RCBC Senate Inquiry: “Mr Senators, I can account for all the US$81mm”
This is a follow-up to my first article THE GREAT BANGLADESH CENTRAL BANK HEIST and updated to cover the Senate inquiry Apr 5, 2016.
I was wrong in my initial gut feel that there was no hacking but purely an inside job because I had surmised that BCB did not have a SWIFT interface. Forensic experts have confirmed that indeed BCB was hacked. However, my proviso was spot on. As I indicated, for hacking to take place, then BCB must have a SWIFT interface. Indeed they do use a SWIFT Alliance package, a third party application that connects their accounting system to the SWIFT system, with a bank network exposed to online connectivity. I also pointed to the issue of non-print out of SWIFT “ack” messages and it seemed BCB indeed had printer malfunction.
What is not known is whether it was the accounting system or the SWIFT Alliance app that was hacked into. Outward remittance transactions could have been inserted into the accounting system which are then automatically picked up by the SWIFT Alliance app and sent into the SWIFT system. Or was the SWIFT Alliance app hacked into and the transactions created there. The latter is more frightening because all banks in the world using the same SWIFT Alliance app may be facing a heightened security risk.
Failure at RCBC
The first line of defense failed at Rizal Commercial Banking Corp, Jupiter branch. There is nothing much that a bank can do if the front office personnel responsible for certain tasks are in cahoots with the perpetrators.
The second line of defense also failed. These are other departments where the transactions relating to the release of cash passed through. The Chief Cashier did not find the unusual amount of peso requested by the branch worthy of query. The Treasury did not find the large amount of retail FX unusual and worthy of query.
The third line of defense rests on the back office in the form of various reports, such as compliance reports, large transaction reports, large balances reports, etc. The automated reporting includes some form of artificial intelligence. These reporting routines are all post-fact activities running on different schedules like end of day, weekly, monthly etc. It seems that up to evening of Feb 11 there was still no alert raised. It is left to conjecture whether this third line of defense would have flagged these transaction had the AMLC not conduct their investigation on Feb 12.
What is tantamount to RCBC negligence is the nonchalant manner of the treatment of the stop payment message from BCB. Dhaka sent the message on Feb 8 which was Philippines holiday. On Feb 9 the message was relayed by RCBC Head Office (by who?) to Jupiter Branch manager Deguita via email! Don’t people talk to each other any more? She allegedly down-played the message and basically ignored it. All hell should have broken loose on the morning of Feb 9 and top brasses all the way to the CEO should have been alerted by the BCB stop payment request. 5 or 6 senior managers should have swooped down on the branch to find out what it’s all about. RCBC is negligent and cannot escape liability for money released from Feb 9 onward.
The fact that RCBC did not inform the Bangko Sentral of the BCB’s problems on Feb 9 is also a sticky point. It was probably a moment of national embarrassment for the Philippines bank regulator in response to their Blangadesh counterpart’s call for assistance on Feb 11 to say “oh, I’m sorry we didn’t know of that”.
Failure by Philippines authority
Philippines bureaucracy and legalistic quagmire cannot cope dealing with a crime in progress. The authorities did not even recognize that before there was money laundering at the casinos, there was a bank robbery. Whilst Anti-Money Laundering Commission did swing into action immediately upon receipt of BCB’s request for assistance on the evening of Feb 11, the Police was nowhere in sight.
The casino part of the investigation is rightly AMLC territory, but the RCBC part is a commercial crime. From the git-go, it was a commercial crime so why was the Anti-Fraud and Commercial Crimes Unit not the initial point of contact. The DILG website spells out the responsibilities of the AFCCU :
“The AFCCU shall be responsible for the monitoring, detection, operation and investigation against crimes involving economic sabotage, commercial crimes and other crimes of similar magnitude. It shall conduct operations against violation of intellectual property rights, optical media piracy and white collar crimes specifically fraudulent and illegal transactions, illegal recruitment, estafa, forgery counterfeiting, bank offenses and credit card frauds.”
