After the global financial crisis, clearing corporations or Central Counter Parties (CCPs) have become the focal point of systemic risk. I think that globally banks have become stronger as a result of Basel 3, but clearing corporations have become weaker as they have started clearing OTC contracts where there is poor liquidity and price transparency. Competition among CCPs has led to a race to the bottom where the CCP with the worst risk management grabs market share in the newly opened up markets.
Regulators have been slow in addressing the problems of CCP regulation. Much of the discussion has focused on margins and capital, but this is too narrow a view of what a CCP needs to manage defaults without creating systemic risk. This is where I keep coming back to what I call the 3 Cs – cash, capital and (operational) capability.
Cash: A CCP first of all needs cash to meet its settlement obligations to the non defaulting side when it faces a default by a large counter party. Given the rigid times lines of the clearing process, this liquidity is needed at very short notice. In my view, the only credible provider of liquidity in that time frame is the central bank. I have argued for years (probably decades) that a CCP needs discount window access at the central bank, but this solution presumes that the CCP has an abundance of discount window eligible collateral.
Capital: The moment a CCP takes over a defaulted position, it is exposed to market risk on the position until it is able to unwind the position and restore a matched book position. In periods of market stress, orderly liquidation would happen over time frame of several days if not weeks. I recall the long liquidation period involved when LCH unwound the interest rate positions of Lehman after the latter’s bankruptcy or Singapore liquidated the Barings Bank position after the Nick Leson episode. During this period, the CCP needs capital to absorb the market risk and to credibly continue its business as a CCP.
Capability: In my view, many CCPs and their regulators underestimate the importance of operational capability to liquidate positions. It requires access to talented traders with the skill required to trade large positions at times of market stress. It could require access to related markets to lay on proxy hedges; depending on the contract involved, access may be required to index futures, currency futures, foreign derivative markets, spot commodity markets, OTC derivative markets and so on. All this would require pre-existing brokerage relationships and ISDA documentations (in case of OTC derivatives). LCH solves the problem by imposing a legal requirement on its members to provide highly capable traders on secondment to manage a default. During the Lehman default, CME dealt with the problem by conducting an auction of defaulted positions, but this may not always be possible. In my experience, many large CCPs have not even conducted mock drills of managing very large defaults. They tend to believe that their success in managing small defaults proves their operational readiness. I think this is a mistake.
It is my belief that regulators have not taken an integrated view of the 3 Cs and have focused excessively on margins and CCP resolution as the solution. The problem with this approach is that it creates the risk that the CCP would take steps that create massive systemic risk in its efforts to protect itself. A CCP with inadequate cash, capital or capability gets so scared of a potential default that it takes recourse to pre-emptive margin calls or market distorting regulatory measures to ward off a threat to its own solvency. At a time of market stress, these actions are destabilizing and can become a source of systemic risk.
Wed, 15 Jun 2016
I wonder whether someday the Swiss would be tempted to simply demonitize the 1000 franc note and earn a windfall gain. After falling for decades, Swiss currency in circulation started rising after the global financial crisis and is now higher than at any time in the last 35 years. Notes in circulation are now well above 10% of GDP and the 1000 franc note accounts for 62% of this or over 6% of GDP. The Swiss central bank publishes a nice set of tables and graphs about all this. Even the US whose currency circulates so widely all over the world (half of all US currency is estimated to circulate outside the US) has a currency to GDP ratio of only about 8% (currency data from the FED and GDP data from the BEA).
As Swiss interest rates remain in highly negative territory (-0.75% at the short end and negative all the way to 30 years), the extremely high denomination 1000 franc note has become very attractive to investors. It is conceivable that if this environment persists Swiss currency might approach 15% of GDP and the 1000 franc note might by itself edge close to 10% of GDP. In a regime of negative interest rates, currency is not a source of seigniorage, but is a costly form of borrowing. At some point, the Swiss may well start thinking about just extinguishing this liability and earning a windfall gain of more than 5% of GDP.
I am not talking about an outright default. The Swiss could start by citing the decision of the European Central Bank (ECB) last month to “permanently stop producing the €500 banknote ... taking into account concerns that this banknote could facilitate illicit activities”. They could say that in accordance with global best practices, they too are abolishing the 1000 franc note. Unlike the ECB which retained the existing notes as legal tender, the Swiss could require holders of the 1000 franc note to exchange them for lower denomination notes or bank deposits. The sting in the tail would be a statement that the exchange would be carried out in accordance with the Financial Action Task Force (FATF) recommendations that require member states to seize and confiscate proceeds of money laundering and property involved in financing of terrorism. Therefore, holders of 1000 franc notes would be required to establish their identity as well as the source of the funds.
It is a fair assumption that a significant fraction of the 1000 franc notes will not be tendered for exchange under these conditions, and the Swiss would have made a profit of several percentage points of GDP. The question to my mind is how large that number would need to be for the Swiss to be tempted.
Fri, 10 Jun 2016
The global financial crisis led to a lot of turmoil in derivative markets and large players introduced a number of changes in their valuation models. Acronyms like CVA (Credit Value Adjustment), DVA (Debit Value Adjustment) and FVA (Funding Value Adjustment) became quite commonplace. Of these, CVA and DVA have strong theoretical foundations and have gained wide ranging acceptance. But FVA remains controversial as it contradicts long standing financial theories. Hull and White wrote an incisive article The FVA Debate explaining why it is a mistake to use FVA either for valuing derivative positions on the balance sheet or for trading decisions. But four years later, FVA shows no signs of just going away.
Three months back, Andersen, Duffie and Song wrote a more nuanced piece on Funding Value Adjustments arguing that FVA will influence traded prices, but not balance sheet valuations. I have written a simplified note explaining the Andersen-Duffie-Song model, but at bottom it is a capital structure (debt overhang) issue than a derivative valuation issue.
Consider therefore a very simple capital structure problem of borrowing a small amount (say 1 unit) to invest in the risk free asset. The qualifier “small” is used to ensure that this borrowing itself does not change the company’s (risk neutral) Probability of Default (PD), Loss Given Default (LGD) or credit spread (s). From standard finance theory we get s=DL/(1-DL) where the expected Default Loss (DL) is given by DL=PD×LGD. For simplicity, we assume that the interest rate is zero (which is probably not too far from the median interest rate in the world today).
At default (which happens with probability PD), the pre-existing creditors pay only (1-LGD)(1+s) to the new lender and receive 1 from the risk free asset for a net gain of LGD-s+s×LGD. The expected gain to the unsecured creditors is therefore: PD(LGD-s+s×LGD) which after some tedious algebra reduces to (1-PD)s
If there is no default (which happens with probability 1-PD), the shareholders pay 1+s to the new lender but collect only 1 from the risk free asset. The expected loss to them is (1-PD)s which is the same as the expected gain to the pre-existing creditors.
The transaction does not change the value of the firm, but there would be a transfer of wealth from shareholders to pre-existing creditors. Somebody who owns a vertical slice of the company (say 10% of the equity and 10% of the pre-existing debt) would be quite happy to buy the risk free asset at its fair value of 1, but if the shareholders are running the company, they would refuse to do so. (This is of course the standard corporate finance result that a debt overhang causes the firm to reject low-risk low-return positive NPV projects because they transfer wealth to creditors). The shareholders would be ready to buy the risk free asset only if it is available at a price of 1/(1+s). At this price, the shareholders are indifferent, the pre-existing creditors gain a benefit and the counterparty (seller of the risk free asset) suffers a loss equal to s/(1+s). The price of 1/(1+s) includes a FVA because it is obtained by discounting the cash flows of the risk free asset not at the risk free rate of 0, but at the company’s funding cost of s.
Now consider a derivative dealer doing a trade with a risk free counterparty in which it has to make an upfront payment (for example, a prepaid forward contract or an off-market forward contract at a price lower than the market forward price). If the derivative is fairly valued, the counterparty would be expected to make a payment to the dealer at maturity. From the perspective of the dealer, the situation is very much like investing in a risk free asset (note that we assume that the counterparty is risk free). The shareholders of the derivative dealer would not agree to this deal unless there were a funding value adjustment so that the expected payment from the counterparty were discounted at s instead of 0.
Now consider the opposite scenario where the dealer receives an upfront payment and is expected to have to make payments to the counterparty at maturity. This is very much like the dealer taking a new loan to repay existing borrowing (Andersen-Duffie-Song assume that the dealer uses all cash inflows to retire existing debt and finances all outflows with fresh borrowings). There is no transfer of wealth between shareholders and creditors and no funding value adjustment.
The result is the standard FVA model: all expected future inflows from the derivative are discounted at the funding cost and all expected outflows are discounted at the risk free rate. This is because the future inflows require an upfront payment by the dealer (which requires FVA) and future outflows require upfront receipts by the dealer (which do not require FVA).
Andersen, Duffie and Song correctly argue that (unlike CVA and DVA) the FVA is purely a transfer of wealth from shareholders to pre-existing creditors and is not an adjustment that should be made to the carrying value of the derivative in the books of the firm. This part of their paper therefore agrees with Hull and White. However, Andersen, Duffie and Song argue that in the real world where shareholders are running the company, the FVA would be reflected in traded prices. Dealers would buy only at fair value less FVA. They argue that this is quite similar to a bid-ask spread in market making. The market maker buys assets only below their fair value (bid price is usually below fair value). Just as for liquidity or other reasons, counterparties are willing to pay the bid ask spread, they would be willing to pay the FVA also as a transaction cost for doing the trade.
I wonder whether this provides an alternative explanation for the declining liquidity in many markets post crisis. Much of this has been attributed to enhanced regulatory costs (Basel 3, Dodd-Frank, Volcker Rule and so on). Perhaps some of it is due to (a) the higher post crisis credit spread s and (b) greater adoption of FVA. The increasing market share of HFT and other alternative liquidity providers may also be due to their lower leverage and therefore lower debt overhang costs.
Thu, 09 Jun 2016
I had a short blog post on the Bangladesh-Bank SWIFT hacking shortly before I went on a two month long vacation. Since then, the story has become more and more frightening. It is no longer about Bangladesh Bank and its cheap routers: the hacking now appears to be global in scope and sophisticated in approach:
- BAE Systems have identified parts of the malware that was used in the Bangladesh-Bank hacking. This malware “contains sophisticated functionality” and “appears to be just part of a wider attack toolkit”.
The tools are highly configurable and given the correct access could feasibly be used for similar attacks in the future.
The wider lesson learned here may be that criminals are conducting more and more sophisticated attacks against victim organisations, particularly in the area of network intrusions (which has traditionally been the domain of the ‘APT’ actor).
- More than a year before the Bangladesh-Bank hacking, a total of $12 million was stolen from Banco del Austro (BDA) in Ecuador through SWIFT instructions to Wells Fargo in the US to transfer funds to a number of accounts around the world. The matter came to light only when BDA sued Well Fargo to recover the money.
Neither bank reported the theft to SWIFT, which said it first learned about the cyber attack from a Reuters inquiry.
In 2015, there had been an attempt to steal more than 1 million euros from Vietnam’s Tien Phong Bank through fraudulent SWIFT messages using infrastructure of an outside vendor hired to connect it to the SWIFT bank messaging system. TP Bank did not suffer losses because it detected the fraud quickly enough to stop the transfers.
SWIFT now admits that there were “a number of fraudulent payment cases where affected customers suffered a breach in their local payment infrastructure”. The whole set of press releases issued by SWIFT on this issue is worth reading.
The picture that emerges out of this is that on the one side there are well organized criminals who are building sophisticated tools to attack the banks. They may or may not be linked to each other, but they are certainly borrowing and building on each others’ tools. Their arsenal is gradually beginning to rival that of the APT (Advanced Persistent Threat) actors (who are traditionally focused on espionage or strategic benefits rather than financial gains). Very soon global finance could be attacked by criminals wielding Stuxnet-like APT tools re-purposed for stealing money.
