When Risk Management Fails: The Case of Credit Suisse
- Anna Stylianou
- 3 hours ago
- 10 min read
Credit Suisse was one of the largest and most established banks in the world. It had risk managers, risk committees, internal and external auditors, sophisticated systems and regulatory oversight.
In March 2023, Swiss authorities supported its acquisition by UBS. The transaction was completed on 12 June 2023, ending Credit Suisse’s existence as an independent banking group after 167 years.
The problems at Credit Suisse accumulated over many years. Losses, scandals, regulatory action, governance concerns and repeated changes in management and strategy exposed weaknesses in risk management across the bank.
The Credit Suisse case shows what can happen when an organisation identifies risks but repeatedly fails to respond effectively.
Prefer to watch? In this 10-minute video, I examine what happened to Credit Suisse and what organisations can learn from its risk management failures.
Credit Suisse and Archegos relationship
One of the most damaging events in the case of Credit Suisse involved Archegos Capital Management, a family office founded by Bill Hwang.
Archegos built very large positions in a small number of companies. It relied heavily on borrowed money and derivatives provided by several global banks, including Credit Suisse.
Many of these derivatives were total return swaps. They allowed Archegos to benefit from movements in share prices without buying the underlying shares itself. Credit Suisse generally hedged these transactions by purchasing the underlying shares in its own name.
As Archegos entered into more transactions, the gross market value of its portfolio with Credit Suisse increased.
By March 2021, the portfolio had reached almost US$24 billion. According to the Swiss Financial Market Supervisory Authority, FINMA, this was four times the size of Credit Suisse’s position with its next-largest hedge-fund client and represented more than half of Credit Suisse Group’s equity.
Under the arrangements, Archegos had to cover falls in value and provide additional collateral when required. Credit Suisse therefore faced the risk that Archegos might become unable to meet those obligations.
That risk grew with the portfolio.
In March 2021, the value of several shares underlying Archegos’s positions began to fall. Archegos could not provide the collateral requested by its banks.
The banks started selling the shares they held against the positions. The size and concentration of those positions made them difficult to sell without pushing prices down further.
Credit Suisse incurred losses of approximately US$5.5 billion following Archegos’s default.
The warning signs identified by Credit Suisse
Credit Suisse’s systems repeatedly identified breaches of the limits established for the Archegos relationship.
These limits were intended to control how much Credit Suisse could lose if Archegos defaulted or the market moved sharply against its positions. They included a potential exposure limit and limits based on severe market scenarios.
FINMA found that the bank’s risk monitoring regularly showed limit overruns and a high risk of loss. Credit Suisse requested too little additional collateral from Archegos and repeatedly increased limits that the client had already exceeded.
By early 2021, the warning signs included:
the rapid growth of Archegos’s portfolio with Credit Suisse
Archegos’s heavy reliance on borrowed money
Archegos’s concentration in a small number of companies
insufficient collateral to protect Credit Suisse if Archegos defaulted
repeated breaches of Credit Suisse’s risk limits for the relationship
Credit Suisse’s limited information about Archegos’s relationships with other banks and its total exposure across the market
Employees discussed concerns about the relationship. Relevant information also appeared in reports provided to senior employees within the business and risk functions.
Credit Suisse’s independent investigation found that reducing the risk associated with Archegos failed to become a sufficient priority. The business focused on increasing revenue from the relationship, while the risk function failed to challenge the exposure effectively.
The bank had also planned to introduce a more responsive method for calculating the collateral required from Archegos as the risk changed. Implementation was repeatedly delayed.
In February 2021, Credit Suisse’s credit risk team estimated that the bank needed approximately US$1 billion in additional collateral from Archegos. The Credit Suisse team managing the relationship asked Archegos to provide US$750 million. Archegos refused that amount and ultimately provided US$500 million.
Most of the US$500 million was not new money transferred to Credit Suisse. Credit Suisse already held approximately US$466 million belonging to Archegos as excess collateral. Archegos added enough to bring this amount to US$500 million and agreed that Credit Suisse could hold the full amount as initial collateral against potential losses.
The bank’s reports included information about the growing Archegos relationship. They failed to show senior executives clearly how large the exposure had become and how much Credit Suisse could lose if Archegos defaulted. Some senior executives only became aware of the full scale of the problem shortly before the default.
How concentration risk grew
Concentration risk arises when an organisation could suffer a significant loss because it depends too heavily on a single source.
That source could be:
one customer or counterparty
one group of connected customers
one supplier
one product
one market
one source of funding or revenue
several relationships exposed to the same underlying risk
Credit Suisse accumulated an exceptionally large exposure to Archegos. The relationship also generated significant revenue for the bank.
