Organization: A Latin American microfinance institution servicing economically deprived communities.

Key issues:
• Need to physically meet with clients/maintaining social distance
• Likelihood of widespread defaults by clients

---

2 July Update

Accurate COVID-19 case counts in Mexico remain elusive. As of 2 July 2020, the government reported about 232,000 cases in Mexico. But because there is no comprehensive testing program, “We assume a lot more are infected,” says the microfinance institution’s security director. The director notes that in parts of the country people think the pandemic is a hoax and haven’t adjusted their normal activities. Nor has the government enforced curfews or penalties—measures that helped countries like Italy and Spain control their outbreaks.

However, most COVID-19 cases are in Mexico City and other urban areas. Only this week did Mexico City switch from the red risk level (essential businesses only) to orange, meaning shops, restaurants, and hotels can open with reduced capacity.

Like in the country at large, the bank’s COVID-19 cases have spiked, from 11 to an estimated 200. About 40 of those have been confirmed through testing, while the other patients have consulted with doctors and are assumed to be infected. All the ill have been quarantined, hot spots sanitized and disinfected, and other staff monitored for symptoms. Only three sites out of 800 have had to be temporarily closed for cleaning, and all of them reopened within a few days.

More than 95 percent of staff in head offices are still working from home, which most will continue to do at least through December. Security has devoted special attention to home-office information security, given the profusion of malware, phishing, and ransomware attacks, associated with COVID-19, especially in Latin American countries outside of Mexico. Awareness programs include email reminders and webinars. “We haven’t had any home office issues,” the security director says.

All home offices connect to the corporate network through encrypted VPN. The bank also uses data loss prevention tools at endpoints, in the network, and in the cloud. About half of field staff now work exclusively at home. The rest must have in-person contact with clients at bank branches or service offices, though staff rigidly adhere to protocols on PPE, social distancing, sanitization, barrier use, and sound hygiene.

Before COVID-19 struck, field staff would meet with 2 million customers per week. Communicating via WhatsApp has eliminated a large percentage of these face-to-face encounters. App use will yield a benefit to the bank going forward. “All of their information is now in the app, so we have more data,” the security director says. “We can use it to make our business more efficient and more automated and generate savings in the future.”

Despite this shift to automation, there have been no staff or salary cuts, the security director reports.

Even when an effective treatment or vaccine becomes widely available, the institution will maintain a largely remote workforce. The bank will probably sublease properties or terminate real estate rental contracts, the security director says.

The resulting savings from using WhatsApp and reducing rental payments will help the bank maintain liquidity as borrowers’ default or seek better or more flexible terms. Customers hurt by the economic recession continue to struggle to make payments, even as the bank keeps adding incentives. It is now working on its fourth iteration of improved benefits. Each new version becomes more specific depending on the type of customer, with the bank able to adjust the loan period, interest rate, and amounts. “Each version takes into account customer surveys we do every week,” says the security director. “Are they reopening, what is their situation, what help do they need?” Borrowers who have made payments for six weeks in a row, for example, may see their interest rate decrease, their credit line increase, or repayment period increase.

In the previous update, the security director had predicted that 30 percent of the bank’s customers would default on their loans. But it is still too early to tell. Twenty percent were already behind on their repayment terms as of mid-June 2020, but that may simply mean they took advantage of relaxed terms even though they could afford to make their payments. “We’re not really able to know how severe the collection problem will be,” says the security director. “We still assume about 30 percent.”

Bank executives expect to survive through the pandemic because the institution has received multiple lines of credit. And it believes less stable microfinanciers will go belly up, creating more business opportunities.

---

17 May Update

Like many organizations, the microfinancing institution continues to be hampered by limited information and lack of testing. Businesses greet the COVID-19 numbers released by the Mexican government with skepticism. “The numbers we have are not real,” says the head of security. “Nobody knows which part of the curve we are on.”

Mexico uses a four-color system to indicate COVID-19 risk: Green (low), yellow (medium), orange (high), and red (severe). The government has unveiled a three-phase plan for reopening the economy. First, on 18 May 2020, the government loosened some restrictions in 269 municipalities across 15 states where COVID-19 is rare or seemingly nonexistent. Phase two, which runs from 18-31 May 2020, involves preparing for the 1 June 2020 removal of social distancing measures. This entails training employees in hygiene and sanitary practices. Third, as of June 2020, the government will use the color-coded national map to determine where and when restrictions will be further eased.

Paramount to the bank are business continuity and the health of staff and clientele. Most administrative staff continue to work from home, and have learned to do so efficiently, with only 2 to 4 percent (30 to 60 workers) coming to headquarters.

It is likely, according to the head of security, that many staff members will work at home indefinitely, even when the government gives the all clear.

Because the headquarters is in a severe risk zone, a transition to working at home full-time will save expenses in overhead, reengineering physical spaces, personnel protective equipment, thermal cameras, and cleaning services and supplies. The bank is deciding which positions are best suited to work at HQ.

About three-quarters of the bank’s 23,000-person staff are field agents, and the bank has been working to limit their exposure to clients. Before COVID-19, field agents had been expected to meet in person weekly with debtors over the course of a four-month loan period. By implementing WhatsApp in enterprise mode to substitute for check-ins, agents now must physically meet with clients on only three occasions during the life of the loan: disbursement of the loan in week 1, discussion of the disposition of the loan in week 15, and either renewal or payback of the loan in week 16.

The bank had considered the idea of technology replacing in-person meetings before the pandemic, but it took COVID-19 to make it happen, the security director says.

