Rates, Credit, XVA and Risk · Rates, credit & risk

28Operational Risk and Rogue Trading

On 26 February 1995 the London bank Barings collapsed. Its trader in Singapore had run up losses in an account numbered 88888 that London never saw: more than 20 million pounds by the end of 1993, more than 200 million by the end of 1994, and 827 million by the collapse. He was in charge of both the trading and the back office that recorded it; the bank’s internal auditors had recommended in 1994 that he should not be; London had sent him more than 300 million pounds to lend to clients who had posted about 31 million of collateral, and nobody asked why. None of the models of the previous chapters would have measured this risk: the positions were hidden from them. This chapter is about the risk that sits outside the models: operational risk, and its most expensive form in trading, unauthorised positions concealed by the people who run them.

28.1 Operational risk and its measurement

Definition 28.1 (Operational risk, operational loss event)

Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events; it includes legal risk and excludes strategic and reputational risk. An operational loss event is an occurrence of such a loss, recorded with its date, amount, business line and cause.

Operational losses are rare and heavy-tailed: most are small errors, a few are catastrophic. Banks collect them in loss databases, map them to causes and controls, and hold capital against them.

Method 28.2 (The Basel standardised approach)

Compute the business indicator (BI), a measure of the bank’s size from its income statement. The business indicator component (BIC) applies marginal coefficients of 12% up to EUR 1 billion of BI, 15% from 1 to 30 billion and 18% above. Scale it by the internal loss multiplier $\mathrm{ILM} = \ln\bigl(e-1+(\mathrm{LC}/\mathrm{BIC})^{0.8}\bigr)$ , where the loss component LC is 15 times the average annual operational loss of the last ten years. Capital is $\mathrm{BIC}\times\mathrm{ILM}$ .

Example 28.3 (Capital for operational risk)

A bank with a BI of EUR 35 billion has a BIC of $0.12+29\times0.15+5\times0.18 = 5.37$ billion. With average annual losses of 0.5 billion, its loss component is 7.5 billion, its ILM 1.107 and its capital 5.94 billion; with 0.25 billion of losses, the ILM is 0.904 and the capital 4.85 billion.

28.2 The documented cases

Definition 28.4 (Rogue trading, fictitious trade)

Rogue trading is trading beyond a trader’s authority, in size or in kind, concealed from the firm. A fictitious trade is a booking with no economic reality, entered to offset or disguise a real position in the firm’s records.

As of September 2026 — Six cases

Barings (1995): losses of GBP 827 million concealed in account 88888 by a trader who also ran the back office (the Chancellor’s statement on the Board of Banking Supervision’s report). Daiwa (1995): a New York trader lost about USD 1.1 billion on Treasury securities over eleven years, covering the losses by selling securities held in custody and falsifying records; he also ran the custody department (Federal Reserve order). Sumitomo (1995–96): the US CFTC found that after large losses from speculative trading, the company’s principal copper trader engaged in a scheme to manipulate copper prices; the company paid USD 150 million, and in September 1996 put its losses at USD 2.6 billion. Allfirst (1997–2002): losses of USD 691.2 million concealed by fictitious foreign exchange options that appeared to hedge real positions (the parent bank’s annual report). Société Générale (2008): a long position of EUR 49 billion on index futures, built from 2 to 18 January, cost EUR 6.4 billion to unwind, EUR 4.9 billion net of 2007 gains; it was hidden by 947 fictitious trades cancelled before confirmation (the bank’s inspection report). UBS (2011): losses of USD 2.3 billion on an ETF desk, concealed by late bookings, unmatched internal trades and false trades with deferred settlement; the UK regulator fined the bank GBP 29.7 million.

28.3 The control failures they share

Definition 28.5 (Segregation of duties, block leave)

Segregation of duties separates the people who trade from those who book, confirm, settle, value and report the trades. Block leave requires each trader to be away from the desk, with no access to its systems, for a consecutive period each year, so that positions that need daily attention to stay hidden are exposed.

The documented failures share a pattern (Figure 28.1): a trader who controls the recording or custody of his own trades (Barings, Daiwa); internal counterparties and trades that no one matches or confirms (UBS), or confirmations the trader forges (Allfirst); fictitious trades with distant value dates, cancelled before they are ever confirmed (Société Générale); funding that no one reconciles with the positions it pays for (Barings). Each is a link in the chain of controls that the trade was supposed to pass through, and each is broken by one person.