On the other side is a banking industry that is unable to get its act together. Instead of hiring computer security professionals to shore up their defences, they are busy hiring lawyers to try and deflect the losses on to each other. It is evident that the banks are not sharing information with each other. Worse, my experience is that information is not even being shared within the banks. I have heard horror stories in India of security firms who have detected vulnerabilities in the IT systems of banks being told by the IT departments not to mention these to the top management. These IT people think that everything is fine so long as top management does not know about the problems. The top management in turn thinks that things are fine so long as the regulator does not know that there is a problem. I hear reports of banks quietly reimbursing a customer’s losses without either fixing the problem or reporting it to the regulators or other authorities. Most of the stories that I hear are from India, but the evidence suggests that the situation is not any different elsewhere in the world.
This state of denial and discord in the banking industry provides the hackers the perfect opportunity to learn the vulnerabilities of the banks, improve their hacking tools, and increase the scale and scope of their attacks. At some point, of course, the losses to the banking system would become too big to sweep under the carpet. That is when the confidence in the financial sector would begin to erode.
Another problem for the banks is that in their lawsuits against the paying banker, the victim bank is raising the issue of “red flags” and “suspicious transactions” to argue that the paying banker should have halted the payment. With large amounts of money at stake, this argument would be made by skilled lawyers and may even be successful in court. If that happens, it would set up a dangerous precedent against the banks themselves. So far, banks have taken the stand that their customers are responsible for the transactions so long as the valid authentication was provided. Bank customers typically do not have the resources and inside knowledge to challenge this stand. The inter-bank litigation is very different and has the potential to overturn the established distribution of liability.
I have not so far talked about nation state actors getting into the attack. Any nation state would love to hack the banks of an enemy country. Some rogue states that are excluded from global finance might even want to try and disrupt the global financial system. India is one of the countries at serious risk of an attack from a resourceful nation state, but as I look around, I see only complacency and no sense of concern let alone paranoia.
Mon, 28 Mar 2016
When a serious breach of market integrity is suspected, what should the regulators’ priorities be: should it try to punish the guilty, or should it seek to deter other wrong doers or should it focus on protecting the victims? Both bureaucratic and political incentives may be tilted towards the first and perhaps the second, but in fact it is the last that is most important. I have been thinking about these issues in the context of the order of the Securities and Exchange Board of India in the matter of Sharepro Services, a Registrar and Share Transfer Agent regulated by SEBI. The order which is based on six months of investigation and runs into 98 pages finds that:
Shares and dividends have been transferred from the accounts of the genuine investors to entities linked with the top management of Sharepro without any supporting documents
Records have been deliberately falsiﬁed avoid the audit trails.
Sharepro and its top management have authorized issuances of new certiﬁcates without any request or authorisation from shareholders.
The management of Sharepro has not cooperated with the investigation which being carried out by SEBI and on several occasions, it has attempted to mislead the investigation in the matter.
If one assumes that these findings are correct, then the key regulatory priority must be to take operational control of Sharepro and thereby protect the interests of investors who might have been harmed. A Registrar and Share Transfer Agent is a critical intermediary whose honest functioning is essential to ensure market integrity and maintain the faith of investors in the capital markets. I think that SEBI’s powers under section 11B of the SEBI Act would be adequate to achieve this objective, but in case of need, resort could also be had to section 242 of the Companies Act 2013.
The SEBI order does take some steps to punish the top management of Sharepro but does too little to protect the investors who appear to have lost money. It does not even cancel or suspend the registration of Sharepro as a Registrar and Share Transfer Agent, but merely advises companies who are clients of Sharepro switchover to another Registrar and Share Transfer Agent or to carry out these activities in-house. The only investor protection step in the order is the direction to companies who are clients of Sharepro to audit the records and systems of Sharepro. But if the records have been falsiﬁed, then only a regulator or other agency with statutory powers can carry out a meaningful audit by obtaining third party records.
A decade ago, when the Satyam fraud occurred, I was among the earliest to write that the government should simply take control of the company. I would argue the same in the case of Sharepro as well assuming that the SEBI findings are correct.
Sun, 20 Mar 2016
Usually a manufacturing company goes to a bank to finance its capital expenditure. But last month witnessed a deal where the US manufacturing giant GE stepped forward to finance the capital expenditure of one of the largest banks in the world – JPMorgan Chase – when the latter decided to buy 1.4 million LED bulbs to replace the lighting across 5,000 branches in the world’s largest single-order LED installation to date.
As a finance person, the first explanation that I looked at was the credit rating. GE lost its much vaunted AAA rating during the Global Financial crisis, but based on S&P long term unsecured ratings, GE’s AA+ rating is full five notches above JPMorgan Chase’ A- rating. Based on Moodys ratings, the gap is only two notches. Averaging the two and taking into account S&P’s negative outlook on GE, we could say that GE enjoys a rating that is a full letter grade (three notches) above JPMorgan. So perhaps, it makes sense for the manufacturer to finance the bank.
Another possible explanation is that trade credit has a set of advantages that are not fully understood. Some of the alleged advantages of trade credit (like the idea that a business relationship leads to superior information on credit worthiness) strain credulity when the recipient of the credit is one of the largest banks in the world with hundreds of publicly traded bonds outstanding. Similarly, the idea that vendor financing is a superior form of performance guarantee is hard to believe when the vendor is a manufacturing giant with such a high reputation and credit rating.
In a Slate story, Daniel Gross explained the logic in terms of the inefficiency and inertia of corporate bureaucracies:
The second barrier – “the capital barrier,” as Irick call it – is more difficult to surmount. The economics of buying and installing them can be a challenge to corporate bureaucrats. Companies often produce multiyear budgets well in advance. Going LED means spending a lot of money in a single year to buy and install them, make sure they work, and dispose of the old ones. And it is difficult even for a company like Chase to make a decision quickly to write a check to buy 1.4 million new light bulbs and pay for their installation. GE, of course, has a long track record of helping to finance customers’ purchases of its capital goods, structuring payments over a period of years rather than upfront.
That perhaps makes more sense than any of the finance theory arguments.
Fri, 18 Mar 2016
Voltaire wrote that “His Sacred Majesty Chance Decides Everything”. Neustadter comes to a similar conclusion in a fascinating paper entitled “Randomly Distributed Trial Court Justice: A Case Study and Siren from the Consumer Bankruptcy World” (h/t Credit Slips):
Between February 24, 2010 and April 23, 2012, Heritage Pacific Financial, L.L.C. (‘Heritage’), a debt buyer, mass produced and filed 218 essentially identical adversary proceedings in California bankruptcy courts against makers of promissory notes who had filed Chapter 7 or Chapter 13 bankruptcy petitions. Each complaint alleged Heritage’s acquisition of the notes in the secondary market and alleged the outstanding obligations on the notes to be nondischargeable under the Bankruptcy Code’s fraud exception to the bankruptcy discharge. ...
Because the proceedings were essentially identical, they offer a rare laboratory for testing the extent to which our entry-level justice system measures up to our aspirations for ‘Equal Justice Under Law.’ ...
The results in the Heritage adversary proceedings evidence a stunning and unacceptable level of randomly distributed justice at the trial court level, generated as much by the idiosyncratic behaviors of judges, lawyers, and parties as by even handed application of law ...
Neustadter summarizes the outcome of these proceedings as follows (Table 1, page 20):
|Recovery by Heritage||Filed Settlement Agreements||Heritage Requests Dismissal||Dismissal for Other Reasons||Default Judgments||Summary Judgments||Trials|
|Positive||103 ($1m)||N/A||N/A||10 ($0.9m)||1 ($0.06m)||2 ($0.2m)|
I remember reading Max Weber’s Economy and Society decades ago and being fascinated by his argument that legal rights only increase the probability of certain outcomes (incidentally, Weber obtained a doctorate in law before becoming an economist and sociologist). Weber believed that the function of law in a modern economy was to make things more predictable, but by this also he only meant that probabilities could be attached to outcomes. I resisted Weber’s argument at that time, but over the course of time, I have come around to accepting them. In fact, I now think that it is only the conceit of false knowledge that leads to a belief that certainty is possible.
A greater degree of acceptance of randomness would make litigation a lot more efficient. In my view of things, a judge should be required to set a time limit for the amount of time to be devoted to a particular dispute (depending on the importance of the dispute). When that time has been spent, the judge should be able to say that he thinks there is say a 40% probability that the plaintiff is right and a 60% chance that the defendant is right. He should then draw a random number between 0 and 1; if the number that is drawn is less than 0.4, he should rule for the plaintiff, otherwise for the defendant. All litigation could be resolved in a time bound manner by this method. Even greater efficiency is possible by the use of the concepts of Expected Value of Perfect Information and Expected Value of Sample Information to decide when to terminate the hearings and proceed to drawing the random numbers. If an appeal process is desired, then of course the draw of the random number could be postponed until the appeal process is exhausted and the final value of the probability determined. In a blog post a couple of months ago, I have discussed cryptographic techniques to draw the random number in a completely transparent and non manipulable manner.
In my experience, there is enormous resistance to deciding anything by a draw of lots or other randomization technique though I believe that it is the most rational way of decision making. Instead society creates very complex mechanisms that lead effectively to a process of randomization based on which judge gets to hear the matter and what procedural or substantive legal provisions the judge or the lawyer is aware of. In fact, one way of making sense of the bewildering complexity of modern law is that it is just a very costly way of achieving randomization – if the law is too complex to be remembered by any individual, then what provision is remembered and applied is a matter of chance. That is how I interpret Neustadter’s findings.
In case you are wondering why I am discussing all this in a finance blog, let me remind you that the litigation in question was about recovery of defaulted debt and that is definitely a finance topic.
Sat, 12 Mar 2016
A year ago, I blogged about the Carbanak hacking and thought that it was a wake up call for financial organizations to improve their internal systems and processes to protect themselves from patient hackers. The alleged patient hacking reported this week at the central bank of Bangladesh shows that the lessons have not been learned. There is too much of silo thinking in large organizations – cyber security is still thought to be the responsibility of some computer professionals. The reality is that security has to be designed into all systems and processes in the entire organization. Institutions like central banks that control vast amounts of money need to defend in depth at all levels of the organization. Physical security, hardware security, software security and robust internal systems and processes all contribute to a culture of security in the whole organization. In my experience, even senior management at large banking and financial organizations have a highly complacent attitude towards security that makes the organization highly vulnerable to a patient and determined hacker.
For example, there is no reason not to have a dedicated terminal for large (say $100 million) SWIFT transactions. Cues like dedicated hardware tends to make humans more alert to security considerations. In the paper world, we went to great lengths to institutionalize such cues. For example, the law on cheques permits cheques to be written on plain paper (the law only says “instrument in writing”), but in practice it was always written on special security paper. The importance of keeping blank security paper under lock and key was drilled into every person who worked in a bank from the chairman to the messenger boy. I have yet to see any similar attempt to inculcate a culture of computer security in any bank.
Sun, 06 Mar 2016
Krigman and Wendy have an interesting paper on how issuers pay for their investment banks’ past mistakes. Their conclusions are based on the IPOs that came to market after the the botched Facebook IPO of 2012 in which the stock fell below the IPO price and the investment banks had to buy shares in the market to stabilize the price. IPOs after this event were underpriced by an average of 20% compared to only 11% prior to the Facebook IPO. More interestingly:
We show that the entire increase in underpricing is concentrated in the IPOs of the Facebook lead underwriters. We find no statistical difference in underpricing pre and post-Facebook for non-Facebook underwriters. We argue that investment bank loyalty to their institutional investor client based propelled the Facebook underwriters to increase underpricing to compensate for the perceived losses on Facebook.
