HSBC: The Affiliate Was Trusted, the Money Went Unchecked

HSBC agreed to pay $665 million in civil penalties over anti-money laundering failures that left affiliate wires and cash purchases unchecked. Its U.S. bank rated Mexico “standard” risk, the lowest of its four ratings, and gave compliance too few people and too little authority to investigate the business.

Under its December 2012 deferred prosecution agreement, HSBC Bank USA and HSBC Holdings accepted responsibility for criminal conduct involving anti-money laundering controls and sanctions. The details show how a bank can leave whole categories of business outside scrutiny before an investigator ever sees an alert.

What Failed Inside HSBC’s Anti-Money Laundering Program?

In its 2012 deferred prosecution agreement, HSBC admitted that staffing decisions and affiliate monitoring exclusions left its AML program unable to scrutinize the business. The agreement’s factual account describes a staffing freeze in 2007 intended to cut costs and improve return on equity.

The Financial Crimes Enforcement Network’s civil assessment found heavy reliance on manual transaction reviews, thousands of backlogged alerts and alerts cleared without adequate investigation. Compliance staff frequently could not complete investigations or file timely, complete suspicious activity reports. Management also failed to give compliance sufficient authority over the business and account relationships it was supposed to scrutinize.

Independent testing failed too. The audit program’s scope did not adequately assess the bank’s exposure or identify its failures in time. The bank lacked the people to investigate the activity, and its checks on that process failed to force a correction.

The 2024 Wharton Initiative on Financial Policy and Regulation paper Anti-Money Laundering: Opportunities for Improvement identifies a broader conflict: compliance officials may see themselves as helping law enforcement while others inside their firms see their work as an expense to minimize. HSBC froze hiring to improve returns while its compliance staff could not keep up:

The bank wanted the business without paying for the scrutiny that business required.

HSBC’s Affiliates Reached the U.S. Bank Unexamined

At HSBC, correspondent banking gave foreign affiliates and their customers access to the U.S. financial system through accounts at the U.S. bank.

The Financial Crimes Enforcement Network found that HSBC Bank USA had exempted its group affiliates from customer due diligence. It did not collect or maintain the information needed to understand their business purposes, expected activity, local supervision or compliance histories. Transactions flowed through without those facts informing the monitoring.

An affiliate’s familiar name tells the U.S. bank who owns it. It does not tell the bank whose money the affiliate is moving. Customers of foreign HSBC affiliates gained indirect access to the U.S. system while the U.S. bank lacked the information needed to assess them.

In its deferred prosecution agreement, HSBC Group admitted that it knew about significant compliance deficiencies at HSBC Mexico and their effect on potential illicit flows through the U.S. bank. It did not tell HSBC Bank USA.

A related access problem appeared at Danske Bank. In its guilty plea, Danske admitted misleading U.S. correspondent banks about its Estonian branch’s customers and controls to preserve dollar access. Its executive board had canceled a centralized technology migration because of the cost. In both cases, the bank providing access needed information that the institution upstream failed to give it.

The Cash Came Back Through the Banking System

HSBC’s banknote business bought and sold physical cash, arranging shipments from foreign financial institutions to the U.S. bank and ultimately to the Federal Reserve Bank. FinCEN described the laundering risk plainly: traffickers smuggled U.S. cash into Mexico, deposited it in Mexican financial institutions and sent it back through the banking system.

Under its deferred prosecution agreement, HSBC admitted that its U.S. bank failed to monitor over $670 billion in wire transfers from HSBC Mexico while rating Mexico “standard” risk, the lowest of its four ratings, from at least 2006 through 2009. It also failed to monitor over $9.4 billion in purchases of physical U.S. dollars from that affiliate.

The Justice Department’s account of the criminal case states that at least $881 million in drug trafficking proceeds passed through HSBC Bank USA, including proceeds from the Sinaloa and Norte del Valle cartels.

The agreement’s factual attachment also describes the Black Market Peso Exchange. Colombian businesses supplied pesos to brokers, who arranged for cartel dollars to buy legitimate foreign goods. The goods were sold in Colombia, the cartels received pesos and the brokers kept fees. Ordinary merchandise could complete the conversion of drug-sale dollars into money the cartel could use at home.

A payments or trade employee may know who bought the goods and whose account supplied the dollars. That commercial knowledge can help explain the movement of the money.

HSBC’s Red Flags Went Without Adequate Review

At HSBC, red flags included bulk cash from a high-risk market, unusual traveler’s-check patterns and alerts that disappeared after a risk-rating change. The Financial Crimes Enforcement Network’s findings show both suspicious customer activity and decisions inside the bank that kept it from receiving adequate review.

