Evidence from the record · What it means for leaders
Credit
Suisse
The meeting that was not a decision.
The control system worked. That is the problem.
In March 2021, a single client — the family office Archegos Capital Management — cost Credit Suisse $5.5 billion.
The bank commissioned an external investigation and published it in full.
The investigators interviewed more than eighty people and collected over ten million documents. They found no fraud and no illegal conduct.
More importantly for our purposes, they found nothing wrong with the bank's risk architecture.
The systems detected the danger, accurately and repeatedly, for over a year. The limits were correctly set. The breaches were correctly flagged. The right committee looked at it.
And $5.5 billion went anyway.
The control system did its job
This was not a hidden risk, a missing control or an undetected breach. The warning architecture functioned as designed.
No villain. No broken machine.
Most failure studies let you conclude that someone lied or something was missing. This one doesn't.
The people were competent, the controls were properly designed, and the warnings were both raised and received.
What was missing sat entirely between those things.
What happened
Read this as a sequence of moments where someone could have stopped it, and didn't.
The breaches begin
Archegos starts regularly breaching the risk limits Credit Suisse has set for it. The system flags this correctly, and keeps flagging it.
Ten times the limit
Archegos's potential exposure passes ten times its $20 million limit. The bank has a contractual right to call additional margin. It does not use it, and instead asks Archegos to rebalance its own portfolio.
Twenty-six times the limit
Potential exposure reaches just under $530 million against that same $20 million limit. The business responds that it remains comfortable with the existing margin arrangements.
The committee meets — and this is the moment
The counterparty oversight committee reviews Archegos. Its recorded decision is to notify it of any changes and to “revisit the counterparty at a future meeting”.
No deadline is set for fixing the breaches. No deadline is set for changing the margin terms. No owner is named.
The fix exists, and is not applied
The bank's automated dynamic margining system for swaps goes live that same month. Archegos is not on the priority list of clients to be moved onto it.
Someone finds out from outside
On a due-diligence call, the risk analyst covering Archegos learns that Credit Suisse is the only prime broker not dynamically margining these swaps.
Around the same time, Archegos is granted a bespoke risk appetite increase of $900 million.
The committee returns, nearly six months later
Archegos is now the prime-brokerage unit's largest client by position size.
Collapse
In the days before default, Archegos asks for its excess collateral back across seven separate requests, and receives $2.4 billion.
Three scheduled calls are cancelled at the last minute. Then the positions turn.
How visible was it, really?
Two numbers settle the question of whether anyone could have known.
The exposure was not marginally outside the bank's tolerance. Nor was the protection held against it close to normal.
August 2020
A quarter of the normal cushion
A lower margin means the bank absorbs more of the loss if the client cannot pay. Credit Suisse held roughly a quarter of the cushion it would normally require, on its largest and most concentrated position.
A “fundamental failure of management and controls”
Report of the Special Committee of the Board of Directors, Credit Suisse Group, July 2021.
The same report described the business as having enabled its client's “voracious risk-taking”.
Escalation happened. Decision didn't.
The signal was detected, correctly categorised as risk, and escalated to exactly the committee designed to handle it.
Every step worked.
And the output of that committee was to look at it again some other time.
September 2020: reviewed.
Exposure grows throughout the intervening period.
8 March 2021: reviewed again.
The item was never closed
No deadline for fixing the breaches.
No deadline for changing the margin terms.
No named owner.
The item was not rejected. It was simply never closed.
This is the failure mode that hides best, because on paper it looks like governance functioning. There is a committee, it has the right people on it, it met, and the matter was tabled. Every box is ticked.
A decision has a name and a date attached to it.
The rights existed. Nobody used them.
Throughout this period, Credit Suisse held the contractual power to fix the problem unilaterally.
It could demand more margin. It could terminate the swap positions.
These were not theoretical protections. They were written into the agreements and the bank knew it had them.
They were never used, because using them meant a difficult conversation with a client who might take his business elsewhere.
Instead, the bank asked Archegos to adjust its own portfolio, granted temporary increases to its risk appetite, and waited.
In the week before the default, Archegos asked for its excess collateral back across seven separate requests.
The bank paid it out.
Three calls scheduled to discuss tightening the margin terms were cancelled by the client at the last minute, and the bank let them be.
Afraid of losing the client, not of the exposure
Reduced to one sentence, this is a business more frightened of losing a customer than of the risk that customer was bringing through the door.
The investigators described the unit as having a “lackadaisical attitude toward risk”.
That is a polite way of saying the people whose job was to say no reported to people whose job was to say yes.
What was missing
The Shortboard model describes twelve attributes an organisation builds in three cumulative waves.
Wave One is Lean Dependability — the ability to do what you say you will do, honestly and without drama.
Wave Two enables new growth. Wave Three creates perpetual relevance.
The waves are cumulative. Wave Two capabilities built on a hollow Wave One do not hold, because there is nothing underneath them to take the weight.
Each wave contains four attributes which work together to create the capability required at that stage of the model.
This is the most useful of the first three cases because it does not show a business missing everything.
One Wave One attribute was genuinely present — and it is the one every commentator blamed.
