HSBC made history this week by agreeing to pay a record $1.92 billion in settlement for failing to enforce rules designed to prevent the proceeds of criminal activity finding its way into the financial system. While the huge sum of money ensured sensational news headlines, the Deferred Prosecution Agreement signed by HSBC offers valuable information to compliance professionals on the broader repercussions of compliance and AML program failures. The agreement outlines the remedial measures and changes that must be undertaken by HSBC to address sanctions and money laundering risks, providing an indication of the true cost to a business found guilty of non-compliance with AML laws.
There are a number of significant compliance reforms included in the Agreement, with remedial actions alone costing HSBC an estimated $290 million. As part of the agreement (but not included in the $290mil), HSBC has agreed to retain an independent corporate compliance monitor for five years, the maximum potential period. The monitor will ultimately be selected by the US Department of Justice and will oversee and report on HSBC’s AML compliance programs. The reforms outlined in the Agreement also require HSBC to update compliance processes including restructuring of reporting lines and strengthening the position of the compliance department within the company.
See below for a summary of key points in the agreement (points have been summarised from the original document). A full copy of the agreement can be seen here.
HSBC Deferred Prosecution Agreement
HSBC agreed to charges of:
- Wilfully failing to maintain an effective anti-money laundering program
- Wilfully failing to conduct and maintain due diligence on correspondent bank accounts held on behalf of foreign persons
- Wilfully violating and attempting to violate the Trading With The Enemy Act (USA)
- Wilfully violating and attempting to violate the International Emergency Economic Powers Act
HSBC Parties admit, accept and acknowledge that they are responsible for the acts of their officers, directors, employees and agents as charged in the Information.
Remedial measures that HSBC Parties have taken, will take and shall adhere to include:
- HSBC North America has a new leadership team, including a new CEO, General Counsel, Chief Compliance Officer, AML Director, Deputy Chief Compliance Officer and Deputy Director of its Global Sanctions program.
- In 2011, HSBC Bank USA spent $244 million on AML – approximately nine times more that it spent in 2009.
- HSBC Bank USA has increased AML staffing from 92 full time employees in January 2010 to approximately 880 full time employees as of May 2012.
- HSBC Bank USA has reorganised its compliance department to strengthen its reporting lines and elevate its status within the institution.
- Separating the Legal and Compliance Departments
- AML Director reports directly to the Chief Compliance Officer
- AML Director regularly reports directly to the Board and senior management about the AML program
- HSBC Bank USA has exited 109 correspondents relationship for risk reasons.
- HSBC Bank USA has a new automated monitoring system that monitors every wire transaction that moves through HSBC Bank USA.
- HSBC Group has undertaken to implement single global standards shaped by the highest or most effective AML standards available in any location where the HSBC Group operates.
- HSBC Group has commenced a review of all customer KYC files across the entire Group. The first phase of remediation will cost an estimated $700 million to complete over five years.
HSBC Parties shall cooperate fully with the Department:
- Make available, at their cost, their employees to provide additional information and materials concerning any and all investigations.
- Provide any information, materials, documents, databases or transaction data in HSBC possession.
- HSBC Parties acknowledge that at least $1,256,000,000 was involved in transactions that were in violation of laws and have agreed to forfeit that sum.
Corporate Compliance Monitor:
- HSBC Holdings agrees to retain an independent compliance monitor.
- The Monitor will be retained for no less than 60 months.