This story is about the gap between two systems—a gap into which money fell for seven years, until it became an abyss the size of a small country’s budget.
In Mumbai’s Fort business district stands Brady House—one of the branches of Punjab National Bank, India’s second-largest state-owned bank. The branch specialized in servicing trade transactions: imports, exports, foreign-currency transfers. Routine, paper-heavy work, with a steady stream of applications from jewelry companies—Mumbai remains one of the world’s diamond-trading hubs, and the diamond business here turns over billions of dollars every year. Among the branch’s clients were companies linked to Nirav Modi—the jeweler whose boutiques operated in New York, London, and Beijing, and whose name appeared on Forbes India’s lists of India’s richest people—and to his uncle Mehul Choksi, owner of Gitanjali Gems. Their applications for trade finance passed through Brady House: the companies bought rough diamonds abroad and needed short-term credit in foreign currency. In January 2018, when one of the employees involved retired and his replacement tried to make sense of unfamiliar procedures, the whole structure began to crack.
The hole that came to light totaled 11,394 crore rupees—roughly $1.8 billion at the exchange rate of the time. A sum comparable to the annual budget of a medium-sized Indian state. And yet—not a single hack, not a single compromised security system, not one virus.
To understand how it worked, we need to become bank clerks for a minute. Four terms—and the picture will come together.
SWIFT (Society for Worldwide Interbank Financial Telecommunication) is, essentially, a postal service for banks. A secure network through which financial institutions around the world send one another standardized messages: “transfer the money,” “confirm the letter of credit,” “guarantee payment.” SWIFT does not hold money, maintain accounts, or check whether the sending bank has the funds to make good on its promise. It delivers the envelope and certifies that the envelope is authentic—cryptographically signed, sent from a verified terminal. But what is inside the envelope is the sender’s responsibility.
Letter of Undertaking (LoU) is a bank guarantee issued by one bank to another. Roughly speaking, PNB tells Allahabad Bank’s Hong Kong branch via SWIFT: “We guarantee that our client will repay the loan by such-and-such date; if they do not, we will pay.” On the basis of that message, the foreign bank gives the client the money. LoUs were a standard instrument of Indian trade finance—the Reserve Bank of India permitted their use for import transactions, and thousands of companies used the mechanism every day.
Buyer's credit is a short-term foreign-currency loan an importer receives from an overseas bank to pay for a shipment. Rates on such credit are generally lower than on rupee-denominated loans within India, making it attractive to companies with high import volumes. The arrangement is simple: an Indian bank issues an LoU, an overseas bank lends to the importer on that basis, and after 90 or 180 days the importer—or its Indian guarantor bank—repays the money.
Core Banking Solution (CBS) is a bank’s central accounting system, its bookkeeping spine. In PNB’s case, this was Finacle software, developed by Infosys. Every loan, every deposit, every liability must be recorded in the CBS. If a liability is not entered into the CBS, then formally it does not exist for the bank. It does not appear in reporting, is not factored into risk calculations, is invisible to auditors, does not affect the balance sheet. It is a ghost.
The scheme investigators reconstructed after their inquiry is disarming in its everyday simplicity. Employees at the Brady House branch—above all, the deputy manager with access to the SWIFT terminal—sent SWIFT messages issuing LoUs in favor of companies belonging to Nirav Modi and Mehul Choksi. The companies bore names such as Solar Exports, Stellar Diamonds, Diamond R US, and others. The messages went to overseas branches of Indian banks—for example, Allahabad Bank and Axis Bank in Hong Kong. Having received a cryptographically authentic SWIFT message from PNB, they had no reason to doubt it: the request had arrived through a secure channel, with the correct codes, from a real bank. The money was disbursed.
The crucial step in the fraud was what was not done. The LoUs issued were not entered into Finacle. Not a single accounting entry recorded that PNB had taken on an obligation to pay if the client failed to repay the loan. For the bank’s CBS, these guarantees did not exist. For SWIFT, they were entirely real. Two worlds, two systems, and between them—a gap wide enough to slip billions through.
What gets me is this: it required no technical virtuosity. No reverse engineering, no zero-day exploits. A person with access to a SWIFT terminal, and the knowledge that the CBS would receive no automatic notification, could generate obligations invisible to their own bank for years. Margin collateral—the security a client was required to provide when requesting an LoU—was not demanded either. That meant Modi’s companies received guarantees essentially for free—without an accounting entry and without approval from the credit committee.
When one LoU came due, a new one was issued—to repay the previous one. A classic debt rollover, growing with every turn. The scheme had been running since 2011—for nearly seven years.
This is where the most disturbing part begins. A bank with tens of thousands of employees, external auditors, a regulator in the form of the Reserve Bank of India—and nobody noticed liabilities worth billions of dollars? The answer lies in the architecture.
