By Justin Baer

Industrial & Commercial Bank of China, the world's largest bank, paid $1 for its place on Wall Street. It got more than it bargained for.

The Chinese lender acquired a small New York broker-dealer in 2010, a move that extended its presence into the U.S. securities industry. It is now dealing with the fallout from a cyberattack this month that crippled that business and briefly triggered widespread concerns about the fragility of the largest cash market in the world.

The episode also delivered a grim reminder that hacks and other operational failures can wreak havoc on companies, drain profits and bruise reputations, particularly for financial firms that live or die based on their ability to keep customers' confidence. The cyberattack could weigh on ICBC's U.S. broker long after its systems have recovered, Wall Street executives said, if their clients continue to trade elsewhere.

The broker-dealer was once part of Fortis, the European banking and insurance conglomerate broken apart by regulators during the 2008-2009 financial crisis.

At the time, BNP Paribas struck a deal with the Belgian government to snap up some of the company's operations. As part of that, the French bank inherited its U.S. broker-dealer, then called Fortis Securities.

BNP already had its own U.S. securities arm, so it flipped Fortis Securities to ICBC in October 2010. The purchase price: $1, The Wall Street Journal reported at the time. By transferring the unit to ICBC, BNP sidestepped severance payments and other costs, the Journal reported.

Executives at the Chinese bank saw something intriguing in the discount deal: a beachhead into the lucrative business of underwriting securities in the world's largest capital markets. It hasn't worked out quite that way.

The unit's total assets were $24.5 billion in June 2023, down from $36.5 billion in December 2012, according to ICBC's midyear report and a filing.

"I don't think it's considered a major player by most in the U.S. capital markets," said Kevin McPartland, head of research for market structure and technology at Coalition Greenwich. "We have rankings of the top 20, and they're not showing up in anything."

Foreign banks such as UBS, Barclays and Deutsche Bank have succeeded in building full-service brokerages and investment banks in New York, often through multibillion-dollar acquisitions of U.S. firms.

But few entrants managed to keep pace with the biggest U.S. players on their own turf. And even the most successful have pared back their ambitions amid market downturns.

While ICBC never built a full-service investment bank capable of challenging domestic megabanks such as JPMorgan Chase, it did maintain a steady business in the government-bond market. The ICBC unit, now called ICBC Financial Services, clears Treasury bond trades and repurchase agreements, where Treasurys are used as collateral.

Meantime, the largest U.S. banks have tightened their grip, especially in that market. The top 12 dealers in U.S. Treasurys accounted for 71% of the industry's revenue in 2022, according to Coalition Greenwich.

"One of the hardest things for a foreign bank to do is succeed in domestic banking," said Ernie Patrikis, a former partner at White & Case who later worked as general counsel for ICBC's U.S. operations.

After it was hacked, ICBC FS was forced to unplug from the Treasury market and begin to clear trades manually. On a call Tuesday with industry executives, an ICBC FS official said the business had manually cleared nearly 90% of the trades in its backlog, and encouraged clients to contact the firm directly, according to a person who had dialed into the call.

Two weeks after the attack, the securities arm was still waiting for the all-clear from its cybersecurity consultants to reconnect to the market and Bank of New York Mellon's automated settlement platform, which sits in the middle of the transactions.

ICBC FS executives had held a series of conference calls with other market participants to update the market on its progress, trading executives said. Meantime, customers have moved their business elsewhere.

In a statement posted on its website, the company said that it "has been conducting a thorough investigation and is progressing its recovery efforts." The broker also said it reported the incident, which didn't affect other ICBC operations, to law-enforcement officials. As of Friday the statement remained the first thing that greeted visitors to ICBC FS's website.

Write to Justin Baer at justin.baer@wsj.com

(END) Dow Jones Newswires

November 25, 2023 23:00 ET (04:00 GMT)

Copyright (c) 2023 Dow Jones & Company, Inc.