Talking Banks and Cybersecurity With the FDIC's Former Chief Innovation Officer

Sultan Meghji is the former chief innovation officer of the Federal Deposit Insurance Corporation (FDIC) and a professor at the Pratt School of Engineering at Duke University.

Motley Fool producer Ricky Mulvey caught up with Meghji to discuss:

• Where Silicon Valley Bank and the FDIC faltered in the lead-up to the bank run.
• Ripple effects from the recent bank runs that investors should consider.
• Hindenburg's short report on Block.

To catch full episodes of all The Motley Fool's free podcasts, check out our podcast center. To get started investing, check out our quick-start guide to investing in stocks. A full transcript follows the video.

This video was recorded on April 2, 2023.

Sultan Meghji: Community banks, and regional banks play an incredibly important part of the US economy because the businesses they support account for well over 80% of new job creation, and well over 80% of new capital infusion, it's not even close. What's happening now is the logic is now changed. If I'm a small business owner, instead of looking at the local bank or the local credit union, I now realize, well, if I'm successful, I'm in trouble if something happens to that bank. 

Chris Hill: I'm Chris Hill, and that's Sultan Meghji, the former Chief Innovation Officer at the FDIC. Today, he teaches financial technology and cybersecurity at Duke University. Ricky Mulvey caught up with Meghji last Tuesday to talk about what happened behind the scenes before the collapse of Silicon Valley Bank, how to pack a go-bag for your savings, and new questions for regional banks.

Ricky Mulvey: Before we dive into the Silicon Valley Bank collapse and the effects of all that that are continuing to play out, can you talk a little bit about the relationship between banks and the FDIC for someone who might not be savvy on it?

Sultan Meghji: Sure. The FDIC actually has two jobs. One is to run an insurance fund, the deposit insurance fund, which is what pays for the up to $250,000 current checking account thing that we all see on our banks. The second is they have about 3,000 bank examiners and support staff, and they examine just shy of 4,000 banks directly. But then the second thing they do is they operate the technical infrastructure and a lot of the examination processes for the other federal bank regulators. If there is a bank examiner walking around your bank and making sure that it's being run correctly, most likely it's an FDIC person using FDIC technology.

Ricky Mulvey: The bank examiners have been probably busy lately with Silicon Valley Bank. I'm a little confused on the middle part of the story there. Everything is fine. It's Silicon Valley Bank up until about a month ago. Then there's a middle part where everybody panics because they write down some bonds. I don't know if anything else happened there. Now there's a bank run. The government insures deposits above 250K. Now First-Citizens Bank owns Silicon Valley Bank. What happened in the middle? What am I missing with that story?

Sultan Meghji: Well, can I correct your structure just a little bit?

Ricky Mulvey: You can always correct my structure.

Sultan Meghji: The way to think about it is Silicon Valley Bank grew tremendously over its 40-year history, especially in the last five or six years, and crossed a couple of different thresholds of size to the point that they ended up being one of the top 20 banks in the United States. In 2019, data started showing that they weren't managing their investments very well, and that was well understood to the point that the Federal Reserve, I believe, sent them multiple notes saying, "Hey, maybe you should look at this." It's one of those hurling over the wall and hope they fix that thing. That was fine as long as rates stay low. Then the minute rates started going up, that investment portfolio went from being a concentration risk to now a liability. Your loans were worth more than the assets they were against and that started last year. The regulators we're aware of that, didn't really do too much. They're like, "Oh, they'll figure it out." There was a letter in December of 2022 that said, "Hey, it's getting bad, maybe you guys should do something about it." Then it spiraled out of control because somebody actually started noticing that the bank balance sheet was pretty terrible. Silicon Valley Bank realized they need to raise some money. They needed to put more assets on the books. Goldman Sachs apparently was hired to do that and completely failed to get anything good, mostly because of bad press that was coming out around the same time, and this is about a week before the bank run occurred. Then on Thursday, six different things all happened at the same time that led to that middle part that you're talking about. To me, the middle part of your story goes from 2019 until that Thursday.

