At a glance
The article examines how approval failures, maker-checker controls, SWIFT records and contractual terms determine risk in Malaysia’s US$16 million SBLC case.
The most revealing question arising from the US$16 million Standby Letter of Credit (SBLC) case in Malaysia may ultimately have little to do with the two former investment-bank employees now facing criminal charges and considerably more to do with the financial instrument at the centre of the prosecution, the approvals said to have preceded its issuance, the internal controls through which it was processed and the actual financial exposure, if any, that resulted.
That distinction matters because trade-finance instruments do not exist merely as entries in a computer system or as allegations in a criminal charge. They are contractual and documentary instruments that create obligations between institutions and counterparties, and when something goes wrong, the question of who carries the risk can depend upon the precise terms of the instrument, the authority under which it was issued and the conduct of everyone who handled it.
That broader question has acquired an unusually relevant international comparator this week with the publication of the judgment involving Euro Exim Bank and 18 letters of credit (LC) issued for United Overseas Trading. Global Trade Review reported on 2 October that the Eastern Caribbean Supreme Court had upheld Euro Exim Bank's position in a dispute involving a "pay when paid" clause under which the bank's obligation to honour the letters of credit was made conditional upon receiving payment from its client. The beneficiary, Weifang JS Trading, claimed approximately US$3.42 million after nine LCs were paid in full, two were partially paid and seven remained unpaid, while Euro Exim argued that the contractual provision was a strict term of the instruments and that the beneficiary had the opportunity to object to it before proceeding with the underlying transactions. The judgment is being appealed, with a hearing expected in February 2027, so it should be treated as a first-instance ruling under challenge rather than a settled statement of international LC law.
The significance of the Euro Exim litigation for the Malaysian case is therefore not that the two disputes are legally identical. They are not. The Euro Exim litigation concerns contractual interpretation and allocation of risk under letters of credit, while the Malaysian prosecution concerns an allegation that two former employees represented that a US$16 million standby letter of credit had received approval from the relevant authority or the bank's CEO when, according to the prosecution, such approval had never been given. Chia Kian Lim and Lai Heow Gran have pleaded not guilty, and the prosecution alleges that they used their respective maker and checker roles in the SWIFT system to induce the bank to proceed with the transaction and issue the instrument on 9 November 2023.
What the Euro Exim judgment provides is a useful way of asking a question that the Malaysian reporting has so far left largely untouched: What exactly did the instrument say, who had authority to issue it, who was entitled to rely upon it, what conditions governed the bank's obligations and what documentary trail demonstrates that those conditions were satisfied?
In the Euro Exim dispute, the court placed considerable weight on the actual contractual terms of the LCs and on the conduct of the parties after those terms were issued, including the fact that the beneficiary had an opportunity to examine the instruments and raise objections. The court also considered the parties' course of dealings, including the fact that payments on successful transactions were made directly to the beneficiary by the applicant rather than through the issuing bank.
The Malaysian case raises a different but equally important documentary question because the alleged defect appears to concern authority before the instrument came into existence. If the prosecution's account is correct, the issue was not simply whether an SBLC contained an unusual contractual clause or whether a beneficiary accepted a particular allocation of risk. It was whether the institution had actually authorised the issuance of the instrument at all. That makes the alleged CEO approval particularly important, because the existence, absence or circumvention of such approval could potentially determine whether the transaction was an authorised act of the institution, an unauthorised act by employees, or an institutional control failure that permitted an unauthorised transaction to acquire the appearance of legitimacy.
That is where the familiar language of "maker" and "checker" requires closer examination. A maker-checker structure is intended to separate the person initiating a transaction from the person validating it, reducing the possibility that one individual can originate and complete a material transaction without independent scrutiny. If two people operating within that structure allegedly relied upon a non-existent approval, the investigation should establish what each system actually required, what each person entered or verified, whether the approval was documented outside SWIFT, whether the checker was required to independently confirm the approval and whether the system itself contained a hard control preventing the transaction from proceeding without the necessary authority. The existence of a maker-checker arrangement therefore cannot, by itself, answer whether the bank's controls worked; the relevant question is what those controls actually did when confronted with the transaction in question.