In 2008, the bank summarily cleared more than 4,000 unaddressed alerts after lowering a country’s risk rating. Later reviews of backlogged or cleared alerts produced hundreds of suspicious activity reports filed more than a year after the transactions. Changing the rating had cleared the queue without resolving the underlying activity.

The traveler’s-check business supplied another concrete example. FinCEN described more than $290 million in sequentially numbered checks purchased at a Russian bank, signed with a uniform illegible scrawl and made payable to customers of a Japanese bank. That Japanese correspondent sent batches to HSBC Bank USA by pouch. FinCEN found that HSBC knew or should have known the pattern was a money laundering red flag.

Those details give an investigator something to work with: the sequence of the checks, the signatures, the customer relationships and the decision about which activity would be reviewed.

HSBC Removed Sanctions Details From Payment Messages

HSBC’s deferred prosecution agreement describes sanctions evasion through removed names, omitted country information and payment messages that concealed the underlying transaction. This was a separate control failure from leaving affiliate cash and wires outside AML monitoring.

The Justice Department’s account of the criminal case says HSBC Group allowed approximately $660 million in prohibited transactions to pass through U.S. financial institutions. The affected transactions involved customers in Iran, Cuba, Sudan, Libya and Burma, countries subject to sanctions at the time.

In its deferred prosecution agreement, HSBC Group admitted that it followed instructions to omit sanctioned entities’ names from dollar payment messages. The Justice Department’s criminal-case account quotes instructions including “do not mention our name in NY” and “do not mention Iran.” HSBC also removed country identifiers and deliberately used less-transparent cover payments. A screening system looking for a prohibited party cannot act on a name that has been removed before the message arrives.

The warning came from inside the bank. From 2001 through 2006, HSBC Bank USA repeatedly told senior group compliance officers that cover payments prevented proper screening. The Justice Department’s criminal-case account says those protests were ignored. Group compliance instructions to end the practice gave way to exceptions that allowed it to continue for another three years.

Here, the evidence includes both the payment message and the decision to let the altered message through.

The Civil Penalties and HSBC’s Admissions

The civil anti-money laundering penalties announced with the agreement comprised $500 million for the Office of the Comptroller of the Currency and $165 million for the Federal Reserve. The Comptroller’s penalty also satisfied the Financial Crimes Enforcement Network’s assessment.

HSBC’s deferred prosecution agreement supplied admissions about how the business operated. The Financial Crimes Enforcement Network separately determined that the U.S. bank willfully failed to maintain an effective anti-money laundering program, conduct appropriate foreign-correspondent due diligence and detect and adequately report suspicious activity. The staffing, risk-rating and affiliate failures were central to those findings.

What the HSBC Money Laundering Whistleblower Contributed

A business employee’s information helped investigators pursue questions at HSBC. In written responses to the Senate Judiciary Committee, the U.S. Attorney confirmed that investigators considered information from a former HSBC business employee and made further requests to the bank prompted by it.

That employee, a business relationship manager, alleged in his lawsuit that he could not identify the corporations behind an account assigned to him at HSBC or determine where its money came from and went. The district court’s account of his amended complaint describes his repeated internal reports and further account reviews.

He alleged that a Social Security number associated with the account linked it to 5,449 other accounts, some of which he considered clearly fraudulent. He said he reported the findings to his superiors and received no action.

The investigative detail worth carrying forward is the connection across accounts. A relationship manager trying to understand a customer described finding an identifier reused far beyond that relationship. His account shows why someone outside the compliance department may hold information that explains what a transaction-monitoring system misses.

The Evidence Behind HSBC’s Control Failures

Our whistleblower experts assess how your knowledge connects the transactions to the decisions that let them through. At HSBC, the evidence reached beyond individual payments to the staffing, risk ratings and warnings management chose to act on or ignore.

A monitoring engineer may understand an exclusion rule. An investigator may know why an alert was closed. An operations employee may see the payment information before and after it changed. A relationship manager may know why the customer’s activity cannot be reconciled with the business on file. HSBC’s case shows how those different views can illuminate the same institutional failure.

Whistleblower Rewards for Reporting Conduct Like HSBC’s

FinCEN’s whistleblower program covers Bank Secrecy Act and specified sanctions violations. Qualifying whistleblowers can share 10% to 30% of eligible government collections. A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. These are separate whistleblower laws. We assess which fits the conduct you know and bring in the right expertise for that case.

You Know Why the Activity Went Unchecked

If you saw an affiliate exempted, a warning ignored or payment details removed, speak with our whistleblower experts about what happened inside the bank. We connect your knowledge of the business to the decisions that enabled the conduct, bring in money laundering whistleblower lawyers who understand bank controls and sanctions, and stay beside you throughout the case.