Does an AFCCU or AMLC investigation make any difference? I believe so. The two work with a different ethos. AMLC’s approach is very legalistic based, whilst the AFCCU are very action focused and better suited to handle a “hot pursuit” crime. AFCCU investigators would have more staffers versed in commercial and banking affairs and better able to understand the intricacies involved. Lastly and most importantly, AFCCU investigators are likely to be professionally trained in the art of interrogation.
Failures by AMLC
The AMLC made one very critical error in their initial inquiry. They felt that Philrem Services Corp, the remittance company, was not complicit and thus did not obtain a court order to freeze their bank a/cs. It was a wrong judgment call which I put down to inexperience. As I wrote in my first article, the devil in all this is Philrem. Not in the sense that they planned the whole thing, but the one who moved the money.
Anti-Money Laundering Act of 2001 (RA 9160) provided for AMLC to enlist the co-operation of other government entities, and the power to freeze accounts without court order :
“Sec 7 (10) to enlist the assistance of any branch, department, bureau, office, agency or instrumentality of the government, including government-owned and -controlled corporations, in undertaking any and all anti-money laundering operations, which may include the use of its personnel, facilities and resources for the more resolute prevention, detection and investigation of money laundering offenses and prosecution of offenders.”
Sec. 10. Authority to Freeze. – Upon determination that probable cause exists that any deposit or similar account is in any way related to an unlawful activity, the AMLC may issue a freeze order, which shall be effective immediately, on the account for a period not exceeding fifteen (15) days. Notice to the depositor that his account has been frozen shall be issued simultaneously with the issuance of the freeze order. The depositor shall have seventy-two (72) hours upon receipt of the notice to explain why the freeze order should be lifted. The AMLC has seventy-two (72) hours to dispose of the depositor’s explanation. If it fails to act within seventy-two (72) hours from receipt of the depositor’s explanation, the freeze order shall automatically be dissolved. The fifteen (15)-day freeze order of the AMLC may be extended upon order of the court, provided that the fifteen (15)-day period shall be tolled pending the court’s decision to extend the period.
No court shall issue a temporary restraining order or writ of injunction against any freeze order issued by the AMLC except the Court of Appeals or the Supreme Court.
AMLC has the right to issue a freeze order on the 5 a/cs at RCBC on Feb 12 when they started investigation, but instead waited till the court order was received on Mar 1. Not that it would have helped because the money was gone from these a/cs.
AMLC investigation hit a dead wall at the casino because they could not obtain banking info due to banking secrecy. They need not go to the bank but to simply request the casinos for their bank statements. Had the casinos refused to co-operate, there are 2 ways to make them do. (1) Threaten to freeze the a/cs of the casinos which would have crippled their operation, they will put everything on the table for AMLC. (2) Pagkor is a government entity so they could have been roped in as casino regulator to solicit Midas and Solaire’s assistance. The two casinos are under no fiduciary nor statutory restrictions to provide certain critical info.
And here’s the kicker — AMLC should have focused on info relating to Gamblers identity and details of chip encashment by the Gamblers thus allowing for “hot pursuit” of the money trail. Once again, inexperience of a ‘hot pursuit’ investigation is evident as well as knowledge of casino operation.
The Senate inquiry – an act of criminal incompetence
The hastily convened Senate inquiry is an act that borders on criminal incompetence. It is a coup de grace to any further criminal investigation by the police.
A cardinal rule in interrogation: All potential suspects must never ever be interviewed in the presence of each other in the same room. The Senate inquiry trampled on this cardinal rule, thereby allowing real time calibration of collaborative answers by all concerned. It also prevented those interviewed of offering answers which they may have been more forthcoming in a private session. (Deguita’s decision for an executive session was a wise move.) With everything out in the open, the Senate has denied Police investigators a trump card. When Police interrogates a suspect, he or she does not know what the other co-suspects will say. It’s an angle that allows the Police to drill into inconsistencies that force suspects into corners.