“Loyalty to investor client” sounds very nice in a scandal dominated era where we have to come to believe that bankers have no loyalty to anybody. Yet, it must be remembered that the alleged generosity to investor clients did not come out of the bankers’ profits; it came out of the pockets of another bunch of clients – the issuers. This raises a very disturbing question: what gives them the pricing power to underprice issues relative to what their competitors were doing? The first possibility that came to my mind is that these were deals that the bankers had already won and it was difficult for the clients to change their lead banks after they had already been chosen. However, the data seem to show that the effect lasted more than a year, and moreover there was a 41 day period following Facebook during which there were no IPOs at all. The other possibility is that this is not a competitive market at all and the investment banks have a lot of market power. Chen and Ritter wrote a famous paper about this at the turn of the century (“The seven percent solution.” The Journal of Finance 55.3 (2000): 1105-1131).
Wed, 02 Mar 2016
JPMorgan Chairman Jamie Dimon states in a Bloomberg interview that he now regards JPMorgan’s acquisition of Bear Stearns and of Washington Mutual during the global financial crisis as “mistakes”. I used to think that these were among the better deals in the whole lot of crisis era acquisitions which include such monumental disasters as Bank of America’s acquisition of Countrywide or Lloyds’ acquisition of HBOS. But Dimon says that the Bear Stearns purchase ended up costing JPMorgan $20 billion while if I remember right the headline acquisition cost was only a little over $1 billion (and that after Dimon raised the price per share from $2 to $10). If even JPMorgan’s relatively good deals ended up being big mistakes, then I wonder whether the only sound crisis era banking acquisition might be Wells Fargo’s acquisition of Wachovia. Of course, the very best deals were Warren Buffet’s minority stakes in Goldman Sachs and GE, but these do not count as acquisitions. On a purely accounting basis, the US government did make money on many of its rescue deals, but this accounting does not include the hidden costs that contribute heavily to the $20 billion price tag that Dimon now puts on the Bear deal. What all this means is that even at the depths of the global financial crisis, it would have made a lot of sense to heed the good old advice not to try to catch a falling knife.
Tue, 02 Feb 2016
The following posts appeared on the sister blog (on Computing) during the last two months.
Data access controls within banks (Cross posted on this blog also)
Tweets during the last two months (other than blog post tweets):
28 January 2016
1/2 Paul Volcker in 1985: The success of countries ... of pushing their own currencies down without creating problems is extremely limited
2/2 h/t for Paul Volcker quote is http://ftalphaville.ft.com/2016/01/27/2151269/the-plaza-accord-then-and-cough-now/
20 January 2016
Sumner: "markets seem to respond more strongly to the supposedly meaningless Chinese data than to the US GDP data" http://www.themoneyillusion.com/?p=31430
@KohimaVittal @monikahalan Sorry I cut short the original quote from "global asset markets" to "markets". It was not about India at all.
21 December 2015:
- 1/2. A few months ago, I argued for side pockets for distressed (Amtek Auto) bonds in Indian mutual funds. The side pocket is like an ETF.
- 2/2. More drastic solution is to turn the whole fund into ETF. http://www.etf.com/sections/blog/etfs-solve-mutual-bond-fund-problem shows that ETFs did better in US bond market turmoil
8 December 2015: Nice story on why the Chip & PIN terminal should be in two pieces https://www.benthamsgaze.org/2015/12/01/forced-authorisation-chip-and-pin-hitting-high-end-retailers/(h/t Bruce Schneier). Is this risk there in India?
Sun, 31 Jan 2016
The crowdfunding portal Kickstarter commissioned an investigative journalist to write a report on the failure of Zano which had raised $3.5 million on that platform, and the report has now been published on Medium. I loved reading this report for the quality of the information and the balance in the conclusions. It left me thinking why London’s AIM market never published something similar on many of the failures among the companies listed there, or why NASDAQ never commissioned something like this after the dotcom bust, or why the Indian exchanges never did anything like this about the vanishing companies of the mid 1990s.
Is it because these highly regulated exchanges are protected by a regulatory monopoly and they can safely leave this kind of thankless job to their regulators? Or are they worried that an honest investigative report might be used against them because of the regulatory burden that they face? Does regulation have the side effect of crowding out the private ordering that emerges in the absence of regulation? Does regulation weaken reputational incentives?
In the context of crowdfunding, the reputational incentives and private ordering are well described in Schwartz’ paper on “The Digital Shareholder”:
These intermediaries [funding portals] want investors to have a good experience so they will return to invest again on their website, making them sensitive to a reputation feedback system. A funding portal with lots of poorly rated companies will find it difficult to attract future users to its site. Importantly, this appears to be an effective constraint for existing reward crowdfunding sites, such as Indiegogo, which take care to avoid having their markets overrun by malfeasance.
It is true that regulation does have positive effects, but the challenge in framing regulations is to avoid weakening private ordering.
Fri, 29 Jan 2016
Countries build up reserves in good times for many reasons including depressing the value of the exchange rate. The real proof of the pudding comes in bad times when the government needs to decide who should be bailed out, and who should be allowed to fail.
There have been two archetypes for this decision making. In the old Latin American model, the klepocratic elite was allowed to take its money out and everybody else was hung out to dry. The East Asian model (both in 1998 and 2008) was largely to bail out the banks (but not necessarily their owners) and to let the corporate sector go bust. Russia in 2008 followed a middle path: they bailed out the oligarchs till the reserves fell to uncomfortable levels, and then conserved the remaining reserves to protect the banking system.
The interesting question is which model is China following. The anti corruption campaign might suggest that China is following the East Asian path of forcing losses on the elite. But the scale of capital flight suggests a different interpretation: the anti corruption campaign is sending a signal to the klepocrats to take their money out of China before it is too late. Whatever the intentions might have been, China might end up in practice much closer to the Russian model. Maybe half the reserves will be used to allow the elite to unwind their carry trades and take their money out of the country. The remaining half would still be sufficient to stabilise the economy at a depreciated exchange rate.
Wed, 20 Jan 2016
I was interviewed on CNBC last week for their show The Firm on recent changes made by the Securities and Exchange Board of India (SEBI) in mutual fund regulations. SEBI tightened the norms relating to exposure of a mutual fund to a single issuer or industry. One of the issues that came up was whether the norms should be more generous for AAA rated debt. I referred to the subprime crisis where the losses came in AAA rated mortgage securities and argued that AAA debt is in some ways more dangerous because you do not even get a high coupon to compensate for the default losses. I have tweeted about this in the past quoting Asness: “the most dangerous things are those that you think protect you, but only mostly protect you”
There was also a discussion on the issue of gates and sidepockets that I have blogged about and tweeted about. I continued to maintain that fund managers have the responsibility to ensure that redemption does not take place at NAVs different from the realizable value of the underlying assets.
Wed, 13 Jan 2016
Looking at the turbulence in the Yuan HIBOR market, I was reminded of Thailand in 1997-98. I remember writing about the Thai episode at that time:
To speculate against the baht, a hedge fund has to sell baht, and to do so, it must directly or indirectly borrow baht. If the attack succeeds, the hedge fund would be able to buy back the baht at lower prices and repay the borrowing. The Bank of Thailand attempted to make this difficult by preventing residents from lending baht to non residents in any form including direct loans, overdrafts, currency swaps, interest rate swaps, forward rate agreements, currency options, interest rate options, outright forward transactions. It also preventing residents from selling baht to non residents against payment in foreign currencies. Simultaneously, the Bank of Thailand intervened heavily in the offshore market especially in the forward market. All this created an acute shortage of baht in the offshore market and drove up interest rates in that market to several hundred percent. In the process, several hedge funds reportedly made losses as they scrambled to buy or borrow baht to meet their obligations. When they tried to obtain baht by selling Thai stocks, the Bank of Thailand responded with a rule that the proceeds of all stock sales must be remitted in foreign currency and not in baht.
This policy was hugely successful in its immediate objective of punishing the hedge funds who had the temerity to short the Thai baht. Both the technocrats who engineered this and their political masters were immensely pleased with this result, and boasted about their success. But, all this did nothing to save the baht or fix Thailand’s economic problems back then. Unfortunately, neither the technocrats nor the politicians ever seem to learn the critical lesson that it is easy for a sovereign to fix the speculators, it is much harder to fix the underlying problems that cause the speculation in the first place.
Sun, 10 Jan 2016
Last month, LCH published a White Paper entitled CCP Conundrums which raise a number of interesting issues, though I think that “conundrums” is a bit of a euphemism in this context. In my view, Central Counter Parties (CCPs) or Clearing Corporations globally face serious vulnerabilities arising out of a confluence of factors:
After the Global Financial Crisis, regulators have pushed more and more products into clearing, even though they do not trade in liquid markets. The benefits of CCPs in exchange traded products flow as much from the price discovery in exchange trading as they do from clearing, netting and collateralization. In many of the products now being pushed into trading, price discovery is suspect because of poor liquidity or oligopolistic market structure.
The opening up of several new products to clearing has created a once-in-a-lifetime opportunity for the top clearing corporations to expand into potentially large market segments. There is a temptation to gain market share through lower margins and less stringent risk management.
There is no regulatorily imposed minimum margin that could prevent such a race to the bottom. In fact, there is a tendency for banking regulators to turn a blind eye to this risk because they have no desire to shore up the CCPs by draining liquidity and capital from the banks.
Ultra loose monetary policy in the developed world is leading to yield chasing and suppression of risk aversion. This may be the intended “portfolio balance channel” of monetary policy transmission, but it creates an environment where risks are probably being ignored.
This is what LCH refers to as the risk of pro-cyclicality of risk management at the CCPs. LCH is more or less openly saying that margins need to be increased before monetary conditions tighten as it would be too late to do so after tightening has already happened.
For all these reasons, I have been worrying for quite some time now that in the coming years, the failure of a large global CCP is more a matter of when rather than whether.
Thu, 31 Dec 2015
Early this month, the US SEC passed an order against Behruz and Kenny about how they fraudulently obtained liquidity rebates from the option exchanges on which they traded. When I read this order, my first reaction was to laugh out loud at the stupidity of the alleged victims: some of the largest option exchanges in the US were running pretty silly liquidity rebate schemes. I can understand that regulators might wish to step in to protect small retail investors against their own stupidity, but if somebody like the CBOE chooses to run a scheme that is basically an open invitation to be gamed, my inclination would be to let them suffer the consequences. For the regulator to go after the alleged offender is to my mind a waste of tax payers’ money. I do take Stigler’s classic paper on the optimum enforcement of laws quite seriously.
The first charge against Behruz and Kenny is that they earned $2 million of liquidity rebates (and exchange fees avoided) from the option exchanges by misrepresenting “customer” status for their trading accounts. If you are not a broker-dealer, your orders are treated as “customer” orders unless your trading goes above the threshold of 390-order per day. To reach the 390-order threshold, you would have to enter an order every minute from market open to market close. “Customer” orders do not incur any transaction fees and receive higher liquidity rebates from the exchanges. In practice, trading activity was reviewed quarterly to determine to determine the “customer” status. If the trading was below 390-order per day during one quarter, then the trading account received “customer” status in the next quarter. To see how silly this is, note that if you did not trade at all one quarter, you would have “customer” status in the next quarter even if you were pumping thousands of orders a day in that quarter. Why somebody would think up such a stupid implementation of the rule in this day and age is beyond me.
Behruz and Kenny could have traded thousands of orders a day for six months in the year, and spent their time at the beach for the remaining six months without falling afoul of the SEC. But they were more greedy and wanted to trade with “customer” status round the year. So they created two accounts and switched between them each quarter – when they were trading thousands of orders a day in one account, they kept the other account almost dormant so that that other account would have “customer” status in the next quarter when the first account lost that status. The rules did however require that accounts with the same beneficial ownership should be aggregated for determining “customer” status, and Behruz and Kenny misrepresented the beneficial ownership to avoid this result. One way of looking at the SEC action is that they brought offenders to book, but the other way of looking at it is that the SEC is encouraging large and sophisticated players to create silly rules and implement them in silly ways, confident that the SEC will clean up after them.
