Gross versus net, and the control that catches it

Graduate · enrolled learners

This lesson opens with The Deutsche Bank fat finger, March 2018.

What happened

During a routine process, Deutsche Bank mistakenly sent about 28 billion euros, roughly 35 billion dollars, to an exchange counterparty, an amount far larger than intended and larger than the bank's own position warranted. The cause was a gross-versus-net error: instead of transferring the small net amount that was actually due, the system sent the full gross figure, the total before offsetting amounts were subtracted, which was vastly bigger. There was no pre-send control that noticed the transfer dwarfed anything the process should ever produce and stopped it before it left; the payment simply went out. It was caught and reversed the same day, so there was no lasting loss, but the mistake exposed the gap plainly: a system had sent an amount that should have been impossible for that process, and only luck and a same-day catch prevented harm. The number that left the bank was not wrong by a plausible margin; it was wrong by orders of magnitude, and nothing had been in place to say that an amount that size could not be right.

The decision point

A gross-versus-net error, sending the full gross figure instead of the small net amount actually due, can push an action orders of magnitude larger than intended, and the defense is a pre-send control, a limit or sanity check that catches an oversized or impossible action before it leaves the system. Deutsche Bank is the case: a routine process sent about 35 billion dollars instead of the small net amount owed, because the gross figure went out in place of the net, and nothing stopped a transfer that dwarfed anything the process should produce; only a same-day catch and reversal prevented lasting harm. The lesson is that the size of an action is itself a signal, and a control that knows the plausible bounds of a process, what a normal net transfer looks like, what the maximum could ever be, can catch a value that is wrong by orders of magnitude, which is exactly the kind of error a gross-for-net mistake produces. This is the outbound counterpart to reconciliation: reconciliation checks what the system did against reality, and a pre-send control checks what the system is about to do against the bounds of the possible, refusing to send an amount that could not be right. So the discipline is to build limits and sanity checks on outbound actions, sized to what each process should ever produce, so an oversized or impossible transfer is stopped before it leaves rather than caught, if you are lucky, afterward, because Deutsche Bank was saved by a same-day reversal it had no right to count on, and the number that briefly left the bank, 35 billion dollars from a routine process, was one no control had been built to say was impossible.

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.