Ruth Porat didn’t see it coming.

The Morgan Stanley banker who thought she understood the risks to the financial system in September 2008 was advising the U.S. Treasury Department on its rescue of Fannie Mae and Freddie Mac when she got a message: Would she come back to Washington to deal with the collapse of American International Group Inc.?

“The call I got was ‘We worked on the wrong thing,’” Porat, 55, said in an interview last month at the New York headquarters of the bank where she’s now chief financial officer. That AIG “could vanish that quickly and the impact that could have throughout the country, and that nobody could see it coming, was just staggering.”

Porat’s own bank almost vanished when hedge funds, spooked by difficulties getting money out of bankrupt Lehman Brothers Holdings Inc., pulled more than $128 billion in two weeks from Morgan Stanley. To stay afloat it sold a 20 percent stake, became a bank holding company and borrowed $107.3 billion from the Federal Reserve on a single day.

Five years after Lehman Brothers sank on Sept. 15, 2008, triggering the worst financial crisis since the Great Depression, Morgan Stanley is safe enough to survive a shock that devastating, Porat said. She and Chief Executive Officer James Gorman, with prodding from regulators, led a drive to cut risk and boost capital to soften the next blow.

Not Enough

While the amount of capital at the six largest U.S. lenders has almost doubled since 2008, policy makers and some Wall Street veterans say that’s not enough. They see a system still too leveraged, complicated and interconnected to withstand a panic, and regulators ill-equipped to head one off -- the same conditions that led to the last crisis.

“We’re safer, but we’re not safe enough,” said Stefan Walter, who led global efforts to revise capital rules as general secretary of the Basel Committee on Banking Supervision.

More than 50 bankers, regulators, economists and lawmakers interviewed by Bloomberg News disagreed about what needs to be done. Some said the six biggest U.S. banks have only gotten bigger since 2007 -- a 28 percent increase in combined assets, according to data compiled by Bloomberg -- making it harder to let them fail. Others said they weren’t troubled by bigness or a system that requires government intervention every now and then, calling it an inevitable cost of financing global business.

Banks “are too big, and I think they’re going to have to be too big,” said David Komansky, CEO of Merrill Lynch & Co. from 1996 to 2002. Komansky, now a director at BlackRock Inc., the world’s largest asset manager, said he doesn’t have “the horrible distaste for government intervention.”

Catastrophic Consequences

Congressional inquiries and more than 300 books about the crisis have identified many villains: homeowners borrowing beyond their means, banks selling subprime mortgages, government-supported agencies backing the loans, Wall Street packaging them for investors, ratings firms giving seals of approval, regulators offering little objection and politicians encouraging it all to happen.

Three fundamental flaws stand out. Regulators stripped of power allowed banks to embrace too much risk and load up on toxic debt with short-term funds. Insufficient capital left them little margin for error when those assets plunged in value. A system too large, opaque and interconnected meant they couldn’t fail without catastrophic consequences for the economy.

Morgan Stanley’s Gorman, 55, summed it up in a speech in Florida in 2010, soon after taking over as CEO.

“What caused the financial crisis?” the CEO asked. “Illiquid assets, funded short-term, held by overleveraged institutions that were inadequately capitalized.”

Byzantine Banks

Regulators have since pushed banks to cut the amount of borrowed funds they use, what’s known as leverage, hold more easy-to-sell assets and rely less on overnight loans. The 2010 Dodd-Frank Act established a protocol that would, in theory, enable authorities to seize even the largest lenders and dismantle them without bringing down the entire system. An interagency group has been empowered to make sure banking supervisors work together to monitor systemic risk.

That may be insufficient. The largest banks remain Byzantine, with hundreds of subsidiaries around the world, which could thwart efforts to unwind them. Six U.S. regulators with overlapping authority often clash and are besieged by an army of highly paid lobbyists. Leverage is still too high, some regulators and economists say.

The biggest risks could lie in the unknown: Five years after AIG was brought down by billions of dollars of credit- default swaps, there’s little transparency about banks’ trading and derivatives businesses or their counterparties.

‘Way Short’

“The basic model hasn’t changed much, and it’s still fragile,” said Anil Kashyap, an economics professor at the University of Chicago Booth School of Business. “The banks need much more capital and liquidity. They’re still way short of being safe.”

