On December 10, 2012, UK Banks HSBC and Standard Chartered Bank (SCB) entered into agreements with US enforcement authorities to settle civil and criminal charges relating to US economic sanctions, the Bank Secrecy Act, and the Foreign Narcotics Kingpin Sanctions Regulations. HSBC will forfeit a record $1.9 billion to US authorities, while SCB agreed to pay $327 million. Both have agreed to institute various compliance measures in their management and operations.
On December 12, 2012, the Bank of Tokyo-Mitsubishi UFJ, Ltd. (BTMU) agreed to pay $8,571,634 to settle potential civil liability for apparent violations of US economic sanctions.
The coordinated US enforcement actions highlight the importance of economic sanctions compliance to US foreign policy and national security interests. The HSBC, SCB and BTMU settlement agreements are discussed in detail below.
US enforcement authorities recently announced coordinated settlement agreements with HSBC Holdings Plc (HSBC Holdings), HSBC Bank USA N.A. (HSBC USA), and HSBC North America Holdings (HNAH) to resolve allegations that inadequate compliance measures led to widespread sanctions and money laundering violations involving Iranian banks, Mexican drug cartels, and other sanctioned entities for more than ten years. To resolve the claims, HSBC will pay $1.9 billion in penalties to US authorities. The bank agreed to pay $1.256 billion in disgorgement to the US Department of Justice (DOJ), $375 million in civil penalties to the Department of the Treasury, Office of Foreign Assets Control (OFAC), a $500 million civil penalty to the Office of the Comptroller of the Currency (OCC), and a $165 million civil penalty to the Federal Reserve Board of Governors (Board of Governors). HSBC’s OFAC penalty will be satisfied by payment to DOJ. The New York County District Attorney’s Office (DANY) participated in the investigation and entered into a separate settlement. In addition, the UK Financial Services Authority has worked closely with US authorities on the investigation, but is pursuing a separate action.
Money Laundering-Related Violations
The DOJ criminal Information states that from 2006 to 2010, HSBC USA failed to dedicate adequate resources to its anti-money laundering compliance function and implement a compliance program capable of adequately monitoring suspicious transactions and activities among its affiliates. Under the Bank Secrecy Act (BSA), HSBC USA was required to establish and maintain an anti-money laundering compliance program that provided for: (1) internal policies, procedures, and controls to deter money laundering; (2) a compliance officer to coordinate and monitor BSA and AML compliance; (3) related training; (4) independent audit programs; and (5) due diligence policies, procedures, and controls reasonably designed to detect and report suspicious activity for correspondent accounts it maintained in the US for non-US persons.
Despite inherent money laundering risks associated with correspondent banking activities with affiliate HSBC Mexico, DOJ alleged that HSBC USA failed to conduct adequate due diligence on HSBC Mexico’s operations as required by the BSA. Moreover, despite apparent awareness of narcotics-related money laundering risk associated with Mexican financial institutions, HSBC USA allegedly assigned HSBC Mexico its standard risk rating and neglected to monitor over $670 billion in wire transfers and $9.4 billion in US banknote purchases involving HSBC Mexico. In addition, it did not provide adequate staffing and other resources to maintain an effective AML program. As a result of these alleged compliance failures, HSBC USA laundered at least $881 million in Mexican drug cartel revenues through the Black Market Peso Exchange, a complex network designed to move cartel profits from drugs sold in the United States to foreign cartels.
DOJ alleged that HSBC Mexico did not maintain sufficient “Know Your Customer” (KYC) information, including addresses, reasons for maintaining US dollar-denominated accounts, and source of US dollars. HSBC Mexico executives also overruled recommendations from its AML committee to close accounts with suspicious activity, and failed to act on US and Mexican law enforcement concerns that the volume of HSBC Mexico’s US dollar exports was indicative of money laundering activity. Moreover, HSBC Mexico’s CEO allegedly was told that Mexican law enforcement had obtained a recording of a Mexican drug lord saying that HSBC Mexico was a good bank to launder money.
In addition to the money-laundering allegations described above, OFAC and DOJ claimed that certain of HSBC’s Iranian transactions violated the International Emergency Economic Powers Act (IEEPA), the Trading with the Enemy Act (TWEA), and related Executive Orders and regulations.
