The 400-Day Deposit: When a Rating Becomes the Argument for Breaching a Limit
A listed cement manufacturer in Pakistan runs a group treasury that pools surplus cash from three subsidiaries. Its Board-approved treasury policy caps exposure to any single bank at 25% of group surplus cash, restricts term placements to a maximum of 12 months, and requires two authorised signatories for placements above PKR 250 million. At September month-end, group surplus is PKR 4.4 billion. Internal audit finds: PKR 1.80 billion on deposit with Bank A, of which PKR 1.20 billion sits in a 400-day term deposit; a PKR 300 million placement with Bank B approved by the treasurer alone; and an email from the ALCO chair saying 'go ahead, we will ratify at the next meeting' for the Bank A placement. The treasurer argues that Bank A is the highest-rated bank in the country and that ALCO ratification is merely pending. The CFO wants every audit finding closed before the external auditors arrive next week.
1. Identify each breach, quantify it, and explain whether the bank's credit rating or the pending ALCO ratification mitigates any of them.
Read the worked answer
Breaches, quantified
- Single-name concentration: PKR 1.80bn / PKR 4.40bn = 40.9% against a 25% cap (maximum PKR 1.10bn). Excess = PKR 700m.
- Maturity: PKR 1.20bn in a 400-day deposit against a 12-month maximum. It also locks cash well beyond the working capital cycle.
- Authorisation: PKR 300m placed on one signatory where two are required above PKR 250m.
- Delegated authority: the ALCO chair's email is not an approval. Unless the policy expressly delegates exception authority to ALCO before dealing, the exception is unauthorised. Ratifying after the event is not approval; it creates a precedent that the limit is advisory.
Does the rating mitigate? No. A single-name limit is a loss-given-default control. Ratings are lagging, migrate in stress, and the limit was set with the rating in mind - the rating explains where the limit sits, not why it may be exceeded. Rating quality is an input to limit setting, never a transaction-level waiver.
Does pending ratification mitigate? No, for the same reason: an exception must be prospective and time-bound, otherwise the control only operates after the risk has been taken.
Ownership. The treasurer owns bringing the exposure inside limits - unwind, or a Board-approved dated exception with a wind-down plan. ALCO owns the exception register; internal audit re-performs the limit test after remediation. Closing a finding by documenting the breach is not closure.
2. Recommend the governance changes needed to prevent recurrence, and advise on how the 400-day deposit itself should now be handled.
Read the worked answer
Split the fix into policy, process and behaviour - any one alone will fail.
Policy
- Exceptions may be granted only by the Board or a Board-delegated committee, in writing, before dealing; maximum 30 days with a mandatory wind-down plan.
- Add tenor buckets per counterparty and a connected/related-party sub-limit, so a long-dated placement cannot hide inside one aggregate number.
- Report the aggregate exception register to ALCO monthly and to the Board Audit Committee quarterly.
Process
- Enforce dual signatory in the treasury system, not in email; hard-block placements above limit or above 12 months. Systems prevent, policies only persuade.
- Pre-deal compliance check signed by treasury operations; independent confirmation of every placement with the counterparty; daily limit-utilisation report to the CFO.
- Clarify the ALCO chair's authority in the delegation-of-authority matrix.
Behaviour
- The instruction to 'close findings before the auditors arrive' is the root cause, not a scheduling detail. Findings close on evidence of remediation, not on paperwork. Remove yield-only KPIs for the treasurer; add breach count, exception age and repeat-finding metrics.
The 400-day deposit itself: treat it as a decision with a price. Estimate the break cost versus the liquidity value of PKR 1.20bn against the forecast cash cycle, then take either the unwind or a Board-approved, dated exception with numbers attached. Doing neither is the worst outcome.