and Dubai after takingcitizenship of Saint Kitts.

3/20/2018 30

Page 31: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Amount of Fraud:

Indian banks consortium extended facility to the tune of Rs.2,650 crore. From 2010, foreign banks started invoking the bank guarantees of Indian banks.

Background of Fraud:

All foreign entities were controlled by Choudhary and most of the projects and contracts, claimed to have been bagged offshore by Zoom, were fake. The Promoters are now arrested at Indore after gap of almost 6 years.

3/20/2018 31

Page 32: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Amount of Fraud:

In 2012, the firm started availing the facility of letter ofcredit (LC) from no. of banks like Central / Vijaya Bank /Axis / Federal etc. In January 2013, the firm's maindirector, Amitabh Parekh, who used to take care ofthese affairs, died and the company stopped loanrepayment.

Total fraud now hovers around Rs.1800 crores.

3/20/2018 32

Page 33: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Amount of Fraud:

Bank officials issued the LoUs and informed thesebranches via the international cash transfer servicecalled SWIFT (Society for Worldwide InterbankFinancial Telecommunication) which connects allinternational banks worldwide.

However, exploiting the information gap-and the factthat unlike other Indian banks PNB had not integratedits SWIFT network with the bank's core bankingnetwork- they chose not to record these transactionsin the bank's own system.

3/20/2018 33

Page 34: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Over 150 such LoUs were issued since the first one wasfraudulently issued in 2011.

Interestingly, while an LoU expires in 90-180 days,these bank officials are believed to have rolled themover after each expiry, as a result the fraud layundetected for over 7 years.

Initial fraud amount of Rs.380 crores overnightmultiplied to Rs.11200 crores and now provisionalfinalised at 12600 crores.

It is very difficult even to digest the recovery figures. IfRs.5500 crores, which we believe is taken at MRP ofstocks seized.

3/20/2018 34

Page 35: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

DELHI-ADVANCE REMITTANCE FRAUD - ASHOK VIHAR BRANCH, BOB, NEW DELHI

“Feb 15,2016 - Illegal remittance of around Rs.6172 crore on 12 August 2015.”

Background of Fraud: The modus operandi in this transaction was that a number

of current accounts were opened in the Ashok Viharbranch.

As per the banking system, a remittance of up to $100,000does not raise an alarm and is automatically clearedwithout supporting documents of imports.

The money launderers exploited this loophole to passunder the radar. They also smartly selected commoditieswhich are prone to cancellations on account of quality orsharp price fluctuations like fruits, pulses and rice.

3/20/2018 35

Page 36: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

6. ROTOMAC PENS

Amount of Fraud: The Kanpur-based company's owner had taken a loan of more

than Rs. 800 crore from over five state-owned banks. Allahabad Bank, Bank of India, Bank of Baroda, Indian Overseas

Bank and Union Bank of India compromised their rules tosanction loans to Rotomac.

Background of Fraud: Last year, Bank of Baroda (BOB), a consortium partner declared

pen manufacturer Rotomac Global Pvt Limited as a "willfulldefaulter".

The company moved to the division bench of Allahabad HighCourt seeking removal of its name from the list of willfuldefaulters, who directed bank to remove the name from thewillful defaulters list and now CO. MD Vikram Kothari is arrestedunder charge of fraud

3/20/2018 36

Page 37: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

What the investigation foundThe Enforcement Directorate’sinvestigation found that the fundsraised by Birla Power Solutions werenot used for a power project butwere transferred to other groupcompanies.

3/20/2018 37

Page 38: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Amount of Fraud:

CRB Corporation Ltd raised Rs 84 core through threepublic issues between May 1993 and December 1995.

CRB Share Custodial Services raised a further Rs.100crore in January 1995 to set up operations.

Bhansali was borrowing funds from banks throughquestionable means.

All was well till December 1996. Then the Reserve Bankof India (RBI) refused banking status to CRB andcontemplated action for various irregularities.

Promoter C.R Bhansali spent only 3 months in jail.

