SOFIA, July 4 One worker at Bulgaria's Corporate Commercial Bank knew panic was setting in when she spotted colleagues among the anxious depositors lined up to withdraw cash from the troubled bank.
The alarm came in part because the week before, on June 13, with television news crews filming, Bulgarian state prosecutors had raided a building in Sofia that housed Corpbank offices.
Though both the prosecutors and the bank said the raid did not target Corpbank - the building housed other companies as well - customers soon began to withdraw their savings. Within days, the Central Bank had seized control of the bank, the fourth-biggest lender in Bulgaria, and suspended its operations for three months.
The dramatic raid and bank run were reminders that despite progress from the worst days of the euro crisis, parts of Europe's financial system are still far from secure. The run quickly spread to another bank and saw Sofia announce a protective $2.3 billion credit line. It also stoked uncomfortable memories of a 1996-97 crisis in Bulgaria, when 14 banks collapsed, and followed much more recent bank meltdowns in Ireland, Greece, and Cyprus.
Corpbank had been adjudged safe and secure. At the end of the 2013 financial year, its books were audited by KMPG, who found less than one percent of its loans were non-performing, against an average of 17 percent for Bulgarian banks. KPMG declined to comment.
And just days before the run on Corpbank, the International Monetary Fund had praised the country's financial sector as "stable and liquid". A senior IMF official has since said the problems at the two Bulgarian banks did not reflect any underlying problems in the system, which remains well capitalised and liquid.
The country's central bank initially blamed the bank run on media reports about Corpbank's main owner and leaked news that a central bank deputy governor was under investigation. Central Bank Governor Ivan Iskrov called the leak a deliberate "attack" on the bank.
Others suggested alternative reasons. Behind closed doors some government officials blamed the run on a clash between Corpbank's main owner Tsvetan Vassilev and his political rivals, without saying who they were. Prime Minister Plamen Oresharski publicly blamed a "corporate clash" for the run on Corpbank, without going into specifics.
When the run spread to First Investment Bank, a bigger lender, the government pointed the finger at unnamed people for launching what they called a criminal attack on the country's financial system. Perpetrators were using phone text messages and the internet to spread malicious rumours about Bulgarian banks, the central bank, finance ministry and interior ministry all said.
Much is still unclear. Who was behind the internet rumours and text messages? Why did the government not investigate sooner? How exactly was the feud connected to the run on Corpbank?
"The security authorities, the Interior Ministry, are investigating. They have some suspicions and there are some people who have been accused (of the attack on the banks)," finance minister Petar Chobanov told Reuters. "What is true is that there is an investigation into malpractice at Corpbank. But what is the real situation? We are waiting to see what the external auditors will say."
In the days before the Corpbank run, newspaper stories alleged misconduct by Vassilev, and his businesses. Some papers alleged Corpbank had made improper loans to certain companies linked to Vassilev, though he told Reuters those claims were lies.
"The run on the bank was obviously a perfectly organized plot against me and Corpbank," he wrote in an email to Reuters.
As rumours swirled, depositors started withdrawing what they could. "For five days we managed to withstand the withdrawals that were like an avalanche," said the worker at Corpbank who had seen her colleagues withdrawing money.
On June 17, the central bank issued a statement saying all Bulgarian banks, including Corpbank, had high liquidity, were adequately capitalised and were functioning normally.
The next day, an anonymous letter was leaked to the media by someone purporting to be a central bank employee. The letter alleged that Tsvetan Gounev, a central bank deputy governor in charge of banking supervision, was under investigation by state prosecutors for abuse of office. The letter, parts of which were published on news websites and broadcast on national radio, alleged that the probe into Gounev was linked to dealings with an un-named bank that had been the subject of media attention. Local media speculated the bank in question was Corpbank.
Both the central bank and Gounev's lawyer told Reuters that Gounev would not comment on the investigation into him.
Within hours of the anonymous letter, the central bank confirmed that prosecutors were investigating Gounev, but did not go into specifics. They said Gounev had taken a voluntary leave of absence. The chief prosecutor told reporters on June 18 that there was a pre-trial investigation into Gounev for not fulfilling his duties as a banking supervisor. Central Bank Governor Iskrov said the leaked letter was unlikely to have come from a central bank employee.
State prosecutors said the raid had been prompted by a tip-off by Protest Network, a Bulgarian anti-corruption activist group, and connected the raid with their investigation into the deputy governor.