Ricky Mulvey: That's fair. I think to the outsider's perspective though the depositors and the investors watching Silicon Valley Bank, they were being told by the bank's leadership, "Hey, there's nothing to worry about, we're one of the safest banks in the world. We're fine over here."

Sultan Meghji: There's a fine line and I worry that Silicon Valley Bank's leadership fell on the wrong side of this between keeping a stiff upper lip and oh, everything's going to be fine and the opposite being true. Silicon Valley Bank in a lot of ways how to culture far more like a start-up or a venture capital firm or a PE firm, and less like a bank. If a bank has to make a statement about their safety and soundness, that's usually a really terrible thing. The other thing that happened is because so many of their customers just kept putting money in the same checking accounts. I think 10 accounts accounted for $25 billion of deposits. Can you imagine having a bank account with a billion dollars in it? I, obviously can, but that's not great financial management on the part of the companies in question or the people in question. It was a perfect storm of bad things. I think you can lay a lot of blame on the bank's management for not being clear about what was going on and not enforcing more stringent controls internally. But you also have a fair amount of blame, I think, to go on the regulatory community for not doing something about it. They saw this coming and apparently didn't really do that much to stop it.

Ricky Mulvey: One other way the regulatory community is getting a lot of attention is this idea that all banks now have this implicit insurance, especially regional banks. They may not be covered by being a systemically important bank. However, small banks are now essentially being told, to my understanding by the treasury and the FDIC, that your deposits are safe even above 250K without paying necessarily into that insurance fund. What are the consequences of this implicit insurance? Who pays for it? Is this worthy of attention?

Sultan Meghji: Well, it's an interesting point that you bring out because since really 2008, the Global Systemically Important American Banks have had that. It's been a very implicit thing and there's a very smallest, I'll use JPMorgan as an example. It doesn't really matter how much money is in your JPMorgan account because it's so deeply coupled to the treasury of the United States, you're insured because if JPMorgan goes under the US government goes under. This non-voted-on, non-policy outside of statutory authority shift that says regional banks now get the same thing is in lieu of Congress acting. Logically and following the law that the FDIC cannot say this. It is a violation of existing law for them to say this. Now, what the Treasury Secretary and the rest of the FOMC, this is the financial regulatory leadership of the United States have decided to do, is say, "Listen, we will categorize any bank as systemically important to make sure that we do this because we don't want to bank run." That's where we are now. Now it needs, I think, to dot I, cross t correctly, the Congress to vote on. That's part 1. Part 2 is the insurance fund cannot cover this. Full-stop.

The insurance fund actually, as of today, is basically zeroed out between signature and Silicon Valley Bank, between what they already had to pay out and when the runs happened and when they were shut down. But then also the liabilities of Silicon Valley Bank that are now owned by the FDIC. I think they've got about 15 billion. You left three weeks ago, they had about 130 billion. That's basically done. They can't afford another run, which is I think why First Republic hasn't been put into receivership personally because of the deposits. The third piece of it is the US government fundamentally has to stop these deposit runs from happening, it has to keep American dollars in as close control of the US system as possible because of other ripple effects, this would have. For example, taxes. This is a great example of something, tethered to go into the crypto universe just a little bit, picked up nine billion dollars from US dollars in the last month-and-a-half. If all of a sudden $100 billion leaves the American banking system which only has 17 trillion to begin with and goes, let's say a trillion that goes into crypto, you've fundamentally weaken the balance sheet of the United States and the US government is doing everything it can to keep that from happening.

Ricky Mulvey: I want to circle back on something you just said. You said the FDIC could not afford another bank run right now?

Sultan Meghji: The deposit insurance fund, if you do the math between the checks they're having to write for signature in Silicon Valley Bank wiped out 85-90 percent of the deposit insurance fund. Last time that happened was 2008. What happened was the Federal Reserve and the treasury got together and said, well, we'll just back it by the full faith and credit of the United States government and they fed it in there and then it spent a few years upping the assessments that the banks were charged to then to regrow that. It's published. You can actually go and look at that curve where it was very high 2008, went into negative and then crawled its way back up until three weeks ago.