There is a world of difference in investigations by AMLC, the Senate and the AFCCU (Police) and it’s all in the words. AMLC and senate enquire, inquire, ask, and interview. The Police conduct interrogation. (Both collect affidavits and evidence). The Senate invites “resource persons”, the Police treat them as suspects or persons of interest. Philippines police do have the skills in the art of interrogation employing stuff like Reid’s technique, deception, threats, verbal and non-verbal cues, good-cop-bad-cop ploy, etc. AFCCU will also employ other means in their investigation, such as shadowing suspects, speaking to neighbors, friends, observation of body languages, etc. Take for example the evidence of one Agarrado, an RCBC reserve officer, who testified that he saw Deguito loading 20mm pesos into her car. Given the situation, investigators would be wary of any witnesses’ testimony. One would have wanted to know why he happened to be there, what did he say and to who, if he felt something unusual, why did he not report to his superiors etc. Not all such questions were asked, but Senator Rector mentioned something about shifty eyes.
A Senate inquiry is supposedly for the purpose of aiding legislation. Why oh why couldn’t this be timed after Police or AMLC have completed their investigations. That certain information or knowledge has now come to light because of this inquiry should not detract from the fact that AFCCU or AMLC could also have arrived at a better understanding of the matter.
The Senate inquiry is put up on You Tube to teach all potential crooks the inner workings of banking, it’s weaknesses, its trap-doors, and how to evade bank and Philippines authority scrutiny.
The world set down to watch silly lines of questioning such as :
- Senator Sotto : What does SWIFT stand for? (meaning I never do my homework).
- Senator Enrile : Do you know who are the hackers? You are investigating, don’t you want to know? (AMLC atty was dumbfounded for a few seconds and who could blame her).
- Many others : Questions that lead to nowhere.
- And for a few minutes there was Sen Enrile trying to politicize the matter of who left out the casinos in the AMLA.
I am encouraged by the younger senators Aquino and Angara. Their questions are focused that led to desired objectives. It’s irritating to see senators pop in occasionally instead of committing full time like some others. Bets are on as to whether Senator Ejercito will attend again now that he has attained fame in the Panama Papers.
I give a high score to the RCBC Atty Marcel Estavillo for her absolutely concise responses and contribution which were well articulated. There was an excellent discussion on the problems of banks being put on notice in a stop payment request, something that I touched on in the first article.
1. The greatest looser is Lorenzo Tan, RCBC President. Deguito’s unverified and unsubstantiated comment of her misplaced trust in the CEO unfairly paints him as a suspect at this stage. He fumbled at several questions and was unable to explain some RCBC processes. In fact, he didn’t even know what SWIFT stands for. All these unfairly reflects his standing in an uncomplimentary way. The fact is that top brass often do not know operations in detail and there is nothing wrong in that. Their responsibility is in the big picture, not tiny details. Often, top managers parachuted into their positions either on the basis of connection or academic brilliance do not know the details. In banking, Operations head often rise from the ranks because a wide and in=depth knowledge of so many aspects of the organization is critical to function effectively.
2. As a paying banker, the FEDS owe no responsibility to BCB on whether the payment is correct. They only concern themselves if they are authentic, which as far as SWIFT messages were concerned, they were. When they felt something was wrong, FEDS suspended payment and requested BCB for various additional details. I hope bankers here have taken note and passed on the lessons to their staff. What the FEDS did was anti-money laundering gear kicking in.
3. All the $850mm blocked by the Feds were destined for RCBC for the same 4 fictitious beneficiaries. That is good news in that there is no industry problem. The cancer is isolated at RCBC.
