Cyber attack shines light on role of China’s largest lender in US Treasury market

As they patch up their bond trading operations following the hack of Industrial and Commercial Bank of China, brokers are also piecing together how China’s largest lender became such a significant player in US Treasuries that the attack on its systems could disrupt the $26tn market.

The impact of the attack was still being felt days after the ransomware was found. At least one subsidiary of TP ICAP, one of the world’s largest interdealer brokers, was experiencing difficulties in finalising trades for hedge funds in the short-term lending market, according to two people with knowledge of the matter. The company confirmed it was helping clients suffering from the impact of the hack.

“The unexpected thing we uncovered was that [market] exposure to ICBC was significantly higher than what we expected,” said a senior executive in fixed-income prime brokerage at a large US bank.

The Chinese bank’s rise from new entrant in 2010 to important link 13 years later was made possible by the changes that have swept across the US Treasury market in the intervening period.

On the eve of the 2008 financial crisis, US investment banks dominated the buying and selling of Treasuries, in part because they served as a conduit for the New York Federal Reserve’s monetary policy.

While those banks still play that same role for the Fed, the US Treasury market has more than quadrupled in size, from $5tn in 2007 to more than $26tn this year. A host of new players has come into the market as tougher post-crisis regulations forced the banks to scale back their activities. Proprietary traders such as DRW and Jump Trading, as well as hedge funds, took their place as the biggest daily traders.

The new entrants have been keen to trade the market but wanted to avoid the associated costs and obligations relating to clearing and settling trades, traditionally part of banks’ fixed-income businesses. ICBC has stepped in to fill some of that gap, offering an alternative to the US banks’ fixed-income departments.

“They [ICBC] are a big firm in outsourced settlement in the US markets,” said a clearing markets veteran. “People direct their flows of equities or Treasuries to clear at the [clearing house].”

Its US banking operations remain small compared with its Beijing-headquartered parent, whose total assets of Rmb44tn ($6tn) are greater than JPMorgan Chase and Goldman Sachs combined.

Last week’s hack centred on a unit called ICBC Financial Services, which ICBC bought from Fortis in 2010 and which had assets of just $24.5bn as of June.

This unit is an intermediary for governments, hedge funds and proprietary traders wanting to buy and sell US debt; in return, it interacts with FICC, the main US clearing house where securities are legally transferred to new owners, on their behalf. Last year, FICC handled $1.5tn in Treasuries.

Brokers such as ICBC are members of mutualised clearing houses such as FICC and are required to supply margin to cover deals until they are finalised and take the loss if someone in the market defaults. With few traders willing to take the risk, ICBC quickly established a foothold.

Over the same period, ICBC has also become an important link for China’s government as it started hoovering up US Treasuries. It is now the second-largest holder of US debt, owning about $805.4bn in US debt in August.

ICBC says it is the only Chinese brokerage with a securities clearing licence in the US. It works closely with US-based Chinese banks, which deal with Treasury holdings on behalf of the offshore units of Chinese state-owned companies, according to a sovereign fund manager who used to deal with the unit’s management team.

It also had business ties with Rosewood Investment Corp, the person added, referring to a New York-based investment arm of China’s State Administration of Foreign Exchange.

“It is a routine practice for state-owned enterprises to buy and sell US Treasury bonds through Chinese banks,” said a sovereign fund manager who used to deal with ICBC FS. “It serves the purpose of domestic capital going global.”

ICBC, ICBC FS and China’s National Administration of Financial Regulation, which supervises commercial banks, did not immediately respond to requests for comment.

After the ransomware attack, the Chinese bank was forced to confirm batches of trades manually by talking to FICC, slowing the process to a crawl. Some clients were able to reroute trades through other clearing banks to avoid disruption. ICBC FS has been racing to recover its system, but market participants said it had yet to fully restore operations as of early this week.

However, new rules designed to bolster the Treasury market may mean brokers have to move faster to deal with hacks and outages. In coming months, the Securities and Exchange Commission is expected to announce plans for more Treasury trades to be centrally cleared through FICC. At present, FICC clears only a fraction of Treasuries. That will put greater responsibility on intermediaries such as ICBC to comply with federal laws.

Next year, the window for settling US securities trades will narrow to one day, giving banks and their customers less time to sort out IT issues or hacks before deals are cancelled.

It is not clear yet whether ICBC has paid the ransom or how many trades have still to be settled. Chinese regulators have been urging the state bank to step up communication with its clients. “We’ve requested ICBC to speak up about the incident,” said a regulatory source who is aware of the internal risk assessment of the hack by China’s banking authorities.

Mark Wendland, chief operating officer at DRW, said ICBC was only one of the brokers it used and it was able to switch quickly to another provider. “We remained active in the market without really a second of trading downtime,” he said.

Nevertheless, he warned the rest of the market needed to think about cyber security after the ransomware attack.

“It also highlights the threat of having single points of failure in a system, and I think that’s likely to be a point of discussion coming out of this event,” he said.

Two of the largest players in the Treasury market, DRW and an investment manager, have both confirmed to the Financial Times that they used ICBC FS as one of their clearing providers.

Additional reporting by Joshua Franklin