Payment-Message Stripping: How Sanctions Screening Is Deliberately Defeated

Payment message stripping defeats sanctions screening by removing or changing the identifying information a bank needs to recognize a restricted transaction. The bank sending the payment can know who stands behind it while the U.S. bank clearing the dollars receives a message that conceals that connection. The sending bank keeps the business while depriving the clearing bank of the information it needs to stop the payment. If you work in payment operations or screening, the revealing comparison is between the message your institution received and the one it sent. The instruction explaining the difference can be more revealing still.

What Is Correspondent Banking in AML?

Correspondent banking lets a financial institution use another bank’s services to move money for its customers. In dollar clearing, the U.S. bank can process a foreign bank’s payments without the direct customer relationship that supports anti-money laundering screening.

HSBC’s admitted statement of facts, part of its 2012 criminal deferred prosecution agreement, explains that gap. The U.S. correspondent lacks the direct customer relationship and the customer due-diligence information that goes with it. The statement describes HSBC Bank USA maintaining correspondent accounts for foreign banks, including other HSBC institutions.

In HSBC’s admitted sanctions conduct, overseas affiliates deliberately kept that information from the U.S. banks. They changed what the receiving bank could see while continuing to use its access to the dollar system.

How Cover Payments Hid the Customer

A cover payment can send the customer details down one message path and move the funds down another. HSBC’s criminal statement of facts describes how the bank used that separation to conceal sanctioned parties from U.S. screening.

At the time, an MT 103 message identified the parties to the transaction and went from the originating bank to the beneficiary. An MT 202 message moved the funds through the United States. That second message typically omitted the originating party’s identity. The U.S. bank handling the money received less information than the recipient of the customer message.

HSBC admitted that its employees understood the consequence. The cover method hid the ordering customer and beneficiary and allowed straight-through processing of payments that would otherwise have stopped for review. Sending the fuller message through the U.S. bank risked delay, rejection or blocking.

That was a choice about what another bank would be allowed to know. The statement notes that later cover-message formats generally required originating-party information for customer payments. The historical failure still gives an insider a useful comparison: the customer information held upstream, the information actually transmitted and the information available to the screen.

How Standard Chartered Hid Iranian Connections

New York’s September 2012 consent order described Standard Chartered removing or omitting identifying information through cover payments and an internal practice called repair to conceal Iranian connections.

The consent described approximately 59,000 transactions totaling approximately $250 billion during January 2001 through 2007, with the Iranian connections hidden.

The bank’s April 2019 New York consent order expressly recorded its earlier admission of intentional stripping. A repair process can become the place where a bank knows the customer’s identity and chooses to send something less revealing onward.

For a payments insider, that makes the repair instruction part of the story. We examine the original message beside the transmitted version and the explanation for changing it. The transaction record shows what moved. The instruction can show why the identifying information did not move with it.

HSBC’s Sanctions Channel and the Repair Queue

HSBC admitted deliberate changes to payment messages in a sanctions channel separate from its failures to monitor suspicious activity. Its criminal statement of facts described affiliates following sanctioned entities’ instructions, removing identifying information and using cover payments to keep U.S. filters from stopping transactions.

The Justice Department’s account of the admissions distinguished HSBC Bank USA’s anti-money laundering and correspondent due-diligence failures from HSBC Group’s sanctions conduct. Inside the payment operation, the distinction was concrete: staff were changing the information sent to the bank expected to screen it.

Neutral Payment Messages and Internal Instructions

Bank sanctions screening can receive neutral payment messages because internal instructions have already removed the identifying details. At HSBC Europe, cautionary notes in incoming SWIFT messages sent payments into a repair queue. Employees manually removed references to sanctioned entities before forwarding the payments to U.S. institutions.

One of those instructions said exactly what the sender wanted hidden:

The warning identified the problem for the people preparing the payment. Their repair removed it from the message the U.S. bank received.

The statement also describes a return path. HSBC Europe referred flagged payments to sanctioned entities for clarification. Those entities then reformatted the payments so they could pass through U.S. clearing banks without being caught by the filters. The first message, the query and the returned message tell the story together. Looking only at the final payment loses the instruction that produced it.

The People Raising the Objection Were Inside the Bank

HSBC’s admitted facts show that its U.S. compliance staff repeatedly objected to the cover-payment method. They told senior group compliance officers that they could not properly screen the payments without the underlying information. The objections went unheeded.

