Doesn't look like good risk management at all.
Anyone related can please pitch in with a TA account. How bad/frequent are their Software Errors?
The IT systems within banks are more or less the same as IT systems anywhere. Just as advanced, just as crappy. The difference is that if there is a human error with banking software, you're not sending free pizza, you accidentally pay ouy $900,000,000.
Most in-bank or between banks transfers are reversible and usually a non-issue. That why the risk management probably says something like this:
Risk: Incorrect transfer of funds to customer in another bank
Mitigation: Manual review of all funds transfer above 5 million dollars
Mitigation: Besides litigation issues, lost funds are easily recovered by asking the receiving bank
Status: Risk accepted
Edit: Clarified "Mitigation: Besides litigation issues bank transfers are reversible" into "Mitigation: Besides litigation issues, lost funds are easily recovered by asking the receiving bank"Regardless of the dollar amount or outcome I also have to tell the audit committee, the board, the auditors, and all of my regulators. And exactly none of those groups would let me put your write-up along with the conclusion “risk accepted” in front of them.
For any other payment system for larger sums / corporate and institutional parties, settlement finality is a huge thing that is the subject of all sorts of specific legislation, as it would be a real issue for the health of the financial system if a settled payment can simply be reversed, as it would have a lot of unintended consequences further down the line. So banks actually do have strict risk management policies to avoid wrong payments, but there are so many complex transactions for which ultimately a human (actually at least 2 due to 4-eyes principles) must confirm whether conditions for payment are satisfied and whether payment details are correct, and humans are always prone to making mistakes once in a while.
The law sides with the banking making the mistake as discussed on https://news.ycombinator.com/item?id=24222045
With bank cooperation, which usually happens, settlement are non-issues. When an operation can be reversed by one of parties the settlement agreement usually mentions that the settlement is only final when the reversion period is over.
Risk: An employee can transfer all of a customers funds to an oversees bank account
Mitigation: Multiple employee must approve transfer of funds
Mitigation: No individual employee can deploy modifications to the computer system actually doing the transferring.
Mitigation: No team can both write code and access (the important) production systems
Mitigation: Must stand on head while deploying code, because people standing on their head are more honest
Status: Risk accepted, we'll have 10 more meetings to review this next month.
The idea that bank transfers are reversible is false. Some are, some aren't, the adversaries are interested in the ones that aren't. The idea that manual review is a trivial fix is very false. Even if there was a trivial fix, the idea that you could get this past the numerous gatekeepers with a simple and easy process is probably false in most banks.I imagine bank CEOs know each other and can even call each other and say "Oh sorry old chap, that was a mistake!".