**Figure 28.1.** The chain of controls a trade passes through, and where the documented cases broke it. Each link is independent evidence that the position exists and is what it claims to be. Schematic; cases from the Chancellor’s statement on Barings (1995) and the FSA’s 2012 notice to UBS.

28.4 Detecting fictitious and hidden trades

Surveillance turns the pattern into rules on the trade records: a trade booked long after it was executed; cancellations and amendments around reporting dates, when positions are measured; prices far from the market; internal trades with no matching trade on the other book; settlement dates far in the future, for trades never meant to settle.

def late_booking(t: Trade, hours: float = 4.0) -> bool:
    return t.booked - t.executed > hours


def cancel_amend_near(t: Trade, reporting_times: Sequence[float], days: float = 2.0) -> bool:
    if t.status == "live" or t.status_time is None:
        return False
    return any(abs(t.status_time - r) <= 24.0 * days for r in reporting_times)


def off_market(t: Trade, k: float = 3.0) -> bool:
    return abs(t.price - t.mid) > k * t.spread


def internal_unmatched(t: Trade, ids: set[str]) -> bool:
    return t.counterparty.startswith("INT:") and (t.mirror is None or t.mirror not in ids)


def deferred_settlement(t: Trade, days: int = 30) -> bool:
    return t.settle_days > days

Listing 28.1. Five surveillance rules on a blotter of trades. code/firm/tradecontrol/firm_tradecontrol.py

Example 28.6 (Rules on a synthetic blotter)

A synthetic blotter holds 2 000 genuine trades, with the noise of real operations (4% booked late, a few off-market fills, internal trades of which 2% lack a mirror, cancellations at random times), and 60 trades of a concealment scheme. Alone, each rule catches 23% to 52% of the scheme’s trades, with false-alarm rates from 0.25% (unmatched internal trades) to 4.4% (late bookings). Flagging any trade that breaks one rule catches 88.3% of the scheme at a false-alarm rate of 7.1%, 142 genuine trades to review; requiring two rules catches 61.7% with a single false alarm (Figure 28.2).

**Figure 28.2.** Hit and false-alarm rates of the surveillance rules on the synthetic blotter, alone and combined. No single rule catches most of the scheme; combining them catches most of it, at the cost of alerts that must be investigated. Data: synthetic; the chapter’s tutorial.

Alerts are only as good as their investigation: an alert closed on the explanation of the person it concerns controls nothing. An append-only audit log, in which each entry carries the hash of the previous one, makes the record of trades and of their investigation tamper-evident: an edited entry breaks the chain.

28.5 Tutorial: surveillance on a blotter

Goal. Run the five rules on a synthetic blotter with a planted scheme, measure hit and false-alarm rates, keep a tamper-evident log, and compute operational-risk capital. End state: the numbers of Examples 28.3 and 28.6 and the chart.

Blotter: blotter(), genuine and scheme trades with labels.
Rules: run_rules, evaluate with one and two rules required.
Audit: audit_demo(): the chain verifies, then fails after an edit.
Capital: op_capital(35, 0.5); fig_rc_tradecontrol.py.

What to change next. Weight the rules by their false-alarm rates; add a rule on profits too large for the desk’s risk (a Sharpe ratio above a limit).

28.6 Build: trade control

Purpose. The firm’s surveillance of its own trades: rules on every booking, alert scoring, and a tamper-evident audit log for trades, amendments and investigations.

Interface. Trade; late_booking, cancel_amend_near, off_market, internal_unmatched, deferred_settlement; run_rules, evaluate; AuditLog with append and verify; trade_event.

Rules. Rules are independent and cheap; scores add; alerts are closed only with evidence recorded in the log.

Acceptance tests. code/firm/tradecontrol/tests/: each rule flags its planted case and not the clean one; evaluation arithmetic; the audit chain verifies and detects an edit.

Stretch. Rules on P&L and cash (profits against risk, margin against positions); trader-level behaviour baselines; links to confirmations and settlement data; block-leave monitoring.

Sources and further reading

House of Commons, Hansard, 18 July 1995, statement on the Board of Banking Supervision’s report on Barings.
Financial Services Authority, Final Notice to UBS AG, 25 November 2012.
Commodity Futures Trading Commission, release 4144-98, 11 May 1998.
Board of Governors of the Federal Reserve System, order against Daiwa Bank, 2 October 1995.
Allied Irish Banks, annual report on Form 20-F for 2001 (Allfirst).
Société Générale, General Inspection Department, Mission Green, report of 20 May 2008.
Basel Committee on Banking Supervision, Basel III: Finalising post-crisis reforms, December 2017 (operational risk).

