Due diligence on a bank: the red flags an analyst must catch

Credit Suisse is the cautionary tale for governance rot. Years of scandals (the Archegos family office collapse cost it around $5.5 billion in 2021, the Greensill supply-chain finance funds froze around $10 billion of client money) pointed to a control culture that never held. UBS absorbed it in a state-brokered rescue in March 2023.

Analyst move: read the risk committee minutes cadence and any regulator "matters requiring attention." Repeated, unresolved findings mean the board is not managing.

2. Related-party lending: loans to insiders

A related party is anyone close to the bank: directors, major shareholders, executives, or companies they own. Lending to them cheaply or without scrutiny is one of the oldest ways to loot a bank.

What to check:

• Total related-party loans as a share of capital. In the US, Regulation O (from the Federal Reserve) caps and governs insider lending. In the EU, the Capital Requirements Regulation (CRR) and large-exposure rules apply.
• Are these loans on market terms? A director borrowing at below-market rates is a subsidy flowing out of the bank.
• Non-performing related-party loans. If insiders do not repay, nobody will make them.

This was central to failures at banks in emerging markets and to smaller US and European institutions. The pattern is always the same: capital that looks solid is actually tied up in loans to people who control the bank.

Worked example:

Say a bank reports Tier 1 capital (its core loss-absorbing equity, roughly common equity plus retained earnings) of $2 billion, and related-party loans of $360 million.

Ratio = 360 / 2,000 = 18%.

Many supervisors get uncomfortable above a low single-digit to ~10% concentration in aggregate insider exposure. 18% is a screaming flag warranting a deep look at loan terms and collateral. (Figures illustrative.)

3. Deposit concentration: the SVB lesson

Banks fund themselves mostly with deposits. Not all deposits are equal.

Two questions decide fragility:

a) How concentrated is the base?

SVB's depositors were overwhelmingly venture-backed tech and healthcare firms. They talked to each other, used the same VCs, and moved as a herd. When fear hit, they all ran at once.

b) How much is uninsured?

In the US, the FDIC (Federal Deposit Insurance Corporation) insures deposits up to $250,000 per depositor per bank. In the EU, deposit guarantee schemes cover up to EUR 100,000. Deposits above those limits are "flight risk": they run first.

At SVB, an estimated 90%+ of deposits were uninsured (widely cited estimate). That is a powder keg.

Analyst move: pull the call report / Pillar 3 disclosure and compute:

Uninsured deposits / total deposits.

Then ask: are these depositors correlated? A regional bank serving diverse local businesses is far safer than one serving one hot industry, even at the same headline number.

The FDIC BankFind Suite lets you inspect US bank financial data directly and for free.

4. Interest rate and liquidity risk: the trap under the deposits

This is the mechanical piece that killed SVB, and it is arithmetic.

SVB parked huge deposits in long-dated US Treasuries and mortgage-backed securities when rates were near zero. When the Fed hiked aggressively through 2022 and 2023, those bonds lost market value. Bonds and rates move inversely.

Two accounting buckets matter:

• AFS (available-for-sale): marked to market, losses hit visible equity.
• HTM (held-to-maturity): carried at cost, losses hidden unless you are forced to sell.

SVB had large unrealized HTM losses. On paper, fine. But when the run forced asset sales, those paper losses became real, and the capital hole was exposed.

Watch the LCR: the Liquidity Coverage Ratio requires banks to hold enough high-quality liquid assets to survive a 30-day stress. A ratio comfortably above 100% is the regulatory floor, but a herd-like deposit base can exhaust it faster than the model assumes.

5. AML exposure: the fine you cannot model

AML (Anti-Money Laundering) failures do not usually cause a run, but they generate massive fines, force out management, and signal broken controls.

What to check:

• History of consent orders and fines from regulators like the US OCC (Office of the Comptroller of the Currency), FinCEN (Financial Crimes Enforcement Network), or European supervisors.
• Exposure to high-risk clients: correspondent banking, crypto on-ramps, jurisdictions on the FATF (Financial Action Task Force) grey or black lists.

Danske Bank's Estonian branch processed an estimated EUR 200 billion of suspicious transactions over several years, one of the largest AML scandals on record, ending in a guilty plea and around $2 billion in US penalties in 2022. The controls failure was known internally long before it became public.

Analyst move: if AML fines recur, the bank has a culture problem, not a one-off. Treat it as a governance red flag too.

6. Off-balance-sheet vehicles: where risk hides

Banks can move exposure off the balance sheet into structures that do not show up in headline capital ratios. This was central to 2008 (structured investment vehicles) and it never fully went away.

What to look for:

• Special purpose vehicles (SPVs) and conduits holding assets the bank has implicitly promised to support.
• Contingent liabilities: guarantees, letters of credit, undrawn credit lines. A bank can look well capitalised until those commitments get drawn all at once.
• Derivatives notional exposure versus net exposure. Big notionals are not automatically dangerous, but opaque ones are.

Credit Suisse's exposure to Archegos was effectively a concentrated, poorly-margined bet on a single client running leveraged equity positions. It sat in a corner of the prime brokerage business the risk function did not properly police.

Analyst move: read the notes to the accounts, not just the face of the balance sheet. The phrase "commitments and contingencies" is where the real story often lives.

Putting the checklist together

No single flag is fatal. The pattern is what kills:

| Danger zone | The SVB / Credit Suisse tell |

|---|---|

| Governance | No CROCROConversion Rate Optimization (CRO) is the systematic practice of increasing the percentage of users who complete a desired action, using data, testing, and user research.Voir la définition complète →; passive board; repeat scandals |

| Related-party | Insider loans above prudent share of capital |

| Deposit concentration | Herd depositors, high uninsured % |

| Rate/liquidity | Hidden HTM losses, thin liquidity buffer |

| AML | Recurring fines, high-risk clients |

| Off-balance-sheet | Concentrated client bets, contingent draws |

An analyst who spotted three or more of these at SVB in early 2023 had the full picture before the market did.

Key takeaways

• Governance gaps predict everything else. A missing CROCROConversion Rate Optimization (CRO) is the systematic practice of increasing the percentage of users who complete a desired action, using data, testing, and user research.Voir la définition complète → or a board that cannot resolve regulator findings is an early, cheap-to-spot warning.
• Deposit quality beats deposit size. Compute uninsured deposits over total, then ask if depositors are correlated. A herd runs together.
• HTM losses are real losses under stress. Always check unrealized bond losses against Tier 1 capital, not just the reported ratios.
• Recurring AML fines signal culture, not accident. One fine is bad luck; a pattern is a control failure.
• Read the notes. Off-balance-sheet vehicles and contingent liabilities are where hidden risk lives; the face of the balance sheet will not warn you.