Hacker News Reader

Comment by angrygoat | Hacker News Reader

Here's the administrator's filing with the Bankruptcy Court for the District of Delaware: https://d1e00ek4ebabms.cloudfront.net/production/uploaded-fi...

Page 22 is exciting: "The Debtors did not have the type of disbursement controls that I believe are appropriate for a business enterprise. For example, employees of the FTX Group submitted payment requests through an on-line ‘chat’ platform where a disparate group of supervisors approved disbursements by responding with personalized emojis."

.. and: "In the Bahamas, I understand that corporate funds of the FTX Group were used to purchase homes and other personal items for employees and advisors. I understand that there does not appear to be documentation for certain of these transactions as loans, and that certain real estate was recorded in the personal name of these employees and advisors on the records of the Bahamas."

View on HN

> employees of the FTX Group submitted payment requests through an on-line ‘chat’ platform where a disparate group of supervisors approved disbursements by responding with personalized emojis

This seems like a totally legit approach to me -- ChatOps for expenses, essentially. The usability of "an on-line 'chat' platform" (presumably Teams / Slack / Discord / equivalent) is much better for the employees than most finance tools, and most chat apps these days should have pretty great auditability capabilities.

(Of course, the rest of this FTX fiasco is a total disaster.)

AFAIK they were using Signal with auto-delete turned on. If true, this is a great way to avoid auditability.

Well, they are learning from the “best”: politicians [1].

[1]: https://www.theguardian.com/politics/2019/dec/17/tories-swit...

This is actually standard within financial institutions and big corps. It's not implemented as "signal with auto-delete turned on", but rather as retention policies on emails or whatever.

Except the retention on emails, for instance, is usually 7 years. Not exactly the same as auto delete after read... It's an apples to oranges comparison.

And the relevant transactions and approvals get recorded in other media for even longer periods in auditable forms.

A slack exchange saying, "Hey, would you approve this expense?" "Sure" isn't a problem. It's the lack of formal follow ups in an auditable medium that is.

Worked for a major US bank. 2 years max on email. You don't want discoverability back 7 years.

That's not really how auditing works though. If there is a legal requirement to keep records of communications between senior managers (and there is for financial institutions), then "we purposely used an app that deletes such communications to hide our actions from the auditors" is in itself a crime.

That's just modern double entry bookkeeping - 1 write, then 2 erase. If any transaction isn't erased, it leaves an audit trail for investigation.

It is not legit when you are a business of this magnitude in finance.

Chatops for TechOps? Totally, no one cares if you’re down, there’s little regulatory impact. Accounting and finance? Not even once. (Caveat around TechOps is IAM privs as it relates to SOX, GLBA, etc)

(a component of my work is providing guidance to fintechs on governance and controls with respect to various nation state regulatory frameworks)

ChatOps for expenses through Apple's iMessage Finance plumbing tool can tighten up on the formal regulatory oversight and grow new profit centers for Warren Buffet, TSMC, G20 business ambitions.

Yeah, I'm sure EY will be totally nonplussed and have no further questions. Oh, you used ephemeral messaging for requests and approvals with no audit trail? Totally compliant, ok, now, let's look at dual approvals...

It worked for Wirecard.

Wirecard seems to be a kindergarden party compared to FTX so.

Thinking of it, FTX and Wirecard are hard to compare.

Wow, no.

I suppose it would be fine if you had a Slack integration that was a front-end to a proper piece of accounting software.

But a completely ad-hoc system where accounting and auditors have to grep a giant chat log for an emoji is going to get you sent to some special level of finance hell. Nobody will have any transparency into why a request was approved, who approved it, and why. How do you possibly hand off the history of reimbursements to someone who is hired later, and how do you possibly create a structured report for auditors?

And I’ll even object to your supposition that finance software is hard to use. We use Brex for a corporate card, and it’s a totally smooth process, with a great app and website.

Not disagreeing here, just adding notes.

An example of a Slack integration front-end to proper software: Ramp[0] has a decent Slack integration for in-Slack reimbursement approvals. It's easier than navigating their web app.

Also, Brex is pretty polished today but even they started out as a junk show. Stripe started out as total chaos. Many of the neobanks... Most fintech startups out there started as three engineers in a trench coat 1) hustling for traction then 2) scrambling to get a scalable (and auditable, and reconciling...) system in place before user growth crushed them.

[0] https://ramp.com/

Oh, sure, to be fair, I only just started with Brex.

And I am comparing their website to consumer-facing Chase—was just superficially impressed how much nicer Brex’s UI looks, and also feels more performant.

Sounds like a dream for employees, I don't care what's under the hood. I have unclaimed business expenses because the reimbursement portal is so shit.

Unclaimed expense beats sitting in prison.

Never underestimate the force of procrastination.

Agreed. It's certainly possible to build way more robust controls using chatops than email or some internal "enterprise" app. FTX may not have implemented it this way, but one could envision the chatops automatically requiring approvals from the correct people based on dollar amount and expense type. And requiring those people to 2FA with their approval.