This is also why SWIFT should not become a convenient shorthand for authorisation. A SWIFT message can transmit financial instructions and information, but the existence of a message does not by itself establish that the underlying commercial authority was valid. The investigative trail must therefore run backwards from the message to the approval, from the approval to the authorised decision-maker, from the decision-maker to the underlying transaction and from the transaction to the economic exposure assumed by the institution. If the alleged CEO approval existed only as an oral representation, that raises one set of questions; if a written approval existed, another; if a document was altered, misrepresented or bypassed, another; and if the institution's own systems permitted the transaction without independent evidence of approval, the institutional question becomes more difficult to dismiss as merely an employee-level matter.
The US$16 million figure itself also requires considerably more precision than the headline suggests. The charge establishes an allegation concerning an SBLC amounting to US$16 million, but the face value of an instrument is not automatically the same thing as a bank's realised cash loss. The critical documentary sequence is therefore US$16 million instrument value, actual exposure, whether the SBLC was ever drawn, whether a demand was made, whether the bank paid anything, whether any amount was recovered, whether the instrument expired or was cancelled, whether a provision was created and whether any insurance, collateral or contractual recovery mechanism was available. Until those questions are answered, describing the matter simply as a US$16 million loss risks collapsing several materially different financial concepts into one number.
The Euro Exim dispute demonstrates why that distinction matters. GTR's account separates the total value of the 18 LCs from the amounts actually paid, partially paid and left unpaid, with the beneficiary's claimed loss being approximately US$3.42 million rather than the aggregate face value of all the instruments. The judgment also examined the way documents were released, the contractual payment provision and the parties' conduct over a series of transactions. The lesson for the Malaysian investigation is not that the same legal reasoning will apply, but that the face of a trade-finance instrument cannot substitute for examination of what actually happened to the money, documents and obligations created by it.
That makes the underlying SBLC itself one of the most important missing documents in the public account. Who was the applicant, who was the beneficiary, what was the purpose of the instrument, what governing rules applied, what was the expiry date, what conditions governed any demand, what security or consideration did the bank receive and what internal credit or risk limits applied? If the instrument was subject to a recognised documentary-credit framework, that too matters because the contractual architecture may determine rights and obligations independently of the alleged internal fraud. If the instrument was bespoke, the drafting becomes even more important.
The identity of the institution also remains a separate question from the identity of the accused. The criminal report published by Free Malaysia Today does not name the investment bank. It identifies Chia and Lai as former employees and describes their alleged roles as checker and maker, but the institution itself remains outside the published charge narrative. Public records do, however, place Lai Heow Gran in a senior role at Asia Pacific Investment Bank (APIB), including as a Director in material published by Labuan IBFC.
There is nevertheless another chronology that cannot simply be ignored. The public record indicates that APIB's Labuan banking licence was revoked on 29 September 2026, while the Malaysian criminal charges became public on 30 September, one day later. That sequence is significant enough to warrant examination, particularly because the institution's regulatory history and the criminal proceedings concern financial activity in the same broad period, but the chronology by itself does not establish that the two events were coordinated, that one caused the other or that either was designed to influence the public narrative. The responsible investigative question is therefore not whether the one-day gap proves a connection, but whether the underlying regulatory and criminal records reveal one.
That question becomes more significant when the earlier history of the institution is placed alongside the SBLC allegations. If an institution was facing regulatory concerns while an alleged trade-finance transaction was being investigated, the chronology of internal discovery, regulatory notification, employee departure, forensic review and eventual prosecution becomes material. If the two matters were entirely unrelated, that should be capable of documentary demonstration. If they intersected, the nature and timing of that intersection would itself become relevant.
The distinction between individual criminal liability and institutional responsibility is particularly important here because a bank can simultaneously be the alleged victim of employee misconduct and the institution responsible for the systems through which the transaction passed. Those propositions are not mutually exclusive. An employee may deliberately deceive an employer while an institution may still be expected to demonstrate that its approval, compliance, credit, operational and reconciliation controls were reasonably designed and effectively implemented. Conversely, the existence of a control failure does not automatically establish criminal or civil liability on the part of the institution. Each layer requires its own evidence.
That is why the emerging public narrative should not stop with the proposition that two employees allegedly deceived a bank. The more consequential question is whether the documentary record shows an isolated act that successfully bypassed otherwise functioning controls, or whether the transaction exposed weaknesses in the architecture through which a US$16 million instrument could be represented as properly authorised. The answer may lie in documents that are currently outside the public domain: The approval matrix, internal emails, credit committee records, SWIFT logs, transaction instructions, compliance reviews, board or management records, internal investigation reports, correspondence with regulators and records showing when the alleged irregularity was first detected.
