.svg)
The UK Financial Conduct Authority (FCA) has fined HSBC Bank £63,946,800 after finding failures in the bank’s automated processes that monitored hundreds of millions of transactions on a monthly basis.
According to the FCA, HSBC’s transaction monitoring systems were not risk-sensitive enough, and the bank failed to ensure the policies that managed and monitored those systems were followed. This exposed the bank’s transactions to money laundering risks for eight years between March 2010 and March 2018.
“HSBC’s transaction monitoring systems were not effective for a prolonged period despite the issue being highlighted on numerous occasions,” Mark Steward, executive director of enforcement and market oversight at the FCA, said.
As one of the largest financial institutions in the world, HSBC had 13.6m active customers in 2018 and its flawed transaction monitoring systems monitored around 284.8m transactions each month throughout the eight years.
With hundreds of millions of transactions that needed to be monitored every month, HSBC used automated transaction monitoring systems as an anti-money laundering (AML) control.
Now the FCA has found that three key elements of HSBC’s automated transaction monitoring systems had deficiencies, in breach of the UK’s Money Laundering Regulations 2007.
The first failure was related to weakness in how HSBC considered scenarios that covered risk indicators of money laundering or terrorist financing. According to the FCA, the bank’s monitoring coverage for risk indicators was inadequate and, after 2016, design issues with two of the scenarios caused a large number of overdue alerts, which delayed the identification of potentially suspicious activity.
The bank also did not have appropriate test and update mechanisms in place within those systems that should have determined whether a transaction was indicative of potentially suspicious activity. For example, certain test and update thresholds were set in such a way that it was almost impossible for the relevant scenarios to identify potentially suspicious activity.
Lastly, HSBC did not check whether the data used in its monitoring systems were accurate or complete, which in part resulted from the fact that the bank did not have a list of its correspondent banking relationships. In the absence of such a list, the bank could not make sure that all the necessary data could be fed in and monitored.
HSBC did not dispute the FCA’s findings and agreed to settle the case with the regulator, which meant it could benefit from a 30 percent reduction in fine. Had it not done so, the bank would have paid more than £91m for the failures.
HSBC also agreed to undertake a large-scale remediation programme into AML processes.
“These failings are unacceptable and exposed the bank and community to avoidable risks, especially as the remediation took such a long time,” Steward said.
The case comes hot on the heels of last week’s record fine of £264.8m imposed on NatWest following a money laundering scandal.
Big enforcement actions are becoming a new trend, Theodore Morita, founder and CEO of Beyond Reg Consulting, told VIXIO.
This is in part due to the Money Laundering Directives (MLD4 and MLD5), which strengthened the UK’s regulatory regime in the last couple of years, but also because the FCA is expected by the government to toughen its stance, he explained.
“The industry, regulators and lawmakers are realising altogether that compliance cannot be just a tick-box exercise, nor that self-regulation is enough.”
Seeing a tougher stance on authorisations already, the FCA can also be expected to follow closely the AML compliance of fintechs.
“We are yet to see a major AML or financial crime enforcement against a fintech or a neobank, but it's a matter of when, not if,” Morita warned.
