Banking

At many banks, Nov. 5 will be a scary day. That’s when broad U.S. sanctions are set to be re-imposed on Iran, thereby placing new pressure on its struggling economy and increasing the regime’s desperation for hard currency. A crucial side effect of this effort has gotten too little attention: Iran will likely attempt to skirt these sanctions through cyber-enabled money laundering — and banks will be a prime target. Cyber-enabled money laundering is a fairly simple concept. Hackers use a bank’s computer system to execute a prohibited financial transaction by altering critical information or disabling anti-money laundering controls. It’s effective because it’s subtle: One need only disguise the illicit purpose or sanctioned participant of an otherwise allowable transaction. Iran certainly has the motive for such attacks. Faced with a weakening currency and a looming recession, it is increasingly desperate to sell oil and obtain dollars to support its currency, finance trade, and fund terrorist groups and proxy wars overseas. Adding to the pressure, recent efforts by the U.S. and the United Arab Emirates have made it harder for Iran to conduct illicit activity through Dubai, its traditional backdoor to the financial system. Iran has also demonstrated the needed capabilities. Starting in 2011, it directed cyberattacks against dozens of U.S. banks, causing millions of dollars in lost business. More recently, its hackers stole at least 31 terabytes of documents and data from U.S. academic institutions, businesses, and government agencies, a theft valued at some $3.4 billion. Given the scale of its hard currency needs, Iran might seek help from other capable countries or criminal groups in conducting new attacks to evade sanctions. The finance industry is largely unprepared for this kind of threat. In recent years, it has focused on preventing large-scale hacks like the one that diverted $81 million from Bangladesh Bank in 2016. Due to its boldness and scale, this attack has been the subject of dramatic press coverage and innumerable cybersecurity sessions at financial conferences. But the window for this type of hack is closing as banks and regulators invest in better technology, monitoring and training to prevent unauthorized transfers of funds. Cyber-enabled money laundering isn’t yet on the radar in the same way, and it could prove harder to prevent. Hackers could subtly alter customer data to avoid sanctions-screening lists or exempt an account from the focused scrutiny that banks apply to clients from sanctioned countries. Bypassed controls at a bank’s far-flung branches represent a particular risk. Denmark’s largest lender, Danske Bank A/S, is facing civil penalties and possible criminal charges after its Estonian branch allegedly laundered as much as $235 billion on behalf of sanctioned Russians. Financial institutions aren’t powerless against this threat. But they must commit themselves to continuous monitoring of account behavior, data integrity, employees and supply chains.   For starters, they should invest in software that establishes an internal distributed ledger system to record critical data, which could make manipulation more difficult. Layering such a system with “context-aware” security features that take into account factors such as location, historical behavior, and multifactor authentication before allowing access or changes can help block anomalous activity. A combination of such features could allow administrators to spot hackers before their system controls have been defeated. A further concern is the manipulation of hardware, which can undermine even the most secure networks. Banks will need to audit their global supply chains to ensure the integrity of computers and network equipment. Storing data in secure clouds and accessing it through virtual desktops can minimize the amount of hardware that must be protected. Yet even the most sophisticated security systems can be defeated by the people who use them. Hackers will continue to use phishing and similar attacks to target careless users. Realistic training coupled with ongoing testing of cybersecurity awareness is essential. An insider threat program that monitors employees with critical access is also vital. Finally, better information sharing among banks, governments and academia would enable an attack against one institution to help inform all the others. An advisory issued by the Treasury Department on Oct. 11 detailing Iran’s efforts to abuse the international financial system is a good example. The resumption of broad U.S. sanctions sets up a serious threat of cyber-enabled money laundering by Iran. But it may also be an opportunity for financial institutions to redouble their cybersecurity efforts to avoid being on the receiving end of new attacks, as well as serious penalties if they’re used to evade sanctions. Financial institutions need to act now to protect themselves, their customers and their countries.

