Securities and mortgages

Editors: Angela Flannery and Dr Bill (WJ) Gough GOOD FRAUD MITIGATION PROCEDURES FOR PREVENTING INTERNAL FRAUD A CASE STUDY BY LESA BRANSGROVE AND MATTHEW BRANSGROVE The decision in Pioneer Mortgage Services Pty Ltd v Columbus Capital Pty Ltd [2015 FCA 1067 of Jagot J in the Federal Court on 1 October, 2015 is significant for highlighting to all parties involved in the origination of mortgages, namely banks, originators and managers and those institutions that securitise this asset class, the importance of having robust systems and audits in place to detect and minimise fraud. In this case, a securitisation funder bought a loan book of mortgages originally funded by ANZ Bank and became subject to the bank s obligations in its origination deeds. An originator managed the book and employed someone who systematically carried out fraudulent redraws totalling hundreds of thousands of dollars, which went undetected for seven years. The fraud was found to have occurred because the originator had no system in place to cross-check redraws placed in the software system against written borrower requests for loans below $10,000 and admitted this in evidence. The fraudulent employee was the senior point of contact between the originator and the borrowers and the superior of the staff conducting the audits, as well as the senior contact person to whom borrower complaints were directed. The review or audit of the redraws was carried out by another senior employee in the position of Operations Manager who limited her review in respect of loans under $10,000 to those loans for which the required paperwork had been created. As the frauds were committed using the software system only and did not involve the creation of any paperwork, these checks did not reveal the fraud. The fraud was only uncovered when the fraudster went on leave and a disgruntled customer complained to another employee. In this regard, another failure in the system was allowing the person in charge of software system transactions to be the one taking customer complaints and so having the ability to hide customer complaints. The money was not recovered from the fraudster and the funder suffered loss. The funder sued the originator, the guarantor of the originator and the fraudster for damages, alleging the circumstances of the fraud were a breach of the origination deeds and also constituted misleading and deceptive conduct. The funder ceased to pay management fees as a result of the breach. However interestingly, the primary action was instigated by the originator as against the funder claiming breach of contract and misleading and deceptive conduct for charging borrowers an annual fee. The originator sought final injunctions restraining the funder from doing so. Not only did the originator fail in its claims, but the funder then succeeded on its cross-claims for breach of contract and for misleading and deceptive conduct. The funder sued not just the originator but also the guarantor of the originator. The case illustrates the consequences of having a deficiency in a software system, the deficiency being that an employee through the simple completion of an online electronic form, forwarded to ANZ Bank, could obtain redraws without any signature from a borrower. This deficiency was exploited by the fraudster. The audit system in place to cross-check that an actual borrower had requested the loan was confined to reviewing those loans for which paperwork had been created, at least for loans under $10,000. No paperwork was created for the fraudulent loans and hence the fraud went undetected. Cross-claim for breach of contract Jagot J was clear in her criticism of the originator s systems and held that the originator failed to manage the loans in an efficient and businesslike manner and in accordance with sound business (2015) 26 JBFLP 311 311

practices, 1 as required by its origination deed and accordingly breached the originator s contractual obligation. The court found that if a proper system had been in place, the fraud would have been detected quickly. The case is not unique in its findings but significant in its application to the mortgage finance industry, because it brought into scrutiny the actions of an originator in terms of managing a loan portfolio funded by one of the big four banks in Australia, ANZ Bank. The case is a salutary warning to originators and managers that they need to be alive to any deficiencies in a software system and implement procedures to minimise an employee exploiting that deficiency by fraudulently making unauthorised redraws. Furthermore, the case highlights that not only documented procedures are important but that documented procedures must be reflected in the actual practice of the business. It is not sufficient to simply be aware of a deficiency and document a procedure whereby all redraws must be the subject of a written request and say that a fraudulent employee deliberately breached internal procedures. The awareness of a deficiency makes discharging the standard owed by a reasonably prudent mortgagee more onerous not less. It is not sufficient to intend to have a system in place in which all redraws are checked but implement a flawed system. As noted by the court: Regrettably, the system it implemented, which involved checking only the folder for redraws under $10,000 and not checking the daily reports for correctness, as the procedures manual expressly required, involved a failure to take such steps and maintain such procedures as would be taken and maintained by a reasonably prudent mortgagee in connection with each of the loans. 2 The court held that an originator must go further and implement a system of checks of all redraws to ensure every redraw had the necessary documents or at least a check of a representative sample of redraws to ensure that the that the object of all redraws having the necessary documents was being fulfilled. The court stated: The weakness in the software system which Columbus inherited from ANZ may be accepted. But it was a weakness of which Pioneer was aware from the outset. The existence of this weakness made it more, not less, important that Pioneer take such steps and maintain such procedures as would be taken and maintained by a reasonably prudent mortgagee in connection with each of the loans. I am satisfied that a reasonably prudent mortgagee would have had in place a system of checks that is, a check to ensure every redraw had the necessary documents or, at the least, a check of a representative sample of redraws to ensure that the object of all redraws having the necessary documents was being fulfilled. Pioneer had no such system because Ms Pryde was in fact checking only redraws for which there was paperwork. Checking redraws for which there was paperwork was not a representative or reliable sample of the redraws in fact taking place. That could only be checked by using the LR10104 reports which Pioneer knew existed, knew could be obtained on request and, based on Ms Pryde s evidence, knew could be searched using the relevant transaction codes for redraws. Ms Pryde s evidence that she should have done so in order to act in a a prudent or businesslike fashion was inevitable once it had been exposed that her quarterly check was confined to redraws for which there was paperwork. 3 The court accepted that the fact that ANZ Bank s manuals contained an express requirement to undertake verification in relation to redraws over $10,000 did not obviate the responsibility of the originator to take such steps as would be taken by a reasonably prudent mortgagee. Furthermore, the court noted: Pioneer effectively acknowledged the need to review redraws below $10,000 by the fact that it had a procedure in place to make such checks, in the form of quarterly reviews. This procedure failed in its purpose, however, due to the manner in which the reviews were conducted. Instead of checking the computer reports to see what redraws had in fact occurred and then cross-check to ensure that the written borrower requests and identity material required by Pioneer s own procedures was present on 1 Pioneer Mortgage Services Pty Ltd v Columbus Capital Pty Ltd [2015] FCA 1067 at [71]. 2 Pioneer Mortgage Services Pty Ltd v Columbus Capital Pty Ltd [2015] FCA 1067 at [71]. 3 Pioneer Mortgage Services Pty Ltd v Columbus Capital Pty Ltd [2015] FCA 1067 at [68]. 312 (2015) 26 JBFLP 311