According to the independent investigation, Credit Suisse focused on the short-term revenue generated by Archegos and was reluctant to have difficult discussions that could affect the client relationship.
When Archegos defaulted, Credit Suisse had to sell a very large volume of shares while their prices were falling. Several other banks were also trying to sell positions linked to the same companies.
The size and concentration of the positions made it difficult for Credit Suisse to exit without pushing prices down further and increasing its losses.
The Greensill Capital relationship
Around the same period, serious problems were developing in another part of Credit Suisse.
Credit Suisse Asset Management managed four supply-chain finance funds connected to Greensill Capital, a financial services company founded and led by Lex Greensill.
Supply-chain finance allows a supplier to receive payment for an invoice before the payment becomes due. A finance provider pays the supplier and later collects the amount from the supplier’s customer.
Greensill provided this type of financing to companies. The amounts Greensill expected to collect were converted into financial assets, which the Credit Suisse funds purchased using investors’ money.
By early 2021, the four funds held approximately US$10 billion in assets.
Insurance covered many of the assets and was intended to provide protection if the companies responsible for payment failed to pay.
The insurer had informed Greensill in mid-2020 that the policies would not be renewed and later raised questions about the validity of some of the existing coverage. Greensill was unable to secure replacement insurance before the policies expired.
The loss of insurance created significant uncertainty about the value of the funds’ assets. On 1 March 2021, the funds stopped accepting new investments and suspended withdrawals. On 4 March, the fund boards decided to close the funds and place them into liquidation.
Greensill entered insolvency shortly afterwards. Credit Suisse then worked to recover the money owed and return it to investors.
FINMA later found serious failures in the way Credit Suisse managed its relationship with Greensill.
Concerns had increased in 2018 after another fund provider closed a fund that also worked with Greensill. Journalists subsequently approached Credit Suisse’s Executive Board with critical questions and information, while FINMA repeatedly questioned the bank’s governing bodies about the relationship and its risks.
Credit Suisse asked employees involved in managing the Greensill relationship to handle some of these questions and warnings. They were therefore not independent from the business being examined.
Credit Suisse also asked Lex Greensill for information about which company debts supported the investments purchased by the funds, how those debts were checked and how much of the funds depended on individual companies paying what they owed.
The bank relied on his answers when responding to FINMA. As a result, some of the information provided to the regulator was partly incorrect and presented the situation more positively than the facts justified.
FINMA concluded that Credit Suisse had seriously breached its supervisory obligations in relation to risk management and appropriate organisational structures.
Archegos and Greensill involved different products, clients and business areas. Both cases revealed weaknesses in how Credit Suisse assessed risk information, challenged commercially important relationships, escalated concerns and responded to known risks.
A longer history of financial-crime failures
The failures identified in the Archegos and Greensill cases added to Credit Suisse’s longer history of regulatory and financial-crime problems.
Sanctions violations
In 2009, Credit Suisse accepted responsibility for illegally processing transactions on behalf of customers from Iran, Sudan and other sanctioned countries. The bank agreed to forfeit US$536 million.
According to the US Department of Justice, Credit Suisse removed customer names, bank names and addresses from payment messages so the transactions could pass through US sanctions filters without detection.
The bank also provided Iranian clients with instructions on how to structure payment messages to avoid those filters.
Helping clients evade tax
In 2014, Credit Suisse pleaded guilty to conspiring to help US taxpayers file false tax returns and conceal assets held in offshore accounts. The bank agreed to pay approximately US$2.6 billion in fines and restitution.
Credit Suisse admitted that it had helped thousands of US clients maintain undeclared accounts and hide their assets and income from the US tax authorities.
The methods included:
opening accounts through entities created to hide the real owners
obtaining tax forms that falsely identified those entities as the beneficial owners
destroying account records sent to the United States
arranging cash withdrawals
providing offshore debit and credit cards
structuring transfers to avoid reporting requirements
The bank agreed to disclose its cross-border activities, close accounts belonging to clients who failed to become tax compliant and improve its controls.
AML deficiencies involving FIFA, Petrobras and PDVSA
In 2018, FINMA found that Credit Suisse had breached its anti-money laundering obligations in cases connected to suspected corruption involving FIFA, the Brazilian oil company Petrobras and the Venezuelan oil company PDVSA.
The deficiencies affected fundamental parts of the bank’s AML framework, including:
identifying customers
determining beneficial ownership
classifying relationships as high risk
investigating and assessing high-risk relationships and transactions
documenting the work performed
FINMA found similar weaknesses in the bank’s management of a significant relationship with a politically exposed person. Credit Suisse had been too slow to identify and treat the client as high risk, while its due diligence and documentation remained incomplete.