3/20/2018 38

Page 39: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

14.06.2017 - UBI,Kolkata

They allegedly cheated to the tune ofRs.184.43 crore through the loanamount of Ramsarup Utpadak (Unit-II)of M/s Ramsarup Industries Ltd bydiverting a sum of Rs.130.95 crore to agroup company M/s RAV Dravya PvtLtd."

3/20/2018 39

Page 40: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Amount of fraud: It was alleged that a fraud of Rs.212.30 crores (approx)

was perpetrated and there was fraudulent availment ofCredit limit and Letter of Credit/BG facility from CentralBank of India during the period 2011-2013.

Background of Fraud: During 2011-13, the Central Bank of India allegedly

gave fraudulent credit limit and Letter of Credit/BGfacility to Jain Infraprojects Ltd.

The CBI said that it recovered documents whichincluded copies of LCs and BGs, besides certain seals offour shell companies through which some loanproceeds have been allegedly invested on diversion.

3/20/2018 40

Page 41: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Amount of fraud

These cases are of forgery and cheating by a syndicateof Fraudsters operating in the Banking sector whonegotiated a total of 46 forged outstation Letter ofCredits (LCs) and swindled Bank of India to the tune ofRs.80 crores approx. (Both cases inclusive).

Background of fraud

It was alleged that Rajesh Choradia (A-1), Proprietor ofM/s. A.R. Finance, a third party bill negotiator,presented different bills (LCs) purportedly issued byBank of Baroda.

3/20/2018 41

Page 42: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

The banks before negotiation have a system ofconfirming the LCs from issuing branch and alsosend the original documents for acceptance.

Once the acceptance letter is received, the LCswere negotiated for payment.

In this case, the fraudsters forged the LCs withdifferent telephone numbers and fax numbers andused the services of a lineman of Airtel service whodiverted the telephone calls to a private numberpossessed by one of the accused

3/20/2018 42

Page 43: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Hence, when the official from the bank called to checkthe veracity of the LCs, the call was diverted to theprivate numbers of another accused Mohd. Ziyauddin

He used to confirm the issuance of the LCs.

The accused Mohd. Ziyauddin also managed to get asample signature of the officials of the issuing branchand rubber seal of the issuing branch through a privateperson in Bhopal.

The signatures were super imposed and he made theforged signature on the LCs by overwriting on thesuper imposed signature to take care of confirmationof the LCs signatures with an online system.

3/20/2018 43

Page 44: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Amount of Fraud: Owner allegedly availed of credit facilities of approx. Rs.60

crores from the bank by providing fake collateral securities.

Background of Fraud: A letter addressed to the PNB was faxed from the SBI head

office seeking confirmation of the guarantee. However, it was sent to a fax number other than the one

available with the bank as part of regular transactions. Accordingly, 30 kilograms of gold was delivered to an

authorised representative of borrower. Original guarantee of Rs.7 crs which was increased up to

Rs.60cr for Purchase of Gold. Bank as usual was PNB.

3/20/2018 44

Page 45: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Amount of Fraud: The forged LC for Rs.4.91 crores(approx), purported to

be issued by Union Bank of India, Narasanda Branch,Gujarat, was submitted to the Kochi Branch of StateBank of India Global Factors Ltd (SBIGFL), a sisterconcern of the SBI along with fake & false supportingdocuments by the accused persons and got the LCdiscounted at Kochi.

The amount discounted at SBI GFL, Kochi, was creditedinto the Bank account of the Kochi(Kerala) basedprivate firm represented by its two partners in theBank of Baroda, Ernakulam Branch.

3/20/2018 45

Page 46: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Amount of Fraud: The chairman and secretary of a Cownpore

Swadeshi Urban Cooperative Bank have beenarrested in Uttar Pradesh for issuing a fake bankguarantee of Rs.4.76 crore in favour of a privatecompany, based on which they availedmobilisation advance.