The following is a guest post from Tamar Gutner, associate professor of international relations at American University’s School of International Service, who is writing a book about the birth and design of the Asian Infrastructure Investment Bank. With the Trump administration openly disdainful of multilateralism and many of the international organizations the United States helped create, China is attempting to step into the leadership void by promoting global cooperation and supporting international organizations. The best showcase of China’s leadership aspirations is its regional development bank, the Asian Infrastructure Investment Bank (AIIB), which is holding its third annual meeting on June 25 and 26. When Chinese President Xi Jinping first proposed creating a new Chinese-led development bank to focus on infrastructure development in the fall of 2013, many were suspicious about China’s intentions. After all, the World Bank, Asian Development Bank (ADB), and other regional development banks already operated in Asia, with most lending plenty of money to China. The Obama administration actively lobbied other countries not to join the bank amid concerns it could undermine the others, while unfairly benefitting Chinese companies. The argument was that China’s authoritarian government would be hard pressed to head a user-friendly development bank that followed standards and norms on issues like environment, transparency, and accountability. Now that the AIIB is up and running, we see that it is broadly cut from the same cloth as other development banks, but competition is still likely to be an issue in the future, and suspicions will not quickly disappear.  The AIIB Today Despite U.S. efforts to convince other major donor countries to shy away from the AIIB, none did, except for Japan. Today, the AIIB has the second largest global membership behind the World Bank, with approved membership now standing at eight-six. That compares with 189 at the World Bank’s International Bank for Reconstruction and Development (IBRD), and sixty-seven at the ADB. With $100 billion in capital, the AIIB is a medium-sized regional development bank with total lending to date at around $4 billion. The U.S. concern that the AIIB would deliberately undermine other multilateral development banks (MDB) was overblown. AIIB President Jin Liqun, who was tasked with creating the bank, wanted an institution that would “rest upon multilateralism and international cooperation.” He even brought in recently-retired American World Bank experts to design key parts of the new bank, including Natalie Lichtenstein, the Chief Counsel for establishing the bank, who drafted its charter, and Stephen F. Lintner, the expert who led the design of the new bank’s environmental and social framework. Jin himself also had extensive MDB experience, as a former vice minister at China’s Ministry of Finance who was in charge of the World Bank office, vice president of the ADB, and an alternative executive director at the World Bank. The fact that the AIIB received AAA ratings from top credit rating agencies underscored that it is clearly recognizable as a member of the MDB community, despite its relative youth. The bank’s governance structure is also similar to the other MDBs. It has a board of governors with one representative from each member, a smaller board of directors, and a president. China has the single largest voting share at 26.6 percent, which gives it veto power over major decisions. Jin has said China would not use that power, although there is nothing in the bank’s charter that precludes it from doing so. An important difference between the AIIB and most other major development banks is that the AIIB’s board is nonresident. The AIIB will soon announce another notable difference, an Accountability Framework Regulation, which includes a provision to shift project approval from the board (as it is done at other MDBs) to the president, beginning January 1, 2019, and phased in over several years. The new provision will no doubt increase concerns about how much oversight the AIIB’s board has over the bank’s work. AIIB officials counter that the board will have a stronger oversight function, and that any board member can call for board involvement if there are concerns about a project.   The AIIB has been highly cooperative with other development banks—to date, two-thirds of the bank’s projects are cofinanced. This percentage is likely to decline over time as the young bank gathers momentum, but will likely plateau around 50 percent, according to a senior AIIB official. The bank’s motto is to be “lean, green, and clean,” and the “lean” part reflects its goal to have a small, nimble bureaucracy, while being efficient and cost-effective. The AIIB currently has under a hundred and fifty full-time employees, which is one-tenth the size of the World Bank. While other banks have deeper wells of finance and development expertise to draw from, AIIB is more narrowly focused on infrastructure development in Asia. What About the Future? Clearly, the worst fears about the AIIB crowding out financing from its competitors have not been borne out. More competition between the AIIB and other MDBs is to be expected in the medium term, especially if the AIIB develops a set of specialized expertise. However, it is not uncommon for development banks to vie with one another for projects. The AIIB is not limited to lending in Asia, and its new Strategy on Financing Operations in Non-Regional Members specifies such financing must benefit Asia by supporting cross-country connectivity or renewable energy generation, and in members that are “geographically proximate to and closely economically integrated” with Asia. The bank is currently looking to work in Latin America. Right now, there is a cap of 15 percent on nonregional lending, but that can be revisited by the AIIB’s board in the future. Where it won’t likely be expanding lending for now is China, which has decided to seek few projects from the AIIB. Ultimately, the proof of AIIB’s legitimacy will be reflected in its performance and how it fits with China’s other initiatives and actions. Will the bank follow its state-of-the-art policies? Its projects are still in early stages of implementation. Some international and regional nongovernmental organizations (NGO) are already concerned about how policies are being implemented in specific projects. NGOs are also asking the bank for more clarity in its draft information policy on how it will achieve a culture of transparency. It will also take time to see how AIIB fits in with China’s much larger, amorphous, and less transparent Belt and Road Initiative, originally aimed at building infrastructure from Asia to Europe, but with an ever-expanding geographical scope. AIIB has said numerous times that it is separate from BRI, but the two can intersect in the future, especially if BRI projects meet international standards. India, which does not participate in BRI, is the AIIB’s second largest shareholder and largest borrower to date, and is hosting this year’s annual meeting. One thing is evident: the AIIB gives China increased stature as a leader of an international organization with global membership. China has powerful incentives to keep a close eye on the bank’s performance. But a clear or growing contradiction between China’s actions outside the AIIB and the bank’s policies and goals could still risk turning the AIIB into the Potemkin village of international organizations—a showcase of good intentions in a larger sea of hypocrisy. Other major Western donors decided it is better to be inside rather than outside the AIIB, to ensure their influence. Perhaps it’s time for the U.S. to reconsider its membership, as unlikely as that seems in today’s climate. As Jin has said in the past: “We have a standing invitation [to the United States.] Anytime you think you are ready, pick up the phone, give me a ring.”

