In its 2016 annual report, the $2.8 billion Municipal Credit Union touted how its Internal Audit Department conducted more than 50 integrated audits in the credit union's divisions of operations, compliance, IT and finance, and continuously audited the most sensitive areas of New York's largest credit union by members.

Presumably, those audits included a review and testing of internal controls to detect and prevent internal fraud. But industry experts said those internal controls obviously broke down because of a serious lack of oversight by key personnel, the supervisory committee and the board of directors, which led to a multimillion-dollar fraud scandal by its CEO. While the consequences of this fraud case will have a lasting impact on MCU, industry experts offered insights about how executives may prevent similar circumstances from happening at their credit union.

Federal prosecutors alleged that Kam Wong, MCU's president/CEO for 11 years, stole millions of dollars from the credit union through various fraudulent schemes between 2013 and 2018, and spent $3.5 million of the money on New York lottery tickets. A criminal complaint, based on the findings of a federal investigation, was filed in Manhattan's federal court on May 8 and alleges that the 62-year-old Wong committed fraud, embezzlement and aggravated identify theft.

The charges so alarmed NCUA board members that they recently banned Wong from participating in the affairs of any federally-insured financial institution, an action that the board typically reserves for former employees after they have been convicted of theft, embezzlement or other fraud crimes.

The schemes included reimbursements for fake dental work; millions in cash reimbursements for long-term disability insurance and millions more for taxes to cover those payments; fake repair bills for a luxury car leased to him by the credit union; educational, housing and living expenses for two relatives; tens of thousands of annual cash advances; nearly $2 million in ATM withdrawals and cash payments in place of 320 sick days Wong never used.

Federal investigators determined between July 2013 and January 2018, Wong received and deposited nearly $6 million in handwritten checks from MCU.

Most of these funds came from the schemes that the 13-page criminal complaint described in detail, including how Wong carried them out under the noses of the board of directors, executives and auditors who were supposed to spot the red flags of Wong's internal fraud and investigate them.

The CEO's contract provided him and his spouse with reimbursements for all uninsured medical and dental costs.

From 2013 to 2018, he received $440,000 in credit union reimbursements for dental care not covered by insurance. He arranged for these reimbursements to be made out to him through MCU handwritten checks, instead of through the payroll system, which would have taken additional time to process. But Wong did not explain why such speed was necessary, according to the criminal complaint.

By email, the CEO submitted invoices from two dentists to the credit union's CFO and chief HR officer. But investigators found, after interviewing the dentists, that at least two dozen of these invoices were spurious.

Moreover, Wong received an additional $247,000 from MCU that paid his state and federal tax liabilities for the $440,000 in dental payments over five years. The only problem is that Wong's contract did not provide any provision that required MCU to pay his state and federal taxes.

“The large amounts of dental payments reimbursed to the CEO, I believe, warrant a direct confirmation by the CPA or at a minimum by the internal auditor,” Henry Wirz, retired president/CEO of the Folsom, Calif.-based SAFE Credit Union, said. Wirz also served as a CPA and CFO, and was a member of the credit union oversight committee for California's regulator.

“Even for a credit union of this size, this is a significant expense. Invoices are far too easy to make and therefore direct confirmation with the dentist or other health care provider is appropriate given the large amount, and the fact that the CEO is the recipient. Invoices submitted by the CEO have in many cases been fraudulent. Invoices should always be directly from the vendor or directly to the accounts payable department.”

If anything, the large amount of dental expense reimbursements and subsequent amount paid to Wong for his taxes should have raised a big red flag, observed Christopher Pippett, a partner at Fox Rothschild LLP, who chairs the Exton, Pa., law firm's financial services industry's practice and specializes in board governance.

Investigators noted in the criminal complaint that Wong's dental expense reimbursements were submitted to MCU's CFO and chief human resources officer. But investigators did not indicate whether these officers questioned the high amounts of the reimbursements, which averaged about $88,000 annually from 2013 to 2018. The criminal complaint also did not say whether anyone at the credit union questioned Wong's state and federal tax liabilities of $247,000, which were paid by the credit union even though it was not obligated to.

It is possible, however, that MCU's CFO and chief human resources officer may have felt uncomfortable or perhaps even concerned about placing their jobs in jeopardy if they had raised any questions.

This problem can be addressed through a whistleblower policy and anonymous process employees can use to report possible fraud, Pippett said.

