In its 2016 annual report, the$2.8 billion Municipal Credit Union touted how its Internal AuditDepartment conducted more than 50 integrated audits in the creditunion's divisions of operations, compliance, IT and finance, andcontinuously audited the most sensitive areas of New York's largestcredit union by members.

|

Presumably, those audits included a review and testing ofinternal controls to detect and prevent internal fraud. Butindustry experts said those internal controls obviously broke downbecause of a serious lack of oversight by key personnel, thesupervisory committee and the board of directors, which led to amultimillion-dollar fraud scandal by its CEO. While theconsequences of this fraud case will have a lasting impact on MCU,industry experts offered insights about how executives may preventsimilar circumstances from happening at their credit union.

|

Federal prosecutors alleged that Kam Wong, MCU's president/CEOfor 11 years, stole millions of dollars from the credit unionthrough various fraudulent schemes between 2013 and 2018, and spent$3.5 million of the money on New York lottery tickets. A criminalcomplaint, based on the findings of a federal investigation, wasfiled in Manhattan's federal court on May 8 and alleges that the62-year-old Wong committed fraud, embezzlement and aggravatedidentify theft.

|

The charges so alarmed NCUA board members that they recentlybanned Wong from participating in the affairs of anyfederally-insured financial institution, an action that the boardtypically reserves for former employees after they have beenconvicted of theft, embezzlement or other fraud crimes.

|

The schemes included reimbursements for fake dental work;millions in cash reimbursements for long-term disability insuranceand millions more for taxes to cover those payments; fake repairbills for a luxury car leased to him by the credit union;educational, housing and living expenses for two relatives; tens ofthousands of annual cash advances; nearly $2 million in ATMwithdrawals and cash payments in place of 320 sick days Wong neverused.

|

Federal investigators determined between July 2013 and January2018, Wong received and deposited nearly $6 million in handwrittenchecks from MCU.

|

Most of these funds came from the schemes that the 13-pagecriminal complaint described in detail, including how Wong carriedthem out under the noses of the board of directors, executives andauditors who were supposed to spot the red flags of Wong's internalfraud and investigate them.

|

The CEO's contract provided him and his spouse withreimbursements for all uninsured medical and dental costs.

|

From 2013 to 2018, he received $440,000 in credit unionreimbursements for dental care not covered by insurance. Hearranged for these reimbursements to be made out to him through MCUhandwritten checks, instead of through the payroll system, whichwould have taken additional time to process. But Wong did notexplain why such speed was necessary, according to the criminalcomplaint.

|

By email, the CEO submitted invoices from two dentists to thecredit union's CFO and chief HR officer. But investigators found,after interviewing the dentists, that at least two dozen of theseinvoices were spurious.

|

Moreover, Wong received an additional $247,000 from MCU thatpaid his state and federal tax liabilities for the $440,000 indental payments over five years. The only problem is that Wong'scontract did not provide any provision that required MCU to pay hisstate and federal taxes.

|

“The large amounts of dental payments reimbursed to the CEO, Ibelieve, warrant a direct confirmation by the CPA or at a minimumby the internal auditor,” Henry Wirz, retired president/CEO of theFolsom, Calif.-based SAFE Credit Union, said. Wirz also served as aCPA and CFO, and was a member of the credit union oversightcommittee for California's regulator.

|

“Even for a credit union of this size, this is a significantexpense. Invoices are far too easy to make and therefore directconfirmation with the dentist or other health care provider isappropriate given the large amount, and the fact that the CEO isthe recipient. Invoices submitted by the CEO have in many casesbeen fraudulent. Invoices should always be directly from the vendoror directly to the accounts payable department.”

|

If anything, the large amount of dental expense reimbursementsand subsequent amount paid to Wong for his taxes should have raiseda big red flag, observed Christopher Pippett, a partner at FoxRothschild LLP, who chairs the Exton, Pa., law firm's financialservices industry's practice and specializes in boardgovernance.

|

Investigators noted in the criminal complaint that Wong's dentalexpense reimbursements were submitted to MCU's CFO and chief humanresources officer. But investigators did not indicate whether theseofficers questioned the high amounts of the reimbursements, whichaveraged about $88,000 annually from 2013 to 2018. The criminalcomplaint also did not say whether anyone at the credit unionquestioned Wong's state and federal tax liabilities of $247,000,which were paid by the credit union even though it was notobligated to.

|

It is possible, however, that MCU's CFO and chief humanresources officer may have felt uncomfortable or perhaps evenconcerned about placing their jobs in jeopardy if they had raisedany questions.

|

This problem can be addressed through a whistleblower policy andanonymous process employees can use to report possible fraud,Pippett said.

|

“You would be surprised how many credit unions still don't havea working whistleblower policy,” Pippett, who regularly educatesboards and supervisory committees about their duties andresponsibilities, said. “It can be as simple as a phone number thatgoes to a voicemail that only the chair of the supervisorycommittee has access to. It's not complicated and it's notexpensive. If a CEO is leaning over an employee saying, 'Write thischeck or it could be your job,' then that person will have theability to dial the whistleblower number and anonymously reportwhat's happening.”