The integrity pact, signed in 2013, said that if asuccessful bidder violated the agreement, itwould entail forfeiture of the bank guarantee.

Central government standing counsel AnuragAhluwalia, appearing for the Centre, had told thecourt that on 17 October, 2014, the bankguarantee was invoked and full payment of theamount was demanded as the company hadallegedly violated the integrity pact.

3/20/2018 46

Page 47: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

3/20/2018 47

NORMAL

FINANCIAL ARRANGEMENTS FOR TRADE AND INDUSTRY

Page 48: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

3/20/2018 48

INNOVATIVE

FINANCIAL ARRANGEMENTS FOR TRADE AND INDUSTRY

Page 49: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

NON-FUND BASED FINANCE IS MISNOMER

LIKE EVERY LIVE THING- DEATH IS INEVITABLE

FOR EVERY NON-FUND BASED FINANCE FUNDINGEVENTUALLY HAPPENS.

BROADCATEGORY OF NFF:

A) LETTER OF CREDIT/COMFORT/LOU

B) GUARANTEES

3/20/2018 49

Page 50: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

3/20/2018 50

Page 51: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

1. Uniform Customs and Practices for DocumentaryCredits (UCPDC),

2. Exchange Control Regulations (ECR),

3. Export and Import Policy and Public notices issuedby Director General of Foreign Trade from time to time.

3/20/2018 51

Page 52: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

An instrument by which a bank undertakes to make payment

◦ To a seller / Specified Person

◦ on production of documents stipulated in the credit.

It specifies certain instructions.

◦ To the paying bank or at some future date.

◦ Assurance from Bank to seller for payment on due date.

3/20/2018 52

Page 53: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

LC is also termed as contingent liability and it is off-balance sheet item.

It is a commercial instrument of assured payment subjectto compliance to terms & conditions.

This limit is normally carved out of the fund based limit.

All parties to the credit deal only with the documentsand not the goods.

Available for settlement by acceptance /payment / deferred payment / negotiation.

The negotiation under a confirmed credit iswithout recourse to drawer.

3/20/2018 53

Page 54: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

The Applicant/ Buyer

The beneficiary / seller

The issuing Bank

Advising Bank

Confirming Bank

Negotiating Bank

Reimbursing Bank

3/20/2018 54

Page 55: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

LC is also classified in to various categories depending upon the nature and the functions of the credit. Some of them are:

Inland LC

Import LC

3/20/2018 55

Page 56: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

DP/DA : The letter of credit based on the mode ofpayment may be DA or DP

DP/LC DA/LC Revocable LC Irrevocable LC With or without recourse LCs Instalment LC Confirmed LC Transferable LC: Can be made available in whole or in

part SUBJECT TO UCPDC, 600 Revolving LC: It is reinstated once retired Back to Back LC: Countervailing LC

3/20/2018 56

Page 57: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Revolving credit is one where, under theterms and conditions of the credit, theamount is revived or reinstated withoutrequiring specific amendment to the credit.

The amount under the credit can revolve inrelation to time or value.

The basic principle of a revolving credit isthat ―after a drawing is made, the creditreverts to its original amount for re-use bybeneficiary

3/20/2018 57

Page 58: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Back to Back LC: It is an LC which is issued onthe strength of original LC. Beneficiary oforiginal LC is applicant of Back to Back credit.Normally an exporter uses his export LC as acover for LC in favour of local suppliers.

Back- to-Back L/C is also called asCountervailing L/C

When a second L/C is issued on the basis of aparent L/C, the second L/C will be termed asa ‗back- to- back L/C

3/20/2018 58

Page 59: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Two types of anticipatory L/C are there: red clause credit& green clause L/C In case of anticipatory L/C., paymentis made to beneficiary at pre- shipment stage inanticipation of his actual shipment and submission ofbills at a future date.

The payment which is provided through an anticipatoryL/C is generally a part or full amount of the loan to beadjusted at the time of submission of final documents.

The L/C. contains a special clause authorizing the bank tomake advances to the beneficiary which are recoveredfrom the beneficiary out of the proceeds of bills to bepresented under the credit.