“You would be surprised how many credit unions still don't have a working whistleblower policy,” Pippett, who regularly educates boards and supervisory committees about their duties and responsibilities, said. “It can be as simple as a phone number that goes to a voicemail that only the chair of the supervisory committee has access to. It's not complicated and it's not expensive. If a CEO is leaning over an employee saying, 'Write this check or it could be your job,' then that person will have the ability to dial the whistleblower number and anonymously report what's happening.”

The criminal complaint also focused on how Wong got MCU to reimburse him $3.6 million for supplemental long-term disability insurance and an additional $3.1 million in reimbursements that paid his personal tax liability for the disability insurance payments.

Although Wong's contract entitled him to long-term disability insurance obtained and paid by the credit union starting in 2007, he did not elect to get it until June 2015. At that time, Wong managed for the credit union to pay him a long-term disability offset payment in place of MCU obtaining the insurance for him because he claimed the latter option would be too costly for the credit union.

According to investigators, Wong discussed the offset payments option with the board of directors and said the long-term insurance from when he became CEO in 2007 through the expiration of his contract in 2023 would cost or would have cost MCU about $1 million. Wong proposed he receive a lump-sum, long-term disability insurance payment of $200,000.

However, even though the board did not formally approve this payment or modify Wong's contract to reflect approval of this payment, he received offset payments after directing the CFO to write him handwritten checks, which amounted to $3.6 million from June 2015 to January 2018.

To justify these payments, Wong presented the CFO and MCU's board treasurer with numerous “models” that indicated the alleged escalating cost of insuring him as a measure of what he should receive in offset payments. Wong's models estimated the premiums would have cost $119,000 in 2007 and more than $364,000 in 2023.

However, investigators said Wong's insurance premiums were substantially inflated and that the only estimate he received from one insurance broker indicated the premiums would cost $20,000 to $30,000 a year.

In January, federal investigators interviewed Wong about these long-term disability payments. After that interview, Wong contacted the broker in an effort to support his estimated premium costs, which ranged from more than $100,000 and more than $300,000. Wong also falsely told investigators that the offset payments were approved by the board. Additionally, four days after the interview with federal investigators, Wong asked a credit union board committee, which was not identified in court documents, to “retroactively” recommend the board approve the offset payments, which it did.

But in seeking this retroactive approval, federal investigators said Wong made false and misleading statements to the committee regarding the inflated costs of the long-term disability insurance.

After reviewing how Wong received the long-term disability offset payments, Pippett simply called it “insane.”

“It's not that you can't trust the CEO, but it goes back to the old Ronald Reagan adage, 'Trust but verify,'” Pippett said. “Shame on them for not asking 'What is expensive? Show us the insurance quotes.' That's just a failure of [the board's] fiduciary obligations.”

He also pointed out that it was blatantly improper for the board's committee to retroactively approve the offset payments. While they may approve resolutions on documents that the board forgot to approve at an earlier time, those documents cannot be approved retroactively to a previous date.

Wirz pointed out any insurance for the CEO should be researched and negotiated by the human resources executive on behalf of the board chair, and that all bids and other documentation should be shared with the chair to facilitate consultations with the CEO to make decisions on insurance coverage.

He also said policy, claims and any transactions in regard to insurance should be made through human resources, and that a separate accounting should be made for all benefits paid to the CEO for disability benefits regardless of whether they are by insurance or direct payments by the credit union.

Wong also received cash advances, made ATM withdrawals, and got other payments or reimbursements under questionable and suspicious circumstances, federal investigators said.

According to the criminal complaint, Wong received and deposited into his MCU account nearly $6 million in handwritten checks from the credit union. Much, but not all, of this money was from the various schemes he carried out.

David Legge, president of the Manassa, Va.-based Legge Group, which investigates internal fraud cases for credit unions and other businesses, questioned why these deposits did not trigger suspicious activity reports.

“Their Bank Secrecy Act software should have kicked out activity on his account as suspicious,” Legge said. “SARs should also have been filed. Did someone modify the monitoring controls? This is another area that someone should have questioned.”

Wirz pointed out even if Wong's large and frequent deposits were not in cash, they still should have triggered SARs reports. His large cash advances on his credit card and ATM withdrawals – more than $1.9 million over five years – should have generated the reports.

What also troubled Wirz was the frequent use of handwritten checks.

“All disbursements should be made through the accounts payable process and be subject to the controls that have independent review of the documentation supporting the transaction, independent posting of the transactions and independent approval of the transaction,” Wirz said.