So, basically building auditable accounting systems in house instead of buying existing solutions? Yeah, but no.

There are a lot of fucked up things about FTX, but "omigod they didn't use SAP" isn't one of them.

Assuming I was talking about SAP when saying accounting systems, for what is basically banking, shows a certain lack in understanding either of those systems.

My finance colleagues (Fortune 100 company) who spend all day updating the general ledger in SAP will be interested to learn SAP doesn’t make accounting systems.

Ho Ho Ho.

Nope! That is never going to pass muster with the auditors. You have actual legal responsibilities in corporate accounting, you can’t just make it up as you go along doing whatever seems easiest without ending up in prison.

Noooope. Slack isn’t providing the kind of financial controls or guarantees necessary. There’s no reporting. Presumably any admin can manipulate or delete messages, etc.

Exactly, they would need a immutable, distributed ledger to accounts for their client immutable centralized and vaporized ledgers.

> and most chat apps these days should have pretty great auditability capabilities.

Most chat apps default configuration isn't going to do this well at all out of the box.

With some significant back end work, you can for sure do this. On the other hand you are probably right about it being a pretty good for end user.

If you don't do the back end stuff properly, you're going to be in a mess and will not pass any sort of real audit.

> For example, employees of the FTX Group submitted payment requests through an on-line ‘chat’ platform where a disparate group of supervisors approved disbursements by responding with personalized emojis.

So... the payment system was a discord bot?

Honestly having had to deal with the hell that is a purchasing request in large corporations I think I'd rather go with a discord bot than have to spend 6 months justifying why I need to purchase a $50 piece of software to do my job.

Yeah, but the next paragraph indicates disbursements included entire houses.

I mean, who wouldn't want that? Aside from that whole "embezzlement" issue.

Similar. The best reimbursement system I’ve worked with was for a company that just automatically approved everything under a few thousand dollars (never states a hard threshold) based on individual professional judgement to spend funds to advance company goals. And they audited every purchase ever made when you went for partner.

It was both liberating and terrifying to have that much freedom. The audits weren’t widely available so it’s hard to know how effective this was, but it was pretty rare to hear about people not making partner because of it and they were super thorough about every charge, frequently asking for detail.

Enron, and now FTX, are the reason why that is like that.

Sometimes corporate greed is why systems are so hard.

My previous company had a very rigid repayment system and i swear it was designed to deny expenses.

Once i submitted an expense for $3.25 for a train and they wanted receipts. I didn't have one and they wanted me to sign an affidavit that i would not find the receipt and resubmit my expense.

This is for $3.25 and the amount of time spent trying to get my money back exceeded the expense amount.

The obvious common sense question should have been : If my plane landed in X, and the office is located at Y, how did i get there?

Somehow. That's not their business. But they don't want you claiming a train ticket, a bus ticket, and mileage all for the same trip.

Every seemingly stupid rule has an equally stupid person behind it.

It would be nice if we could just trust people, but there are a class of people who then abuse that trust. Systems are in place to thwart them at the expense of everyone else.

If you claimed all three of those, you would have to claim all three of them, at which point you would have claimed all three of them, and someone could easily see that.

Someone could easily see that if you have an actual reimbursement system in place.

If it's based on the honor system, I could claim the train ticket, then claim a bus ticket and say that the ticket was for something else, you were mistaken. Then claim mileage and say the bus ticket wasn't that trip, you made a mistake. Again, just like the train ticket.

So, yes, the claim needs to be backed by proof of trip or by a deliberate action on your part saying that you are claiming this right here on this date for this trip.

In your example you describe "something else". If there's "something else", then that "something else" is an allowable expense.

Lies are not an allowable expense.

I liked one of my old bosses for this. He'd notice a meeting with 5 engineers about licensing some software and would swoop in.

"How much is the license for this software?" Upon hearing an answer, "The company bills your time out at $250/hr - this meeting has cost us the licensing fee of this software. Next time, just buy it. If I have a problem with that, I'll change the policy then."

Come on, these were professionals… they used slack.

It's a fun read, in a sort of True Crime sense. They had no financial controls whatsoever and just got people to wire them billions of dollars.

> It's a fun read, in a sort of True Crime sense.

It sounds like it was purposely written to be the cold open of the inevitable Netflix miniseries.

One of the biggest mistakes in this whole fiasco is from the people who enabled this - how (why?) on Earth were they given such ridiculous sums of money… with 0 oversight!

Only true if the investors weren't sharing in the embezzlement.

It's interesting that, under every silo's balance sheet shown in that document, there is a footnote saying that customer crypto deposits are not represented in the balance.

Is that his way of saying that they haven't been able to figure out where the customer crypto deposits were represented in the ledgers?

Matt Levine's piece yesterday also mentions a $1bn loan ("loan") from FTX to SBF

Reply on news.ycombinator.com