4. It boggles the imagination to think that almost $1 billion of funds was planned to come in and out of RCBC in one day. How could they shield a foreign exchange conversion of that magnitude? The Philippines daily peso/US$ FX volume is only about US$650mm. However, one underestimates the conspirators’ intelligence at one’s peril. One thing is for sure, the involvement of higher level management across several banking depts is a certainty.
5. The question of Philrem. From day one, I have seen Philrem’s role as dubious. It is not even a money changer, but a pure remittance play. Even though banks are big institutions, they deal with money changers fairly regularly. Banks carry very little foreign cash, so on the occasion when the need arises, they deal with money changers as an intermediary. In the case of Inward Remittances, there is absolutely no necessity for RCBC to deal with a third party remittance company. Only Senator Angara questioned this redundancy of Philrem.
What then was the role of Philrem? It was simply to take out the funds from RCBC quickly, arrange for the conversion to pesos, and obfuscate the delivery to final beneficiaries by layering. Smart as they are, Philrem’s grave error was to go back to RCBC to do the FX thereby creating an additional money trail. That demonstrates Philrem’s lack of capacity to convert the large sum of US$ currency outside of the banking system because they are not money changers.
Philrem declared in the first inquiry they converted US$63mm to peso and remitted Php 1,473mm to Solaire, Php 1,000mm to Eastern Hawaii, and handed to Weikang Xu in cash Php 0.6mm + US$18mm. If this is correct, they handed over US$ 63mm (US$81-US$18) in peso equivalent of Php3.073mm. That would mean they converted the US$63mm at a rate of 48.8 which means they would have lost their pants as market rate is about 46.2. Their loss would be Php 308mm, but Philrem said their profit was Php 10 mm which they are prepared to return to Bangladesh. The mathematics do not add up.
Solaire said they received Php 1.365mm and Wong confirmed Eastern Hawaii received Php 1,000mm and he (not Weikang Xu) received cash Php 0.4 mm and US$5mm. That makes a total of Php 2,765mm converted from the US$63mm. The rate would have been about 43.9 compared to market rate of 46.2 which means Philrem made a whopping profit of Php 146mm. This is a more believable accounting. However, that leaves the question of a missing cash of US$ 13mm (US$18 mm – US$ 5mm) that Philrem handed to Xu/Wong.
Philrem and Wong presented different versions of not only quantum of cash handed over but the manner of the delivery. It reminds me of movies where, after a successful robbery, the team members cannot agree on loot sharing and started shooting each other.
For a conspiracy involving almost $1 billion, there must have been an elaborate plan. The unfortunate event that only $81mm came in must have frustrated that plan somewhat, leading to an untidy way of moving the funds out of RCBC and inconsistencies in statements given to investigators.
Rappler report described Philrem’s involvement in other cases of notoriety.
6. On Pagcor : The greatest stink of money laundering legislation is not the exclusion of casinos in the Anti-Money Laundering Act 2001. It is the fact that Pagcor is both the industry regulator and a casino operator. Conflict of interest is written all over and it is so strange that a country with great predisposition to legal correctness never addressed this. When Pagcor lobbied for the exclusion of casinos in AMLA were they doing it as a regulator, or as casino operator?
At the inquiry, a person no less than the chair of Pagcor attempted to deride the perception of ease of money laundering at casinos. He pointed out that in VIP Rooms they use dead chips which cannot be exchanged for cash. But he was not pushed to give a full explanation, which would have exposed his folly and lack of understanding. The world reels in horror to see the chair of a regulating body unable to discern the avenue of money laundering in a casino VIP room.
Casino VIP Room Operation
It seems many in the anti-money laundering investigation do not even really understand the operation of the VIP Room of the casinos. It is incumbent upon investigators to understand the game, and to know the roles of all those named in the inquiry (Kim Wong, Eastern Hawaii, Bloomberry, Weikang XU, Gao and Ding). An explanation here is in order so you can see clearly how money can be laundered.