The same documentary discipline should be applied to the question of publicity. The fact that the criminal reports identify the employees while leaving the institution unnamed is observable. It does not establish who supplied information to journalists, whether the bank was approached for comment, whether prosecutors or investigators had restricted the release of the institution's identity, whether the bank itself sought confidentiality or whether the omission simply reflected the information available to the media at the time.
That does not make the question irrelevant. It makes it more important to ask properly. Who knew about the alleged irregularity and when, when were the employees suspended or removed, when was the transaction internally classified as problematic, when was any regulator notified, when did the criminal investigation begin, and when did the institution first quantify its potential exposure? A chronology answering those questions could show whether the criminal prosecution was the culmination of a conventional internal investigation or whether the case developed alongside a larger regulatory or institutional crisis.
There is also a further issue that the Euro Exim case brings into sharper focus: Sophisticated counterparties and banks are expected to understand the instruments they create and accept rather than rely entirely upon assumptions about how conventional trade finance normally operates. In Euro Exim, the court's first-instance reasoning placed importance on the beneficiary's opportunity to examine the unusual contractual language before proceeding, while the bank's position rested heavily on the express terms of the instruments. In the Malaysian case, the corresponding question is whether the institution's internal architecture contained sufficient documentary certainty around the authority to issue the SBLC, rather than whether outsiders should have understood an unusual clause.
The distinction may ultimately determine where the institutional responsibility lies. If the bank can demonstrate that its approval framework clearly required a specific authorisation, that authorisation was absent, the employees circumvented the controls through deliberate misrepresentation and the transaction was subsequently detected through functioning monitoring systems, the institutional narrative would look materially different from one in which the controls themselves permitted unsupported representations of senior approval to become operational instructions. Neither proposition should be assumed before the evidence is produced.
The real story therefore lies in reconstructing the complete life of the US$16 million SBLC rather than allowing the criminal charge to become the beginning and end of the story. The investigation should establish the underlying commercial transaction, the parties, the instrument, its governing terms, the approval process, the maker-checker trail, the SWIFT messages, the point at which the transaction became irrevocable or operational, the point at which the alleged irregularity was discovered, the amount actually exposed, the amount actually paid, the amount recovered and the manner in which the institution accounted for the exposure.
Only after that reconstruction can the wider question of responsibility be properly addressed. The two accused will have their criminal allegations tested in court, and their pleas of not guilty must remain central to any fair account of the proceedings. The institution, if identified by authoritative records as the bank concerned, may have its own explanation concerning the transaction, its controls, its losses and its regulatory dealings, and that explanation should be examined against the documentary record rather than presumed to be either exculpatory or culpable.
What makes the September 2026 sequence particularly worth investigating is that several strands now sit alongside one another: An alleged US$16 million SBLC transaction dating from November 2023, a criminal prosecution announced on 30 September 2026, the documented professional association of one accused with APIB, and a reported APIB licence revocation dated 29 September 2026. None of those strands, standing alone, proves an institutional theory. Taken together, however, they create a documentary trail that deserves to be followed rather than compressed into the convenient proposition that two former employees allegedly committed fraud and the matter therefore ends with them.
The Euro Exim litigation provides the wider warning. A financial instrument can carry a risk allocation that is radically different from what a reader might assume from its label, and a court can ultimately focus on the precise terms, documents and conduct surrounding the transaction rather than the conventional expectations attached to the instrument. The Malaysian SBLC case presents the inverse problem: Before anyone can determine where the risk ultimately fell, the public needs to know what the instrument actually required, what approval was actually obtained, what the bank actually did, what the employees allegedly represented, and whether US$16 million ever became an actual loss.
That is where the investigation now needs to go. The central issue is not simply whether two employees should answer for an alleged deception, because that is a matter for the criminal process. The larger institutional question is whether the documentary chain from approval to SWIFT message to SBLC to financial exposure supports an explanation of isolated employee misconduct, reveals a failure of internal controls, establishes a contractual allocation of risk, or produces some combination of all three. Until that chain is reconstructed, the headline tells us who has been charged, but it does not yet tell us who ultimately carried the risk created by the US$16 million instrument.