The sensational USD101-million cyber heist from Bangladesh Bank’s account was one of the highlights of 2016. Following the heist, the then central bank governor Atiur Rahman had to resign, and two BB deputy governors - Dr. Naznin Sultana and Abul Kashem – were sacked. Former bureaucrat Fazle Kabir has been appointed as the new BB governor.
One year after the heist, Bangladesh Bank is on the way to an image overhaul, and most of the stolen fund still remains unrecovered. On February 5, 2016, transactions worth USD101 million were withdrawn from a Bangladesh Bank account with the Federal Reserve Bank of New York. Of that amount, USD20 million traced to Sri Lanka has been recovered, and the USD81 million traced to the Philippines has been recovered partially. In a year, about USD15 million has been recovered from the Philippines, while the recovery of the rest of the USD65 million is still pending. The hope to recover the rest of the money is dwindling day by day, as the money recovery attempts are slowing down.
On March 15, 2016, a governmentcommissioned investigation committee was formed to investigate this heist. Headed by former central bank governor Mohammed Farashuddin, the three-member panel was supposed to submit an interim report within 30 days and a full-fledged report within 75 days. The other two members of the panel were the finance ministry’s additional secretary Gokul Chand Das and professor Mohammad Kaikobad of BUET’s science and engineering department. The panel met the deadline and submitted the report to finance minister AMA Muhith on May 30. However, Muhith has deferred releasing the final probe report several times. As of now, the report remains unpublished.
To recover the rest of the stolen money, a delegation led by law minister Anisul Huq went to the Philippines in December 2016. The objective of this visit was to meet the Philippine president Rodrigo Duarte to press him for the return of the missing funds. However, the scheduled meeting between the Bangladeshi delegation and president Duarte was canceled at the last moment. Later, the Philippine president’s spokesperson Ernesto Abella said that the meeting was canceled due to “pressing matters that demand the president’s immediate attention.” Philippine finance secretary Carlos Dominguez met the Bangladesh delegation, and strongly recommended Dhaka to share the results of its investigation. He also assured the visitors that the Philippine government is doing its best to find Bangladesh's missing money.
The Philippine central bank has slapped a USD21.3-million penalty on the Manila-based Rizal Commercial Banking Corporation (RCBC) for its involvement in the heist. The anti-money laundering council of Philippines filed charges against six RCBC officials in connection with the theft. However, RCBC denied any role in the heist and refused to pay any compensation to Bangladesh Bank. Moreover, the bank has blamed Bangladesh Bank's negligence behind the heist, and demanded the publication of the probe report conducted by Bangladesh.
"RCBC is not the proximate cause of the theft. They have no case against us. Bangladesh Bank was the one who was negligent," RCBC external counsel Thea Daep said in a statement, adding that the bank will not pay Bangladesh Bank anything. The RCBC authority also accused Bangladesh ambassador John Gomes of “wrongfully using the mass media to create pressure on the Philippines government.” On behalf of the bank, Daep urged Bangladesh Bank to be transparent and produce the results of its own investigation to shed light on who was behind the heist. “Philippine government has done a lot to assist Bangladesh in the aftermath of the heist. Now it is up to Bangladesh Bank to find out who was behind the heist,” he said.
RCBC’s statement comes as a response to John Gomes’ interview to Philippine Daily Inquirer in November. In the interview, John Gomes said, “Definitely, we would seek for RCBC to release some money. In the senate hearing, they had informed that if RCBC was made liable, they would take it to their board to compensate Bangladesh with USD50 million. This amount was very clearly mentioned.” According to a central bank source, the bank is expecting to recover an additional USD47 million of the stolen money which has been seized from some casinos of Philippines. Moreover, Bangladesh Bank insists that there is enough proof of RCBC’s involvement in the heist, pointing to the fines and charges against the bank and its officials by the Philippine authorities.
The probe committee hinted at the involvement of bank insiders in its report, and the finance minister agreed. However, he did not elaborate on this matter. Besides, he criticized the Federal Reserve Bank of New York. “They have approved four transactions without checking any validity. So, they have some responsibility in this regard. The security system was faulty, and NY Fed is not without liability,” he said. NY Fed, Bangladesh Bank, and Society for Worldwide Interbank Financial Telecommunication (SWIFT) have vowed to work together to recover the stolen money. A three-party meeting was held in New York to discuss the cyber fraud on May 10, 2016. Bangladesh Bank deputy governor Abu Hena Mohammad Razee Hassan and lawyer Azmalul Hossain QC represented Bangladesh Bank in the meeting. Following the meeting, NY Fed and Swift released a joint statement. Later on, Bangladesh Bank released the same statement.
The written statement said, “The senior representatives of the New York Fed, Bangladesh Bank, and SWIFT met in New York to continue discussions about the cyber fraud event that occurred in early February. The parties discussed certain technical details of the February event to enhance their mutual understanding of how the fraud occurred and further discussed steps that have been and will be taken to remediate the event and place Bangladesh Bank’s account at the New York Fed on a path to more normalized long-term operations. The participants remain concerned about this event and recommitted to working together to recover the entire proceeds of the fraud as expeditiously as possible, bring the perpetrators to justice in cooperation with law enforcement from other jurisdictions, and lend support to multilateral international efforts to further protect the global financial system from these types of attacks in the future.”
Subhankar Saha Bangladesh Bank executive director and spokesman
Whatever we did after the heist has been completely transparent. International organization Fire Eye investigated the heist and submitted a report in March. Large-scale planning is underway to further strengthen the security system. SWIFT’s money transfer protocol has been changed to deal with the security lapses. From now on, they will only send money after getting verified permission from three different levels. Besides, all the Bangladesh Bank officials are receiving training about cyber security and information technology. Changes are underway in the Bangladesh Bank structure as well. Strong measures are being taken to strengthen cyber security throughout the entire sector. The investigation committee has submitted their final probe report to the finance ministry. We are carrying on the lengthy process of bringing back the stolen money from abroad. So far we have recovered USD15 million with the help of the Philippine government. Discussions with SWIFT and NY Fed are going on as well.