The VIP Room Operation is a business model of casinos in Macau. Casinos have the usual mass market part of the business where customers register-in, buy cash chips and play. When they are done, the customers exchange their cash chips in return for cash. The VIP rooms are dedicated for the high-volume international players and are run more on a personal network basis. Basically you can view a VIP room as a mini casino within a casino, with its own cages and tables, although the game variety will be limited, mostly to just baccarat.
Philippines casinos adapted the Macau model, with variations as to profit sharing and commission schemes, but basically similar. Between Promoter and Casino there is obviously some profit-sharing scheme. Junket Operators earn commissions, with bonuses for high volumes. In Macau, Malaysia, Singapore the commission is in the region of 1% – 1.25%.
VIP does not necessarily mean the Gamblers are all high rollers in the Las Vegas sense. It’s just Promoter-recruited gamblers (through his Junket Operators) gaming in their private room, with a process and systems mechanism that allow for tracking individual Gambler’s game for the purpose of facilitating profit and commission computation.
The parties involved :
- The Casinos: (Midas Casino, Bloomberry operated Solaire Casino)
- VIP Room Promoter: (Eastern Hawaii – owned by Kim Wong) This may be a private individual or a corporate entity. The Promoter and Casino has a contractual agreement which spells out various terms and conditions, such as the tenor. The Promoter operates the VIP room and engages their own Junket Operators.
- Junket Operators: (Gao Shuhua and Ding Zhige) They bring in the customers for their respective Promoters. They target their prospects mostly through network introductions, thereby indirectly doing promotion for the Casinos.
- Gamblers: (????) They play in the particular VIP room of the Junket Operator who brought them in.
Credits or loans:
The Casinos do not grant loans to players. Promoters maintain certain deposits with the Casinos as security for their normal business operation. Junket Operators offer credits to their Gamblers, hence they are the ones that bear the credit risks.
The dead chips :
These are special chips used as bets only in the VIP Rooms. They cannot be exchanged back for cash. The sole purpose is to enable the casino to track a Gambler’s play. It is also to ensure that Gamblers have played. That is because when these Gamblers come to play, they are feted like VIPS — free accommodation, meals, and maybe some un-mentionables. So they are not going to get freebies on the house without playing.
How the game is played:
- Obtaining the dead chips:
- Casino loans dead chips to Promoter. Promoter loans the chips to their Junket Operators. Junket Operators loan chips to their Gamblers.
- When big games are played, most likely the dead chips are sold COD.
- Playing the game:
- The game is played between the Gambler and the Casino. All bets are placed in dead chips. If the Casino wins the round, it collects the dead chips. If the Gambler wins, he retains the dead chips that were placed as bets, and the Casino pays his winnings in cash chips. So it is a process by which all the dead chips end up with the Casino, and the Player accumulates cash chips. The cash chips cannot be used as bets.
- All the dead chips that the Casino wins back from the Player are said to have been “played”. The Junket operator commission is based on these “played” chips.
- “Dealing” or “Rolling” by Junket Operator:
- During the game, the Gambler will find his Junket Operator often by his side, like a good pal. Actually, his job is to encourage the Gambler to play and continually roll his chips. As the Gambler builds up his cash chips and his dead chips diminish, his Junket Operator will encourage him to exchange his cash chips for more dead chips to play. If he has no more dead chips and no cash chips, the Junket Operator is more than willing to loan him more dead chips.
- Paying for the dead chips:
- At the end of the session, the Gambler exchanges the cash chips for cash (or cheque if it’s a large amount), pays his Junket operator for the dead chips. Junket Operator pays Promoter for the dead chips. Promoter in turn pays the Casino for the dead chips.
All games are statistically stacked in favor of the Casino, so more often than not, the Gambler makes a loss and creates a debt to his Junket Operator. He goes licking his wounds in the free hotel room, orders his free meal, have a free massage (all on the Casino)…. later on he strategizes how to explain to the wife for the losses.