The second charge is that Behruz and Kenny used spoofing orders to earn liquidity rebates from the (Nasdaq OMX) PHLX options exchange. The typical scheme was to enter a series of large hidden All-or-None (AON) orders to buy options at a price that was a penny more than the option’s current best bid. Because they are hidden, these AON orders do not change the best bid. Behruz and Kenny then placed smaller (typically one lot), non-bona fide sell orders at the same price as the AON. These orders were too small to execute against the AON order, but (since they were not hidden) they lowered the option’s best offer by one penny. The idea was to induce genuine sellers to send sell orders at the new best offer. When enough such sell orders arrived to make up the quantity of the AON order, they all executed against the AON. The PHLX in its infinite wisdom regarded the AON orders (that nobody could see) as having provided liquidity to the market. Since the AON buy order was sitting in the order book before the sale orders arrived, the AON was deemed to have provided liquidity while the sell orders were deemed to have taken liquidity. The PHLX gave a liquidity rebate to Behruz and Kenny, and charged a liquidity take fee to the sellers. Behruz and Kenny then turned around to execute the same strategy on the opposite side to dispose of the options that they had just bought – a large hidden AON sell order and a small displayed buy order.
One can have a debate on whether liquidity rebates and the maker-taker model make sense at all. But there is no debate about the silliness of what PHLX is doing. The idea that a hidden AON buy order that did not even move the best bid offered liquidity to the market is laughable. In a rational market, exchanges that do stupid things should lose money or business or both – the survival of the smartest. The regulators should not be trying to protect the silly and impede this market dynamic.
A recent blog post by the Streetwise Professor makes an even broader but similar argument about spoofing in general. He says that sophisticated and knowledgeable players have the incentive to detect spoofing and take defensive measures that would reduce the frequency and scale of spoofing activity. Therefore regulators need not bother much about it. I tend to agree. Harris’ classic book on market microstructure for practictioners (Trading and Exchanges, OUP, 2002) has a whole chapter on “bluffers” and within that there is a section in particular on how bluffers discipline liquidity providers. We might have invented a more exotic name (spoofing) for what has been known for centuries as bluffing, but the basic principles remain the same – spoofers discipline the HFTs.
Fri, 25 Dec 2015
A month back when I blogged about Creditor versus Creditor and Creditor versus Debtor, I talked about the potential for conflicts between operational and financial creditors, but did not have any good examples of such battles. I am able to remedy that gap now thanks to the fading fortunes of shale oil producers in the United States. A couple of days ago, Reuters carried a story about three instances where operational creditors had initiated involuntary bankruptcy proceedings against large energy producers to avoid being outmanoeuvred by financial creditors:
Involuntary bankruptcy gives vendors some say over how an energy producers’ dwindling funds are managed, and vendors can use it to try to stop a company from cutting deals that favor lenders or investors.
Such cases also allow creditors to choose the court, and all three of the recent cases have been filed outside the busy bankruptcy court in Wilmington, Delaware. Bankruptcy lawyers in Texas said that may suggest suppliers are worried the court is too eager to approve quick sales of businesses, which tend to favor secured creditors.
A lawyer for the creditors ... said the involuntary bankruptcy prevented the Gulf of Mexico producer from being stripped of all of its value in favor of the company’s owners.
If the facts stated in the story are correct, then standard theory (governance rights vest with residual rights) would imply that the operational creditors should indeed be in charge of the bankruptcy process.
Wed, 23 Dec 2015
Under the US FATCA Act and the related Inter-Governmental Agreement between India and the US, banks and other financial institutions in India are required to report information about accounts held with them by US persons or entities controlled by US persons. All the documents that I have read are clear that this should not affect Indian citizens who are tax resident in India. But I find Indian banks and financial institutions send out notices demanding complex information and threatening closure of accounts to Indian citizens resident in India.
I am not a lawyer, but both Rule 114H(3) and the RBI Guidance Notes are very clear that banks should seek information from the account holder only if any of the indicia of foreign citizenship or foreign tax residence are present. The indicia include:
- Foreign citizenship or residence
- US place of birth
- Foreign address or telephone number
- Repeating payment instructions to US address or US account
- Power of Attorney or signatory authority granted to a person with a US address
- “Care of” or “Hold mail” address is the sole address for the account holder
In the cases that I am referring to, the account is fully KYC compliant, the Indian address and identity documents are on record with the bank, and none of the other indicia are present, and still the FATCA notice is being sent. In one case, where the Indian citizen and Indian resident account holder was threatened with closure of account, I spent several minutes struggling to understand the complex form in which information was sought before realizing that the form that had been sent to an individual account holder was the form relevant for legal entities! Surely, a bank should know whether its customer is an individual or a corporate entity. But this elementary confusion had caused the bank to apply the $250,000 threshold applicable to legal entities for identifying “high value” accounts instead of the $1 million threshold applicable to individuals. It is another matter that even if it was classified as a “high value” account, the FATCA notice should not have been sent because the bank knew that none of the indicia were present.
I think tax terrorism by governments in both hemispheres of the world has become so severe that banks would rather harass their customers needlessly and go berserk with enforcing non existent compliance requirements than risk being held guilty of any shortfall in compliance. Perhaps some customers should sue the banks for sending baseless threatening letters so that banks would start doing what is required by law – neither more nor less.
Sun, 20 Dec 2015
An order last month by the UK Financial Conduct Authority (FCA) against Barclays Bank highlights the problems faced by banks and other financial services firms in controlling the access that their employees have to customer data. I have long heard complaints about this: for example, some bank employees keep telling me that as soon as their bonus is paid to them, other employees with access to the core banking software can find out the exact quantum of this bonus.
Now we have confirmation that when one of the largest banks in the world wants to limit who can see the information about a customer, the best they can do is to go back to paper hard copies stored in a vault.
The FCA order refers to a £1.88 billion transaction that Barclays was doing for a group of ultra-high net worth Politically Exposed Persons (PEPs) who wanted a very high degree of confidentiality:
Prior to Barclays arranging the Transaction, Barclays agreed to enter into the Confidentiality Agreement which sought to keep knowledge of the Clients’ identity restricted to a very limited number of people within Barclays and its advisers. In the event that Barclays breached these confidentiality obligations, it would be required to indemnify the Clients up to £37.7 million. The terms of the Confidentiality Agreement were onerous and were considered by Barclays to be an unprecedented concession for clients who wished to preserve their confidentiality. (Para 4.11)
In view of these confidentiality requirements, Barclays determined that details of the Clients and the Transaction should not be kept on its computer systems. (Para 4.12)
Barclays decided to omit the names of the Clients from its internal electronic systems in order to comply with the terms of the Confidentiality Agreement. As a result, automated checks that would typically have been carried out against the Clients’ names were not undertaken. Such checks would have included regular overnight screenings of client names against sanctions and court order lists. If, for example, the Clients had become the subjects of law enforcement proceedings in any jurisdiction, Barclays could have been unaware of such a development. No adequate alternative manual process for carrying out such checks was established by Barclays. (Para 4.49)
Some documents relating to the Business Relationship were held by Barclays in hard copy in a safe purchased specifically for storing information relating to the Business Relationship. This was Barclays’ alternative to storing the records electronically. While there is nothing inherently wrong with keeping documents in hard copy, they must be easily identifiable and retrievable. However, few people within Barclays knew of the existence and location of the safe. (Para 4.52)
I am sure that 130,000 clients of HSBC Private Bank in Switzerland (now accused of evading taxes in their home countries) wish that their data too was kept in paper form in a vault beyond the reach of Falciani’s hacking skills.
More seriously, banks need to rethink the way they maintain customer confidentiality. With anywhere banking, far too many employees have access to the complete data of every customer. A lot of progress can be made with some very simple access control principles:
Every access to customer information must be logged to provide a detailed audit trail of who, when, what and why. Ideally, the customer should have access to a suitably anonymously form of these logs.
Every access must require justification in terms of a specific task falling within the accessor's job profile.
Every access request should only result in the minimal information required to complete the task for which the access is requested.
For example, a customer comes to a branch (assuming such archaic things still exist) for a cash withdrawal. The cashier requests access by providing details of the requested withdrawal; and the system accepts the request because it is part of the cashier's job to process these withdrawals (Principle #2). The system responds with only a yes or a no: either the customer has sufficient balance to allow this withdrawal or not. The actual balance is not provided to the cashier (Principle #3). It should be emphasized that without Principle #1 and #2, the cashier could make repeated queries with different hypothetical withdrawal amounts and guess the true balance within a relatively small range using what computer scientists would recognize as a binary search method.
In my view, access controls are easy to implement if banks decide to prioritize (or regulators decide to enforce) customer confidentiality. However access controls have their limits and cryptographic tools are indispensable to achieve more complex objectives. Banks need to promote further research into these tools in order to make them usable for their needs:
To deal with Falciani risk, the entire customer data must be encrypted even inside the core banking software. The Snowden episode demonstrates that even system administrators must not have access to all information. Banks need to think very carefully about database level and column level encryption of the core banking data. Of course, banks need to worry about application security of their core banking systems: one publicly released security report of three different popular core banking software products revealed poor applications security to the point of causing an operational risk to the banks concerned.
The problem that Barclays had of running automated tests against sanctions and court order lists while keeping the customer identity confidential can be solved using a more sophisticated cryptographic tool – homomorphic encryption. Homomorphic encryption is a form of encryption which allows computations to be performed on data without first decrypting it. For example, suppose two numbers a and b have been encrypted into cypher texts x and y, and it is desired to compute a+b. Homomorphic encryption would perform some computations on x and y and produce a result z such that decrypting z yields a+b. The person who is performing the computation knows that she is adding two numbers, but does not know which numbers are being added. Moreover, she does not know what was the sum; she obtains only an encrypted version of the sum. Only the person with the encryption key or password can determine the sum by decrypting z.
Some special cases of homomorphic encryption are reasonably efficient, but fully homomorphic encryption is currently impractical. Banks need to think creatively about how to use partially homomorphic cryptosystems to achieve their goals efficiently. Simple transactions like deposits and withdrawals involve only addition (and subtraction) which are more amenable to homomorphic encryption than more complex computations.
It is desirable to allow compliance staff to verify that adequate documentation exists without being privy to the confidential information. Another advanced cryptographic tool comes to our rescue – zero-knowledge proof. Suppose the relationship staff who know the client are trying to satisfy the compliance staff that they have obtained the requisite documentation from the client, but the compliance staff are not allowed to see the documents themselves to protect the confidentiality of the customer. A zero-knowledge proof is a technique which must satisfy three properties:
- If the documentation actually exists, the compliance staff will be convinced of this fact by the “proofs” provided by the relationship staff.
- If the documentation is missing, it is almost certain that the relationship staff would fail to convince the compliance staff that it exists.
- If the documentation actually exists, then the “proof” of its existence (provided by the relationship staff) will not allow the compliance staff to learn anything about the documentation other than that it exists.
The core procedure of a zero-knowledge proof is interactive: it consists of a series of challenges by the compliance staff and a series of responses by the relationship staff which are so designed that it is very difficult to provide fake responses to fool the challenger. At the same time, each challenge and response is designed not to reveal anything about the content of the document, and the responses to different challenges cannot be put together to learn anything either.
The regulatory regime needs to be redesigned from the ground up to exploit zero-knowledge proofs. The effort involved is non trivial, but the benefits are well worth the effort.
Sat, 12 Dec 2015
Most of the bank failures of the Global Financial Crisis involved complex products or an excessive reliance on markets rather than good old banking relationships. The HBOS failure as described in last month's 400 page report by the UK regulators (PRA and FCA) is quite different. One could almost say that this was a German or Japanese style relationship bank.