The settlement agreements state that beginning in the mid-1990s, employees of HSBC’s non-US affiliates took deliberate action to withhold information that would have identified Bank Melli London, a US-sanctioned Iranian financial institution, in certain Society for Worldwide Interbank Financial Telecommunication (SWIFT) cover payments routed through an HSBC USA correspondent account. According to the allegations, if the transfer messages had accurately reflected the involvement of sanctioned entities, the US banks receiving the instructions could have rejected, blocked or stopped the transactions for investigation, per OFAC regulations. Therefore, to avoid denied transactions or costly delays, HSBC UK subsidiary HSBC Bank plc allegedly “stripped” information identifying sanctioned parties from the messages. This “wire stripping” allegedly caused US financial institutions unknowingly to provide banking services to sanctioned entities; prevented US regulatory and law enforcement authorities from detecting unlawful transactions; and resulted in false business record entries by New York financial institutions in violation of New York state law. OFAC acknowledged, however, that certain of HSBC Bank plc’s Iranian transactions were permissible under authorizations and exemptions, including the U-turn exemption that was in place prior to November 10, 2008. Under the “U-turn” authorization, US financial institutions could process transactions for Iranian banks, individuals, and other entities if the transaction was initiated with a non-US, non-Iranian bank, ended with a non-US, non-Iranian bank, and was not barred by any other regulation.
The OFAC settlement catalogs HSBC’s alleged stripping of the Iranian parties’ identities from the transfer messages, despite HSBC group-wide compliance policies and management instructions prohibiting US dollar payments that were barred by OFAC regulations. OFAC regulations required US institutions to “determine that the underlying transaction is not prohibited by this part” before processing the transaction under the U-turn license. HSBC’s stripping activity prevented affiliated and unaffiliated US financial institutions from discharging their responsibility to investigate whether the U-turn exemption indeed applied when it was part of the law.
As for the magnitude of the illegal conduct, the HSBC-OFAC settlement agreement claimed that from March 2004 to June 2010, HSBC Bank plc processed 203 electronic funds transfers (EFTs) worth $164.3 million for the benefit of the Government of Iran or persons in Iran. The HSBC-DOJ/DANY deferred prosecution agreement claimed that from 2000 through 2006, HSBC affiliates processed $183 million on behalf of sanctioned entities in Iran.
Other Sanctioned Transactions
According to DOJ and OFAC, HSBC also stripped wire transfers involving restricted transactions with the following countries:
- Burma: From March 2005 to May 2006, HSBC affiliates processed through US banks 1,031 EFTs worth $136.7 million in violation of prohibitions against exportation of financial services to Burma and/or dealing in property located in the US and belonging to Burmese specially-designated nationals (SDNs)
- Cuba: From March 2004 to December 2007, HSBC affiliates processed through US banks 40 electronic funds transfers in which Cuba or a Cuban national had an interest
- Libya: From March 2004 to August April 2004, HSBC affiliates processed through US banks 25 EFTs worth $1.2 million in violation of now-repealed prohibitions on the exportation of goods, technology, or services to the Government of Libya and/or persons in Libya
- Sudan: From March 2004 to August 2007, HSBC affiliates processed through US banks 1,036 EFTs worth $109 million for the benefit of the Government of Sudan and/or persons in Sudan and/or dealing in property located in the US and belonging to the Government of Sudan
In addition, OFAC alleged separate and unrelated violations of Burmese, Iranian, Sudanese, and Zimbabwe sanctions regulations. Under the terms of its OFAC Settlement Agreement, HSBC Holdings agreed to a $375 million penalty. That penalty will be satisfied by HSBC’s settlement with DOJ.
Office of the Comptroller of the Currency Settlement
HSBC USA agreed to an OCC Consent Order whereby it will pay a $500 million civil penalty—the largest ever levied by OCC—to settle allegations that its compliance program deficiencies violated the BSA, suspicious activity reporting obligations, and a related October 2010 consent order. The OCC penalty also satisfies a related $500 million Financial Crimes Enforcement Network (FinCEN) penalty.
