HSBC will pay a £63.9m fine after UK regulators found that it had allowed customers to make transactions worth millions or even billions of pounds without being checked for money laundering – including on one occasion leaving out the whole of Wales from monitoring.
The Financial Conduct Authority (FCA), the UK’s banking regulator, issued the punishment on Friday after finding “serious weaknesses” across HSBC’s automated systems used to monitor hundreds of millions of transactions a month to identify possible criminal activity.
It highlighted three key failings that were found over the eight years from March 2010 to March 2018. This included failures to consider what checks it was using to identify money laundering and terrorist financing covered relevant risks, as well as “poor” risk assessment when they were updated after 2016.
It is the latest in a series of problems for the bank related to money laundering. HSBC has previously been forced to pay £1.2bn in the US for failing to track drug-related money laundering in Mexico, and the FCA also found related failings in its investigations.
Banks use automated systems to save money on checking the millions of transactions that go through their systems. However, the FCA found that HSBC’s systems were letting through tens of thousands of payments that should have been looked at more closely. For example, in 2011, HSBC realised that the system had automatically rejected every report of suspicious activity from customers in the entire Welsh nation – meaning 1,780 red flags had been missed.
The regulator detailed several examples where HSBC failed to detect criminal activity. For example, over a period of 14 years up to 2016 the bank failed to monitor customer accounts for suspicious activity such as transactions from high-risk countries, repeated transactions of rounded figures, or unusual spikes in payments.
In one instance, a customer set up an account, declaring an annual income of £81,851. Just over a week later, the customer received five identical payments of nearly £10,000 on a single day – but HSBC failed to spot the irregularity.
The customer was arrested for cigarette smuggling four months later. Yet even after they were convicted and imprisoned in 2012, HSBC failed to detect a series of unusually large transactions. The bank filed a suspicious activity report – a regulatory requirement – more than four years after the customer was convicted.
In another instance, HSBC failed to raise an alert after a customer with an annual income of £40,000 received £120,000 across eight payments in a single day. The customer was later jailed for VAT fraud for setting up fake construction companies.
The bank did not dispute the findings and agreed to settle at the earliest opportunity, resulting in a reduction in the fine from £91m.
Mark Steward, the executive director of enforcement and market oversight at the FCA, said: “HSBC’s transaction monitoring systems were not effective for a prolonged period despite the issue being highlighted on numerous occasions.
“These failings are unacceptable and exposed the bank and community to avoidable risks, especially as the remediation took such a long time.
“HSBC continued their remediation to address these weaknesses after the relevant period.”
An HSBC spokesperson said: “We are pleased to resolve this matter, which relates to HSBC’s legacy anti-money laundering systems and controls in the UK.
“As is well known, in 2012 HSBC initiated a large-scale remediation of its financial crime control capabilities. More recently, as the FCA recognised, HSBC has made significant investments in new and market-leading technologies that go beyond the traditional approach to transaction monitoring.”
