SFC reprimands and fines The Royal Bank of Scotland PLC $6 million for internal control failings 

The Securities and Futures Commission (SFC) of Hong Kong, has issued a reprimand to The Royal Bank of Scotland Public Limited Company (RBS) and fined it $6 million for internal control failures relating to the detection and prevention of unauthorized trading activities and the conduct of its Emerging Markets Rates business in Hong Kong (Notes 1 & 2).
The action follows an SFC investigation into the systems and controls around RBS’s Emerging Markets Rates Desk in 2011 following the discovery of unauthorized trading activities by one of its traders, Ms Shirlina Tsang Pui Yu (Note 3).
On 15 October 2011 which was a Saturday, RBS contacted the SFC on an urgent basis to report its concerns about unauthorized trading activities by Tsang, who worked on its Emerging Markets Rates Desk in its Hong Kong branch.
At the time of the self-report, RBS had discovered anomalies in Tsang’s trading but did not yet know their scale or the size of any losses. It was later found that Tsang’s unauthorized trading and mis-marking activities, which had taken place over a three-year period, caused substantial losses to RBS totaling GBP24.4 million. Tsang concealed the losses by mis-marking her bond positions and booking, cancelling and amending fictitious bonds and futures trades in RBS’s internal systems.
While Tsang’s misconduct is the primary cause of the losses to RBS, the SFC considers RBS’s risk management and controls over its Emerging Markets Rates Desk were deficient and failed to prevent misconduct like Tsang’s. In particular, the SFC investigation found:

• inadequate and ineffective front office supervision;
• an absence of controls over the process for independent price verification to mitigate the risk of inaccurate marking by traders of their positions, which had allowed Tsang to collude with RBS’s pricing sources to manipulate prices in her favour;
• weak reconciliation process which Tsang exploited to conceal her unauthorized trading (Note 4);
• RBS required traders to mark their positions to market value every day but when Tsang took leave in 2008, 2009 and 2010, her positions were not covered by anyone else resulting in her positions not being independently marked during these periods (Note 5);
• the computerised system used by RBS to store block leave information failed to “lock out” Tsang from her RBS computer account and prevent her from accessing RBS applications while on block leave;
• a lack of processes to monitor trades conducted outside RBS’s office and/or outside normal business hours via remote access i.e., a remote connection to RBS’s internal systems;
• the management information provided to the front office for supervision purposes was unclear and/or inadequate making it difficult for supervisors to detect and question anomalies; and
• there was no training provided to front office in relation to RBS’s front office supervisory policy and to employees who were promoted to supervisory roles as to their responsibilities which created inconsistent standards of supervision in the front office.

RBS’s systems and controls in relation to its Emerging Markets Rates business were seriously inadequate and revealed significant weaknesses in its procedures, management systems and internal controls.
“RBS acted quickly in alerting the SFC on a Saturday afternoon which in turn led to action being taken that prevented Tsang from leaving Hong Kong. This deserves substantial credit and is the reason why today’s sanctions are not heavier ones,” said Mr Mark Steward, the SFC’s Executive Director of Enforcement. “The SFC expects firms to report misconduct concerns immediately, as in this case.”
In deciding the disciplinary sanction, the SFC took into account all relevant circumstances, including RBS’s full co-operation with the SFC’s investigation, no loss to customers, RBS’s clean disciplinary record and its implementation of new governance structures, including front office supervision and new controls over operations, information technology, remote access, business unit control, group internal audit, compliance, block leave and trading books.

Source: SFC

---