The regulator also found that Credit Suisse lacked an automated system giving relevant departments a complete view of all the relationships a customer held across the bank.
The Mozambique loan case
In 2021, Credit Suisse and its UK subsidiary admitted that they had defrauded investors in connection with a US$850 million loan intended to finance a tuna-fishing project in Mozambique.
Credit Suisse Securities (Europe) Limited pleaded guilty to conspiracy to commit wire fraud. Three former bankers had previously pleaded guilty to offences that included conspiracy to commit wire fraud and conspiracy to commit money laundering.
According to the US Department of Justice, Credit Suisse failed to disclose material information about:
how the loan proceeds were used
kickbacks paid to Credit Suisse bankers
the risk of bribes to Mozambican officials
other debt owed by Mozambique
Credit Suisse had identified significant corruption and bribery concerns connected to the contractor involved in the project. Independent experts also identified a shortfall of between US$265 million and US$394 million between the money raised and the value of the boats, infrastructure and services provided.
The bank failed to disclose this information to investors during a later restructuring of the debt.
The coordinated resolutions with authorities in the United States and the United Kingdom involved more than US$547 million in penalties, fines and disgorgement.
How repeated failures damaged confidence
By 2021, Credit Suisse had faced major cases involving sanctions violations, tax evasion, anti-money laundering deficiencies, corruption risks, investor fraud, Archegos and Greensill. It had also undergone repeated leadership changes, strategic shifts and reorganisations, while high costs, fines and losses weakened its financial position.
FINMA later concluded that management errors, repeated scandals and the inadequate implementation of the bank’s strategy had damaged confidence in Credit Suisse. By October 2022, clients were withdrawing substantial amounts of money.
Pressure intensified in March 2023. On 14 March, Credit Suisse published its annual report and disclosed material weaknesses in its internal control over financial reporting for 2021 and 2022. The disclosure came during a period of considerable pressure across the banking sector and was followed by further substantial withdrawals.
Although Credit Suisse continued to meet its regulatory capital requirements and held liquidity buffers, the scale and speed of the withdrawals placed it under severe pressure. Banks do not hold all customer deposits in immediately available cash because they use part of those funds for lending, investment and other activities. Rapid withdrawals therefore create an urgent need for liquidity.
FINMA found that digital communication accelerated the spread of concerns, while online banking allowed clients to transfer their money immediately. By mid-March, the withdrawals had brought Credit Suisse close to being unable to meet its financial obligations.
On 16 March, the Swiss National Bank began providing substantial emergency liquidity assistance. On 19 March, the Swiss authorities announced emergency measures centred on UBS’s acquisition of Credit Suisse and additional liquidity support. UBS completed the acquisition on 12 June 2023.
Further tax failures identified after the acquisition
In May 2025, Credit Suisse Services AG pleaded guilty to conspiring to conceal more than US$4 billion from the US tax authorities through at least 475 offshore accounts. The conduct occurred between 2010 and approximately July 2021.
According to the US Department of Justice, Credit Suisse bankers falsified records, processed fictitious donation documents and serviced accounts containing more than US$1 billion without evidence that the assets had been declared for tax purposes. This conduct violated the obligations imposed following Credit Suisse’s 2014 guilty plea.
A separate agreement covered undeclared accounts maintained for US taxpayers in Singapore between 2014 and June 2023. The Department of Justice found that Credit Suisse’s Singapore operation had failed to identify the true beneficial owners of certain accounts and investigate indications that the account holders were US persons.
The 2025 resolution involved more than US$510 million in penalties, restitution, forfeiture and fines.
These findings were not public in March 2023 and therefore did not contribute to the confidence crisis. They revealed that tax-related failures Credit Suisse had committed to addressing in 2014 continued for several more years.
Lessons for boards and senior management
Boards and senior management should understand what happens after a risk limit is exceeded, a concern is escalated or a serious weakness is identified.
They should ask:
What action was taken?
Who was responsible for taking it?
Was the exposure reduced?
Was additional protection obtained?
Was a commercially important relationship challenged?
Was the agreed action completed?
Does the same weakness exist elsewhere in the organisation?
They should also examine repeated incidents together. Archegos, Greensill and the financial-crime cases involved different clients, products and business areas. Similar weaknesses appeared in how Credit Suisse assessed information, challenged profitable activities, escalated concerns and addressed known problems.
Risk management creates value when it changes what an organisation does. It should influence which relationships the organisation accepts, how much risk it tolerates and when it decides that the potential return no longer justifies the exposure.
Boards and senior management should identify the risks the organisation continues to accept because addressing them would require a difficult commercial decision. They must then decide whether the commercial value still justifies the exposure.
Official references for the article