One reason is the intensity of Wall Street’s pushback. Bank executives, lobbyists and lawyers logged more than 700 meetings with regulators on a section of Dodd-Frank that seeks to curb banks’ trading for their own account, according to data compiled by Kimberly Krawiec, a Duke University law professor. An October 2011 proposal for implementing the rule, named after former Fed Chairman Paul A. Volcker, generated more than 18,000 letters, many from banks complaining it was too complex and could hurt economic growth.

Unfinished Volcker

Regulators still haven’t finished the Volcker rule. The Securities and Exchange Commission has to conduct a cost-benefit analysis, which could lead to further delays. The current proposal has so many exemptions that even Volcker has said he isn’t sure it will do what he wanted.

“It’s just the complexity and difficulty of the rule that has made it so hard to complete,” Mary Schapiro, chairman of the SEC from 2009 until last year, said in an interview. “A lot of agencies with different viewpoints have been involved.”

The Volcker rule isn’t the only one held up. As of Sept. 3, more than three years after Dodd-Frank was enacted, just 40 percent of 398 rulemaking requirements were completed, according to law firm Davis Polk & Wardwell LLC, which monitors progress.

Lack of coordination among regulators and their poor supervision of derivatives, money-market funds and bank capital helped tear the system apart in 2008, according to the Financial Crisis Inquiry Commission. Regulatory authority was stripped away or blocked, the congressionally appointed panel wrote, with much of what remained undermined by infighting, loopholes and influence that the financial industry bought with $2.7 billion of lobbying and $1 billion of campaign contributions in the decade before the crash.

Softened Rules

Since the crisis, regulators more than doubled the highest quality capital the biggest banks are required to hold and subjected them to stress tests.

Even so, Wall Street has found ways to soften or delay the impact. It found allies among European policy makers, who sought to curtail the reach of proposed derivatives rules, and asset- management firms that opposed changes to the money-market funds that banks rely on for short-term funding.

Schapiro spent two years working on a plan to prevent a repeat of what happened in 2008, when the money-market industry ground to a halt. Holdings of Lehman debt caused the $62.5 billion Reserve Primary fund to “break the buck,” its share price dropping under $1, which triggered a wider run.

Purple Ads

The plan, requiring the funds to hold extra capital or abandon their fixed $1 share price, sparked a fierce reaction. The U.S. Chamber of Commerce blanketed the subway station near the agency’s Washington headquarters with orange and purple ads warning against the change. Schapiro canceled a vote after a commissioner who met 11 times with fund companies and their supporters told her that he changed his mind.

The latest compromise, offered by Schapiro successor Mary Jo White, doesn’t eliminate all $1 share prices. That leaves the funds vulnerable, the University of Chicago’s Kashyap said.

Banks also stymied government efforts to rein in the largely unregulated $633 trillion derivatives business. They carved out exemptions to Dodd-Frank rules that transactions go through central clearinghouses, which would force even the biggest dealers to post collateral. The exemptions, including one for currency swaps, could cover as much as 80 percent of the market, according to data compiled by Bloomberg.

Getting Gensler

A lobbying campaign by banks and foreign governments headed off an attempt by Commodity Futures Trading Commission Chairman Gary Gensler to extend the agency’s reach to derivatives deals overseas. Before it collapsed in 2008, leading to a $182 billion U.S. government bailout, AIG ran its credit-default swaps business out of London, helping banks move risk off their books. Under pressure from Treasury Secretary Jacob Lew, Gensler agreed in July to accept European Union jurisdiction.

“At a point where politically you would think that the big banks are at their weakest, still they have had an enormous amount of influence,” said David Skeel, a University of Pennsylvania law professor. “There was no serious effort to neutralize the big banks. They were seen much more as partners than as problems.”

Wall Street firms also resisted limits on how much business they can do with one another. The Fed, seeking to reduce the chance that one failing company would topple others, proposed in December 2011 to cap how much counterparty credit risk a bank could have with any systemically important trading partner at 10 percent of regulatory capital.

Goldman’s Warning

JPMorgan Chase & Co., Citigroup Inc. and Morgan Stanley were among lenders arguing that the limit was poorly constructed, overstated risk and would restrain the economy. It could cut U.S. economic growth and destroy 300,000 jobs, Goldman Sachs Group Inc. warned last year.

“The fact that they find counterparty exposure limits so onerous shows you how interconnected they are,” said Anat Admati, a Stanford University finance professor and member of the Federal Deposit Insurance Corp.’s Systemic Resolution Advisory Committee.