Ricky Mulvey: One of the lessons seems to be that if the FDIC comes knocking at your door, perhaps they need to knock twice if they ignore your first call. What are the lessons from the Silicon Valley Bank collapse? Do you think bankers and regulators are learning them?

Sultan Meghji: No. Simple. I think if you watched the Senate Banking Committee hearing today, you saw the old guard preaching the old ways. The politicians giving their talking points, but fundamentally it's not actually changing anything. They spent a lot of time today talking about the tools at their disposal. Fact is they have the data, they have the tools, and they weren't acting the right way. When I think about innovating and transforming and keeping things like this from happening I think about three things. I think about the technology, I think about the process and I think about the people. On the technology side there's a big tech upgrade needed. They need to be able to be getting data in real-time. They need to be analyzing it real-time. They need to be doing a far better job of risk management on these bank balance sheets and that's across the regulatory system.

The second is the processes that the organizations use need to be far better. For example, if I was the chair of the FDIC, I would require any bank in the United States their chairman to call me, [inaudible] pick up the phone, call me and tell me if you see more than 1% of your deposits leave in a 24-hour period or if the aggregate over three days is 2% or something like that. If we knew that, that would fundamentally alter how we think about that institution, how we think about the management, etc. Number 3 is the people involved. There are roughly 4,000 bank examiners in the United States. The vast majority of them worked for the FDIC. Those people should be held accountable to ensure that they aren't just sending memos. They're saying, listen, your balance sheet is off by X. Rates are going to continue to go up for the next year. Probably we're looking at a target of five. Let's say if that happens, you have two days to come back to me and tell me what that does to your balance sheet. If you can't do that, then great, I'm going to tag you on your examination and you're going to have to really come to the principal's office and tell me what the heck you're actually doing. The fact is, is none of those three things have been happening.

Ricky Mulvey: Going back to the regional banks, if you're a small to medium-sized business, and I think a lot of them are thinking this right now. Why would you do business with the regional bank if you know it's not systemically important?

Sultan Meghji: Well now the logic that you would use as a small business owner is different. Up until the last month or so, generally speaking, the big banks were better for consumers, the small and regional banks were better for businesses. They had more organized products and services that made more sense. They were a little closer. If you're a mainstream business, it was easier to work with a main street bank because they understood you. You've got a car dealer, you've got a coffee shop or whatever. There's a bank three doors down. It's an easier thing. It's easier to get lending and credit facilities without some guy in New York deciding that you aren't cool enough or Silicon Valley deciding you're not cool enough. Community banks, regional banks play an incredibly important part of the US economy because the businesses they support account for well over 80% of new job creation, and well over 80% of new capital infusion. It's not even close. What's happening now is the logic is now changed. If I'm a small business owner, instead of looking at the local bank or the local credit union, I now realize, well, if I'm successful, I'm in trouble if something happens to that bank. Now the calculus of where I put my money and how I operate is radically different. I might keep some deposits in a community bank, but I also have an account with a G-SIB, we're going to see a significant recalibration of deposits. On the consumer side, it's already 85% within, I think seven banks. That's going to go well over 90%, I think here by the end of the year, and we're going to see a lot of pressure on the banking system. There was already a tremendous amount of pressure on the community and regional system because no matter what happens in Congress, there will be more examination, more regulatory compliance expense on the regional banks and mid-sized banks, and that will continue to push on those institutions. In 1987, I think there were 27,000 banks in United States, now there are about 4,500. I would not be at all surprised for us to break 3,000 within the next five years.

Ricky Mulvey: With more consolidation is this [inaudible].

Sultan Meghji: I'm also not convinced there won't be a couple of more failures before we get through the end of the year, but I think there's about 15 or 20 banks that I'm really staring at hard to figure out how they manage their balance sheet. But I think we'll see consolidation. That's always been the main driver of that, but we'll see more of that too.

