3 ms·

I worked at one of these banks, in a technical not a trading role, for a while and it was constantly drummed into us that we should not use external communicati

by simonh 4y ago

I worked at one of these banks, in a technical not a trading role, for a while and it was constantly drummed into us that we should not use external communications software for work of any kind. The tech organisation was adamant about it and penalties for violating it were severe, and the tech org has no incentive to turn a blind eye. These aren't hive minds, they're big unwieldy organisations and one part of the org can be doing things that would horrify and be stamped on hard by another part if they found out. It's absolutely right that the regulators are taking this seriously, and the banks too as people are being fired over it. Having said that, there's no allegation or evidence given that these side channels were used particularly or mainly to hide illegal activity. Using official communications systems can be clunky and inconvenient, and it's also possible this was done more to hide activity from potential rivals within the organisation than from regulators, although I'm sure that happened too. We don't really know.

steveBK123 4y ago
> they're big unwieldy organisations and one part of the org can be doing things that would horrify and be stamped on hard by another part if they found out I think people on "the outside" completely underestimate how true this is. If you've never worked at a 100K employee firm, and especially a bank.. its unimaginable. It sets up a lot of weird incentives, particularly for some rules/processes to seem very arbitrary and rigid. This is because the sample size is so big, they end up worrying about the worst thing the worst person could do. Inevitably this leads to backdoors and side channels to work around the standard processes because these processes make doing your job insufferably more difficult. For years we had chat apps which were horribly slow on desktop and had no mobile app, while we all had iPhones/Androids in our pockets. An anecdote would be that at one bank I worked, releasing a new version of our application required filling out a change request form. This form was a desktop app which was multi-page, multi-tab, with pop-up modals. There were radio buttons, checkboxes, drop down selectors, and free form text fields. Once certain parts were completed, you couldn't go back and correct them if wrong and had to start again. We had 1-2 out of 20 devs good at filling out the form, and it took 45 minutes. We then had to chase 5+ MD-level (don't read email / chat / etc) to click the approve button between then & when we wanted to release. We budgeted a week to chase these guys. Again if we failed to get approvals it went back to square 0 and start over on the form again.
- kennend3 4y ago
  This is an underrated comment by someone who clearly understands what it is like in these large banks. I've spent 20+ years with various banks and it is obvious when i read comments about "banks" those writing have near-zero experience. Expanding on the change control for just a second. Imagine that one arm of the bank (Say ATM's) only releases updates once per year and so they can spend days filling out the CR's, chasing approvals, etc. Their change is also very visible outside the bank and needs to be carefully vetted. They then create "processes and controls" around this. Now, imagine working for "Capital Markets" where you need to update your system constantly to stay competitive, but also have the banks change process enforced on you? You need change management, but the banks processes are overwhelming and inflexible... This "one size does not fit all" pattern is very common in Banks (i would imagine in any large org?).
  - steveBK123 4y ago
    Yup. And the side channels / work arounds end up turning into "just release the fix and send me an email, we'll paper it up later" or "look I have no idea what your application does but I'll approve the change, just don't F* it up"

by simonh 4y ago

steveBK123 4y ago

> they're big unwieldy organisations and one part of the org can be doing things that would horrify and be stamped on hard by another part if they found out I think people on "the outside" completely underestimate how true this is. If you've never worked at a 100K employee firm, and especially a bank.. its unimaginable. It sets up a lot of weird incentives, particularly for some rules/processes to seem very arbitrary and rigid. This is because the sample size is so big, they end up worrying about the worst thing the worst person could do. Inevitably this leads to backdoors and side channels to work around the standard processes because these processes make doing your job insufferably more difficult. For years we had chat apps which were horribly slow on desktop and had no mobile app, while we all had iPhones/Androids in our pockets. An anecdote would be that at one bank I worked, releasing a new version of our application required filling out a change request form. This form was a desktop app which was multi-page, multi-tab, with pop-up modals. There were radio buttons, checkboxes, drop down selectors, and free form text fields. Once certain parts were completed, you couldn't go back and correct them if wrong and had to start again. We had 1-2 out of 20 devs good at filling out the form, and it took 45 minutes. We then had to chase 5+ MD-level (don't read email / chat / etc) to click the approve button between then & when we wanted to release. We budgeted a week to chase these guys. Again if we failed to get approvals it went back to square 0 and start over on the form again.

kennend3 4y ago
This is an underrated comment by someone who clearly understands what it is like in these large banks. I've spent 20+ years with various banks and it is obvious when i read comments about "banks" those writing have near-zero experience. Expanding on the change control for just a second. Imagine that one arm of the bank (Say ATM's) only releases updates once per year and so they can spend days filling out the CR's, chasing approvals, etc. Their change is also very visible outside the bank and needs to be carefully vetted. They then create "processes and controls" around this. Now, imagine working for "Capital Markets" where you need to update your system constantly to stay competitive, but also have the banks change process enforced on you? You need change management, but the banks processes are overwhelming and inflexible... This "one size does not fit all" pattern is very common in Banks (i would imagine in any large org?).
- steveBK123 4y ago
  Yup. And the side channels / work arounds end up turning into "just release the fix and send me an email, we'll paper it up later" or "look I have no idea what your application does but I'll approve the change, just don't F* it up"