Restricted LC: A letter of credit in which negotiation isrestricted to a particular bank.

3/20/2018 59

Page 60: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

It is backup available to the beneficiary (fromissuing bank) in case the applicant fails to pay orperform.

No transport document is required.

3/20/2018 60

Page 61: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Liability of an opening bank in a letter of creditarises, when the beneficiary delivers thedocuments strictly drawn as per terms of theletter of credit. These documents include thefollowing

Bill of Exchange

Invoice

Transport Documents

3/20/2018 61

Page 62: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

The words 'to', 'until', 'from' and 'between' whenused to determine a period of shipment includethe date mentioned and the words 'before' and'after' exclude the date mentioned.

The words 'from' and 'after' when used todetermine a maturity date exclude the datementioned.

The terms 'first half' and 'second half' of a monthshall be construed respectively as the 1st to the15th and the 16th to the last day of the month,all dates inclusive

3/20/2018 62

Page 63: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

The terms 'beginning', 'middle' and 'end' of a monthshall be construed respectively as the 1st to 10th, the11th to the 20th and the 21st to the last day of themonth, all dates inclusive.

Branches in different countries are considered to beseparate banks.

The date of issuance of the transport documents willbe deemed to be date of dispatch, taking in charge orshipped on board and the date of shipment

3/20/2018 63

Page 64: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Transshipment means unloading from one means ofconveyance and reloading to another means ofconveyance.

A clean transpon documents is one bearing no clause ornotation expressly declaring a defective condition of thegoods or their packaging.

If there is no indication in the credit about insurancecoverage, amount of insurance coverage must be at least110% of CIF or CIP value of the goods.

Bill of Lading should be "On Board Bill of Lading". Since Billof Lading is issued in more than one set, all negotiablecopies of bill of lading should be obtained.

Bank should accept Clean Bill of Lading and notconditional one.

Bill of Lading should be presented for negotiation within21 days of shipment.

3/20/2018 64

Page 65: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

If words about is written in LC with quantity or amount,then variation of plus or minus 10% is permitted. If word'about' is not written in LC with quantity or amount, thenvariation of plus or minus 5% is permitted in quantity butnot in amount.

Insurance policy should be in the same currency as those ofLC.

If insurance policy is dated later than the date of issue ofBill of Lading, then it should cover the risk from date of Billof Lading.

If expiry date of LC fails on a holiday declared for banks,then LC can be negotiated on the next workingdayNegotiating, confirming and Issuing Bank are given 5banking days each to scrutinize that documents are as perLC.

3/20/2018 65

Page 66: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

During the course of business, banks are oftenrequired to furnish guarantee on behalf of their owncustomers in lieu of their obligations, performance orengagement.

Used for participation in tenders, in lieu of securitydeposits◦ for capacity to perform contracts,◦ avail concessions in duty on imports.

The guarantee with a maturity of more than 10 yearsonly after prior permission of Higher Authority.

As per RBI guidelines, Banks are required to set up―E-confirmation Cell at Central Office, for electronicconfirmation of genuineness of bank guaranteesissued.

3/20/2018 66

Page 67: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

A guarantee based on location can be either of thefollowing:

Inland Guarantee

Foreign Guarantee

3/20/2018 67

Page 68: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

For discharge of a pecuniary liability of theprincipal debtor on his default.

Broadly they are the guarantees for repayment ofa debt.

Guarantees issued in favour of Income Tax/GSTorin respect of disputed assessment etc.

Guarantee for obtaining mobilisation advance

3/20/2018 68

Page 69: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

When the beneficiary agrees to allow certain advanceto complete the contractual obligations.

Bid bond guarantee:

As and when tenders are called for, the beneficiary askfor a bid bond, being the part of the total contractvalue say 5%.

3/20/2018 69

Page 70: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

The beneficiary as part of the contract, may retainsome portion of the contract amount.

This retained money is released only after beingsatisfied about the project.

