Exclusive: How the Home Capital Sausages Were Made

By @DonutShorts

In mid-2014, a whistleblower alerted the Home Capital board to the massive income verification fraud that had gone undetected for years at HCG.  The board responded in early 2015, no doubt at the insistence of OSFI, by hiring KPMG to conduct an independent review of what led to this epic breakdown in HCG’s underwriting systems.  We are in possession of a copy of KPMG’s report, and for the first time ever are giving the public the unvarnished truth of how Home Capital ran its mortgage business.  In preview, it is a very ugly picture. Read on for a full vetting of what the Financial Post’s Terence Corcoran described as “clearly insignificant developments.”

The Root Cause

• KPMG found that HCG ignored the traditional 3C’s of lending and focused almost exclusively on “collateral at the expense of other credit risk criteria (character and capacity) and operational and AML risks.”

• This root cause was exacerbated by a company culture that prized aggressive growth above all else, and, as a result, those tasked with maintaining broker relationships “were allowed to function without adequate governance and responsiveness to independent oversight”

• Moreover, a flawed $50MM SAP implementation was rushed into service without critical mortgage origination functionality and without a parallel run with the legacy control system.   As a result, “underwriting processes were without either automated controls or effective system support for years and the oversight functions in turn lacked reliable and timely monitoring data.”

Underwriting and Credit Review – I Love Lucy in the Chocolate Factory

KPMG found that the underwriting and credit review functions were riddled with broken processes, faulty or non-existent documentation, and rushed, half-baked loan approvals.  Reading the document evokes images of Lucy’s futile efforts to inspect and package truffles while the line speeds up in the chocolate factory.  Among KPMG’s findings were:

• Credit Department reviews found a 40% deficiency rate in loan file quality

• Despite this, the Credit Committee promulgated a change from Credit Review approval of 100% of files to an ‘exceptions only‘ approval process

• Incredibly, during peak months of July – October 2014 (after the whistleblower alert was received) Credit Review was further limited to ‘sample review only’. There was no discussion by the Credit Committee of whether Genworth or CMHC would be comfortable with this approach

• While management indicated it takes two days to complete due diligence after all documents are received, Credit Department records indicate 40% of loan files are submitted for credit review on the same day as funding and over 60% within two days of funding

• Income verification requirements in the Accelerator program were ambiguous stating “verbal confirmation may be performed when employment confirmation is questionable” without defining what constitutes questionable confirmation

• KPMG did its own review of loan files and found 14% were funded prior to prior verifying that the file was complete, 14% had legal documents that were collected as late as 5 months after funding, 28% had down payment verification that would not meet regulatory requirements, 21% had down payments already made to a builder where no verification was conducted and 11% had material differences between NOA and declared income, creating potential AML issues.  Overall, 75% of the files reviewed by KPMG were found to have defects.  [Contrast this finding with Gerry Soloway’s July 30, 2015 statement that “we will not tolerate any documentation that is not fully accurate”]

• KPMG’s file reviews suggested “down payment verification guideline are not sufficiently granular to ensure compliance with regulations, and underwriting practices might not be compliant with AML/ATF legislation”

Red Flags Ignored

Despite the obvious potential for fraudulent loan applications to escape notice in such a slipshod credit approval process, even when it was presented with direct evidence of high risk loan files and submitting brokers, HCG ignored the red flags being raised both from within and outside of the organization.  Such was the strength of the ‘sales growth at any cost’ culture of the company that it willfully walked into a minefield of fraudulent loan applications.

• OSFI’s warning about increased fraud in the broker channel was not communicated within the organization and no follow up action or discussion took place.
• Broker performance assessment focused solely on volumes with no qualitative or critical assessment despite repeated recommendations to do so by Enterprise Risk Management (ERM) and Internal Audit.  HCG’s strategy was to achieve a minimum 90% approval rate on broker submitted loans

• The number of broker relationships increased by 60% in 2014 without a commensurate increase in resources to manage the quality of loans submitted by brokers

• Genworth’s broker watch-list contained a number of the Company’s brokers

• Lack of awareness of the business shift within the Interfinance portfolio

• The Mortgage Broker Report of March 2014 noted that high volume brokers performed worse than the benchmark suggesting they were referring lower quality business.  Credit Committee minutes reflect no follow up on this issue

• Onboarding processes focused on checking the broker license being renewed only – there was no AML or background check