Money laundering at the casino VIP Room
So how is money laundered? Dirty money is brought in to pay for the dead chips. These are money that you cannot explain to the bank when you deposit them, such as proceeds from drug sales. In the casino, the money launderer uses the dirty money to buy dead chips, which are all “played”, and he ends up with lots of cash chips. He exchanges all the cash chips for a cheque from the Casino, then goes to the bank to deposit as gaming wins. For larger sums, he probably has the casino wire transfer for the money to a foreign account. Obviously, money launderers expect heavy losses in their casino games, such is the cost for cleansing their money.
Where is Bangladesh Central Bank’s money?
According to Solaire, Philrem remitted Php 1,365mm to their bank a/c for the a/c of 2 Junket Operators the names of which they refuse to divulge for client confidentiality. Php 107.8mm of this is left. The rest have been ‘played’..
Kim Wong said the Php 1,000mm remitted to Eastern Haiwaii’s bank a/c and Php 400,000 and US$5mm cash he received, came from 2 Junket Operators (Ding Zhige and Gao Shuhua). Of this sum, Php 450 mm was loan repayment by Gao to him and there is a balance of US$4.63mm left at Eastern Hawaii. The rest has been “played”.
Philrem says they hold Php 10mm as their profit for their remittance services.
By my account, about Php 2,260mm dead chips were played. How much cash chips did the Gamblers win? Who were the Gamblers and how did they encash the cash chips — by cash, cheques or wire transfer? The figures are unclear at the moment. Chances are the money has been wire-transfered out to Hong Kong long ago. It is not likely to be in China because of restrictions of movement of capital there. Very unfortunately, with all these delays in the investigation, the money transfers would have been layered beyond recognition and most probably into the final stage of money laundering — re-institution into normal economic activity. Bangladesh ambassador said he had high hopes of early recovery of the money from Philippines. Sorry to disappoint.
To summarise, BCB’s US$81mm can be accounted for as follows :-
- Php 450mm used to repay loan to Kim Wong
- Php 10mm FX profits retained by Philrem (according to them)
- Php 107.8mm balance in deposit money at Solaire Casino
- US$4.63mm balance deposit money at Eastern Hawaii (Kim Wong)
- Php ??? share of net profits of Midas Casino
- Php ??? share of net profits of Eastern Hawaii
- Php ??? net profits of Solaire Casino
- Php ??? commissions to Junket Operators
- Php ??? gaming tax paid to government
- Php ??? cash chips won by Gamblers (probably ended up in Hongkong)
- US$ 13mm missing (discrepancy between Philrem and Wong’s accounting for cash handed over).
- Php 136mm suspected foreign exchange earned by Philrem (Php146 – Php10 declared in (2))
Items (5) to (10) figures can be provided by the casinos. Dis-regarding the overheads charged in arriving at the casinos’ net profits (remember the Gambler’s free massage etc?) and give and take 5% error, that would probably be where all those money went into.
If you believe the Php 450mm was for loan repayment to Kim Wong, you must most likely have been born yesterday. I contend that items (1), (2), (11) and (12) are now the subject of great intense squabbling. Local co-conspirators now battle it out for a share of the loot, but after accounting for the payolas or payoffs for a band of fringe actors playing out the sub-plot scripts planting innuendos — I saw her there, she offered me millions, he was with them, he know him — so many sub-plots to unravel.
Adding items (1), (2), (11) and (12) the total is roughly 25% of the US$81mm. This is an interesting number. The often touted going rate for money laundering is about 30%. Senator Osmena in fact also mentioned this figure.
A China story
Could the release of the RCBC funds be stopped had it occurred in another country? Yes I believe so. Probably not all but a substantial part of it. Commenter Joe Can contributed a story of an illegal funds transfer by Mattell from Los Angeles USA to a bank in China was frustrated by Chinese police dashing to the bank on the basis of what? – an FBI request. You can argue all the legalities, the end result was Mattel got their money back. That’s what mattered.