The report describes the approach of the Corporate Division where most of the losses arose:
The often-quoted approach of the division was to be a relationship bank that would ‘lend through the cycle’. Elsewhere the division’s approach had been called ‘counter-cyclical’. This was described as standing by and supporting existing customers through difficult times, while continuing to lend to those good opportunities that could be found. The division claimed it had a deep knowledge of the customers and markets in which it operated, which would enable it to pursue this approach with minimal threat to the Group. It was an approach that was felt to have served BoS well in the early 1990s downturn. (Para 274)
What could go wrong with such old fashioned banking? The answer is very simple:
Taking into account renting, hotels and construction, the firm’s overall exposure to property and related assets increases to £68 billion or 56% of the portfolio. (para 285)
And in some ways, relationship banking made things worse:
The top 30 exposures included a number of individual high-profile businessmen. Many of these had been customers of the division for many years, some going back to the BoS pre-merger. True to the division’s banking philosophy, it had supported these customers as they grew and expanded their businesses. However, business growth and expansion sometimes meant a change in business model to become significant property investors; not necessarily the original core business and expertise of the borrower. In the crisis, a number of these businessmen, though not all, incurred losses on their property investments. (Para 318)
When you as a bank lend a big chunk of your balance sheet into a bubble, it does not matter whether you are a transaction bank or a relationship bank: you are well on your way to failure. (If you do not want to jump to conclusions based on one bank, a recent BIS Working Paper on US commercial banks studies all bank failures in the US during the Great Recession and comes to a very similar conclusion).
Tue, 01 Dec 2015
The following posts appeared on the sister blog (on Computing) during the last two months.
Tweets during the last two months (other than blog post tweets):
November 26: Deal Professor on recent M&A deals: "business leaders seem to have perhaps slightly lost their touch with reality" http://www.nytimes.com/2015/11/25/business/dealbook/telltale-signs-that-deal-makers-swallowed-the-silly-pills.html
November 19: Asness says the most dangerous things are those that you think protect you, but only mostly protect you https://medium.com/conversations-with-tyler/cliff-asness-986ba8e92b4f#.cwcoch7nk
November 19: Asness says "There's no investment process so good that there's not a fee high enough that can't make it bad." https://medium.com/conversations-with-tyler/cliff-asness-986ba8e92b4f#.cwcoch7nk
October 29: Excellent BIS paper http://www.bis.org/publ/work524.htm shows how conventional cross border capital flow and investment data can be misleading.
Yellen call 1/2. Artemis has a research report on preemptive central bank action. http://www.artemiscm.com/s/ArtemisQ32015Volatility-and-Prisoners-Dilemma-x71i.pdf (h/t http://ftalphaville.ft.com/2015/10/13/2142116/the-shadow-convexity-risk-in-the-machine-and-the-vix/)
Yellen call 2/2. Greenspan (S&P500) Put took the risk out of buying stocks. Yellen VIX Call takes the risk out of selling volatility.
Mon, 30 Nov 2015
Update: While linking to Ajay Shah's blog for a summary of global regulatory regimes on self trades, I failed to mention that the particular post that I was referring to was authored not by Ajay Shah, but by Nidhi Aggarwal, Chirag Anand, Shefali Malhotra, and Bhargavi Zaveri.
Imagine that you are bidding at an auction and after a few rounds, most bidders have dropped out and you are left bidding against one competing bidder who pushes you to a very high winning bid before giving up. Much later you find that the competing bidder who forced you to pay close to your reservation price was an accomplice of the seller. You would certainly regard that as fraudulent; and many well running auction houses have regulations preventing it. Observe that the seller did not actually sell to himself; in fact there would have been no fraud (and no profit to the seller) if he actually did so. The seller defrauded you not by an actual (disguised) self-trade but by a (disguised) potential self-trade that did not actually happen. In fact, the best of auction houses do not prohibit actual self-trades: when the auction does not achieve the seller’s (undisclosed) reserve price, they allow the item to be “bought in” (the seller effectively buys the item from himself). So the lesson from well run auction houses is that potential self-trades (which do not happen) are much more dangerous than actual self-trades.
In the financial markets, we have lost sight of this basic intuition and focused on preventing actual self-trades instead of limiting potential self-trades. India goes overboard on this by regarding all self-trades as per se abusive. Most other countries also frown on self-trades but do not penalize bona fide self-trades; they take action only against self-trades that are manipulative in nature. However, they too regard frequent self-trades as suggestive of manipulative intent (see Ajay Shah for a nice summary of these regulatory regimes). Many exchanges and commercial software around the world therefore now provide automated methods of preventing self-trades: when an incoming order by an entity would execute against a pre-existing order on the opposite side by the same entity, these automated procedures cancel either the incoming order or the resting order or both.
A little reflection on the auction example would show that the whole idea of automated self-trade prevention is an utterly misguided response to an even more misguided regulatory regime. Manipulation does not happen when the trade is executed: it happens when the order is entered into the system. The first sign that the regulators are understanding this truth is in the complaint that the US Commodity and Futures Trading Commission (CFTC) filed against Oystacher and others last month. Para 53 of the complaint states:
Oystacher.and 3 Red manually traded these futures markets, using a commercially available trading platform, which included a function called “avoid orders that cross.” The purpose of this function is to prevent a trader’s own orders from matching with one another. Defendants exploited this functionality to place orders which automatically and almost simultaneously canceled existing orders on the opposite side of the market (that would have matched with the new orders) and thereby effectuated their manipulative and deceptive spoofing scheme ...
Far from preventing manipulation, automated self-trade prevention software is actually facilitating market manipulation. This might appear counter intuitive to many regulators, but is not at all surprising when one thinks through the auction example.
Mon, 16 Nov 2015
In India, for far too long, bankruptcy has been a battle between creditor and debtor with the dice loaded against the creditor. In its report submitted earlier this month, the Bankruptcy Law Reforms Committee (BLRC) proposes to change all this with a fast track process that puts creditors in charge. It appears to me however that the BLRC ignores the fact that in well functioning bankruptcy regimes, the fight is almost entirely creditor and creditor: it is very much like the familiar scene in the Savannah where cheetahs, lions, hyenas and vultures can be seen fighting over the carcass which has no say in the matter.
The BLRC ignores this inter-creditor conflict completely and treats unsecured financial creditors as a homogeneous group; it believes that everything can be decided by a 75% vote of the Creditors Committee. In practice, this is not the case. Unsecured financial creditors can be senior or junior and multiple levels of subordination are possible. Moreover, the bankruptcy of any large corporate entity involves several levels of holding companies and subsidiary companies which also creates an implicit subordination among different creditors made more complex by inter company guarantees.
Consider for example, the recommendation of the BLRC that:
The evaluation of these proposals come under matters of business. The selection of the best proposal is therefore left to the creditors committee which form the board of the erstwhile entity in liquidation. (p 100)
If the creditors are homogeneous, this makes eminent sense. The creditors are the players with skin in the game and they should take the business decisions. The situation is much more complex and messy with heterogeneous creditors. Suppose for example that a company has 60 of senior debt and 40 of junior debt and that the business is likely to be sold for something in the range of 40-50. In this situation, the junior creditors should not have any vote at all: like the equity shareholders, they too are part of the carcass in the Savannah which others are fighting over. On the other hand, if the expected sale proceeds are 70-80, then the senior creditors should not have a vote at all. The senior creditors have no skin in the game because it matters absolutely nothing to them whether the sale fetches 70 or 80; they get their money in any case. They are like the lion that has had its fill and leaves it to lesser mortals to fight over what is left of the carcass.
The situation is made more complex by the fact that in practice the value of the proposals is not certain, and the variance matters as much as the expected value. A junior creditor’s position is often similar to that of the holder of an out of the money option – it tends to prefer proposals that are highly risky. Much of the upside of a risky sale plan may flow to the junior creditor, while most of the downside may be to the detriment of the senior creditor.
Another recommendation of the BLRC that I am uneasy about is the stipulation that operational creditors should be excluded from the decision making:
The Committee concluded that, for the process to be rapid and efficient, the Code will provide that the creditors committee should be restricted to only the financial creditors. (p 84)
Suppose for example that Volkswagen’s liabilities to its cheated customers were so large as to push it into bankruptcy. Would it make sense not to give these “operational creditors” a seat at the table? What about the bankruptcy of a electric utility whose nuclear reactor has suffered a core meltdown?
Mon, 19 Oct 2015
I have piece in today’s Mint arguing that the Volkswagen emission scandal is a wake-up call for all financial regulators worldwide:
The implications of big firms such as Volkswagen using software to cheat their customers go far beyond a few million diesel cars
The Volkswagen emissions scandal challenges us to move beyond Ronald Reagan’s favourite Russian proverb “trust but verify” to a more sceptical attitude: “distrust and cross-check”.
A modern car is reported to contain a hundred million lines of code to deliver optimised performance. But we learned last month that all this software can also be used to cheat. Volkswagen had a cheating software in its diesel cars so that the car appeared to meet emission standards in the lab while switching off the emission controls to deliver fuel economy on the road.
The shocking thing about Volkswagen is that (unlike, say Enron), it is not perceived to be a significantly more unethical company than its peers. Perhaps, the interposition of software makes the cheating impersonal, and allows managers to psychologically distance themselves from the crime. Individuals who might hesitate to cheat personally might have less compunctions in authorizing the creation of software that cheats.
The implications of big corporations using software to cheat their customers go far beyond a few million diesel cars. We are forced to ask whether, after Volkswagen, any corporate software can be trusted. In this article, I explore the implications of distrusting the software used by big corporations in the financial sector:
Can you trust your bank’s software to calculate the interest on your checking account correctly? Or might the software be programmed to check your Facebook and LinkedIn profiles to deduce that you are not the kind of person who checks bank statements meticulously, and then switch on a module that computes the interest due to you at a lower rate?
Can you be sure that the stock exchange is implementing price-time priority rules correctly or might the software in the order matching engine be programmed to favour particular clients?
Can you trust your mutual funds’ software to calculate Net Asset Value (NAV) correctly? Or might the software be programmed to understate the NAV on days where there are lots of redemption (and the mutual fund is paying out the NAV) while overstating the NAV on days of large inflows when the mutual fund is receiving the NAV?
Can you be sure that your credit card issuer has not programmed the software to deliberately add surcharges to your purchases. Perhaps, if you complain, the surcharges will be promptly reversed, but the issuer makes a profit from those who do not complain.
Can you trust the financials of a large corporation? Or could the accounting software be smart enough to figure out that it is the auditor who has logged in, and accordingly display a set of numbers different from what the management sees?
After Volkswagen, these fears can no longer be dismissed as mere paranoia. The question today is how can we, as individuals, protect ourselves against software-enabled corporate cheating? The answer lies in open source software and open data. Computing is cheap, and these days each of us walks around with a computer in our pocket (though, we choose to call it a smartphone instead of a computer). Each individual can, therefore, well afford to cross-check every computation if (a) the requisite data is accessible in machine-readable form, and (b) the applicable rules of computation are available in the form of open source software.
Financial sector regulations today require both the data and the rules to be disclosed to the consumers. What the rules do not do is to require the disclosures to be computer friendly. I often receive PDF files from which it is very hard to extract data for further processing. Even where a bank allows me to download data as a text or CSV (comma-separated value) file, the column order and format changes often and the processing code needs to be modified every time this happens. This must change. It must be mandatory to provide data in a standard format or in an extensible format like XML. Since data anyway comes from a computer database, the bank or financial firm can provide machine-readable data to the consumer at negligible cost.
When it comes to rules, disclosure is in the form of several pages of fine print legalese. Since the financial firm anyway has to implement rules in computer code, there is little cost to requiring that computer code be freely made available to the consumer. It could be Python code as the US SEC proposed five years ago in the context of mortgage-backed securities (http://www.sec.gov/rules/proposed/2010/33-9117.pdf), or it could be in any other open source language that does not require the consumer to buy an expensive compiler to run the code.