Moustachioed mogul Vassilev, Corpbank's main owner, is one of the country's most prominent businessmen. Last year his donations to a monastery prompted the institution to add his portrait to a mural of religious figures. Shared on Facebook, the pictures drew scorn from some Bulgarians, who complained that a wealthy businessman should not be paid such reverence. The painting was later removed.
Vassilev owns just over 50 percent of Corpbank. The other main shareholders are Oman's sovereign wealth fund, which has around 30 percent, and Russian bank VTB, with just under 10 percent. The bank sponsors a Bulgarian soccer club, basketball team and several sports federations. Vassilev also owns more than 40 percent in Vivacom, Bulgaria's biggest telecoms operator by revenue.
Corpbank has had close ties to the state. In 2010 as much as 48 percent of the deposits of major state-owned companies were held at the bank, finance ministry data show. A change to the regulations by a caretaker government which ran the country just before the Socialists took power in May 2013, had pushed this down sharply, Deputy Prime Minister Daniela Bobeva said.
Bulgaria's banks have had more than a decade of strong growth. Banking assets increased more than six-fold between 2001 and 2014, to 43.8 billion euros. But ratings agency Standard & Poors says the country's banking sector is one of the weakest in Europe, and blames a rapid increase in borrowing for its fragile position.
In the weeks before the bank run, Vassilev had been feuding publicly with a rival mogul, 33-year-old Delyan Peevski, a member of MRF, an ethnic Turkish political party. MRF has been part of most Bulgarian governments since 1989, most recently forming a coalition government with the Socialist party. Peevski himself was appointed to a top government security job in June last year, an appointment that sparked months of street protests. He stepped down but the protests continued.
Peevski and Vassilev were once allies. In a February 2011 newspaper interview, Vassilev called Peevski his "son". Vassilev told Reuters the two later fell out. Vassilev and Peevski have both alleged that each has plotted to have the other killed. Both have denied those allegations.
Questions to Peevski via a party spokesman were not answered.
Vassilev, who has stayed abroad since the bank run because he says his life is under threat, says he has no doubt what happened to his bank.
"I would give you details about what seems like a story-board of a Hollywood movie: How to ruin a bank! How to commit calumny! Subtitle: Threaten people by telling them your money is not safe and the majority shareholder is a 'murderer,'" Vassilev wrote in an email to Reuters. He did not name anyone behind the alleged plot.
"While there is a rift between Peevski and me, I believe that some media have over-concentrated their attention on it to deviate attention from what is truly happening in Bulgaria," Vassilev said.
Peevski, he said, was "a tool in a larger scenario" to destroy Corpbank and undermine Bulgaria's financial stability. "Arguably, this is in the interest of people with large debts who want to melt them away and the political circles that support them."
The precise nature of the feud is unclear, and both have given different reasons for it. Vassilev in an interview with a TV channel, parts of which were published on Corpbank's website one day before the central bank took control, said the "first sparks" began last year. Vassilev said he had refused to become part of such "malicious practices" as paying bribes to win public contracts.
Peevski has repeatedly denied allegations of wrongdoing. "The convenient excuse - Peevski - is used to disguise and crush problems and questions to which Mr. Vassilev himself needs to respond," Peevski said in an interview to Bulgarian news website pik.bg on June 18.
"For 13 years I have not heard any real charge against me backed by facts, evidence ... So I am being slandered, 13 years without facts and evidence by people with their own business and political interests."
As the problems at Corpbank gathered pace, regional branch managers phoned Sofia headquarters worried about large withdrawals, according to the bank employee. Depositors, some of them in tears, were desperate to take out their savings, as were some state companies.
By June 20, more than a fifth of the bank's assets had been withdrawn. That's when the central bank acted, temporarily nationalising Corpbank.
In the days after the rescue, Bulgarian officials went on a scheduled visit to London as part of a European road show to drum up investment in a 1.5 billion euro bond. One or two investors at the meeting in the heart of London's financial district, asked about the run on Corpbank.
Officials characterized the run as a political event outside their control, according to a source who was present.
In January, Standard & Poor's had flagged potential supervisory problems in Bulgaria, warning that "the regulator has a limited record of successfully dealing with past crises." In its last report on Bulgaria, the IMF said Bulgaria needed "to reduce corruption and cronyism," and act "to reinforce the rule of law." (With additional reporting by Angel Krasimirov in Sofia, and Laura Noonan and Sujata Rao in London; Edited by Simon Robinson)