The pandemic economy continues to take a toll on the bank’s customers, and bank management believes it will get worse before it gets better. “The name of the game is just surviving,” says the security director, and maintaining liquidity is key to survival. Fortunately, the bank has negotiated favorable lines of credit with other financial institutions, so the security director predicts the bank will weather the downturn.

The bank has been struggling with defaults, expecting that 30 percent of its customers will not be able to repay their loans. The security director says it’s too early to tell how successful the easing of terms—including extending payback periods and reducing interest rates—will be, but the bank is poised to further assist debtors by offering special rates and further extending payback deadlines.

There has been some good news. The bank initially confirmed 20 cases of COVID-19, but that number has been reduced to 11, with only one fatality. Six of the 11 have recovered, and the other four are on the mend.

 

---

April 2020 Update

This financial institution focuses on underserved populations—individuals and businesses that would not be able to get loans or credit elsewhere. COVID-19 and the subsequent economic downturn has hit this bank’s clients the hardest. The bank was formed out of a spirit of building communities up from the bottom to help people escape poverty, so corporate social responsibility is part of its ethos.

Although confirmed cases of COVID-19 were thousands of miles away in early January 2020, the bank assembled a crisis committee with the head of security as the chair. The team began adapting their business continuity plan based on what they were seeing to determine how the bank could preserve both service and safety. Backup scenarios included finding alternate office sites and developing redundancy in staff skills and abilities to avoid a single point of failure if someone got sick. Through training, the bank ensured that at least four backup staff could perform a process that was vested in a single person. They also assessed that 80 percent of the 23,000 staff members could work at home or in an otherwise remote location. IT staff checked home Internet connections and signal strength. Through its regular contingency plan, the bank had tested and reinforced its VPN and put backup systems into place 18 months prior.

In February 2020, the crisis committee built out the plan as the pandemic began to seep beyond China’s borders. They quickly instituted guidelines for staff traveling to certain affected countries, such as Japan and South Korea. Staff members were required to present a compelling business purpose to travel, and travel guidelines and precautions were ramped up. Anyone traveling was required to spend at least 14 days at that destination.

The CEO offered his opinion on the contagion and its likely impacts, which informed the crisis teams’ work. In his view, everyone in the world would eventually get the disease: 80 percent would display minimal or moderate symptoms; 20 percent would need hospital care; and some of that 20 percent would require emergency or intensive care. While keeping that in mind, the crisis team felt no need to panic, and they focused on creating feelings of certainty and safety in their clients and staff.

COVID-19 took hold in the Americas in early March 2020, triggering daily meetings of the crisis committee. The team feared that simultaneous sickness of the population would overwhelm the healthcare infrastructure, as well as incapacitate the bank.

The bank did its part to “flatten the curve.”

Says the head of security, “the name of the game was to put people as far away as possible to avoid simultaneous contagious environments.” In the first week of March 2020, half of bank employees were re-stationed to home offices. A week later, 80 percent were working at home. As of mid-April 2020, only 40 staff members populated the headquarters facilities, which typically holds 1,500.

The bulk of the staff—17,000 out of 23,000—are agents, and their relationships with clients are critical. The bank’s clients are low income, and many receive short term loans or lines of credit. Agents typically meet with clients weekly to see how business is going and ensure that payments can be made.

As the security head explains, it is critical that agents meet face to face on two occasions per account: when credit is formally extended, and when the payments have been made and credit is renewed, usually several months later.

But the bank wanted to stay closer to its clients during the economic downturn, asking agents to meet with them weekly to make sure they were getting by. For these meetings, the bank set guidelines on how many people could be in the same area and proscribed minimum distances between people.

And clients have been hit hard. About 80 percent of the bank’s 3.4 million customers have lost at least half of their income. In many cases, clients lost all revenue. The bank has extended payback periods by several months and lowered interest rates, but it is likely that many borrowers won’t be able to meet their obligations. The bank is likely to extend the payback deadline and lower the interest rate if conditions do not improve.

Even borrowers who can meet their obligations—such as businesses that make masks—will benefit from the relaxation of terms. They are likely to see lower interest rates and higher credit limits.

If enough borrowers default, then the bank may need to seek funding of its own, even though it is currently highly solvent. “Our customers are not in great shape to repay, so we started negotiations for lines of credit a month ago (mid-March 2020),” says the security head. The bank hasn’t needed it yet, but it is prepared in case it needs a cash infusion.

So far, about 20 staff members have contracted the virus, six of them headquarters staff. All now work at home. However, the bank expects the numbers to multiply in the weeks ahead.

To help prevent the spread of COVID-19, offices are frequently sanitized and branches contain markings on the floor to maintain minimum distance between people. A corporate doctor determines who a sick employee has had contact with. The doctor works with HR to figure out who should be isolated and for how long. Because tests are scarce and costly, the bank plays it safe by assuming that symptoms of COVID-19 indicate presence of the disease, meaning that the ill worker is sent home and waits out the full recovery period whether they still feel sick or not.

As of mid-April 2020, the bank had no plans to lay off or furlough workers. In fact, it has a foundation that will help staff with expenses should they fall ill.

 

Michael Gips, JD, CPP, CSyP, CAE, is the principal of Global Insights in Professional Security, LLC, a firm that helps security providers and executives develop cutting-edge content, assert thought leadership, and heighten brand awareness. Gips was previously Chief Global Knowledge Officer at ASIS International, with responsibility for Editorial Services, Learning, Certification, Standards & Guidelines, and the CSO Center for Leadership & Development. Before that, as an editor for ASIS’s Security Management magazine, he wrote close to 1,000 articles and columns on virtually every topic in security. In his early career he was an attorney who worked on death-penalty cases.