Credit Suisse: Teaching Clients to Beat Sanctions Filters

Under its 2009 sanctions deferred prosecution agreement, Credit Suisse admitted payment stripping that concealed Iranian customers from U.S. banks and training those customers to disguise their own payments. It promised those customers that an employee would hand-check every message so it would get past U.S. sanctions filters. A payments employee would recognize the machinery: customer instructions, internal warnings, manual reviews and screenshots showing staff what to enter. Credit Suisse deceived U.S. banks into moving money for customers those banks could not identify.

The Justice Department announced the deferred prosecution agreement on December 16, 2009. The Swiss bank admitted the facts behind a federal criminal charge of evading the Iran sanctions.

The admitted factual statement describes prohibited transactions for Iran, Sudan, Burma, Cuba and Libya with a total value exceeding $1.6 billion. Payment processing took place in Switzerland, while the asset-management transactions described in the case ran through London.

What Is Correspondent Banking in AML?

Correspondent banking lets a financial institution use another bank to receive deposits, make payments or process transactions. In Credit Suisse’s case, U.S. correspondent banks supplied dollar clearing. The information those banks received determined whether their sanctions filters could identify the customer behind a payment.

The factual statement attached to the criminal agreement explains the split in the payment messages used at the time. An MT 103 carried customer-payment details. With a cover payment, that message went directly between the originating and receiving sides, while an MT 202 moved the funds through the U.S. bank without those details. The bank handling the dollars could be missing the identity of the customer whose payment it was completing. The factual statement says Credit Suisse used cover payments about 95% of the time for outgoing customer payments involving Iran, compared with approximately 60% for non-sanctioned countries and entities.

Credit Suisse admitted using cover payments to conceal Iranian connections. When it sent payments through the United States by the alternative serial method, employees removed Iranian names, addresses and telephone numbers. They substituted “Order of a Customer” or Credit Suisse’s own name. Internal instructions also kept Iranian references out of SWIFT fields 70 and 72, and the bank agreed, at its Iranian customers’ request, to remove bank identification codes. The payment still traveled through the American bank. The identifying information did not.

Client Instructions Became Bank Procedure

Credit Suisse’s admitted client coaching made sanctions evasion part of its payment service. The factual statement describes guidelines sent to Iranian customers, promises of manual checking and materials those customers could use to train other banks. One instruction captures what the service was meant to accomplish:

The instructions also ran inward. According to the same admitted factual statement, a team leader in Bank Payments circulated screenshots showing how staff should replace the Iranian ordering institution in SWIFT field 52 with “one of our clients.” Other instructions told employees to leave misleading entries naming Credit Suisse as the ordering bank unchanged. The bank had the customer’s identity and taught employees how to keep it out of the message the U.S. bank received.

The Iran Desk put warnings on customer files directing staff to omit the Iranian bank’s name. If a payment needed further clarification, the payment-processing investigations unit contacted the originating Iranian bank about how to amend it. Employees also removed identifying information on their own initiative. Manual review had become a way to keep identifying information out of sanctions screening.

The business grew. The factual statement says that after Lloyds TSB stopped clearing dollars for its Iranian bank clients, those customers moved their clearing business to Credit Suisse. Iranian dollar payments increased from approximately 49,000 in 2002 to nearly 200,000 in 2005. Credit Suisse did no due diligence to determine why nearly every Iranian bank customer of Lloyds had left.

A New Rule Changed the Disguise

The admitted factual statement shows Credit Suisse changing its method when Swiss rules required payment orders to identify the remitter. In June 2004, the bank prohibited generic customer wording in international wire transfers. Nearly all of the affected payment messages then went through the cover-payment method.

Credit Suisse sent Iranian customers new cover-payment instructions to keep the clearing business going. The change removed a conspicuous phrase from the payment message while preserving the separation between the customer information and the dollars traveling through the United States. A policy revision could look like progress while the bank continued hiding the same customers.

That is why the instructions and the resulting payment traffic belong together. The factual statement describes a system default that omitted the ordering institution, customer-file warnings and subsequent long-term instructions directing staff to use cover payments. The internal account of how a payment should be processed explains the missing information in the outgoing message.

What Are Examples of Sanctions Evasion?

Credit Suisse’s admitted conduct included stripping payment identifiers, coaching customers to conceal Iranian connections and using code names for sanctioned securities clients. The securities business shows the same concealment reaching another desk.

In the admitted factual statement, Credit Suisse Asset Management in the United Kingdom managed portfolios for a Sudan-based development bank and a Libyan state-owned investment company. Special procedures restricted knowledge of the clients’ identities. Staff used code names and maintained subaccounts under those names within an omnibus account at Credit Suisse USA. Trades in U.S. securities went through Credit Suisse’s New York operation and other American brokerages.

The pattern also appears at Standard Chartered. Its New York banking regulator’s consent order describes the removal or omission of Iranian identifiers through cover payments and an internal repair practice. Across these cases, the useful comparison is what the sending institution knew about the customer against what it allowed the receiving institution to see.

What the Sanctions Deferred Prosecution Agreement Required

Credit Suisse’s federal deferred prosecution agreement addressed the payment machinery as well as the bank’s acceptance of responsibility. It required a written policy for the MT 202COV bank-to-bank message and a bank-wide system requiring that format for all cover payments.

The agreement required sanctions training for dollar-payment and securities staff, their supervisors and all U.S. employees. It also required the bank to preserve its SWIFT payment messages and internal dollar-payment documents, keeping the transactions and the instructions behind them available for examination.

The Justice Department also announced a separate agreement resolving civil claims by the Treasury’s Office of Foreign Assets Control arising from the conduct.

What the Payment Records Can Show

The Credit Suisse admissions connect the incoming message, the outgoing message and the employee instructions between them. Screenshots, customer correspondence and internal payment procedures showed how identities disappeared. For an insider, knowing why a field was changed can explain a transaction that looks unremarkable at the receiving bank.

The Wharton Initiative on Financial Policy and Regulation’s 2024 paper Anti-Money Laundering: Opportunities for Improvement describes the overlap between the systems institutions use for anti-money laundering and sanctions compliance. It also explains the Bank Secrecy Act‘s foundation in keeping records available to investigators. Credit Suisse’s factual statement makes the consequence of manipulating that shared information concrete: the bank admitted causing false entries in U.S. institutions’ records and preventing required Bank Secrecy Act and sanctions reports.

Operations staff may know how a message was altered. A systems employee may understand the default that suppressed a field. A relationship manager may know what the customer was promised. We connect those accounts to the transactions and the decisions behind them.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. For sanctions violations, the Financial Crimes Enforcement Network’s anti-money laundering whistleblower program can pay rewards. Our whistleblower experts work out the strongest route with you for the conduct you know.

You Know Why the Name Disappeared

If you saw payment messages changed to hide a customer or instructions written to defeat sanctions screening, speak to our whistleblower experts about what happened inside the bank. We build the case around the transactions and decisions you understand, bring in sanctions whistleblower lawyers with experience in bank payment systems, and stand with you throughout the case.