How Jerome Kerviel hid 50 billion euros in bets from Societe Generale
In January 2008, Societe Generale found that one of its junior futures traders had built up nearly 50 billion euros in hidden bets, more than the entire bank was worth on the stock market.[1] This case file covers how the positions stayed hidden for so long, how they were found, what they cost, and the one control that would have stopped it.
What happened
Jerome Kerviel, who had worked in the bank's support and IT side before moving to trading, sat on a Paris desk that traded futures on European stock indexes.[1][6] His job was supposed to involve small, balanced positions. Instead, from as early as 2005, he took large one-way bets on the direction of the markets and covered them with fake offsetting trades so that his books looked nearly flat.[1][5]
By the end of 2007 his real positions had swung from losses of more than 2.5 billion euros to a gain of about 1.5 billion, while he reported only small results.[4] In early January 2008, a set of trades with a small bank drew questions that could not be answered.[4] By January 18 to 19, the bank had uncovered a hidden position of about 49.9 billion euros.[9]
The bank then had to get out without triggering a market panic. It sold down the positions over 3 trading days, January 21 to 23, and announced the loss on January 24.[9] The total bill was 4.9 billion euros.[1][8]
How it worked
A bank's control teams rarely watch a trader's every order. They watch the totals: how much risk a desk holds after its buys and sells cancel each other out. Kerviel exploited that. For each real bet, he entered a fake trade in the opposite direction, so the net figure stayed small even as the real exposure grew. The bank's investigators later counted 947 false transactions.[5]
The fake trades were built to slip through gaps. Reports found the bank's checks did not cover trades that were cancelled or changed afterward, did not track total gross positions, and did not flag deals with unnamed counterparties, odd settlement dates or internal counterparties.[4][6] Kerviel canceled or replaced fake trades before they would have needed confirming, and when questions came, he produced forged emails to explain them. Investigators said he also used colleagues' logins to enter some trades.[6][9]
The warning signs were there. Between July 2006 and September 2007, control systems raised 24 alerts about trades exceeding limits, and later counts ran to more than 70 across the whole period. Staff accepted his explanations each time.[4][6][7] For part of 2007, after his manager left, he was largely unsupervised.[7]
What it cost
On October 5, 2010, a Paris court convicted Kerviel of forgery, breach of trust and unauthorized computer use. He received 5 years in prison with 2 suspended, and was ordered to repay the full 4.9 billion euros.[1] An appeals court upheld the ruling in October 2012.[2]
The bank paid too. In July 2008, France's Banking Commission fined Societe Generale 4 million euros for serious weaknesses in its internal controls, including no gross trading limit for Kerviel's activity.[3][8] The bank committed more than 100 million euros to fix its controls.[5]
Courts later took the bank's own failures into account. In 2014, France's highest court set aside the 4.9 billion euro damages award, and in September 2016 an appeals court in Versailles cut what Kerviel owed to 1 million euros, finding the bank's oversight had been deficient.[8][9] The bank said the ruling still confirmed its 4.9 billion euro loss.[10]
The missing control
The missing control: independent confirmation of every trade. Every transaction, including canceled and changed ones, should have been checked against the other side of the deal by people who did not report to the trading desk.
The whole scheme rested on trades that did not really exist. A fake trade cannot be confirmed by a counterparty that never agreed to it. If the back office had insisted on confirmation for every entry, with no exceptions for internal deals, pending trades or last-minute cancellations, the offsetting trades would have failed within days and the real bets would have been exposed long before they reached 50 billion euros. Following up every alert, rather than accepting the trader's word, would have done the same.[6][7]
What to do in your business
- Confirm with the other party. For large sales, invoices or payments, have someone other than the person who entered them confirm directly with the customer or supplier.
- Watch cancellations and edits. Review voided invoices, refunds and changed entries every month, not just new ones. That is where hidden activity tends to sit.
- Look at the gross, not just the net. A report that nets to zero can hide large amounts flowing in both directions. Check the total volume too.
- Close every alert in writing. When a bank, accountant or system flags something, record who checked it and how, and do not accept an explanation you cannot verify.
- Never share logins. Give every person their own account so every entry can be traced to the person who made it.
Check your business for this control
The free Heist Control Checklist walks through the controls behind every case on this site in about ten minutes. For ready-made policies, the Policy Pack has five editable templates, and the Insider Threat Kit covers risks from inside your own team.
- How the Hot Lotto was rigged: the security director who wrote the numbers
- The Ubiquiti hack was an inside job: how a senior developer extorted his employer
- How the Coinbase data breach happened: bribed support agents and a $20 million demand
- How one trader brought down Barings Bank: account 88888
- How a Twitter employee sold user data to Saudi Arabia for a watch and cash
- The Tesla insider bribe plot: the $1 million offer an employee reported
- Every insider risk control
- All case files
Facts are drawn from court records, government reports, company statements and reputable reporting, listed below. People are named only where they were convicted, pleaded guilty or spoke publicly in an official role.
- NBC News (AP): Ex-trader jailed, told to repay $6.7 billion
- CNN: French court upholds rogue trader's conviction
- Al Jazeera: SocGen fined for rogue trading loss
- Risk.net: Kerviel acted alone, SG report finds
- Risk.net: Reports highlight SG weaknesses
- CSO Online: Poor IT security to blame in Societe Generale fraud
- Computerworld: Five reasons SocGen did not detect $7 billion fraud
- Global Custodian: SocGen fined for rogue trader by French banking commission
- Wikipedia: 2008 Societe Generale trading loss
- Societe Generale: Position following the ruling of the Versailles Court of Appeal