How the Punjab National Bank fraud hid $1.8 billion outside the bank's own books

For years, one branch of Punjab National Bank, one of India's largest state-owned banks, sent out guarantees worth about $1.8 billion that its own accounting system never recorded.^[1][2] This case file covers how the guarantees worked, why the bank's systems could not see them, what regulators did once it surfaced, and the one control that was missing.

What happened

How it worked

Banks send these guarantees to each other over SWIFT, the secure messaging network banks around the world use for payment and credit instructions. Inside the bank, a separate core banking system is supposed to record every transaction so managers, auditors and risk teams can see the bank's total exposure.^[2]

At Punjab National Bank, those 2 systems were not connected. A SWIFT message could go out to an overseas bank without any matching entry appearing in the core system.^[1][2] The staff involved sent guarantees over SWIFT and simply did not record them in the bank's books, which kept them out of view of the checks that would normally have flagged them.^[1][2]

SWIFT access itself was meant to have 3 layers, someone to create a message, someone to check it and someone to verify it.^[2] Reporting after the fraud described officials passing guarantees without the needed approvals, which suggests those layers were not working as separate people with separate judgment.^[2]

What it cost

The bank was left facing claims from the overseas lenders for guarantees it had never knowingly approved. India's Central Bureau of Investigation arrested bank officials, including a former branch official, within days of the disclosure.^[7] Prosecutors in India charged the businessmen behind the companies, who left the country; those cases are still being fought in court and through extradition proceedings, so they are not named here.

The regulatory response went well beyond one bank. The Reserve Bank of India told banks to link SWIFT with their core banking systems, and state-owned banks were given until April 30, 2018, to do it.^[1][4] In March 2019, the central bank fined 36 banks for failing to follow its SWIFT rules on time, and Punjab National Bank itself was fined 2 crore rupees.^[5][8]

The missing control

The missing control: reconciling every outgoing SWIFT message against the core banking system, every day, with someone independent reviewing any message that has no matching entry.

The whole scheme depended on a gap between 2 records: what the bank told other banks and what the bank told itself. A daily match between the two would have turned up the first unrecorded guarantee within a day, not after years. Linking the systems so that no message could go out without a booked transaction behind it would have closed the gap entirely, which is exactly what the regulator ordered once the fraud came out.^[1][4]

What to do in your business

• Match what leaves with what you record. Compare your bank's list of outgoing payments against your accounting software every week, and look into anything that appears in one but not the other.
• Separate who sends from who approves. Set up your online banking so one person creates a payment and a different person releases it.
• List every promise you make on paper. Guarantees, credit terms and purchase commitments are liabilities too. Keep a register and review it monthly.
• Have someone outside the process do the check. The person who reconciles accounts should not be the one who makes the payments.
• Treat rollovers as red flags. A customer or supplier who keeps needing new credit to pay off old credit deserves a closer look.

Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.