file for each redraw, Ms Pryde merely checked Pioneer s redraw file to see whether the documents in that file were in order, thus failing to check whether redraws had been made for which there was no paperwork at all. 4 The court stated: It is apparent from the evidence that every transaction type had a unique transaction code including the kind of redraws carried out by Ms Dando without authority. In other words, had anyone in Pioneer wished to do so, Pioneer could have obtained the LR10104 reports relating to each quarter for the Pioneer loan portfolio in an electronic format. Pioneer could have used a search function to identify all redraws on loan accounts from the LR10104 reports by using the transaction code as the relevant search term. Pioneer could then have checked that the procedures for redraws had been satisfied in respect of all those redraws. Had it done so, I am satisfied Pioneer would have discovered Ms Dando s fraud almost immediately (in 2006). However, because Pioneer s checking process, at least for loans under $10,000, used only the record of loans for which there was paperwork, Ms Dando s frauds continued undetected until 2014. 5 Vicarious liability Securities and mortgages The court held that the originator was liable for the fraud and it did not matter that the act was a criminal act if the act was within the scope of employment. Nor did it matter that the employee s actions were a deliberate breach of the originator s requirement that all redraws be the subject of a written request. The court accepted that: Ms Dando s actions did not involve assault or pick-pocketing but using the very procedures and computer systems she was trained in and given access to in the course of her employment. 6 The court found that so far as the lender was concerned, the originator had the requisite authority to effect the redraws because she had been given access to and capacity to use the software system to effect redraws and did so as part of the originator s business. The court found the originator breached its obligation in the deeds to manage the loans in an efficient and businesslike matter. The court accepted: Whatever the precise test for scope of employment in the context of vicarious liability in the case of the fraud of an employee, the test is satisfied in the present case. 7 The court also stated: the actions of Ms Dando were undertaken in ostensible pursuit of the originator s business and in the apparent execution of authority which the originator had held out to the funder and which she, in her role as Client Services Manager, enjoyed. 8 The court endorsed the requirement in the case of New South Wales v Lepore [2003] HCA 4 that: It is the identification of what the employee was actually employed to do and held out as being employed to do that is central to any inquiry about course of employment. 9 The court found that the employee committed her fraudulent acts as a representative and in the course of the originator s business and as such, were taken to be those of the originator. The court found the originator vicariously liable for the fraudulent actions of its employee. Cross-claim for misleading and deceptive conduct The court also found that the originator engaged in misleading and deceptive conduct under the Trade Practices Act 1974 (Cth) because it represented falsely that customers had requested redraws. In relation to the claim for misleading and deceptive conduct, s 84(2) of the Trade Practices Act 1974 4 Pioneer Mortgage Services Pty Ltd v Columbus Capital Pty Ltd [2015] FCA 1067 at [34]. 5 Pioneer Mortgage Services Pty Ltd v Columbus Capital Pty Ltd [2015] FCA 1067 at [40] and [41]. 6 Pioneer Mortgage Services Pty Ltd v Columbus Capital Pty Ltd [2015] FCA 1067 at [103]. 7 Pioneer Mortgage Services Pty Ltd v Columbus Capital Pty Ltd [2015] FCA 1067 at [115]. 8 Pioneer Mortgage Services Pty Ltd v Columbus Capital Pty Ltd [2015] FCA 1067 at [116]. 9 New South Wales v Lepore [2003] HCA 4 at [232]. (2015) 26 JBFLP 311 313