• Through August 2014, 27 brokers were marked with detected fraud, but only three were marked as “Do Not Use”.  The DNU list consisted mainly of brokers with expired licenses and there was no active listing of brokers with performance issues

• Issues were raised by the Internal Audit and ERM functions concerning discrepancies between employment information in loan files versus that entered in the CMHC portal (NB Evan Siddall: to paraphrase Forrest Gump, Accelerator loan files from HCG are like a box of chocolates, you never know what you’re going to get)

We Don’t Need No Stinking Systems

The best way to describe HCG’s systems infrastructure is this: utter fiasco.  As was suggested by the botched and serially rebooted broker portal “launch”, HCG appears to have no internal capability to manage an IT project of any scale.  Despite this, it undertook a program to replace its legacy systems with an SAP implementation that ran significantly over budget.  Tales of SAP consultants burning $600 an hour are legion among HCG ex-employees, with the finally tab for the project coming in at over $50MM.  And yet, when all was said and done, major parts of the SAP system were never fully implemented.  There is a reason why Rhonda Starkman’s statements from HCG don’t foot.  Among KPMG’s findings:

• The number of known systems issues in the SAP mortgage origination module ran as high as 4,000 and still numbered 400 at the time of the KPMG review
• The SAP mortgage origination module was never fully implemented and the legacy system was turned off without a parallel run to confirm the functionality of the SAP system
• HCG had used manual processes without controls since 2011 for thing such as Gross Debt Service and Total Debt Service calculations (done in Excel) and its underwriting process was a completely paper based system

• There was no linking of the Do Not Use broker list with the master broker list, necessitating manual updates and a master list that was frequently out of date

• Broker relationship data was stored in SalesForce which was not linked to SAP thus creating a gap in measuring broker level performance of loans

• The Compliance function was not notified of fraud incidents listed on the broker watchlist

Sales Culture Trumped any Genuine Efforts at Risk Management

The KPMG report makes clear that the credit and risk management functions were paper tigers within the HCG culture and their findings and recommendations were routinely ignored or overruled by the imperative to meet growth objectives.  This is the house that Jerry Soloway built.  KPMG’s investigation found:

• The Code of Conduct is not consistently well respected
• There are no formally established training modules or processes for underwriting
• There were minimal responsibilities related to risk and quality of lending contained in the mandates and compensation framework for Originations (Sales and Underwriting)
• Roles and responsibilities among Mortgage Officers and Underwriters is not clear – responsibilities appear to be situational or transactional dependent.
• The Credit Review function’s original mandate was to provide independent adjudication and not specifically a quality control function (the mandate states Credit Review is “to participate in the approval and extension of credit”)
• The Credit Committee had limited representation from Compliance and ERM functions – most voting members were from Mortgage Lending or Operations
• Internal Audit recommendations regarding broker relationship management resulted in some cases of controls being implemented and then shortly thereafter discontinued.  Other recommendations were never followed through.  The head of broker relationships was not aware of these recommendations even though he was copied on the reports.
• The Chief Credit Officer’s Q2 2014 report mentioned a deterioration of underwriting quality but did not become a priority for the Risk and Capital Committee

“Underwriter S” had a loan approval rate of over 150 per month, implying he approved almost one loan per hour of each workday.  The EVP and SVP of Mortgage Lending were informed by ERM of the deteriorating quality of Accelerator loans by “Underwriter S” in May 2014, but this issue was not discussed at either the Credit or Operational Committees where both were members.  [Contrast this finding with Martin Reid’s July 30, 2015 statement that “no employees were complicit in any of this (income verification fraud)”]  Underwriter S was terminated as part of Project Trillium.

The KPMG report in its totality is devastating.  Its description of HCG’s operations resemble those of a Wolf of Wall Street-worthy boiler room operation rather than a Schedule 1 bank.  All the normal business functions of a financial institution were subjugated to growth objectives.  Red flag warnings were routinely ignored, internal credit and quality control processes were either non-existent overridden or outvoted, and the IT systems were either dysfunctional or simply turned off.  Home Capital was a $20+B bank run on spreadsheets and SalesForce.com.  Finally, the report removes any remaining mystery as to why HCG, despite trolling the length of Bay Street for financing, could only raise money on loan shark terms in its deals with HOOPP and Warren Buffett.  Quite simply, no one trusted the quality of loans produced by a culture and an organization with these glaring flaws.

via http://ift.tt/2vj3zcd Tyler Durden