Royal Bank of Scotland has been fined £450,000 by Hong Kong financial regulators after “seriously inadequate” internal systems and controls failed to detect a rogue trader hiding losses worth tens of millions of pounds.
The Hong Kong Securities and Futures Commission (SFC) announced on Tuesday that it has fined the bank HK$6 million (£450,000) for “internal control failures” after unauthorised trades were recorded by an employee at its Emerging Markets Rates business, Ms Shirlina Tsang Pui Yu.
Tsang, who had been working at the firm since 2004, was found to have hidden losses of £24.4 million over a three-year period by regularly cancelling or amending transactions that had been entered into RBS’s internal trading systems.
RBS discovered the trading anomalies in October 2011 and relayed the information to the SFC, though the bank was unaware of the scale of losses.
A subsequent investigation by the SFC found that RBS' risk management and internal controls at its bank’s Emerging Markets Rates business were "deficient and failed to prevent misconduct".
For example, the SFC found a "weak" reconciliation process in place which allowed Tsang to conceal unauthorised trading, as well as revealing a “lack of processes” to monitor trades conducted outside RBS’s office and outside normal business hours via remote access into RBS’s internal systems.
The investigators also found that a computerised system used by RBS to store block leave information failed to “lock out” Tsang from her RBS computer account and prevent access to RBS applications while on leave.
RBS said in a statement: "We put in place a comprehensive remediation programme that strengthened our governance and supervisory oversight, and our control environment. We are pleased that the SFC has acknowledged the immediate steps we took to alert them and the significant measures taken to enhance our internal controls".
Tsang was subsequently sentenced to 50 months in prison after pleading guilty to fraud offences in September 2013.
"RBS acted quickly in alerting the SFC on a Saturday afternoon which in turn led to action being taken that prevented Tsang from leaving Hong Kong. This deserves substantial credit and is the reason why today’s sanctions are not heavier ones," said Mr Mark Steward, the SFC’s executive director of enforcement. "The SFC expects firms to report misconduct concerns immediately, as in this case."
In 2008, French banking group Societe Generale (SocGen) reported a £3.6bn loss due to the fraudulent actions of a rogue trader who used his "in-depth knowledge" of the bank's fraud control systems to circumvent internal checks.
Find your next job with computerworld UK jobs