In this chapter, we dig deeper into five case studies: JPMorgan Whale, the Archegos Credit Suisse scandal, DNB Bank ASA anti–money laundering failings, UBS unauthorized trading, and the Knight Capital technology glitch.

JPMORGAN WHALE: RISKY OR FRISKY?

Are large losses at banks always a sign of poor governance, or are they sometimes merely the realization of losses that were expected, and even planned for, in the well-governed risk management of the firm? In May 2012, JPMorgan announced that it had lost $2 billion (possibly much more) on a hedging strategy that was being driven by Bruno Michel Iksil, aka “The London Whale,” in its chief investment office. Was this poor governance, or were these losses predictable under JPMorgan's risk management practices? Was this acceptable risky behavior, or was it frisky misbehavior?

You can't win the game all of the time, and for every winner, there is a loser somewhere in the financial system. For each loss event that happens, we should ask the same question: Were these losses within the boundaries of the bank's known risk, or were they out of control?

We have all heard the worn-out caveat “investments may go down as well as up,” and we all know that the banking industry sometimes makes money on its risk-taking activities and sometimes loses it on those same activities. So why all the noise in the press about these JPMorgan losses?

• “London Whale Harpooned”¹
• “JPMorgan's ‘Whale' Causes a Splash”²
• “Beached London Whale”³

Anything over a billion dollars still gets our attention, that's true. But even at that size, the steam would have gone out of the story very quickly if the loss had just been the result of an unfortunate market movement. That would have been a short-lived and dull story about market risk.⁴

So the question is: Was it well-managed risk taking that led to these unfortunate losses, or was there “frisky” behavior in a poorly governed trading desk?

This story had frisky written all over it. Both the Wall Street Journal⁵ and Bloomberg⁶ raised concerns about the size of Iksil's trades earlier in April, and hedge funds quickly responded and set about taking the other side of his trades, betting that the Whale's position was outsized and unmanageable. Jamie Dimon, CEO and chairman of JPMorgan, made comments that he certainly now regrets, calling the concerns raised “a complete tempest in a teapot.”⁷ How was it that outsiders were appropriately concerned about the trading strategy, but the firm itself was not?

Jamie Dimon later admitted,

In hindsight, the new strategy was flawed, complex, poorly reviewed, poorly executed, and poorly monitored. The portfolio has proven to be riskier, more volatile, and less effective as an economic hedge than we thought.⁸

Even JPMorgan's own risk management tools were not working effectively, as Dimon added:

We are also amending a disclosure in the first quarter press release about CIO's VaR, value at risk. We'd shown average VaR at 67. It will now be 129.⁹

Value at risk (VaR) is the strongest tool in the market risk manager's arsenal, providing an indication of the actual current risk taking of the firm measured against its expected levels of risk taking. If it is flawed, then they are flying blind.

These statements made by the senior management team suggested that they might have first learned of the Whale's positions from press reports, a possibility strengthened by the apparent decision to shut down the trading strategy just four days after it hit the press in April—and shutting it down may well have increased the losses, as this caused a sudden change in the market profile of those instruments.

The SEC swiftly opened a review¹⁰ into the accounting practices used by JPMorgan, and the Justice Department opened a criminal inquiry¹¹ into the whole affair. Lawsuits¹² sprang up among disgruntled JPMorgan shareholders. Jamie Dimon, earlier dubbed “The King of Wall Street,” battled sustained negative sentiment and watched his stock price take a beating every time more information hit the press. In 11 painful days JPM stock went from 40.64 to 32.51 and only recovered a little when all banks stocks got a boost on news of good U.S. home sales, as shown in Figure 18.1.

Dimon's rhetoric against regulation on Wall Street was now falling on deaf ears as everyone wondered¹³ how he let such behavior go unchecked in his own backyard.

Risky or frisky? The positions being taken by the chief information office (CIO) desk were not being accurately captured by the firm's risk management tools, the trading was going on with little or no understanding at the senior management level, and the regulators suspected foul play. All this despite the fact that the whole purpose of the CIO desk is to hedge the firm's risk at the highest level and to protect it against large unexpected losses.

This author's verdict: frisky.

JPMorgan released two reports of the event in January 2102,¹⁴ one by an internal task force, and the other conducted independently by the board. In the task force report, they were transparent about their own failings, as summarized by Bloomberg:

In a 129-page report issued yesterday, the bank described an “error prone” risk-modeling system that required employees to cut and paste electronic data to a spreadsheet. Workers inadvertently used the sum of two numbers instead of the average in calculating volatility. The firm also reiterated an assertion that London traders initially tried to hide losses that ballooned beyond $6.2 billion in last year's first nine months.¹⁵

The task force had five key observations:

First, CIO's judgment, execution and escalation of issues in the first quarter of 2012 were poor, in at least six critical areas:

1. CIO management established competing and inconsistent priorities for the Synthetic Credit Portfolio without adequately exploring or understanding how the priorities would be simultaneously addressed;
2. the trading strategies that were designed in an effort to achieve the various priorities were poorly conceived and not fully understood by CIO management and other CIO personnel who might have been in a position to manage the risks of the Synthetic Credit Portfolio effectively;
3. CIO management (including CIO's Finance function) failed to obtain robust, detailed reporting on the activity in the Synthetic Credit Portfolio, and/or to otherwise appropriately monitor the traders' activity as closely as they should have;
4. CIO personnel at all levels failed to adequately respond to and escalate (including to senior Firm management and the Board) concerns that were raised at various points during the trading;
5. certain of the traders did not show the full extent of the Synthetic Credit Portfolio's losses; and
6. CIO provided to senior Firm management excessively optimistic and inadequately analyzed estimates of the Synthetic Credit Portfolio's future performance in the days leading up to the April 13 earnings call. …

Second, the Firm did not ensure that the controls and oversight of CIO evolved commensurately with the increased complexity and risks of CIO's activities. …

Third, CIO Risk Management lacked the personnel and structure necessary to manage the risks of the Synthetic Credit Portfolio.

Fourth, the risk limits applicable to CIO were not sufficiently granular.

Fifth, approval and implementation of the new CIO VaR model for the Synthetic Credit Portfolio in late January 2012 were flawed, and the model as implemented understated the risks presented by the trades in the first quarter of 2012.¹⁶

Jamie Dimon faced a 50 percent pay cut as a result, and many executive team members also saw their compensation significantly impacted.

This internal report focuses heavily on what went wrong in the CIO office, but it does not clearly state the operational risk categories and causes.

Let us look at the two external data providers that we discussed earlier for their view on this event: ORX News Service¹⁷ (ORX) and IBM FIRST Risk Case Studies¹⁸ (FIRST). Both provide details on events that have happened in the industry and offer classifications of the event.

ORX classified the event as shown in Figure 18.2. They selected unauthorized trading as the risk category and inadequate policy/procedure, unauthorized activity, and management/control of staff as the three main causes.

FIRST classified the event as shown in Figure 18.3.

FIRST selected execution, delivery, and process management as the risk category and lists many contributing control factors, also including management, inaction, corporate governance, human errors, and excessive risk taking.

It is important to acknowledge that different interpretations of the Basel II risk categories are common, and external data sources need to be carefully used for this reason.

In the following case studies, you will have an opportunity to read the short descriptions of the event from the perspective of either ORX or FIRST and will determine the appropriate classifications of the risk type and major causes.

REVIEW QUESTIONS