28.7 Exercises

Exercise 28.1 ★

Compute the BIC of a bank with a business indicator of EUR 10 billion.

Solution

Solution of Exercise 28.1.

$0.12\times1+0.15\times9 = \text{EUR}~1.47$ billion.

Exercise 28.2 ★

Why is the ILM equal to one when the loss component equals the BIC?

Solution

Solution of Exercise 28.2.

Then $(\mathrm{LC}/\mathrm{BIC})^{0.8}=1$ and $\mathrm{ILM}=\ln(e-1+1)=\ln e=1$ : a bank whose losses are in line with its size holds the BIC. More losses raise the multiplier, fewer lower it, both less than proportionally.

Exercise 28.3 ★

Which rule would have flagged the UBS scheme’s deferred-settlement ETF trades?

Solution

Solution of Exercise 28.3.

The deferred-settlement rule (settlement dates far beyond the market’s two days), together with the late booking rule, since the FSA found both in the scheme.

Exercise 28.4 ★★

Why is lending GBP 300 million against GBP 31 million of collateral a control signal?

Solution

Solution of Exercise 28.4.

Collateral of a tenth of the money lent means either the clients were given unsecured credit no one approved, or the money was not going to clients at all. Either way funding requests that cannot be reconciled with known positions and clients should stop the funding until they are explained.

Exercise 28.5 ★★

Why does requiring two rules cut false alarms far more than hits?

Solution

Solution of Exercise 28.5.

The rules flag genuine trades for unrelated reasons (a late booking here, an off-market fill there), so two rules rarely coincide on a genuine trade; a concealment scheme breaks several rules at once by design. On the blotter, false alarms fall from 7.1% to 0.05% while hits fall only from 88.3% to 61.7%.

Exercise 28.6 ★★

How does block leave expose a concealed position?

Solution

Solution of Exercise 28.6.

A concealed position needs its fictitious trades rolled, amended and explained every day. With the trader away and locked out, the positions are run by someone else, and breaks, margin calls and unmatched trades surface.

Exercise 28.7 ★★★

Coding. Verify that the audit log detects an edit to one trade’s price, and explain why rewriting the whole chain after an edit would still be detected if the latest hash is stored elsewhere.

Solution

Solution of Exercise 28.7.

audit_demo() returns True before and False after the edit. Rewriting the chain from the edited entry onward produces a consistent chain with a different latest hash; if that hash was copied elsewhere (another system, a daily report, a third party), the rewrite is detected by comparison.

Exercise 28.8 ★★★

Find the flaw. “Our trader’s P&L is steady and high with low VaR; he is our best, and we should raise his limits.”

Solution

Solution of Exercise 28.8.

Steady, high profits with low measured risk are what a hidden position or fictitious hedge looks like: the returns are too good for the risk the firm sees. The right response is to explain the P&L by strategy and risk before raising any limit.

28.8 Problem: January 2008

Problem 28.1

Weekend problem — sizing a hidden position

Société Générale’s inspection report found that a trader built a long position of EUR 49 billion on index futures between 2 and 18 January 2008, discovered on the 20th; unwinding it from 21 to 23 January cost EUR 6.4 billion, or EUR 4.9 billion net of the 1.5 billion his positions had gained in 2007.

Part I — The arithmetic.

Give the average adverse move implied by the loss and the position.
What position would the same loss imply at an average adverse move of 5%?
Why did the unwind itself move the market against the bank?
Assuming an annual volatility of 25% for the shares, what one-day 99% VaR would the position have shown?
Why did the firm’s VaR not show it?

Part II — The controls.

What kind of fictitious trades hide a large directional position?
Which of the chapter’s rules would catch them?
What would confirmations with counterparties have revealed?
Which cash or margin signal should have appeared?
What role does block leave play?

Part III — Detection in practice.

Give the hit and false-alarm rates of the combined rules on the chapter’s blotter.
How many alerts a year would a desk of that size generate, and who investigates them?
Why do alerts get closed without being resolved?
How does the audit log help an investigation after the fact?
What would you add to the rules for a futures desk?

Part IV — Judgement.

Why do rogue traders usually start by hiding losses, not by seeking gains?
Which control is the first line that would have caught it?
How should operational-risk capital reflect such events?
State the named result: the average move implied by the reported loss and position, and the first control in the chain that would have caught it.
In one sentence: what makes a control work?

Solution

Solution of Problem 28.1.