Ricky Mulvey: Any parts of the story that maybe we haven't gotten to or the second or third order effects that people aren't discussing enough?

Sultan Meghji: Yeah, I think commercial real estate is something to pay a lot of attention to right now. I think the bonds side of the story is something to pay a lot of attention to right now. I think as we get through, as we go conceivably into this recession later this year, which seems to be a fait accompli at this point. There are a lot of banks that have made a bunch of investments that are now worth less than they need to be in order for the banks to survive. They're going to be looking for the Fed to balance the drop-off in rates and the drop-off in the reactivation of more quantitative easing, that whole story over the next, let's say 9-12 months, I think is going to be far more important than anything we're talking about right now.

Ricky Mulvey: Wow. With respect to the recession coming, I feel like a recession has been six months away now for about the past 18 months. We'll see how that continues. In a previous interview I've heard you talk about essentially if you're an individual, you're worried about these bank collapses, you can pack it to go bag for your savings, hoping you can share with The Motley Fool audience how one can do that.

Sultan Meghji: It's really easy. I always keep a clean bank account with far less than the whatever the depositary insurance number is at a G-SIB, one that I know isn't going to fail. I always have a clean credit card. I always keep them all separate, use them just enough, they don't get shut down. That basically created parallel siloed financial infrastructure. That is absolutely critical now because I think I'm fairly well-quoted as saying, I think there are only two banks in the United States that I think are doing the cybersecurity correctly and managing that correctly, and so you got to worry about ransomware. To me there are two levels of concern. One is, can I pay my bills today? Can I get a cup of coffee? Can I buy my groceries, pay my electric bill, whatever. The second order is, is the institution and the structure itself I'm operating inside of something that I can rely on long term? I worry tremendously about raising the debt ceiling because that will impact the value of the US dollar, which then value, credit ratings, etc. You go down that list. At some point, it is entirely possible two years from now that I will find a way to operate in a non-banking infrastructure that is independent of the US dollar just because I'm not 100% certain that a silly political fight in DC won't devalue the US dollar so much that it becomes an inaccessible payments infrastructure for me.

Ricky Mulvey: I'd be remiss if I didn't ask you, what are the two banks that you think are doing cybersecurity correctly?

Sultan Meghji: I never name those two.

Ricky Mulvey: All right. Fair enough, maybe we'll chat after the program. [laughs] Speaking of financial regulation, though, Binance is in a lot of trouble and non-bank institutions. They've allegedly encouraged customers to use VPNs, virtual private networks to circumvent trading restrictions both in the United States, in China, they've hit a hat-trick, in my opinion, by angering the US Commodity Futures Trading Commission, the IRS, and the Chinese government, what are the laws that Binance was allegedly hoping those customers circumvent?

Sultan Meghji: It's an incredible list of laws that they are alleged to have violated. On the People's Republic of China side, it's basically anything related to crypto and anything related to a PRC citizen during banking outside of the PRC. It's the laundry list. On the US government side, it's everything from tax evasion to money laundering to facilitating the financing of terrorism. You just go down the list. It's an incredible list. By the way, it's not just the IRS, I think there's more to come on the Binance story. If you take what they've been accused of doing as it relates to the PRC and you take what they've accused of doing to the United States, there's a bit of overlapping, that Venn diagram. I'd be curious how much bigger one circle that surrounds them all actually is. But it does, to me say Binance is probably one of the riskiest organizations right now to do something with whether you're a US citizen or not. If you can upset the US and PRC government at the same time, I mean, good luck. I'm curious what shallow grave you'll eventually be found in organizationally, I mean. [laughs]

Ricky Mulvey: Binance claims that it was their angels, volunteers who are helping customers circumvent trading restrictions. These are folks on Discord, Telegram, not tied to the company. Looking at your Twitter, I think you disagree with that claim from Binance.