Bank issue a retention money guarantee to replacedeposit.

3/20/2018 70

Page 71: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

A guarantee which lays stress on the performance ofcertain acts.

Issued for the due performance of a contract within agiven time frame.

The instances of such guarantees are◦ Bid Bonds◦ Guarantee on behalf of a manufacturing co. in respect of

supply◦ Guarantee on behalf of a contractor for due completion of

work◦ Guarantee in favour of Railways for due performance/licence

fee etc.◦ Export Performance Guarantee

3/20/2018 71

Page 72: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

◦ The all-in-cost per annum , payable for the credit doesnot exceed LIBOR + certain basis points for credit up toone year and LIBOR + certain basis points for credit forperiods beyond one year but less than 3 years, for thecurrency of credit.

◦ ADs shall not issue guarantee letter ofundertakings/credit except with prior approval of thereserve bank.

3/20/2018 72

Page 73: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

In case of purchase of capital goods like machinery,the necessity to issue deferred payment guaranteearises.

Unlike all other L.G.’s, the payment will have to bemade by the banks on the accepted due dates

3/20/2018 73

It is a usance credit where payment will be made bydesignated bank, on respective due dates, determinedin accordance with stipulations of the credit

Page 74: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

1) Only senior level assistants should verify L/C and BG relatedtransactions and reverification by partner and proprietor is must

2) Please read bank’s internal guidelines along with instructionmanual which normally comes along with appointment letter

3) In case of any Doubts don’t hesitate to consult other friendlyBank officers other than Branch/ Bank under Audit withoutdiscussing details and if there is any Fraud immediately are tobe reported to RBI and Police/ CBI and for non-reporting, RBIcan impose penalty u/s 47-A of Banking Regulation Act.Definition of fraud is same as in Criminal Procedure Code.

4) if the audit assignment is for the first time, please study howother banks are opening L/C or BG from inhouse clients. SomeL/C, BG’s are appended herewith of kind perusal of allparticipants.

3/20/2018 74

Page 75: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Having regards to the recent developments following controls have beenintroduced with immediate effect and the branch heads to ensure strictcompliance on ongoing basis:

a) Liability voucher is to be passed in CBS before opening of Letter ofUndertaking (LOU) or other transactions pertaining to Non-financialmessages.

b) Direct message creation has been disabled through SAM for allbranches. Wherever the message is required to be created in SWIFTdirectly, the branches have to approach DC with the details of liabilityvoucher passed in CBS such as reference number, currency, amount anddate. Where liability voucher is not required to be passed the brancheshave to give cogent reasons for the same.

c) Six eye principle is to be followed without exception.

d) Branch head to check every day the details of all SWIFT messagestransmitted / originated from SWIFT directly.

e) Such details are to be preserved permanently.

3/20/2018 75

Page 76: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

Frauds of Rs.1 lac and above should be reported toRegional office of RBI on form FMR 1 within 3 weeks ofthe frauds.

Frauds of Rs.1 crore and above should be reported toCentral Office of RBI on form FMR 1 within 3 weeks ofthe fraud.

3/20/2018 76

Page 77: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

1. Frauds less than Rs.3 crore should be reported to Local Police.2. Frauds of Rs.3 crores and above should be reported to CBI.3. Frauds of Rs.3 crores and above BUT UPTO Rs.25 crores; if staff involvement-report to Anti Corruption Cell to CBI; if no staff involvement then report to Economic Offence Wing of CBI Rs.25 crore to Rs. 50 crores Banking Security ND Fraud

Cell of the CBI of the CBI whether there is staff involvement or not.

More than Rs.50 crores-Joint Director(Policy)CBI, HQ New Delhi.

3/20/2018 77

Page 78: Presented By C.A. Pankaj R. Majithia · Regular Cyber, Admin and Financial audit to confirm the immunity of their swift infrastructure is must to prevent such attacks. It is also

C.A. Pankaj [email protected]

9820122218

3/20/2018 78