In the battle between the consumer and the corporation, the computer is the consumer’s best friend. Of course, the big corporation has far more powerful computers than you and I do, but it needs to process data of millions of consumers in real time. You and I need to process only one person’s data and that too at some leisure and so the scales are roughly balanced if only the regulators mandate that corporate computers start talking to consumers’ computers.
Volkswagen is a wake-up call for all financial regulators worldwide. I hope they heed the call.
Tue, 13 Oct 2015
Last week, I read two stories that made me wonder how regulators are far behind the curve when it comes to new media.
First, Business Insider reported that after the newswire hacking scandal (which I blogged about last month), Goldman Sachs was considering announcing its earnings on Twitter instead of on the newswires. Of course, such reports are often speculative and nothing may come of it, but it indicates that at least some organizations are taking the new media seriously.
Currently, section 202.06(C) ... on the best way to release material news ... is outdated as it refers to, among other things, the release of news by telephone, facsimile or hand delivery. Instead, the Exchange proposes ... that listed companies releasing material news should either (i) include the news in a Form 8-K or other Commission filing, or (ii) issue the news in a press release to the major news wire services.
The regulators have finally decided to shift from obsolete media to the old media; the new media is not even on the horizon.
Mon, 12 Oct 2015
Bloomberg TV carried an interview with me last week. The video is available at the channel’s website. Among several other things, the interview also covered the Amtek Auto episode that I have blogged about in the past. I argued that Amtek Auto is unlikely to be the last episode of distressed corporate bonds in mutual fund portfolios, and we need to be more proactive in future.
Thu, 08 Oct 2015
Last month, I read four seemingly unrelated papers which all point towards problems posed by large fund managers.
Ben-David, Franzoni, Moussawi and Sedunov (The Granular Nature of Large Institutional Investors) show that the stocks owned by large institutions exhibit stronger price inefficiency and are also more volatile. They also study the impact of Blackrock’s acquisition of Barclays Global Investors (which the authors for some strange reason choose to identify only as “a mega-merger between two large institutional investors that took place at the end of 2009”). Post merger, the ownership of stocks which was spread across two fund managers became concentrated in one fund manager. The interaction term in their regression results show that this concentration increased the volatility of the stocks concerned. On the mispricing front, they show that the autocorrelation of returns is higher for stocks that are held by large institutional investors; and that stocks with common ownership by large institutions display abnormal co-movement. They also show that negative news about the fund manager (increase in the CDS spread) lead to an increase in volatility of stocks owned by that fund.
Israeli, Lee and Sridharan (Is There a Dark Side to Exchange Traded Funds (ETFs)? An Information Perspective) find that stocks that are owned by Exchange Traded Funds (ETFs) suffer a decline in pricing efficiency: higher trading costs (measured as bid-ask spreads and price impact of trades), higher co-movement with general market and industry returns; a decline in the predictive power of current returns for future earnings); and a decline in the number of analysts covering the firm. They hypothesize that ETF ownership reduces the supply of securities available for trade, as well as the number of uninformed traders willing to trade these securities. Much the same factors may be behind the results found by Ben-David, Franzoni, Moussawi and Sedunov.
Clare, Nitzsche and Motson (Are Investors Better Off with Small Hedge Funds in Times of Crisis?) argue that on average investors were better off investing with a small hedge fund instead of a large one in times of crisis (the dot com bust and the global financial crisis). They speculate that bigger hedge funds might attract more hot money (fund of funds) which might lead to large redemptions during crises. Smaller hedge funds might have less flighty investors and more stringent gating arrangements. Smaller hedge funds might also have lower beta portfolios.
Elhauge (Horizontal Shareholding as an Antitrust Violation) focuses on problems in the real economy rather than in the financial markets. The argument is that when a common set of large institutions own significant shares in firms that are horizontal competitors in a concentrated product market, these firms are likely to behave anticompetitively. Elhauge discusses the DuPont-Monsanta situation to illustrate his argument. The top four shareholders of DuPont are also four of the top five shareholders in Monsanto, and they own nearly 20% of both companies. The fifth largest shareholder of DuPont, the Trian Fund, which did not own significant shares in Monsanto, launched a proxy contest criticizing DuPont management for failing to maximize DuPont profits. In particular, Trian complained that DuPont entered into a reverse payment patent settlement with Monsanto whereby, instead of competing, DuPont paid Monsanto for a license to use Monsanto’s patent. Trian’s proxy contest failed because it was not supported by the four top shareholders of DuPont who stood to gain from maximizing the joint profits of DuPont and Monsanto. I thought it might be useful for the author to compare this situation with the cartelization promoted by the big investment banks in 19th century US or by the big banks in early 20th century Germany or Japan.
Sun, 04 Oct 2015
By assuming non negative interest rates, finance textbooks arrive at many results that are false in a negative rates world. Finance theory does not rule out negative rates – theory requires only bond prices to be non negative, and this only prevents interest rates from dropping below −100%. In practice also, early 2015 saw interest rates go negative in many countries. The BIS 2015 Annual Report (Graph II.6, page 32) shows negative ten-year yields in Switzerland, and negative five year yields in Germany, France, Denmark and Sweden in April 2015.
Let us take a look at how many textbook results are no longer valid in this world:
The formula for the present value of a perpetuity PV=1/r yields the absurd result that the present value is negative when r is negative. In fact, the present value is infinite (the geometric series diverges for negative r).
Interestingly, the formula for a growing perpetuity PV=1/(r−g) is still valid under the text book assumption that r>g. But this requires negative g in a negative rates world. That is why the 1/r formula for the zero growth case fails.
It is no longer true as the textbooks claim that an American call option on a non dividend paying stock would never be exercised prematurely and is therefore the same as a European call. If the call is sufficiently deeply in the money, the holder would want to pay the exercise price as early as possible to avoid the tax (of negative rates) on cash holdings.
The opposite text book claim about puts is now false. The textbook result is that a deep out of the money put could be exercised early to realize the cash flow early. In a negative rates world, we want to postpone the realization of cash (and avoid paying negative rates on that cash). Consequently, in a negative rates world, American puts would never be exercised early. Even the non dividend paying assumption is not needed for this result.
It is no longer true that the modified duration of a bond is slightly less than the duration; with negative rates, the modified duration of a bond is slightly more than the duration. Modified duration is given by MD=D/(1+r); if r is negative, the denominator is less than unity and the ratio is therefore more than the numerator.
Negative rates have not so far generally translated into negative coupons. For example, the Swiss Government and German Government have sold bonds with non negative coupons at a premium to par to achieve negative yields. If this trend continues, then in a negative rates world, there will be no par bonds and no discount bonds, and the concept of a par bond yield curve becomes problematic.
Over a period of time, probably negative coupon bonds will emerge. Warren Buffet’s Berkshire Hathaway sold a convertible bond with a negative coupon way back in 2002. With negative coupons, it is no longer true that the duration of a bond cannot exceed its maturity. It is also not true that for the same maturity, the zero coupon bond has the longest duration. For example, a simple calculation shows that a ten year par bond with a −1% coupon and a −1% yield has a duration of 10.47 years.
Sun, 27 Sep 2015
Corporate disclosures rules in the US still permit long delays more appropriate to a bygone age before technology speeded up everything from stock trading to instant messaging. Cohen, Jackson and Mitts wrote a paper earlier this month arguing that substantial insider trading occurs during the four business day window available to companies to disclose material events. The paper studied over forty thousand trades by insiders that occurred on or after the event date and before the filing date; the analysis demonstrates that these trades (which may be quite legal) were highly profitable.
Cohen, Jackson and Mitts also document that companies do usually disclose information much earlier than the legal deadline: about half of the disclosures are made on the same day; and large firms are even more prompt in their filing. But nearly 15% of all filings use the full four day delay that is available. In the early 2000s, after the Enron scandal, the US SEC tried to reduce the window to two days, but gave up in the face of intense opposition. I think the SEC should require each company to monitor the median delay between the event and the filing, and provide an explanation if this median delay exceeds one day. Since there are on average about four filings per company per year, it should be feasible to monitor the timeliness over a rolling three year period.
Another troubling thing about the US system is the use of press releases as the primary means of disclosure. Last month, the SEC filed a complaint against a group of traders and hackers who stole corporate press releases from the web site of the newswire agencies before their public release. What I found most disturbing about this case was that the SEC went out of its way to emphasize that the newswire agencies were not at fault; in fact, the SEC redacted the names of the agencies (though it was not at all hard for the media to identify them). Companies disclose material events to a newswire several hours before the scheduled time of public release of this information by the newswire; the newswire agencies are not regulated by the SEC; they are not required to encrypt market sensitive data during this interregnum; there are no standards on the computer security measures that the newswires are required to take during this period; a group of relatively unsophisticated hackers had no difficulty hacking the newswire websites repeatedly over a period of five years. And the SEC thinks that no changes are required in this anachronistic system.
Wed, 09 Sep 2015
The Reserve Bank of India (RBI) has granted “in principle” approval to eleven new payment banks and has also promised to license more in future. Many of the licensees could prove to be fierce competitors because of their deep pockets and strong distribution networks. For the incumbent banks, the most intense competition from the new entrants will probably be for the highly profitable Current and Savings Accounts (CASA) deposits which are primarily meant for payments. And it is here that the complacency of incumbents banks could provide an opening to the new payment banks.
In the late 1990s and early 2000s, new generation private banks innovated on technology and customer service and gained significant market share from the public sector banks. However, in recent years, some complacency seems to have set in; customer service has arguably deteriorated even as fees have escalated. Public sector banks have caught up with them on ATM and online channels; and in any case these channels are rapidly being overtaken by mobile and other platforms. In fact, India may not need any more ATMs at all.
In this competitive landscape, payment banks could gain significant market share if they are sufficiently innovative and provide better customer service than the incumbents. Unlike mainstream banks which have to worry about investments and advances and lots of other things, payment banks can be totally focused on serving retail customers. Since their survival would depend on this sharp focus, there is every likelihood that they would turn out to be more nimble and innovative in this segment.
The ₹100,000 limit on balances at the payment banks means that initially it would be the rural CASA that would be at risk. But if payment banks do a good job, the limit may be raised to a much larger level (maybe ₹500,000) over a few years. At that point, urban CASA will also be at risk of migration. It will be easy for RBI to raise the limit because the balances have to be invested in Government Securities and so customer money is subject only to operational risk.
eWallets could prove to be another competitive weapon in attacking the urban CASA segment. Large segments of the Indian population are uncomfortable with online credit card usage and with netbanking. A few years ago, eCommerce firms in India used Cash on Delivery (COD) to gain acceptance. However, COD is not scalable and it is breaking down for various reasons. In the last year or so, eWallets have begun to replace COD, and these too could pose a threat to traditional payment services. All banks are trying to launch eWallets and mobile banking apps, but I am not sure that traditional banks have a competitive advantage here. In fact, a customer who is worried about online security might well prefer to have an eWallet with a small balance for online transactions instead of exposing his or her main bank account to the internet. In this context, the payment banks may find that the ₹100,000 limit does not pose a competitive disadvantage at all.
All this is of course good news for the customer.
Sun, 06 Sep 2015
JPMorgan Mutual Fund has gated (restricted redemptions from) two of its debt funds which have large exposure to Amtek Auto which is in distress. A gate is better than nothing, but it is inferior to a side pocket. I would like to quote from a proposal that I made in a blog post that I wrote in October 2008 when the NAVs of many debt oriented mutual funds were not very credible:
At the very least what is required today is a partial redemption freeze to ensure that nobody is able to redeem units of mutual funds at above the true NAV of the fund. Anybody who wants to redeem should be paid 70% or 80% of the published NAV under the assumption that the true NAV would not be below this. The balance should be paid only after the true NAV is credibly determined through asset sales.