1. $6.4/49 = 13.1\%$ (the net 4.9 billion mixes in the 2007 gains). 2. $6.4/0.05 = \text{EUR}~128$ billion. 3. Selling tens of billions of shares in a few days is a large share of the market’s volume; prices moved against the bank under its own selling. 4. $49\times0.25/\sqrt{250}\times2.326 = \text{EUR}~1.80$ billion. 5. The fictitious trades offset the real ones in the firm’s records, so the net position the VaR saw was small. 6. Trades in the opposite direction with internal or fictitious counterparties, or forward trades that would never settle. 7. Internal unmatched, deferred settlement, cancel-and-amend near reporting, and late booking. 8. Nothing, as the trades were cancelled before their confirmation date; confirming at booking would have shown trades no counterparty recognised. 9. Margin and cash flows on the real positions, far larger than the net position explained. 10. Without the trader to roll and amend the fictitious trades, they break. 11. 88.3% hit and 7.1% false alarms with any rule; 61.7% and 0.05% with two rules. 12. About 200 a year with one rule (142 false, 53 real), about 40 with two, for a blotter of 2 060 trades; control functions independent of the desk investigate them. 13. Too many false alarms, closure on the explanation of the person concerned without evidence, and no escalation of repeats. 14. It shows every booking, amendment and closure with its time and author, and proves the record was not edited. 15. Margin against positions, exchange position reports against the book, and gross against net. 16. A first loss, hidden to avoid its consequences, grows as the trader bets to recover it. 17. A rule on cancelled trades with distant value dates, at booking: confirmation came too late. 18. Through the loss component: the losses enter the average for ten years and raise the ILM. 19. Named result: the January 2008 arithmetic: an unwinding loss of EUR 6.4 billion on 49 billion is an average adverse move of 13.1%; the first control in the chain that would have caught it is at booking: flagging trades with distant value dates that are cancelled before confirmation. 20. It is followed through: every alert closed with evidence, independently of the people it controls.

28.9 Interview questions

Interview question 28.1 ★ risk, bank

Define operational risk. How is it different from market and credit risk?

Solution

Solution of Interview question 28.1.

The risk of loss from failed processes, people, systems and external events, including legal risk. Market and credit risk are taken deliberately for a return; operational risk comes with doing business, has no upside, and is heavy-tailed.

What the interviewer is looking for: the definition and the difference in nature.

Interview question 28.2 ★★ risk

What controls prevent rogue trading? Which ones failed at Barings?

Solution

Solution of Interview question 28.2.

Segregation of duties, independent booking and confirmation, reconciliation of cash, margin and positions, P&L explain, limits, block leave, and investigated alerts. At Barings the trader ran the back office, funding was not reconciled with positions, and exceptional profits were not questioned.

What the interviewer is looking for: the controls and the documented failures.

Interview question 28.3 ★★ developer

Design a surveillance system for fictitious trades.

Solution

Solution of Interview question 28.3.

Feeds from booking, confirmation, settlement and market data; rules like the chapter’s plus behaviour baselines per trader; scores and thresholds tuned on false alarms; case management with evidence and escalation; an append-only audit log; independent ownership.

What the interviewer is looking for: data, rules, scoring, investigation and independence.

Interview question 28.4 ★★ trader

A colleague’s P&L is steady, large and unexplained by his positions. What do you do?

Solution

Solution of Interview question 28.4.

Do not ignore it; ask the desk head and risk for the explanation by strategy, and escalate to control functions if none comes. Unexplained, steady profit is a warning sign.

What the interviewer is looking for: escalation, not investigation on one’s own.

Interview question 28.5 ★★★ bank, risk

How is operational-risk capital computed under the Basel standardised approach, and what are its weaknesses?

Solution

Solution of Interview question 28.5.

Capital is the BIC (marginal coefficients of the business indicator) times the ILM from ten years of losses. Weaknesses: size is a crude proxy of risk, past losses predict tail events poorly, and it gives little incentive for better controls.

What the interviewer is looking for: the formula and its limits.

Interview question 28.6 ★★★ risk

Why do surveillance alerts fail to stop unauthorised trading, and how would you fix it?

Solution

Solution of Interview question 28.6.

Too many false alarms, closure on the trader’s explanation, no escalation of repeats, and investigators who depend on the desk. Fix: combined scores, evidence required to close, repeat tracking, and independent investigators with standing.

What the interviewer is looking for: alert fatigue and independence.

Terms defined in this chapter

See all 2333 terms in the glossary