Bankers and their lobbyists have made similar arguments attacking higher capital requirements and restrictions on trading. They say too much regulation harms average Americans along with Wall Street.

“You obviously don’t want crises, but if you stifle innovation, you might not expand the pie,” said John Neary, who ran U.S. equities trading at Morgan Stanley and left the bank this year. “It’s bad for U.S. growth any time you have highly complex regulation for an uncertain payoff.”

Losing Leverage

For all their groaning, banks have taken steps to improve their defenses. Morgan Stanley, whose assets at the end of 2007 were 38 times its equity, is an example. It sold a preferred stake to a Japanese bank after Lehman’s bankruptcy, raised $6.9 billion in 2009 and curtailed dividends and share buybacks. Leverage fell to 14 times equity as of June.

Morgan Stanley, the sixth-largest U.S. bank, has doubled equity and customer deposits to cut reliance on short-term borrowing, which accounted for more than half of its funding in 2008, leaving it helpless when markets froze. Gorman reshaped the company’s business model, buying Smith Barney from Citigroup to build the world’s largest wealth-management firm.

The bank also rewrote contracts with hedge funds to clarify how much cash they can pull out quickly. The goal is to buy the bank more time to react if markets plunge. Morgan Stanley now has enough cash and easy-to-sell assets to survive a year of dysfunctional markets, according to Porat.

“The most important thing is addressing and eradicating the notion of a weekend event,” Porat said, referring to the short time regulators and other banks had to react to Lehman.

New Crisis

The CFO said those efforts paid off in September 2011, as concerns mounted that the European sovereign-debt crisis was spreading and that Morgan Stanley was overexposed. The price of swaps protecting against the bank’s default tripled, surpassing those of Italian lenders, and its shares fell almost 50 percent.

Even so, Morgan Stanley’s internal risk updates showed its liquidity barely budged, Porat said. The bank wasn’t forced to sell assets, and clients pulled out less than 10 percent of what the firm had prepared for in the first month of a crisis.

It wasn’t a true test of Morgan Stanley’s ability to survive a meltdown. The scare was defused in December 2011, when the European Central Bank said it would pump as much liquidity as needed into the region’s lenders.

Zero Chance

The steps banks have taken make another crisis on the scale of 2008 almost impossible, according to Morgan Stanley’s CEO.

“The probability of it happening again in our lifetime is as close to zero as I could imagine,” Gorman said in an interview last week on PBS’s “Charlie Rose” show. “The way these firms are managed, the amount of capital that they have, the amount of liquidity that they have, the changes in their business mix -- it’s dramatic.”

Morgan Stanley still has the highest leverage of any of its peers under a proposed Fed rule that would require banks to have at least $5 of equity for every $100 of assets. The firm now has $4.20 according to that measure, which calculates leverage differently than the banks. That means a 4.2 percent net drop in asset values could wipe it out. Porat said the company will reach the proposed minimum within two years.

Morgan Stanley also increased its derivatives holdings in the past four years. The notional value of those deals, most of which aren’t recorded on its balance sheet because they’re netted out under accounting rules, surged 20 percent to $46.9 trillion as of the end of March, according to the Office of the Comptroller of the Currency.

Hiding Risk

Those transactions, along with repurchase agreements that also supposedly offset one another, are part of a shadow-banking system that has more than doubled since 2002, according to the Financial Stability Board. While notional values exaggerate the extent of the risk, netting underestimates it and provides hidden leverage to banks, said Gary Gorton, a finance professor at Yale University.

“You can’t really see how big the banks are or what risks they’re taking by looking at their balance sheets,” Gorton said. “We don’t really know where the risk is.”

The ability of banks to hide risk, years after Lehman’s fall, was demonstrated by JPMorgan’s $6.2 billion loss in 2012 on wrong-way derivatives bets by a trader known as the London Whale because his positions were so vast. The trades, which had a notional value of about $150 billion, appeared much smaller on the balance sheet of the largest U.S. bank.

Modern Life

Whether JPMorgan’s $2.4 trillion in assets poses a risk to the system or is a buffer against failure is a matter of dispute. Daniel Neidich, a former co-head of merchant banking at Goldman Sachs, said big banks are a condition of modern life.

“It’s just a reality of the world we live in, and how global and how interrelated it is,” said Neidich, CEO of New York-based Dune Real Estate Partners LP. “The benefits that all of that interconnectedness has created are tremendous.”