(Cth), which is in the same terms as the Competition and Consumer Act 2010 (Cth), provides that any conduct engaged in on behalf of a body corporate by a director, employee or agent within the scope of the person s actual or apparent authority shall be deemed to have been engaged in also by the body corporate. In this regard, the court noted that the test under the Trade Practices Act 1974 (Cth) in s 84(2) for performing an act on behalf of a corporation is more widely cast that the test under the law of vicarious liability, as the expression includes any act engaged in the conduct in the course of the corporation s business, affairs or activities. Loss The court held the funder entitled to damages and rejected that damages were too remote upon either basis put forward by the originator, namely (a) on the basis that the funder acquired the loan portfolio through a trust of which it was sole beneficiary or (b) on the basis that the funder was a securitisation funder. A securitisation funder suffers loss in two ways, either through funds being used from the reserve account that the structure provides for in its waterfall of payments or because the receipts are less as a result of the defrauded borrowers not paying any interest. The court stated: A reasonable person in the originator s position would have recognised that if there was fraud on any loan account (itself a matter within reasonable contemplation) it was more likely than not that the legal owner of the loan would not suffer any loss, but that the loss would be incurred by the beneficiary for which the legal owner held title. This is precisely what has occurred. 10 The court noted this was indeed not unusual where the funder proposed to securitise the loans. Guarantor s position The court held the guarantor of the originator was also liable for the breaches and conduct. The court found that the guarantor s release in respect of matters after a certain date did not save him from liability because whilst the fraud only came to light after that date, the fraud was committed before that date. The court noted that guarantees are construed according to their reasonable commercial meaning. The court found that the funder suffered loss when it paid for the purchase of the book on the basis of the loan amounts, irrespective of the fact that it did not know at that time of the fraud. Management fees The court found that the funder was entitled to treat each breach as an Event of Default under the origination deeds and to stop paying management fees. 11 The court rejected that the funder s notice of default to the originator was invalid because it failed to specify a payout figure and found that it just meant that the originator was not in breach by failing to pay the payout figure within seven days after notice was given. 12, However, this was ultimately immaterial to the orginator s entitlement to management fees because the court found that the originator was not entitled to management fees in the event of there being an Event of Default, which had occurred, and the deed made the determination of that a matter for the funder. Further, the court found that the fact that the entitlement to fees was the subject of dispute did not mean that the funder had to keep paying fees while the issue was being resolved. The court found that the funder did not act unconscionably in its dealings with the originator by doing business with the originator after the fraud was discovered, noting that it did serve a default notice and made clear it still reserved its rights under the deed. Originator s misleading and deceptive conduct claim against the funder The court found that the funder was entitled to impose new fees and it was not unconscionable or misleading and deceptive in doing so and was not done to introduce a new term into the loan agreements. The court said: The idea that the funder had to audit its own costs before it could properly say to borrowers that it was imposing a fee to contribute to loan administration costs is fanciful. No one is suggesting that there 10 Pioneer Mortgage Services Pty Ltd v Columbus Capital Pty Ltd [2015] FCA 1067 at [93]. 11 Pioneer Mortgage Services Pty Ltd v Columbus Capital Pty Ltd [2015] FCA 1067 at [151]. 12 Pioneer Mortgage Services Pty Ltd v Columbus Capital Pty Ltd [2015] FCA 1067 at [148]. 314 (2015) 26 JBFLP 311

were no such costs or that the annual fee was so far outside the bounds of an amount that would contribute to the covering of those costs that a reasonable person could not have reasonably believed a fee of that amount would perform the cost contribution function The fact that the fee would be likely to increase the funder s profit does not mean it was not a cost covering exercise. 13 Originator s breach of contract claim The court also noted that the related breach of contract claim was misconceived because even if the introduction of the fee breached the loan agreements, which it did not, any loss was that of the borrowers not the originator, who was not a party to the loan agreements. 14 The originator s claims were dismissed, the injunction dissolved and the funder succeeded on its cross-claim. Take away lesson The take away lesson for securitisers is that software systems to manage cashflows need to be sufficiently robust to minimise fraud by using appropriate fraud minimisation procedures which are both documented in procedures manuals and actually understood and put into practice by staff. Otherwise, the law on vicarious liability and the statutory equivalent will regard any fraud perpetrated in the course of employment as those of the institution and result, not only in liability, but reputational damage for providing an environment in which fraud can go undetected for many years. Lesa Bransgrove, Partner and Matthew Bransgrove, Partner Bransgroves Lawyers, Sydney 13 Pioneer Mortgage Services Pty Ltd v Columbus Capital Pty Ltd [2015] FCA 1067 at [167]. 14 Pioneer Mortgage Services Pty Ltd v Columbus Capital Pty Ltd [2015] FCA 1067 at [188]. (2015) 26 JBFLP 311 315