Unlike the generalized distress of 2008, what JPMorgan funds are facing today is distress limited to a single large exposure. According the July portfolio statement, Amtek Auto was about 15% of the NAV of the Short Term Income Fund. Even if this is valued at zero, the fund can pay out 85% of the NAV to everybody. (For the India Treasury Fund, Amtek is only 5% of NAV, so the fund can pay out 95%). Essentially, my proposal is what is known in the hedge fund world as a side pocket: the holding in Amtek Auto should go into a separate side pocket until it is liquidated and the value is realized. The rest of the money would remain in the normal mutual fund which would be open for unrestricted redemption (as well as for fresh investment).
The gate has two big disadvantages:
The gate is not total: redemptions are not stopped, they are only restricted to 1%. This means that some redemptions are taking place at a wrong value. The money that is being paid out to this 1% is money that is partly money stolen from the remaining investors.
The gate rewards the mutual fund for its own incompetence. A fund which has made a bad investment choice would be punished in the market place by a wave of redemptions. That is the competitive dynamic that encourages mutual funds to perform due diligence for their investment. A gate stops the redemption and shields the fund from this punishment.
It is possible that the mutual fund offer document might not contain a provision for a side pocket. But the Securities and Exchange Board of India (SEBI) as the regulator certainly has the power to issue directions to the fund to use this method. Let us see whether it acts and acts quickly.
Sat, 05 Sep 2015
The following posts appeared on the sister blog (on Computing) last month.
SMS does not provide true two factor authentication. This was cross posted on this blog also.
Tweets during the last month (other than blog post tweets):
August 25: I retweeted @chyppings Indian mobile money. I particularly liked the statement that “Most consumers, most of the time, need payments not banking”. Related post by @chyppings: Unbanked is not the problem, banked is not the solution
August 12: Average foreign subsidiary of US bank is a five level step down subsidiary. Max is 19 levels! Liberty Street Economics
August 1 / July 31: 20 years from now, what would be seen as the most important financial event of 2008: Lehman bankruptcy (15 Sep) or Bitcoin (1 Nov)?
Mon, 31 Aug 2015
I am a strong supporter of two factor authentication (2FA), and I welcomed the idea of a one time password sent by SMS when it was introduced in India a few years ago. But gradually I have become disillusioned because SMS is not true 2FA.
Authentication is a problem that humanity has faced for centuries; and long before computers were invented, several authentication methods were developed and adopted. Two widely used methods are nicely illustrated by two different stories in the centuries old collection Arabian Nights. The first method is to authenticate with something that you know like Open Sesame in Ali Baba and the Forty Thieves. The Ali Baba story describes how the secret password is easily stolen during the process of authentication itself. What is worse is that while we would quickly detect the theft of a physical object, the theft of a secret password is not detected unless the theft does something stupid like Ali Baba’s brother did in the story.
The second method is to authenticate with something that you have, and its problems are eloquently portrayed in the story about Aladdin’s Wonderful Lamp. In the Aladdin story, the lamp changes hand involuntarily at least four times; physical keys or hardware tokens can also be stolen. The problem is that while you can carry “what you know” with you all the time (if you have committed it to memory), you cannot carry “what you have” with you all the time. When you leave it behind, you may (like Aladdin) find on your return that it is gone.
Clearly, the two methods – “what you know” and “what you have” – are complementary in that one is strong where the other is weak. Naturally, centuries ago, people came up with the idea of combining the two methods. This is the core idea of 2FA – you authenticate with something that you have and with something that you know. An interesting example of 2FA can be found in the Indian epic, the Ramayana. There is an episode in this epic where Rama sends a messenger (Hanuman) to his wife Sita. Since Hanuman was previously unknown to Sita, there was clearly a problem of authentication to be solved. Rama gives some personal ornaments to Hanuman which he could show to Sita for the “what you have” part of 2FA. But Rama does not rely on this alone. He also narrates some incidents known only to Rama and Sita to provide the “what you know” part of 2FA. The Ramayana records that the authentication was successful in a hostile environment where Sita regarded everything with suspicion (because her captors were adept in various forms of sorcery).
In the digital world, 2FA relies on a password for the “what you know” part and some piece of hardware for the “what you have” part. In high value applications, a hardware token – a kind of electronic key – is common. While it is vulnerable to MitM attacks, I like to think of this as reasonably secure (maybe I am just deluded). The kind of person who can steal your password is probably sitting in Nigeria or Ukraine, while the person who can steal your hardware must be living relatively close by. The skill sets required for the two thefts are quite different and it is unlikely that the same person would have both skill sets. The few people like Richard Feynman who are equally good at picking locks and cracking the secrets of the universe hopefully have better things to do in life than hack into your bank account.
The SMS based OTP has emerged as the poor man’s substitute for a hardware token. The bank sends you a text message with a one time password which you type in on the web site as the second factor in the authentication. Intuitively, your mobile phone becomes the the “what you have” part of 2FA.
Unfortunately, this intuition is all wrong – horribly wrong. The SMS which the bank sends is sent to your mobile number and not to your mobile phone. This might appear to be an exercise in hair splitting, but it is very important. The problem is that while my mobile phone is something that I have, my SIM card and mobile connection are both in the telecom operator’s hands and not in mine.
There have been cases around the world where somebody claiming to be you convinces the telecom operator that you have lost your mobile and need a new SIM card with the old number. The operator simply deactivates your SIM and gives the fake you a new SIM which has been assigned the old number. If you think this is a figment of my paranoid imagination, take a look at this 2013 story from India and this 2011 story from Malaysia. If you want something from the developed world, look at this 2011 story from Australia about how the crook simply went to another telecom operator and asked for the number to be “ported” from the original operator. (h/t I came across all these stories directly or indirectly via Bruce Schneier at different points of time). I have blogged about this problem in the past as well (see here and here).
My final illustration of why the SMS OTP that is sent to you is totally divorced from your mobile phone is provided by my own experience last week in Gujarat. In the wake of rioting in parts of the state, the government asked the telecom operators to shut down SMS services and mobile data throughout the state. I needed to book an air ticket urgently one night for a visiting relative who had to rush back because of an emergency at home. Using a wired internet connection, I could login to the bank site using my password (the “what I know” part of 2FA). The mobile phone (the “what I have” part of 2FA) was securely in my hand. All to no avail, because the telecom operator would not send me the SMS containing the OTP. I had to call somebody from outside the state to make the payment.
This also set me thinking that someday a criminal gang would (a) steal credit cards, (b) engineer some disorder to get SMS services shut down, and (c) use this “cover of darkness” to steal money using those cards. They would know that the victims would not receive the SMS messages that would otherwise alert them to the fraud.
I think we need to rethink the SMS OTP model. Perhaps, we need to protect the SIM with something like a Trusted Platform Module (TPM). The operator may be able to give away your SIM to a thief, but it cannot do anything about your TPM – it would truly be “something that you ” have. Or maybe the OTP must come via a secure channel different from normal SMS.
Thu, 27 Aug 2015
Before coming to India and Mauritius, let me talk about US and the Dutch Antilles in the early 1980s. It took the US two decades to change their tax laws and stop the free gift they were giving to the Antilles. If we assume India acts with similar speed, it is around time we changed our tax laws because our generosity to Mauritius has been going on since the mid 1990s.
There is a vast literature about the US and the Netherlands Antilles. The description below is based on an old paper by Marilyn Doskey Franson (“Repeal of the Thirty Percent Withholding Tax on Portfolio Interest Paid to Foreign Investors”, Northwestern Journal of International Law & Business, Fall 1984, 930-978). Since this paper was written immediately after the change in US tax laws, it provides a good account of the different kinds of pulls and pressures that led to this outcome. Prior to 1984, passive income from investments in United States assets such as interest and dividends earned by foreigners was generally subject to a flat thiry percent tax which was withheld at the source of payment. Franson describes the Netherlands Antilles solution that was adopted by US companies to avoid this tax while borrowing in foreign markets:
In an effort to reduce the interest rates they were paying on debt, corporations began as early as the 1960s to access an alternative supply of investment funds by offering their debentures to foreign investors in the Eurobond market. The imposition of the thirty percent withholding tax on interest paid to these investors, however, initially made this an unattractive mode of financing. Since foreign investors could invest in the debt obligations of governments and businesses of other countries without the payment of such taxes, a United States offeror would have had to increase the yield of its obligation by forty-three percent in order to compensate the investor for the thirty percent United States withholding tax and to compete with other issuers. This prospect was totally unacceptable to most United States issuers.
In an effort to overcome these barriers, corporations began to issue their obligations to foreign investors through foreign “finance subsidiaries” located in a country with which the United States had a treaty exempting interest payments. Corporations generally chose the Netherlands Antilles as the site for incorporation of the finance subsidiary because of the favorable terms of the United States – Kingdom of the Netherlands Income Tax Convention ... The Antillean finance subsidiary would issue its own obligations in the Eurobond market, with the United States parent guaranteeing the bonds. Proceeds of the offering were then reloaned to the United States parent on the same terms as the Eurobond issue, but at one percent over the rate to be paid on the Eurobonds. Payments of interest and principal could, through the use of the U.S.-N.A. treaty, pass tax-free from the United States parent to the Antillean finance subsidiary; interest and principal paid to the foreign investor were also tax-free. The Antillean finance subsidiary would realize net income for the one percent interest differential, on which the Antillean government imposed a tax of about thirty percent. However, the United States parent was allowed an offsetting credit on its corporate income tax return for these taxes paid to the Antillean government. Indirectly, this credit resulted in a transfer of tax revenues from the United States Treasury to that of the Antillean government. (emphasis added)
The use of the Antillean route was so extensive that in the early 1980s, almost one-third of the total portfolio interest paid by US residents was paid through the Netherlands Antilles. (Franson, page 937, footnote 30). There was a lot of pressure on the US government to renegotiate the Antillean tax treaty to close this “loophole”. However, this was unattractive because of the adverse consequences of all existing Eurobonds being redeemed. This is very similar to the difficulties that India has in closing the Mauritius loophole. Just as in India, the tax department in the US too kept on questioning the validity of the Antillean solution on the ground “that while the Eurobond obligations were, in form, those of the finance subsidiary, that in substance, they were obligations of the domestic parent and, thus, subject to the thirty percent withholding tax.” (Franson, page 939).
Matters came to a head in 1984 when the US Congress began discussing amendments to the tax laws “that would have eliminated the foreign tax credit taken by the United States parent for taxes paid by the finance subsidiary to the Netherlands Antilles.” (Franson, page 939). The US Treasury was worried about the implications of closing down the Eurobond funding mechanism and proposed a complete repeal of the 30% withholding tax on portfolio interest. This repeal was enacted in 1984. Since then portfolio investors are not taxed on their US interest income at all. Similar benefits apply to portfolio investors in US equities as well. This tax regime has not only stopped the gift that the US government was giving to the Antilles, but it has also contributed to a vibrant capital market in the US.
It is interesting to note a parallel with the Participatory Note controversy in India: “The Eurobond market is largely composed of bearer obligations because of foreigners’ demand for anonymity. Throughout the congressional hearings on the repeal legislation, concerns were voiced over the possibility of increased tax evasion by United States citizens through the use of such bearer obligations.” (Franson, page 949).
It is perhaps not too much to hope that two decades after opening up the Indian market to foreign portfolio investors in the mid 1990s, India too could adopt a sensible tax regime for them. The whole world has moved to a model of zero or near zero withholding taxes on portfolio investors. Since capital is mobile, it is impossible to tax foreign portfolio investors without either driving them away or increasing the cost of capital to Indian companies prohibitively. It is thus impossible to close the Mauritius loophole just as it was impossible for the US to close the Antilles loophole without first removing the taxation of portfolio investors. The Mauritius loophole is a gift to that country because of the jobs and incomes that are created in that country solely to make an investment in India. Every shell company in Mauritius provides jobs to accountants, lawyers, nominee directors and the like. As the tax laws are tightened to require a genuine business establishment in Mauritius, even more income is generated in Mauritius through rental income and new jobs. All this is a free gift to Mauritius provided by greedy tax laws in India. It can be eliminated if we exempt portfolio income from taxation.
