"Technical Window": How Sense Bank Briefly Disabled Its Anti-Money Laundering System

The protection systems of financial monitoring were breached not through hacker attacks, but by a routine administrative command to "send to the server" — and that's the most troubling aspect of this story.

41
Share:
Андрій Пишний (Фото: НБУ)

NBU Chairman Andrii Pyshny publicly called the very mechanism that allowed 150 million hryvnia to be legalized through Sense Bank a "proof of effectiveness." The logic is simple: if fraudsters had to bypass the system rather than break it directly — then the system works. But the details of the scheme show something else: there is a vulnerability in banking controls that no regulations will close if it is controlled by a person who has access to the "off switch" themselves.

Not a hack, but turning off the lights

According to the investigation, circumventing mandatory manual approval of large payments was accomplished without any technical tricks in the classical sense. The head of the bank's board, according to NABU, simply initiated an official transfer of the payment filtering system into "maintenance mode" — for a short period of time, agreed in advance with accomplices.

This is the most practical lesson of the case: the most reliable control is powerless when the decision to temporarily disable it is made by the same management that is supposed to ensure that control. The technical "hole" here is not in the code, but in the authority of one person to disable protection without independent permission.

Bags of cash in the age of cashless transactions

Despite years of talk about digitalization of banking oversight, the final stage of the scheme looked completely archaic: money under guard was physically delivered in bags to an exchange center. Only after that did cash turn into cashless funds in the accounts of fictitious companies, which Sense Bank, according to the investigation, helped settle for collateral.

This points to a gap between how complex digital financial monitoring systems have become and how simple it remains to bypass them — at the level of direct conspiracy between specific people, not technologies.

Who is responsible when the controller opens the door himself

The NBU itself discovered violations of 3.3 billion hryvnia in legalized funds in Sense Bank during its own inspection — long before NABU's revelations. According to the chairman of the Financial Committee of the Council Danylo Hetmantsev, after this inspection, no real personnel measures were taken against either the board or the supervisory board of the bank.

"Pyshny closed his eyes for a year and a half to outright violations. Today there is no other way out than to demand Pyshny's resignation," Hetmantsev stated.

It is notable that Hetmantsev himself also appears in the released recordings, although he is not involved in this particular criminal case.

What has already changed

  • On August 19, immediately after the release of the recordings, the Cabinet of Ministers suspended the head of the supervisory board of Sense Bank and recognized his unsuitability for the position.
  • The fate of the head of the bank's board, who, according to the investigation, directly initiated "windows" for payments, has not yet been decided — but dismissal for him is also considered a likely scenario.

The key practical question remains open: will the NBU introduce a rule that no bank manager can unilaterally disable the financial monitoring system even temporarily — or will this case be limited to personnel changes in one institution, while the "technical window" mechanism itself remains available to the next willing participants.

World News