|

The criminal complaint also focused on how Wong got MCU toreimburse him $3.6 million for supplemental long-term disabilityinsurance and an additional $3.1 million in reimbursements thatpaid his personal tax liability for the disability insurancepayments.

|

Although Wong's contract entitled him to long-term disabilityinsurance obtained and paid by the credit union starting in 2007,he did not elect to get it until June 2015. At that time, Wongmanaged for the credit union to pay him a long-term disabilityoffset payment in place of MCU obtaining the insurance for himbecause he claimed the latter option would be too costly for thecredit union.

|

According to investigators, Wong discussed the offset paymentsoption with the board of directors and said the long-term insurancefrom when he became CEO in 2007 through the expiration of hiscontract in 2023 would cost or would have cost MCU about $1million. Wong proposed he receive a lump-sum, long-term disabilityinsurance payment of $200,000.

|

However, even though the board did not formally approve thispayment or modify Wong's contract to reflect approval of thispayment, he received offset payments after directing the CFO towrite him handwritten checks, which amounted to $3.6 million fromJune 2015 to January 2018.

|

To justify these payments, Wong presented the CFO and MCU'sboard treasurer with numerous “models” that indicated the allegedescalating cost of insuring him as a measure of what he shouldreceive in offset payments. Wong's models estimated the premiumswould have cost $119,000 in 2007 and more than $364,000 in2023.

|

However, investigators said Wong's insurance premiums weresubstantially inflated and that the only estimate he received fromone insurance broker indicated the premiums would cost $20,000 to$30,000 a year.

|

In January, federal investigators interviewed Wong about theselong-term disability payments. After that interview, Wong contactedthe broker in an effort to support his estimated premium costs,which ranged from more than $100,000 and more than $300,000. Wongalso falsely told investigators that the offset payments wereapproved by the board. Additionally, four days after the interviewwith federal investigators, Wong asked a credit union boardcommittee, which was not identified in court documents, to“retroactively” recommend the board approve the offset payments,which it did.

|

But in seeking this retroactive approval, federal investigatorssaid Wong made false and misleading statements to the committeeregarding the inflated costs of the long-term disabilityinsurance.

|

After reviewing how Wong received the long-term disabilityoffset payments, Pippett simply called it “insane.”

|

“It's not that you can't trust the CEO, but it goes back to theold Ronald Reagan adage, 'Trust but verify,'” Pippett said. “Shameon them for not asking 'What is expensive? Show us the insurancequotes.' That's just a failure of [the board's] fiduciaryobligations.”

|

He also pointed out that it was blatantly improper for theboard's committee to retroactively approve the offset payments.While they may approve resolutions on documents that the boardforgot to approve at an earlier time, those documents cannot beapproved retroactively to a previous date.

|

Wirz pointed out any insurance for the CEO should be researchedand negotiated by the human resources executive on behalf of theboard chair, and that all bids and other documentation should beshared with the chair to facilitate consultations with the CEO tomake decisions on insurance coverage.

|

He also said policy, claims and any transactions in regard toinsurance should be made through human resources, and that aseparate accounting should be made for all benefits paid to the CEOfor disability benefits regardless of whether they are by insuranceor direct payments by the credit union.

|

Wong also received cash advances, made ATM withdrawals, and gotother payments or reimbursements under questionable and suspiciouscircumstances, federal investigators said.

|

According to the criminal complaint, Wong received and depositedinto his MCU account nearly $6 million in handwritten checks fromthe credit union. Much, but not all, of this money was from thevarious schemes he carried out.

|

David Legge, president of the Manassa, Va.-based Legge Group,which investigates internal fraud cases for credit unions and otherbusinesses, questioned why these deposits did not triggersuspicious activity reports.

|

“Their Bank Secrecy Act software should have kicked out activityon his account as suspicious,” Legge said. “SARs should also havebeen filed. Did someone modify the monitoring controls? This isanother area that someone should have questioned.”

|

Wirz pointed out even if Wong's large and frequent deposits werenot in cash, they still should have triggered SARs reports. Hislarge cash advances on his credit card and ATM withdrawals – morethan $1.9 million over five years – should have generated thereports.

|

What also troubled Wirz was the frequent use of handwrittenchecks.

|

“All disbursements should be made through the accounts payableprocess and be subject to the controls that have independent reviewof the documentation supporting the transaction, independentposting of the transactions and independent approval of thetransaction,” Wirz said.

Complete your profile to continue reading and get FREE access to CUTimes.com, part of your ALM digital membership.

  • Critical CUTimes.com information including comprehensive product and service provider listings via the Marketplace Directory, CU Careers, resources from industry leaders, webcasts, and breaking news, analysis and more with our informative Newsletters.
  • Exclusive discounts on ALM and CU Times events.
  • Access to other award-winning ALM websites including Law.com and GlobeSt.com.
NOT FOR REPRINT

© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.