Sultan Meghji: I have to admit to having a degree of personal impact here that I should disclose. A "volunteer army" related to a specific crypto project recently tried to deep fake me and use my voice to shill for a product that is currently being sued by a US regulator. This volunteer army is used by various crypto projects or crypto companies. It is, I think, going to come out very clearly that they are not independent at all and they are funded one degree or another directly taking strategic direction, etc. It's saying if you see an influencer on social media, like let's say on TikTok, shilling for brand X, of course, there's a financial relationship there. Of course, they're doing that on purpose. Maybe they're doing it to establish a bona fides, maybe they are doing it because they're getting some crypto from one hidden wallet to another hidden wallet. That is entirely operating in this market, and so to me that is a weak argument and frankly one that is going to be very easy to prove that it's a weak argument.

Ricky Mulvey: I got another dumb question for you. I can bet on whether or not an NBA team will win the championship with a futures contract. With a gambling company, I can bet on the price of oil a year or two from now and I can bet on a company's stock price. Why does the US Commodity Futures Trading Commission, why don't they want me to bet on the price of cryptocurrencies?

Sultan Meghji: Such a great question, Ricky. You should ask them. I do not work for the CFTC. Probably the only thing good that came out of that is their argument about Litecoin and Bitcoin not being securities, which I think was correct. But the fact is the US government is having what I call a Chinese communist party moment. They want to control and govern all financial activity. You are allowed to gamble because there's a legal framework under which that operates that you cannot technically violate, and it took decades and decades for that to be created. The thing that is terrifying for, I think, most of the people in the regulatory community is they don't have a system that allows them to control how a US citizen operates in that environment, and if it is inside the US sphere of influence, can we collect taxes on it? A couple of years ago, I think it was 2021, IRS did a survey, something like 40% of Americans that filed taxes said they owned crypto. I think that plus cash outflows through COVID into crypto and offshore really terrified a lot of people in the regulatory system, especially the IRS.

Ricky Mulvey: I want to move on to one big fintech story in the news is you teach fintech at Duke University. Hindenburg, the short research firm, I missed that short research forum.

Sultan Meghji: I would totally be up for signing onto a short research forum.

Ricky Mulvey: Maybe some more uniform sizes. Did anything in Hindenburg's research on Block, Jack Dorsey's financial technology company that has been accused of maybe opening the door too much to folks generating accounts to one address being able to commit fraud, to give the extremely short version of the 100-page report. Does anything in there surprise you as someone with a foot in the fintech and regulation world?

Sultan Meghji: No. Lots of financial services firms do a lot of these things. Wells Fargo has been called out multiple times for doing versions of this same kind of thing. Creating fake accounts as one example. For the last five years, we've seen a lot of people, in essence, one degree or another exaggerate or stretch where they were with something. The problem I think that Block currently has is that their financial operations and revenue and margin, and all that kind of stuff was not in line with what they were talking about publicly and I think a bunch of people did some really high-quality research and discovered there's a gap there. That gap is an investable thesis which now has opened the door to a bunch of other activities. We have a financial system right now where some things are very transparent, some things are entirely opaque, and the gap between those two is Alpha as we say. I think Block is a great example, something went from very small, to medium, to large very quickly and the math just doesn't seem to add up correctly in some of those cases.

Ricky Mulvey: I know there's a line somewhere between banks and FinTech companies. I use Venmo for a lot of banking activities, a lot of folks who use the Cash App for banking activities. Are those products banks?

Sultan Meghji: It's a great question. My argument would be if your wallet is holding dollars and it's an American entity, it's a bank. That would be an example. So Venmo is a bank, PayPal is bank, Starbucks is an app, as the app is a bank. That is not the definition that holds up to legal standards though and that's not what we've established as a community around that. It's really, there are banks, there are things that touch banks, and then there is financial services activities that touch them or touch banks as a gap. It's a really interesting problem we have right now because if you were to take Starbucks, I just happen to know the math on Starbucks, and take that app and call it a bank, it would be the 17th or 18th largest bank by value in the United States. One of the video game companies that, I can't remember what it maybe it's, I won't say the one, I don't want to say the wrong one, but one of the video game companies out there runs a tremendous amount of payments infrastructure because of people playing on it by loot boxes, etc. That would be like the 7th largest bank in the United States, if you call it a bank.

