NEW, DELHI/MUMBAI – The Punjab National Bank branch in south Mumbai sits just down the road from both the Bombay Stock Exchange and the Reserve Bank of India, at a physical center of one of the world’s fastest-growing major economies.
The branch, clad in a stately colonial edifice, is now also at the heart of a fraud case linked to billionaire jeweler Nirav Modi that has shaken confidence in a state banking sector that accounts for some 70 percent of India’s banking assets.
It was here, according to accounts from Punjab National Bank executives and government investigators, that a lone middle-aged manager, later aided by his young subordinate, engineered fraudulent transactions totaling about $1.8 billion from 2011 to 2017.
The bank is investigating how they were able to do so and go undetected for so long. The accounts given by current and former executives suggest an answer as simple as it is alarming: No one was paying attention.
The bank has since stepped up its controls on the use of SWIFT according to memos issued this month. The measures mean only PNB officers will be able to initiate messages on SWIFT, and limits have been placed on the amount that officers can generate.
The still-unraveling story of how the fraud happened — which includes the alleged misuse of the SWIFT interbank messaging system and incomplete ledger entries — points to a breakdown in checks and balances, and standard banking practices.
The apparent failure of anyone to notice the largest fraud in Indian banking history until this January reveals a “rot” in the state financial sector that goes beyond one lender, said Santosh Trivedi, who spent nearly four decades at Punjab National Bank before retiring in 2016 as a senior manager of audit and inspection in the New Delhi head office.
Last month, Punjab National Bank filed an initial criminal complaint with the country’s Central Bureau of Investigation accusing Modi and others of defrauding the bank and causing it a loss of 2.8 billion Indian rupees (more than $43 million).
The allegations against a man whose diamond creations have draped Hollywood stars such as Kate Winslet and Dakota Johnson generated a flurry of coverage across India’s TV screens and newspapers.
Modi and his family left the country in early January.
As more details surfaced about what is alleged to have happened at the state-run bank, which was founded in 1894, the stakes have gotten higher.
A review of bank and government documents related to the case — and interviews with current and former PNB executives, bank auditors and experts — points to a lack of accountability and standards in the country’s public banking system.
As of last September, those banks held about 87 percent of the Indian banking system’s 9.46 trillion rupees (about $147 billion) of soured loans that are nonperforming, restructured or rolled over.
A preliminary investigation by the tax authority said “the hit Indian banks would take in the end may well exceed” $3 billion, according to an internal note.
But despite a promise of action, one current senior executive at the bank’s headquarters in New Delhi said further problems could not be ruled out. “In Indian banks, we don’t work under ideal situation,” the executive said. “We are in the business of risk — you can’t say there won’t be road accidents.”
According to court documents filed by the CBI, a deputy manager at the branch, Gokulnath Shetty, issued a series of fraudulent letters of undertaking — essentially guarantees sent to other banks so that they would provide loans to a customer, in this case a group of Indian jewelry companies.
These letters were sent to overseas branches of banks, thought to be almost all Indian, that would then lend money to the jewelry firms.
Shetty did so using the bank’s SWIFT system to log in with passwords that allowed him, and in at least some instances a more junior official, to serve as both the person who sent messages and as the person who reviewed them for approval, according to court documents and interviews.
Shetty is now in custody and he has not publicly responded to the allegations.
Asked about the password sharing, the senior Punjab National Bank executive said it was not best practice, but in the everyday bustle of Indian banks it happens. “When you are flooded with customers in the morning, with 101 demands, you look for shortcuts,” he said. “You do somebody else’s work, somebody else does your work. You are not working in an ideal situation.”
After entering the transactions on SWIFT, the CBI documents said, Shetty — who worked at the same branch from 2010 to 2017 despite the normal bank practice of initiating regular rotations — did not record them on the bank’s internal system.
Because PNB’s internal software system was not linked with SWIFT, employees were expected to manually log SWIFT activity. If that was not done, the transactions did not show up on the bank’s books.
All together, there were at least 150 such fraudulent letters of undertaking during a seven-year period, according to a CBI official.
In addition to detaining Shetty and the junior employee, the CBI has arrested a man who it described in court documents as both being “aware about the modus operandi of the entire scams” and serving as a director in “15 to 16 companies of Nirav Modi Group.”
An older brother of the man, Hemant Bhatt, said outside a courtroom last Saturday that he was innocent and the allegations were the result of a “media trial.”
An uncle of the junior bank employee, Manoj Kharat, told a reporter outside the court that his nephew was “just following orders of superiors” and added “he wasn’t aware of what he is doing.”
All three are to be held in custody until March 3. No charges have so far been laid against them. Police have searched the bank’s south Mumbai branch and questioned five more Punjab National officials, taking the total number of staffers questioned to 11.
A Feb. 12 note seen by Reuters, sent from PNB to other banks and marked “confidential,” said: “None of the transactions were routed through the CBS system” — the bank’s internal network — “thus avoiding early detection of fraudulent activity.”
The Reserve Bank of India called the fraud at PNB “a case of operational risk arising on account of delinquent behavior by one or more employees of the bank and failure of internal controls.”
The CBI paperwork says the fraudulent letters of undertaking are likely to add up to “the vicinity of” 60 billion rupees (more than $930 million). Bank executives say the amount tallied by working back through internal records is $1.77 billion.
With assets of about $120 billion as of December, according to bank filings, PNB will be able to cover any associated losses, though it is still a huge hit for a bank whose stock market value was only $6.1 billion before it revealed details of the alleged fraud. It has since seen $1.4 billion wiped off that market capitalization.
The mechanics of how the fraud happened, and what it says about the underlying industry culture, are worrying, said Abizer Diwanji, national leader for financial services in India at accounting firm Ernst & Young.
“Checks and balances are there in public banks as well, but they are not followed earnestly,” said Diwanji. “This is where the discipline, the culture is not there. I always believe that we don’t have the culture to manage risks, even operational risks. PNB is not an outlier in this.”
To control such risks, most private-sector banks require branches to route SWIFT messages through their central offices, Diwanji said. They also usually integrate their own software systems and SWIFT, meaning that activity such as a letter of undertaking being sent would get automatically recorded.
Neither is the case at PNB or most state-run banks in India, Diwanji said.
Representatives of two of the external audit firms listed on PNB’s annual report for the 2016-2017 fiscal year said they could not have known what happened.
“It was off-books, so auditors will not be in a position to detect it,” said Sudesh Punhani, a partner at Chhajed & Doshi.
Asked whether the bank’s failure to integrate its software system and SWIFT was a cause of concern, Neeraj Golas, a partner at R. Devendra Kumar & Associates, also an external auditor of the bank, said: “True, true — we have to really get into it and understand what all these things are.”