Like the DOJ DPA, the 2010 OCC Consent Order found that HSBC USA did not adequately monitor banknote transactions, collect or maintain customer due diligence information, process or file timely suspicious activity reports, or conduct adequate risk assessment on high-risk customers, even in instances where customers were associated with politically-exposed persons. As a result of these and other compliance weaknesses, the Consent Order required HSBC USA to institute certain compliance program elements, including establishing a Compliance Committee of the Board and a comprehensive BSA/anti-money laundering action plan; hiring a Regional Compliance Officer and BSA Officer; and implementing appropriate due diligence procedures, training, audits, and review. In light of HSBC’s recent compliance failures, OCC issued a separate Cease and Desist Order to address weaknesses in HSBC’s enterprise-wide compliance program.
Federal Reserve Board of Governors Settlement
HSBC Holdings and HNAH will pay a $165 million civil penalty to the Board of Governors for maintaining inadequate BSA and anti-money laundering risk management procedures and internal controls as required by the Federal Deposit Insurance Act, and violation of a related October 2010 consent order. The Board of Governors also issued a Cease and Desist Order against HSBC Holdings, requiring it to institute a compliance program approved by the Board of Governors.
II. Standard Chartered Bank
London-based Standard Chartered Bank (SCB) entered into agreements with DOJ, DANY, OFAC, and the Federal Reserve Board of Governors in relation to the bank’s financial activities implicating US sanctions relating to Iran, Burma, Libya, Sudan, and the Foreign Narcotics Kingpin Sanctions Regulations. SCB agreed to forfeit $327 million in total to US and NY authorities, and institute various compliance measures in its management and operations. The federal and DANY agreements follow the bank’s August 14, 2012 settlement with the New York State Department of Financial Services (DFS), which addressed similar activity and resulted in SCB’s forfeiture of $340 million and its agreement to engage in compliance measures, as described in Steptoe’s prior advisory.
SCB is alleged, from January 2001 through 2007, to have purposely falsified wire transfer messages to its New York branch in order to facilitate US dollar clearing activities involving entities subject to US sanctions. Like HSBC, SCB’s Dubai and London offices allegedly avoided US sanctions and related delays by stripping information identifying any sanctioned parties from the messages. The allegations assert that senior corporate managers and the legal and compliance departments of SCB knew and approved of these practices.
In addition, SCB is alleged to have made misleading statements to OFAC in 2003, and provided “incomplete information” to US bank regulators, the Federal Reserve Bank of New York (FRBNY) and the New York State Banking Department (NYSBD) in 2004, regarding its transactions involving sanctioned entities.
SCB voluntarily disclosed the activities in question to the US authorities, and agreed to terminate such activities and take remedial action, including implementing compliance measures in its management and operations, such as reporting procedures and monitoring. Of its $327 million forfeiture, SCB will pay $227 million in the DOJ and DANY settlement, and $100 million to the Board of Governors. The bank’s agreed forfeiture with OFAC of $132 million will be satisfied by SCB’s settlement with DOJ/DANY.
SCB’s Iranian-related transactions appear to have been the primary focus of the US authorities’ investigations, as those payments are alleged to have totaled over $240 billion from 2001 to 2007. SCB allegedly processed payments for the Iranian banks Markazi, Melli, Sepah, Persia International, Saderat, and Mellat, as well as unspecified other Iranian banks and corporate customers. However, a carve-out to the OFAC restrictions, known as the “U-turn” payment provision, existed during the period of the transactions.