Frankly, I think when you get to that scale, it does. We're going to have to create new regulatory systems and structures to allow for us to manage that because you talk to a younger person and you say, what's the difference between JPMorgan and Venmo, they don't know, they don't care. Now some of that it's because of the defunding of parts of our educational system. But the other part is they just use it like one. I have an exchange account and I have a card that's in my Apple Wallet and so I can just buy stuff with it, I send stuff with it. I don't know if it is to a degree "insured". But the way we defined banking in the United States goes back to the 1930s and we haven't really reevaluated that. We're going to have to do that at some point. The rest of the world has already done that and has already moved on and we went from being five years out of date in 2008 to 10-15 years out of date now.

Ricky Mulvey: One topic before we get going. I'm going to ask you to wear your cybersecurity hat and that is because a company called ByteDance, which owns TikTok, big in the news, hot in the streets in DC where legislators are considering a ban on the social media platform. I want to talk about the solution that they've laid out, which is that to make it a separate entity that the Chinese government cannot spy on Americans' information is that the company, Oracle is going to house all the data in Texas and that way, if you can hear my sarcasm, the Chinese government can't touch it, mess with it. All that good stuff. I don't buy that explanation, but do you?

Sultan Meghji: No. Not at all. The fact is the PRC government, and I always say PRC because I don't want people to think that they get to call themselves China there's a second country that also has China it's named, the People's Republic of China is strategically focused on gathering up as much data on every American as possible for long-term utilization and this proposed "solution" is just a pile of ByteDance. I'll say it like that. Interesting, time us back to the Binance conversation, there are data centers in Asia that have ByteDance data sitting on the server that's right next to each other. Alibaba, Tencent, Binance, ByteDance, these companies are all sharing hardware with data-sitting co-resident across all of them in a variety of different environments. There is no way that I would trust ByteDance or anything else owned by the PRC, which just as a reminder, there's no such thing as a private company inside of the PRC. The government always owns a piece of it. That is always part of the discussion. In order to launch companies or scale companies, you have to be a member of the communist party. I'm I going to trust a communist-backed by a communist government in the protection of American data? No. Not at all. Now, is breaking up TikTok a thing? There are million ways we can solve this, from a cybersecurity perspective I think it is a nightmare currently and the proposed solution only makes it worse.

Ricky Mulvey: But the data is in Texas. How are they grabbing it?

Sultan Meghji: There's a thing called the Internet, Ricky, I'm not sure if you've heard of it. The ability for Oracle to lock that out is impossible. Whether it's at the hardware layer, whether it's at the network layer, whether it's at the virtual machine or database layer, there are an almost infinite number of ways that the Chinese could get access to that data even if all they do is own the land the data center is on, which by the way, the amount of land in Texas owned by the PRC directly or indirectly is a relevant one here. How much of the Oracle shareholder base is PRC? These are all very important questions. I think people should really ask the longitudinally relevant questions. The Chinese don't care about next year, they care about the next century, and so are we going to play at that level or are we going to argue about what sounds good on CNN?

Ricky Mulvey: That's Sultan Meghji, he's the former Chief Innovation Officer at the Federal Deposit Insurance Corp. You may know it as the FDIC. He's also a professor at the Pratt School of Engineering at Duke University. Appreciate you joining us Fools on Motley Fool Money.

Sultan Meghji: Thanks for having me Ricky. 

Chris Hill: As always, people on the program may have interest in the stocks they talk about and The Motley Fool may have formal recommendations for or against, so don't buy or sell stocks based solely on what you hear. I'm Chris Hill, thanks for listening, we'll see you tomorrow.