AML Enforcement in Practice: Regulatory Actions and Compliance Implementation

The HSBC Money Laundering Settlement (2012)

The HSBC case remains one of the largest AML enforcement actions in history. In 2012, HSBC entered into a Deferred Prosecution Agreement (DPA) with the US Department of Justice, paying $1.9 billion in penalties for widespread AML failures.

• The Violation: HSBC's Mexican subsidiary (HBME) processed $8.9 billion in transactions involving shell companies with no meaningful due diligence. These funds were linked to drug cartels (including Sinaloa and Los Zetas) and sanctioned countries (Iran, Cuba, North Korea, Sudan).
• The Failure: HSBC knowingly stripped identifying information from wire transfers (a practice called "wire stripping") to hide the origin of funds from sanctioned jurisdictions. The bank also failed to monitor $15 trillion in wire transfers and $42 billion in traveler's checks.
• The Penalty: $1.9 billion in forfeiture and fines — a record at the time. However, the DPA meant no criminal conviction. Critics argued this was a small price for a bank with $2.5 trillion in assets.
• Key Lesson: Cultural failures in compliance are as dangerous as technical ones. HSBC's compliance staff were under-resourced, and senior management prioritized revenue over AML controls. The bank was put under an independent monitor for five years.

Standard Chartered: $1.1 Billion in Sanctions Violations

Standard Chartered Bank faced enforcement actions from multiple regulators for processing transactions for sanctioned entities, primarily Iran.

• The Violation: Between 2001 and 2010, Standard Chartered processed over 60,000 transactions worth approximately $250 billion for Iranian entities, including the Central Bank of Iran and the National Iranian Oil Company. These transactions were deliberately hidden from US regulators.
• The Method: Bank officials instructed Iranian clients to remove identifying information from wire transfers, using coded language like "we have corrected the issue" after stripping data. A senior compliance officer reportedly said, "You f*ing Americans — who are you to tell us, the rest of the world, who we can or cannot do business with?"
• The Penalty: $1.1 billion in total penalties across multiple settlements with US federal and state authorities (2012, 2014, 2019). The bank was also subject to a temporary asset freeze and license revocation threat from the New York Department of Financial Services (DFS).
• Key Lesson: Individual accountability matters. The DFS investigation was notable for its aggressive, name-and-shame approach, focusing on specific executives and their decisions. The case established the pattern of deferred prosecution agreements with independent monitors.

BNP Paribas: $8.9 Billion for Sudan Sanctions

In 2014, BNP Paribas pleaded guilty to falsifying business records and conspiracy, paying $8.9 billion — the largest criminal fine for sanctions violations at the time.

• The Violation: BNP Paribas processed transactions for Sudanese entities that were subject to US economic sanctions, including the Government of Sudan, which had been designated a state sponsor of terrorism. The transactions involved oil and gas payments, telecommunications, and agricultural commodities.
• The Method: BNP systematically removed identifying information from wire transfers (a practice known as "stripping" or "sanctions screening evasion"). The bank used internal codes to flag Sudan-related transactions for manual processing that bypassed automated screening systems. Over 70% of the bank's Sudan-related transactions were processed through New York.
• The Penalty: $8.9 billion in forfeiture and fines. The bank was also temporarily barred from conducting certain US dollar-clearing operations — a severe operational penalty that threatened the bank's global business model.
• Key Lesson: Dollar-clearing power gives US regulators extraordinary extraterritorial reach. Even non-US banks must comply with US sanctions if they process any USD transactions through the US financial system. This case forced banks worldwide to fundamentally rethink their sanctions compliance programs.

The SAR Filing Process: From Detection to Reporting

Suspicious Activity Reports (SARs) are the backbone of the AML reporting system. Understanding how to identify, document, and file SARs is a critical application skill.

Step-by-Step SAR Process

SAR Secrecy and Safe Harbor

Two critical legal protections govern SAR filings:

• Safe Harbor (31 USC § 5318(g)(3)): Financial institutions and their employees are protected from civil liability for filing a SAR, even if the underlying activity is later determined to be legitimate. This is essential to encourage reporting without fear of defamation or breach of contract lawsuits.
• Prohibition on Disclosure (31 CFR § 1020.320): It is illegal for any person involved in filing a SAR to disclose the existence or contents of the SAR to the subject of the report or to any third party. Violations can result in criminal penalties, including fines and imprisonment.

Building an AML Compliance Program

Applying AML requirements to build a practical compliance program requires integrating five pillars:

1. Risk Assessment

• Identify inherent risk: customer types, products/services, geographies, delivery channels
• Apply a risk rating matrix (Low/Medium/High/Extreme) based on weighted factors
• Document risk appetite statement approved by the board
• Update risk assessment annually or when material changes occur

2. Policies and Procedures

• Written AML/CFT policy covering KYC, CDD, EDD, transaction monitoring, SAR filing, and recordkeeping
• Customer Acceptance Policy defining who the institution will (and will not) bank
• Suspicious Activity Reporting procedures with clear escalation paths
• Sanctions screening policy covering OFAC, EU, UN sanctions lists

3. Internal Controls

• Automated transaction monitoring system with calibrated rules and thresholds
• Sanctions screening system (name and transaction screening)
• Independent testing (internal audit or external consultant) at least annually
• Case management system for tracking alerts, investigations, and SARs

4. Training

• Annual AML training for all employees (risk awareness and reporting obligations)
• Specialized training for frontline staff (red flags, customer identification)
• Advanced training for compliance and investigation teams (typologies, case law, regulatory updates)
• Board-level training on AML responsibilities and regulatory expectations

5. Independent Testing

• Annual audit of the AML program by internal audit or external qualified party
• Testing of transaction monitoring system tuning and calibration
• Sample testing of CDD/KYC files for completeness and accuracy
• Review of SAR filing timeliness and quality

Application Scenario: Evaluating a Suspicious Transaction

Scenario: You are an AML investigator at a mid-sized bank. An alert fires for a corporate customer (ABC Imports Ltd) that deposits $950,000 in cash over five consecutive business days ($190,000/day). The company's declared business is importing textiles from Bangladesh. Its expected monthly revenue based on tax filings is $300,000.

Apply your knowledge:

1. What red flags are present? Identify at least three.
2. What additional information would you gather in your investigation?
3. Should you file a SAR? Justify your decision referencing applicable indicators.
4. What risk rating should this customer have, and what EDD measures are appropriate?

(These are the types of scenario-based judgments expected in real-world AML roles. The ability to apply regulatory requirements to specific facts distinguishes a competent AML professional from one who simply memorizes rules.)