As stated in the SCB agreements with DOJ and OFAC, because of the U-turn authorization, only a small portion of SCB’s underlying Iranian-related banking transactions allegedly were themselves a substantive violation of OFAC sanctions:
- SCB-OFAC Settlement Agreement: From January 2001 to December 2007, SCB processed through US banks 488 EFTs worth $24,002,250 in apparent violation of the prohibition against exporting services to Iran or the Government of Iran
- SCB-DOJ/DANY Deferred Prosecution Agreement: From 2001 through 2007, SCB processed through US banks $23 million in Iranian-related transactions in violation of the IEEPA. SCB accepted and acknowledged responsibility for “knowingly and willfully conspiring” to engage in transactions involving sanctioned country entities, including Iran, in violation of US law
Other Sanctioned Transactions
According to the allegations, SCB used the same “stripping” practice to avoid alerting its US branch of certain sanctioned transactions involving Burma, Libya, Sudan, and the Foreign Narcotics Kingpin Sanctions. SCB allegedly processed the following prohibited transactions through financial institutions located in the United States:
- Burma: From August 2003 to May 2005, five EFTs worth $59,642 in violation of the prohibition against the exportation or reexportation of financial services to Burma
- Libya: From January 2001 to April 2004, 135 EFTs worth $12,349,361 in violation of the prohibition against the exportation of goods, technology or services to Libya
- Sudan: From January 2001 to November 2007, 283 EFTs worth $96,665,537 in violation of the prohibition against the exportation or re-exportation to Sudan of services
- FNKSR: From February 2011 to April 2011, SCB NY processed eight EFTs worth $243,506.69 in which an entity designated pursuant to the Foreign Narcotics Kingpin Sanctions Regulations (FNKSR) had an interest. OFAC alleges that these transactions were prohibited by Executive Orders and/or regulations promulgated pursuant to IEEPA and the Foreign Narcotics Kingpin Designation Act (FNKDA)
Federal Reserve Board of Governors Settlement
In a Consent Agreement among the Federal Reserve Board of Governors, SCB, and its indirect parent company, London-based Standard Chartered plc, SCB acknowledged that its policies and procedures prevented SCB’s New York branch from determining whether financial transactions “were carried out in a manner consistent with US law” and from “properly conduct[ing] the transaction review required under the 2004 Written Agreement” based upon prior sanctions-related activities. In addition, the Consent Agreement noted the New York branch’s failure to provide adequate and complete responses to examiners in sanctions-related inquiries, and deficiencies in the New York branch’s risk management and compliance procedures.
SCB and its parent company did not admit wrongdoing, but settled the matter by instituting a compliance program and the payment of a joint civil money penalty totaling $100 million, with $65 million assessed in connection its alleged unsafe and unsound practices relating to OFAC regulations, and $35 million assessed in connection with its alleged deficient and misleading provision of information to examiners.
III. BTMU Tokyo
On December 12, 2012, the Bank of Tokyo-Mitsubishi UFJ, Ltd. (BTMU) reached a settlement with OFAC regarding allegations of sanctions violations stemming from procedures similar to those alleged of SCB and HSBC. According to OFAC, between April 2006 and March 2007, BTMU’s Tokyo operations willfully concealed the involvement of countries or persons subject to US sanctions relating to Iran, Burma, Sudan, Cuba, and the proliferation of weapons of mass destruction, in transactions that it processed through financial institutions in the United States. BTMU allegedly systematically deleted or omitted from payment messages any information that would result in the funds being blocked or rejected because of links to US sanctions targets. OFAC estimates that BTMU processed at least 97 funds transfers, with an aggregate value of approximately $5,898,943, through BTMU’s New York branch or other banks in the United States, in violation of US sanctions laws. BTMU’s senior management voluntarily self-disclosed these activities to OFAC.
The SCB and HSBC cases are notable for the number of federal and state agencies involved in the enforcement measures. The coordinated enforcement effort and relatively high penalties levied in these and prior cases indicate that US regulators intend to strictly enforce against entities that directly or indirectly interfere with US sanctions policies and related laws and regulations. The HSBC agreements are important not only for the record monetary penalty, but also for the layering of extensive money laundering charges on top of the sanctions charges.
Further, like other recent enforcement activity against non-US financial institutions, the above cases are notable for US authorities’ focus on the applicability of US sanctions laws to non-US entities. The US agencies have clearly signaled their disapproval of wire stripping to obfuscate sanctioned party activity even where an underlying transaction may have been lawful. The language of the DOJ and OFAC agreements does not explicitly assert that the wire stripping was unlawful when used to process otherwise permissible transactions. Thus, while DOJ and OFAC did not clarify their own positions on wire stripping related to authorized transactions, the magnitude of the penalties and the coordinated enforcement effort shows that the agencies view the activity as impermissible and subject to enforcement, irrespective of whether the underlying transactions are lawful. Accordingly, non-US financial institutions, especially those that that process transactions through US branches involving US-sanctioned parties, should consider the adequacy of their AML and sanctions compliance programs and the transparency and accuracy with which they identify sanctioned parties to US financial institutions.
The HSBC and SCB settlements have attracted substantial attention in the UK, mainly because of the economic importance of these banks and less (as would previously have been the case) because of a view that the US is unfairly targeting foreign entities. UK and EU sanctions and anti-money laundering law and enforcement have become much more aggressive in recent years, and as noted above HSBC remains subject to investigation by the UK Financial Services Authority for conduct related to the US settlement.