On the other hand, non portfolio investment is intimately linked to a business in India and must necessarily be subject to normal Indian taxes. In the US, the portfolio income exemption does not apply to a foreigner who owns 10% or more of the company which paid the interest or dividend, and India should also do something similar. The Mauritius loophole currently benefits non portfolio investors as well, and this is clearly unacceptable. Making portfolio investment tax free will enable renegotiation of the Mauritius tax treaty to plug this loophole.
Wed, 26 Aug 2015
On October 15, 2014, after an early morning release of weak US retail sales data, the benchmark 10-year US Treasury yield experienced a 16-basis-point drop and then rebounded to return to its previous level between 9:33 and 9:45 a.m. ET. The major US regulators were sufficiently disturbed by this event to prepare a Joint Staff Report about this episode. I blogged about this report last month arguing that there was nothing irrational about what happened in that market on that day.
Now compare that with what happened to the S&P 500 stock market index on August 24 and 25, 2015 in response to bad news from China. On the 24th, the market experienced the following before ending the day down about 4%:
A fall of about 5% within minutes of the open
A rise of about 3.5% over the next hour or so
A fall of about 1.5% over the next hour or so
A rise of about 2.5% over the next hour or so
A fall of about 3.75% over the next three hours or so
The market was a little less erratic the next day, rising 2.5% before falling 4% and ending about 1.4% down.
I see similar phenomena at work in both episodes (15-Oct-2014 US Treasury and 24-Aug-2015 US Stocks): the market was trying to aggregate information from diverse participants in response to fundamental news which was hard to evaluate completely. In Hayek’s memorable phrase, prices arise from the “the interactions of people each of whom possesses only partial knowledge” (F. A. Hayek, “The Use of Knowledge in Society”, The American Economic Review, 35(4), 1945, p 530).
Sometimes, the news that comes to the market is such that it requires the “interactions of people” whose beliefs or knowledge are somewhat removed from the average, and these interactions can be achieved only when prices move at least temporarily to levels which induce them to enter the market. The presence of a large value buyer is revealed only when the price moves to that latent buyer’s reservation price. A temporary undershooting of prices which reveals the knowledge possessed by that buyer is thus an essential part of the process of price discovery in the market when fundamental uncertainty is quite high. To quote Hayek again, “the ‘data’ from which the economic calculus starts are never for the whole society ‘given’ to a single mind which could work out the implications, and can never be so given.” (p 519).
Hayek’s insights are timeless in some sense, but today seventy years later, I venture to think that if he were still alive, he would replace “people” by “people and their algorithms”. Algorithms can learn faster than people, and so sometimes when the algorithms are in charge, the overshooting of prices needs to last only a few minutes to serve their price discovery function. That is conceivably what happened in US Treasuries on October 15, 2014. Sometimes, when the evaluation and judgement required is beyond the capability of the algorithms, human learning takes over and overshooting often lasts for hours and days to allow aggregation of knowledge from people whose latency is relatively long.
Wed, 05 Aug 2015
There are many important and surprising lessons to be learned from the findings in the Kroll report on the bank fraud in Moldova. I believe that these have implications for regulators world wide.
The report is about the collapse in November 2014 of three of the largest banks of Moldova (Unibank, Banca Sociala, and Banca de Economii) which together accounted for 30% of the country’s banking sector. The missing money of more than $1 billion is over 10% of Moldova's GDP.
There are three elements in the story:
A surreptitious takeover of three of the largest Moldovan banks in 2012.
Use of interbank markets and other wholesale sources by these banks to borrow large amounts of money so that they could lend more.
Surreptitious lending of very large amounts of money to one borrower.
The crucial take away for me from the report is that it is possible to evade all the rules and regulations that banking regulators have created to prevent such actions.
For example, as in many other countries, acquisition of a stake of more than 5% in any bank requires formal approval from the National Bank of Moldova. However, shares in the banks were acquired by a large number of apparently unrelated Moldovan, Russian and Ukrainian entities none of which crossed the 5% threshold. All the entities had different addresses and do not seem to have common directors or shareholders. The Kroll report presents some circumstantial evidence that they are related based largely on the fact that they followed similar strategies around the same time and that some of the directors of these entities appear to be nominee directors. I do not believe that this could have been detected in real time. More importantly, I seriously doubt that an attempt to block the purchase of shares at that time on highly speculative grounds would have stood up in a court of law. I conclude that in a modern open economy, ownership restrictions are largely meaningless and unenforceable. They are mere theatre.
Turning to change of control, this too is not easy to establish even in retrospect. The weakest element in the Kroll report in my opinion is that it provides too little evidence that there was a major change in the management and control of the banks. In some of the banks, the management appears to have been largely unchanged. In some cases, where new senior management personnel were inducted, they came from senior positions at other large banks. It is difficult to see how the banking regulator could have objected to these minor management changes.
Finally, the fact that these banks lent such large amounts to money to one single business group (the Shor group) has become apparent only after extensive investigation. The analysis included things like checking the IP addresses from which online banking facilities were accessed by these entities. Media reports suggest that people in Moldova were taken by surprise when the Kroll report identified the Shor group as the beneficiary of massive lending by the failed banks. I am not at all convinced that regulators could have identified all these linkages in real time.
Finally, it must be kept in mind that the whole fraud was accomplished in a little over two years. Supervisory processes work far too slowly to detect and prevent this before the money is gone. I would not be surprised if much of the money left Moldova long ago, and the Shor group was just a front for mafia groups outside the country.
This example has made me even more sympathetic than before to the view that larger capital requirements and size restrictions are the way to go to make banking safer.
As an aside, the “strictly confidential” Kroll report was published in an unusual way. The report was available to only a very limited number of people in the Moldovan government because of the stipulation that:
Any communication, publication, disclosure, dissemination or reproduction of this report or any portion of its contents to third parties without the advance written consent of Kroll is not authorized.
The Speaker of the Moldova Parliament, Mr. Andrian Candu, published it on his personal blog with the following statement (Google Translated from the original Romanian):
I decided to publish the report Kroll and I take responsibility for this action. I do it openly, without hiding behind anonymous sources. ... I understand the arguments of Kroll not to accept publication, but the situation in Moldova and our responsibility to be transparent with the citizens requires us to adapt to the realities of the moment ... I think it is important that every citizen should have access to that report.
Every page of the published report contains the footer:
Private and Confidential: Copy 33 of 33 – Mr. Andrian Candu, the Speaker of the Parliament of the Republic of Moldova
This is about as transparent as one can get. Yet many sections of the media have described the publication of the report as a leak. I think the use of the derogatory word leak in this context is quite inappropriate. In fact, I wish more people in high positions display the same courage of their convictions that Mr. Candu has demonstrated. The world would be a better place if they do so.
Sat, 01 Aug 2015
The following posts appeared on the sister blog (on Computing) last month.
Tweets during the last month (other than blog post tweets):
July 25: Pozsar “there are no shadow banks, just a shadow banking system”. Good discussion on bond funds & asset management. http://ssrn.com/abstract=2558945
July 13: @lauraisreal No. We used R
July 12: Economists regain self confidence. Larry Summers in the FT: Economic laws are like physical laws; they do not yield to political will.
Sat, 25 Jul 2015
To a Bayesian, almost everything is informative and therefore relevant. This means that the Independence of Irrelevant Alternatives axiom is rarely applicable.
A good illustration is provided by the Joint Staff Report on “The U.S. Treasury Market on October 15, 2014”. On that day, in the narrow window between 9:33 and 9:45 a.m. ET, the benchmark 10-year US Treasury yield experienced a 16-basis-point drop and then rebounded to return to its previous level. The impact of apparently irrelevant alternatives is described in the Staff Report as follows:
Around 9:39 ET, the sudden visibility of certain sell limit orders in the futures market seemed to have coincided with the reversal in prices. Recall that only 10 levels of order prices above and below the best bid and ask price are visible to futures market participants. Around 9:39 ET, with prices still moving higher, a number of previously posted large sell orders suddenly became visible in the order book above the current 30-year futures price (as well as in smaller size in 10-year futures). The sudden visibility of these sell orders significantly shifted the visible order imbalance in that contract, and it coincided with the beginning of the reversal of its price (the top of the price spike). Most of these limit orders were not executed, as the price did not rise to their levels.
In other words, traders (and trading algorithms) saw some sell orders which were apparently irrelevant (nobody bought from these sellers at those prices), but this irrelevant alternative caused the traders to change their choice between two other alternatives. Consider a purely illustrative example: just before 9:39 am, traders faced the choice between buying a modest quantity at a price of say 130.05 and selling a modest quantity at a price of 129.95. They were choosing to buy at 130.05. At 9:39, they find that there is a new alternative: they can buy a larger quantity at a price of say 130.25. They do not choose this new alternative, but they change their earlier choice from buying at 130.05 to selling at 129.95. This is the behaviour that is ruled out by the axiom of the Independence of Irrelevant Alternatives.
But if one thinks about the matter carefully, there is nothing irrational about this behaviour at all. At 8:30 am, the market had seen the release of somewhat weaker-than-expected US retail sales data. Many traders interpreted this as a memo that the US economy was weak and needed low interest rates for a longer period. Since low interest rates imply higher bond prices, traders started buying bonds. At 9:39, they see large sell orders for the first time. They realize that many large investors did not receive this memo, or may be received a different memo. They think that their interpretation of the retail sales data might have been wrong and that they had possibly over reacted. They reverse the buying that they had done in the last few minutes.
In fact,the behaviour of the US Treasury markets on October 15 appears to me to be an instance of reasonably rational behaviour. Much of the action in those critical minutes was driven by algorithms which appear to have behaved rationally. With no adrenalin and testosterone flowing through their silicon brains, they could evaluate the new information in a rational Bayesian manner and quickly reverse course. The Staff Report says that human market makers stopped making markets, but the algorithms continued to provide liquidity and maintained an orderly market.
I expected the Staff Report to recommend that in the futures markets, the entire order book (and not just the best 10 levels) should be visible to all participants at all times. Given current computing power and communication bandwidth, there is no justification for sticking to this anachronistic practice of providing only limited information to the market. Surprisingly, the US authorities do not make this sensible recommendation because they fail to see the highly rational market response to newly visible orders. Perhaps their minds have been so conditioned by the Independence of Irrelevant Alternatives axiom, that they are blind to any other interpretation of the data. Axioms of rationality are very powerful even when they are wrong.
Sun, 12 Jul 2015
In response to my blog post of a few days back on regulating crowd funding, my colleague Prof. Joshy Jacob writes in the comments:
I agree broadly with all the arguments in the blog post. I would like to add the following.
If tapping the crowd wisdom on the product potential is the essence of crowdfunding, substituting that substantially with equity crowdfunding may not be a very good idea. While the donation based crowdfunding generates a sense of the product potential by way of the backings, the equity crowdfunding by financiers would not give the same, as their judgments still need to be based on the crowd wisdom. Is it possible to create a sequential structure involving donation based crowdfunding and equity based crowdfunding?
Unlike most other forms of financing, the judgement in crowdfunding is often done sitting far away, without meeting the founders, devoid of financial numbers, and therefore almost entirely based on the campaign material posted. This intimately links the central role of the campaign success to the nature of the promotional material and endorsements by influential individuals. Evolving a role model for the multimedia campaigns would be appropriate, given the ample evidences on behavioral biases in retail investor decision making.
Both these are valid points that the regulator should take into account. However, I would worry a bit about people gaming the system. For example, if the regulator says that a successful donation crowdfunding is a prerequisite for equity crowdfunding, there is a risk that entrepreneurs will get their friends and relatives to back the project in a donation campaign. It is true that angels and venture capitalists rely on crowdfunding campaign success as a metric of project viability, but I presume that they would have a slightly greater ability to detect such gaming than the crowd.