The SWIFT terminal at the Brady House branch operated as a separate island. Messages sent through it did not generate automatic entries in Finacle. This was not a configuration error at one particular branch—it was a systemic feature: integration between SWIFT and PNB’s CBS simply did not exist. A SWIFT operator could send a message, and the only record of it would remain in the SWIFT system’s own logs, which regular bank audits, focused on CBS data, rarely consulted—or did not consult at all.
The principle of segregation of duties—one of the basic pillars of banking control—holds that the person initiating a transaction should not be the same person authorizing and recording it. Under normal procedure, issuing an LoU requires: a client request, a check of the client’s credit limit, management approval, an entry in the CBS, and dispatch of the SWIFT message. Each step—a different person, a separate control. But when a SWIFT message can be sent outside the CBS, the entire chain of controls shrinks to one person at a terminal. Segregation of duties becomes a fiction.
The overseas recipient banks had no reason for alarm either. The SWIFT message was cryptographically authentic. It came from PNB. For Allahabad Bank in Hong Kong, checking whether the obligation had been recorded in PNB’s internal system was like checking whether your neighbor had written a will before accepting a letter from him. It lay beyond their sphere of responsibility and their technical capacity. Each side assumed the verification was the other’s job.
When the scale became clear, the Reserve Bank of India moved quickly. On March 13, 2018—less than a month after PNB publicly announced the fraud—the RBI issued a circular that changed the rules of the game in three directions at once.
First, and most radically: LoUs and LoCs (Letters of Comfort) for trade credit were banned outright. An instrument Indian banks had used for decades was removed from circulation. The decision made credit more expensive for Indian importers—buyer’s credit backed by an LoU had been cheaper than the alternatives—but the regulator decided that the risk of abuse outweighed the savings.
Second: all banks were ordered to integrate their SWIFT infrastructure with their Core Banking Systems by April 30, 2018. Two months to close a gap that had existed for years. From then on, every SWIFT message had to automatically generate an entry in the CBS—or be blocked pending manual confirmation with the appropriate authorization. The island had to become a peninsula, and then part of the mainland.
Third: tighter internal-control procedures, mandatory reconciliation of SWIFT messages against CBS entries, enhanced real-time transaction monitoring. In essence, the RBI was demanding that banks do what should have been done from the outset—but without a catastrophe, no one had found the motivation.
For Nirav Modi and Mehul Choksi, the consequences were criminal. Both left India before the case became public. Modi was arrested in London in March 2019 and has been contesting extradition in British courts ever since. Choksi obtained citizenship of Antigua and Barbuda, creating a separate legal complication. Several PNB employees were arrested. The proceedings dragged on for years—the Indian judicial system moves to its own rhythm.
The counterfactual question is inevitable: if SWIFT and Finacle had been integrated from the beginning, would any of this have happened?
Technical integration would have closed precisely the gap through which the scheme operated. If every SWIFT message issuing an LoU automatically creates an entry in the CBS, the liability becomes visible. It appears on the balance sheet, in reports, in the sights of auditors and the credit committee. The absence of margin collateral immediately raises questions. So does the debt rollover: the CBS will show that the previous LoU has not been repaid and a new one is already being requested. The scale of the scheme—seven years, nearly two billion dollars—would, in all likelihood, have been impossible.
But “impossible in this form” and “impossible altogether” are different things. Systems integration is a barrier, not a wall reaching to the sky. An employee with sufficient authority could have entered fictitious records into the CBS as well—fabricating documents for margin collateral, forging approvals. It would have been harder, riskier, more conspicuous—but the history of bank fraud is full of examples of people finding ways around every kind of control system. I think it is fair to say this: integration would almost certainly have prevented this particular scheme at this particular scale, but to claim that it would have eliminated the possibility of fraud itself is to overestimate technology and underestimate human ingenuity.
The PNB catastrophe is instructive for any system in which security is distributed across several components. SWIFT assumed authorization was the sending bank’s responsibility. The CBS did not know that a SWIFT message had been sent at all. The overseas bank relied on the message’s cryptographic authenticity as proof of the transaction’s complete legitimacy. Every link in the chain functioned correctly within its own logic—and that was precisely what created the illusion of control where none existed.
Finacle is a mature banking product. SWIFT is one of the most secure communications networks in the world. Both systems did what they were designed to do. The problem lay in the space between them—in the assumption that someone else had already checked. In critical infrastructure, the most dangerous failure is the one in which every subsystem reports “all normal,” because the emergency zone belongs to none of them. PNB paid for this discovery at a price still reflected in its balance sheet, and India’s banking system lost an entire class of financial instruments because the regulator decided it was easier to remove the tool than to guarantee its safe use. Whether that choice was excessive remains a question to which India’s diamond importers and their bankers still give different answers.