In September 2016, the Bank of Japan adopted a new strategy to boost the flagging Japanese economy: “yield curve control,” or YCC. The aim was to widen the gap between long- and short-term interest rates, by keeping shorter-term (10-year) government bond (JGB) rates at 0%, as a means of encouraging bank lending. As shown in top two figures above, it seemed to work. Bank lending growth soared as companies borrowed more for capital expenditures. BoJ Governor Haruhiko Kuroda has trumpeted the policy’s success in boosting lending. As shown in the bottom left figure, though, lending did not increase because of the mechanism underlying YCC—that is, a widening of the gap between what banks pay to borrow funds short-term and what they receive from borrowers longer-term. Banks’ net interest margins actually fell following YCC, only recently recovering to their original levels. Whatever was driving borrowing, it was clearly not YCC’s success in boosting such margins. What happened, then? After YCC was announced, the BoJ’s pledge to hold 10-year JGB rates at 0% pushed bond investors to find yield outside Japan. As shown in the bottom right figure, this caused the yen to fall sharply, which boosted exports. The uptick in bank loans was almost certainly driven by corporates investing in response to export activity, and not greater bank willingness to lend. Since this explanation is transparently logical, it may seem curious that Kuroda chose to ignore it and instead to highlight an explanation unsupported by the data. His reason was almost certainly political. Back in April 2013, shortly after Prime Minister Shinzo Abe took office, the Obama administration admonished Japanese authorities for public statements calling for yen depreciation. Abe and Kuroda learned the important lesson that one may only target the exchange rate if one does not speak of it. Since then, both men have been careful not to attract Washington’s ire by stating the obvious: that in an environment of depressed demand and zero inflation, depreciation works.

  In 2013, I showed that the ECB’s monetary transmission mechanism had broken down in the crisis-hit periphery countries. ECB rate cuts were not being passed on to rate cuts on new loans to businesses. Perhaps the strongest sign that the crisis has ended is that this mechanism has now been restored in the periphery countries. In fact, the link between ECB rates and the rates banks charge on new business loans is now, on average, considerably stronger in the periphery than in the core—as can be seen in the main graphic above. (I use the overnight interbank rate as a substitute for the ECB’s policy rate, as it captures both the ECB’s policy rate and the effects of its QE and lending to banks.) The turning point was the ECB’s June 2014 announcement of a negative deposit rate and cheap long-term loans to banks—known as targeted longer-term refinancing operations, or TLTROs. This is because these new measures have disproportionately benefited periphery banks. Periphery banks borrow from the ECB, and have been able to lower their funding costs by switching into cheap TLTROs—which have gotten cheaper with the decline in the ECB policy rate. Banks in Italy and Spain account for over 60 percent of TLTRO holdings. Banks in the core countries, in contrast, tend to hold funds at—rather than borrow from—the ECB, and have been disproportionately hit by the negative deposit rate. As of June, German banks have €551 billion parked with the central bank, just 4 percent shy of the record set in May. In the first half of 2017 alone, they paid, rather than received, €900 million in interest charges—just marginally below the €1 billion they paid for all of 2016. The ECB’s asset purchase program (APP)—which began in late 2014, and was expanded to include sovereign bonds in 2015—has also disproportionately benefited periphery banks, which made capital gains on their security holdings. Core banks, on average, did not. With lower funding costs from TLTROs, and higher profits from APP, periphery banks have lowered lending rates to business customers considerably more than core banks have, as the small inset graph shows. The health of eurozone banks broadly remains poor. But the fact that ECB policy is once again affecting lending rates across the marks an essential step on the path to a sustained recovery.