In 2011, HSBC discovered that its monitoring software had been throwing away every suspicious-activity report involving customers in Wales. That meant 1,780 red flags missed. It is one of the details in the £63.9m penalty the UK’s Financial Conduct Authority handed the bank on Friday, December 17, 2021.
The exact figure is £63,946,800. Without a discount it would have been £91,352,600. HSBC did not dispute the findings and settled at the earliest opportunity, which earned it a 30% reduction.
What went wrong
Think of transaction monitoring as a smoke alarm network. Banks use automated systems to scan hundreds of millions of payments a month and ring a bell when something looks like money laundering or terrorist financing. The FCA found that three key parts of HSBC’s alarm system were weak for eight years, from 31 March 2010 to 31 March 2018.
First, the bank did not check whether its detection scenarios covered the relevant risks until 2014, and it was slow to assess new scenarios after 2016. Second, it did not properly test and update the settings that decide whether a payment looks suspicious. Third, it never confirmed that the data feeding the systems was accurate and complete. The Guardian reported that tens of thousands of payments that deserved a closer look slipped through.
Two cases from the regulator’s notice show the practical result. One customer opened an account declaring an annual income of £81,851 and, just over a week later, received five identical payments of nearly £10,000 in a single day. Nobody at the bank flagged it. The customer was arrested for cigarette smuggling four months later, and even after imprisonment in 2012 the bank missed a run of unusually large transactions. It filed a suspicious activity report more than four years after the conviction. In another case, a customer declaring £40,000 a year received £120,000 across eight payments in one day. That person was later jailed for VAT fraud involving fake construction companies.
The regulator’s verdict
“HSBC’s transaction monitoring systems were not effective for a prolonged period despite the issue being highlighted on numerous occasions,” said Mark Steward, the FCA’s executive director of enforcement and market oversight. “These failings are unacceptable and exposed the bank and community to avoidable risks, especially as the remediation took such a long time.”
HSBC called the matter one about its “legacy anti-money laundering systems and controls in the UK” and said it was pleased to resolve it. It also said it had invested heavily in newer technology that goes beyond the traditional approach to monitoring. The FCA noted that the bank had run a large remediation programme, which it supervised.
Not the first time
The word “again” in the headline has a history behind it. In 2012, HSBC paid $1.9bn after a US Department of Justice investigation into laundering by Mexican drug cartels, and agreed to be monitored by US regulators for five years. The FCA stressed that its fine had nothing to do with that case, according to the BBC.
Days earlier, NatWest had been fined £265m after admitting it failed to prevent the laundering of nearly £400m by one firm.
Sources
- HSBC fined £64m for anti-money laundering failings (BBC News)
- FCA fines HSBC Bank plc £63.9 million for deficient transaction monitoring controls (Financial Conduct Authority)
- HSBC fined £64m for failures in anti-laundering processes (The Guardian)