The same statement describes group compliance directing HSBC Europe to stop amending messages, then granting an extension after HSBC Europe raised the business opportunities offered by the sanctioned entities. Further extensions allowed the practice to continue. HSBC Europe also resisted fuller payment messages because it feared blocked or rejected payments, higher costs and the loss of Iranian banking relationships.

The business reason and the compliance objection sat inside the same institution. That is why an approval, an exception request or a reply to a warning can add so much to the payment itself. It connects the missing information with a decision to keep the business moving.

What Proof Do You Need as a Whistleblower?

For payment-message stripping, useful bank evidence connects the originator fields, the transmitted message and the internal decision that changed what the sanctions screen received. Payment operators, screening engineers and compliance staff can hold different parts of that account. We work with you to connect the transaction to the people and systems responsible. Questions about confidentiality belong in that conversation with our whistleblower experts.

The original message can show which customer or bank identifiers were available at the start. The transmitted or repaired message shows what reached the next institution. An instruction, customer communication or approval can explain why a field disappeared or why a less informative message path was used. HSBC’s repair queue and cover-payment admissions show both forms of concealment.

The customer file supplies another comparison. Information about the real owner, the business and the source of funds can sit beside the payment message and the assurances given to the correspondent. We examine whether the message reflects what the institution already knew about the customer.

Screening output adds the next part of the sequence. HSBC’s admitted facts describe payments flagged for clarification and then reformatted to pass the filters. The alert and the returned message can connect a control’s objection with the change that overcame it. A final message that looks unremarkable can be the end of a much more revealing exchange.

For a screening engineer, the deployed scenario and its test results answer a different question: did the control run as its written design said it should? For an auditor or compliance officer, the warnings, exceptions and management responses can show who knew about the gap. These records let us examine what the institution saw, what it sent and what it chose to do next.

When the Monitoring System Does Not Match the Rulebook

Standard Chartered’s later monitoring findings concerned failures in the controls themselves. New York’s August 2014 consent order described implemented monitoring scenarios that did not match the rulebook, contained errors or were incomplete. The order also identified failures in testing.

The earlier stripping conduct changed the information reaching a control. The later findings concerned whether the monitoring actually performed the work described on paper. For an insider, the useful comparison shifts from the original and altered message to the written scenario, the deployed version and the test results. Both comparisons reach the same practical question: what did the bank’s control actually get to see and do?

The Justice Department’s April 2019 announcement describes a further set of admissions under Standard Chartered’s amended criminal deferred prosecution agreement. The bank admitted that former Dubai employees helped Iran-connected customers conduct dollar transactions, concealed their Iranian connections and helped disguise those connections to avoid suspicion.

The bank admitted processing approximately 9,500 dollar transactions through the United States for one customer’s companies between 2007 and 2011. More than half resulted from compliance deficiencies that allowed customers to request dollar transactions from sanctioned countries. The employees’ assistance and the system’s blind spot belong together in that account. They show why a review needs both the customer communications and the way the payment service actually operated.

Faster Payments Still Need the Missing Information

Payment speed puts more pressure on the exchange of information between banks. The Treasury’s Office of Foreign Assets Control, in its 2022 guidance for instant payment systems, encourages communication between participating institutions so they can resolve potential sanctions alerts. It also describes exception processing that takes a payment out of the automated flow long enough to investigate a concern.

The connection with the older cases is direct. An inquiry helps when the response supplies the information the reviewing bank needs. In HSBC’s admitted conduct, the return path instead produced a reformatted payment that avoided the filters. The exchange between banks can expose the customer or help conceal it.

Anti-Money Laundering: Opportunities for Improvement, published by the Wharton Initiative on Financial Policy and Regulation in 2024, finds substantial overlap between anti-money laundering and sanctions compliance infrastructure. It also describes extensive law-enforcement use of Bank Secrecy Act data while questioning the system’s overall effectiveness:

Valuable infrastructure can still depend on information that someone upstream chooses to remove. For us, the original message and the instruction changing it are a way to examine that failure at the transaction level.

Whistleblower Rewards for Sanctions Information

The Financial Crimes Enforcement Network’s whistleblower program covers specified Bank Secrecy Act and sanctions violations. In qualifying cases, eligible whistleblowers can receive a combined 10% to 30% of qualifying government collections.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Which program fits the information you hold is a question we answer with you.

When You Know Why the Message Changed

If you know who ordered a payment message changed or why a screening objection disappeared, speak with our whistleblower experts about the decision behind that payment. We build the case with you around the messages, the money and the people who controlled what the bank could see. We stay with you through the case and bring in sanctions whistleblower lawyers who understand dollar clearing and the decisions behind altered messages.