A decade and a half after HSBC’s financial links with the Vatican Bank first drew public attention, the central question remains unresolved: how did a world-spanning financial institution maintain accounts for an organization that had been mired in controversy for decades? The Vatican Bank, formally called the Institute for the Works of Religion (IOR), is headquartered within Vatican City and overseen by a Board of Superintendence.
By 2012, the IOR had been entangled in so many scandals that change had become unavoidable. That year, the IOR held its first public briefing on its operations. In 2013, it introduced a website and issued its inaugural annual report.
These steps came late and were largely defensive. HSBC had provided correspondent banking services to the IOR, meaning the Vatican Bank could route money through HSBC’s network.
This created a tangible risk: illicit funds could flow from the IOR into the broader global financial system, effectively laundered through a legitimate channel. HSBC’s anti-money-laundering and know-your-customer procedures suddenly fell under intense scrutiny. The implications were far from theoretical.
Correspondent banking serves as the infrastructure of international finance. One bank holds accounts for another bank in a different country, enabling the second institution to execute transactions it otherwise could not.
When that infrastructure carries dirty money, the impact reaches real people: drug traffickers launder their proceeds, tax evaders conceal assets, and sanctioned parties bypass restrictions. HSBC’s connection to the IOR created an opening, and the question was who used it. Regulators responded with attention.
HSBC came under significant pressure to overhaul its correspondent banking relationships. The bank committed to remediation, promising enhanced compliance reviews and the closure of legacy correspondent accounts.
These were not trivial pledges. Shutting down a correspondent account terminates a banking relationship entirely and halts a stream of transactions—a blunt but decisive measure. Available records do not specify the exact penalties HSBC faced, nor do they detail the terms of any deferred-prosecution agreement or monitorship. Nonetheless, the regulatory pressure was unmistakable.
HSBC argued that its actions would prevent future problems and insisted its correspondent banking relationships would meet compliance standards. Now, thirteen years later, the episode stands as a case study in how slowly reform unfolds.
The Vatican Bank did not publish an annual report until 2013, years after its first scandal. HSBC did not close problematic accounts until regulators compelled action. The bank’s compliance reviews were reactive rather than proactive.
The risk inherent in correspondent banking is structural: a single account can link a scandal-ridden institution to the entire global system. The IOR was not a minor or obscure entity.
It was the bank of the Holy See, based inside Vatican City, governed by a Board of Superintendence, and troubled for years. HSBC knew this and kept the accounts open anyway. The takeaway is not straightforward.
Banks argue they must serve all legitimate customers. Regulators insist compliance must take priority.
In the gap between these positions, accounts remain open, money continues to move, and scandals persist. Then, years later, someone asks what went wrong. That is where matters stand today.