Three human failures. One working machine.
The operational system — the instrumentation, limits, flags and reporting — was sound. The investigators said so explicitly.
Every gap was in how people related to that system: whether anyone could argue, whether anyone owned the answer, and whether anything was ever allowed to stop.
Wave One
Lean Dependability
Three absent, one present
conflict Surfacing and working through disagreement so that difficult truths can influence decisions. Absent
Wave Two
New Growth
Not the issue here
Wave Three
Perpetual Relevance
Not the issue here
Three gaps, and one that held
Each of these findings is stated in the published investigation. None is inferred simply from the outcome.
The exception matters as much as the three failures. Credit Suisse had capable systems and effective instrumentation. They made no difference when the organisation would not act on what they revealed.
The investigation records that some individuals raised concerns appropriately. They were not silenced, ignored or punished — they were simply outranked.
The people paid to protect the balance sheet reported into the people paid to grow the revenue. When those two disagreed, the outcome was never in doubt.
The committee's own minute names no owner and sets no date. The analyst who understood the exposure best had no authority to change anything.
Between the person who knew and the person who could act, there was nobody whose job it was to close the gap.
The bank had the contractual right to call margin or terminate the positions and never exercised either.
There was no threshold at which the relationship stopped by rule rather than by argument. Exposure concentrated in one client, and concentration was treated as a fact to be managed rather than a line to be held.
Present, and it changed nothing. The systems were well built and did their job.
A better dashboard would have shown the same numbers to the same people, who would have made the same decision. This is the attribute organisations reach for first, and the one that was never the problem.
Not the whole floor this time — and the exception is the instructive part.
You cannot build your way out of a human Wave One failure.
The tooling was excellent. It simply had no authority attached to it.
A 167-year-old bank, gone in two
Credit Suisse's response to Archegos was substantial and, on its own terms, correct.
Nine executives left. Around $70 million of pay was clawed back. Every hedge-fund client was moved onto dynamic margining.
Risk exposure in the prime-services business was cut sharply, and the bank commissioned a review of the dual-reporting roles that had blurred the line between growing revenue and controlling risk.
None of it was enough.
Confidence moved faster than remediation
Archegos did not cause that ending on its own, and it would be dishonest to claim it did.
What it did was make visible a way of operating that the institution had not fixed.
Depositors and counterparties draw conclusions from that faster than any remediation programme can run.
The loss was never the point.
$5.5 billion was survivable for a bank that size.
What proved fatal was what the loss revealed: warnings could reach the right room and still produce nothing.
Confidence is not lost when an organisation has a problem. It is lost when people conclude the organisation cannot act on what it already knows.
Detection without authority is decoration
Every control is only as strong as the most inconvenient moment it will be enforced in.
Credit Suisse had limits. They were breached twenty-six times over and the limit did not bind.
A threshold nobody is willing to enforce when enforcing it costs revenue is not a threshold. It is a number in a report.
This is why buying better instrumentation so rarely fixes anything.
The information was never the constraint. The willingness to act on it was.
Every control is only as strong as the most inconvenient moment it will be enforced in.
Three questions for your own team
Test these against the actual decisions, actions and reporting lines in your organisation.
When did we last enforce a limit against our largest or most important customer? If never, is it a limit?
Look at our last governance meeting's actions. How many have a named owner and a date — and how many say “revisit”?
Do the people whose job is to say no report to the people whose job is to say yes?
Audit your verbs, not your dashboards.
Go through the last quarter of decisions your leadership team recorded.
Count how many contain a commitment someone could be held to.
“Noted”, “discussed”, “to be reviewed” and “monitor” are not decisions — and an organisation can run for years on them without anyone noticing.
How we know this, and what we don't
These studies are only worth reading if the evidence behind them is stated plainly, including where it is weak.
Credit Suisse gives us an unusually detailed account of how the risk was detected, escalated and handled. It does not answer every question about the wider institution.
An exceptional internal record
An external investigation was given access to internal documents and published in full by the bank's own board rather than reduced to a summary.
It quotes committee minutes, internal correspondence and specific dated exposure figures. That level of internal detail is almost never public.
It also reports findings that are deeply unflattering to the institution that commissioned it, which provides some evidence of independence.
The review had a defined audience and scope
The bank commissioned the investigation, set its scope and published it while facing litigation and regulatory scrutiny. Reports written in that position have an audience.
The investigation focused on the investment bank and prime services.
It did not resolve why an exposure of this size never reached group management or the board. That gap has been noted by others since.
Treat this as a well-lit example of a common mechanism.
Several other banks held similar positions with the same client and lost far less. That tells us the difference was institutional rather than inevitable.
But we only have this level of internal detail for one of them.
This is not proof of how every bank behaves.
Report of the Special Committee of the Board of Directors, Credit Suisse Group AG, prepared by external counsel and published July 2021.
Credit Suisse Group disclosures on remediation and clawbacks.
Contemporaneous reporting on the March 2021 Archegos default and the 2023 sale of Credit Suisse to UBS.
Subscribe to Notes from the Water
Our weekly newsletter brings readers the latest insights, studies, and observations relating to institutional judgement and the business design