Regulators and policy makers say they aren’t so sure. When credit markets froze after Lehman filed for bankruptcy, the U.S. rescued other large financial institutions through capital injections and loans. The rebound in bank profits and executive payouts as U.S. unemployment remained stuck above 8 percent for 43 months created a public backlash against taxpayer-financed bailouts. Preventing more of them has been a top goal of U.S. and international regulators.

Dodd-Frank requires the largest firms to submit guides to their intricate corporate structures along with blueprints for orderly wind-downs. The FDIC, which has taken over and liquidated hundreds of small banks, was given the job of coming up with a strategy for the biggest.

Multiple Implosions

That’s a difficult task when an institution as vast as JPMorgan has 3,391 legal entities in more than 100 countries. The FDIC’s plan involves seizing a bank’s umbrella holding company, converting its debt to equity and providing bridge loans to ensure operating companies can continue functioning.

The strategy could fail if some of the world’s largest banks implode simultaneously. Regulators aren’t sure their plan to keep banks’ derivatives-trading partners and lenders from pulling out collateral in a run will work, according to three people with knowledge of the discussions.

The plan “might work for a very idiosyncratic event, but probably not during a systemic crisis,” said Rodrigo Quintanilla, an analyst at ratings firm Standard & Poor’s.

While Treasury Secretary Lew said in July that “as a matter of law” banks are no longer too big to fail, he acknowledged the issue hasn’t been resolved.

‘Straight Face’

“If we get to the end of this year and we cannot with an honest, straight face say that we have ended too big to fail, we’re going to have to look at other options,” he said at an investor conference in New York in July.

For now, the risk of contagion persists.

Because Goldman Sachs, Morgan Stanley and other major banks aren’t required to post collateral for all derivatives trades, almost 20 percent of over-the-counter deals involving large firms lack margin agreements, according to the International Swaps & Derivatives Association. That means if a trading partner closes positions because it’s concerned a bank isn’t viable, the bank has to come up with cash or securities. That drained liquidity at Lehman in 2008 and could do the same today to the largest lenders, which are also the biggest derivatives dealers.

Dodd-Frank sought to reduce that risk by requiring central clearing of derivatives trades and forcing parties to post collateral. That could increase the concentration of risk even further, according to Walter, the former Basel administrator.

Derivatives Meltdown

“The frequency of meltdown is less,” said Walter, who’s now a principal at Ernst & Young LLP in New York. “But should a problem occur, the systemic impact could be much greater.”

Regulators also haven’t done much to rein in repurchase agreements, or repos, a form of lending in which the borrower sells a security and pledges to buy it back later. They aren’t even sure how large the market is. A 2010 paper by Gorton estimated $10 trillion. The Federal Reserve Bank of New York pegged it at about half that in a report last year.

Because repo collateral is often resold or re-pledged, it can be difficult for borrowers to retrieve. That led to widespread uncertainty in 2008 and could drive hedge funds and other investors to pull assets from banks in another crisis.

“The bonds they financed most likely won’t be at the place they actually repoed them to, they’ll be two or three or four places down the line,” said Larry Tabb, CEO of New York-based research firm Tabb Group LLC. “So getting those bonds back will be a challenge.”

JPMorgan, Goldman Sachs and Morgan Stanley had sold or re- pledged $1.5 trillion of collateral as of June 30, the highest amount since 2008.

Obama’s Order

Realizing that Dodd-Frank and new international capital rules haven’t made the system safe enough or kept banks from being too big to fail, U.S. regulators including Fed Governor Daniel Tarullo and FDIC Vice Chairman Thomas Hoenig have pushed for tougher standards. In July, they proposed a cap on leverage tighter than the one adopted by the Basel committee. They’re also working to increase capital surcharges for banks relying on short-term funding.

Last month, President Barack Obama, who made Dodd-Frank a centerpiece of his first term, told Lew, Fed Chairman Ben S. Bernanke and other regulators it was time to get around to fully implementing the law, according to a White House statement.

If the president needed prodding, the Fed announced hours before the meeting that each of the nation’s 18 largest banks still falls short in risk management.

For John Reed, a former Citigroup co-CEO who helped engineer the merger that created the third-largest U.S. bank, Wall Street hasn’t changed as dramatically as it should have. He said he worries that a recovering economy, record stock prices and hefty bank profits might lull people into complacency.

“There are some banks that would believe the longer the delay the better,” Reed said. “The world looks pretty benign right now. But it always does until it isn’t.”