Staff Director and Chief Counsel

Counsel and Chief Investigator

Senior Counsel

Detailee

Detailee

Congressional Fellow

Detailee

Staff Director to the Minority

Chief Investigator to the Minority

Senior Investigator to the Minority

Law Clerk

Law Clerk

Law Clerk

Law Clerk

Law Clerk

Law Clerk

Law Clerk

Law Clerk

Intern

Intern

Intern

Intern

Chief Clerk

199 Russell Senate Office Building – Washington, D.C. 20510

Majority: 202/224-9505 – Minority: 202/224-3721

i

(1) Longstanding Severe AML Deficiencies. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

(2) Taking on High Risk Affiliates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

(3) Circumventing OFAC Prohibitions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

(4) Disregarding Terrorist Links. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

(5) Clearing Suspicious Bulk Travelers Cheques. . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

(6) Offering Bearer Share Accounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

(7) Allowing AML Problems to Fester. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

(1) Screen High Risk Affiliates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

(2) Respect OFAC Prohibitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

(3) Close Accounts for Banks with Terrorist Financing Links. . . . . . . . . . . . . . . . . . 11

(4) Revamp Travelers Cheque AML Controls. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

(5) Boost Information Sharing Among Affiliates . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

(6) Eliminate Bearer Share Accounts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

(7) Increase HBUS' AML Resources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

(8) Treat AML Deficiencies as a Matter of Safety and Soundness. . . . . . . . . . . . . . . 12

(9) Act on Multiple AML Problems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

(10) Strengthen AML Examinations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

(1) HBUS Compliance and AML Leadership . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

(2) HBUS AML Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

(1) U.S. Assessment of AML Risk in Mexico . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

(2) HSBC Assessment of Risk in Mexico . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

(1) High Risk Money Service Businesses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

(a) Casa de Cambio Puebla . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

(b) Sigue Corporation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

ii

(2) Cayman Island U.S. Dollar Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

(3) Cashing U.S. Dollar Travelers Cheques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

(1) HBUS’ Global Banknotes Business . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

(2) HBMX U.S. Dollar Sales to HBUS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

(3) Remedial Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110

(1) Transactions Involving Iran . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

(a) Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

(b) Concealing Iranian Transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

(c) Pressuring HBUS on Iran . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128

(d) Continuing Pressure on HBUS to Process Iranian Transactions . . . . . . . . . 132

(e) Reaching Agreement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

(f) Processing the Iranian Transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150

(g) Establishing Group-wide Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

(h) Shifting Iranian Transactions from HBUS to JPMorgan Chase and

and Back Again . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158

(i) Getting Out . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 162

(j) Looking Back . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 165

(2) Transactions Involving Other Countries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

(a) 2005 and 2006 GCLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

(b) Transactions Involving Cuba . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 169

(c) Transactions Involving Sudan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171

(d) Transactions Involving Burma . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

(e) Transactions Involving North Korea . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175

(f) Other Prohibited Transactions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175

(3) HBUS’ OFAC Compliance Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

(4) Server Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182

iii

(1) Islami Bank Bangladesh Ltd. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225

(2) Social Islami Bank Ltd. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

(1) Key Anti-Money Laundering Laws . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285

(2) AML Oversight In General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287

(3) OCC AML Oversight in General . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293

(1) Chronology of OCC AML Oversight of HBUS . . . . . . . . . . . . . . . . . . . . . . . . . . 300

(2) Six Years of AML Deficiencies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316

(1) Treating AML Deficiencies As A Consumer Compliance Issue . . . . . . . . . . . . . 319

(2) Restricting Citations of AML Program Violations . . . . . . . . . . . . . . . . . . . . . . . . 322

(3) Using Narrowly Focused Exams . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 326

(4) Failing to Use Enforcement Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329

(5) Issuing Weak Supervisory Letters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330

# # #

This Report examines the anti-money laundering (AML) and terrorist financing

vulnerabilities created when a global bank uses its U.S. affiliate to provide U.S. dollars, U.S.

dollar services, and access to the U.S. financial system to high risk affiliates, high risk

correspondent banks, and high risk clients. This Report also offers recommendations to

strengthen correspondent AML controls to combat money laundering, drug trafficking, and

terrorist financing.

Over the last decade, the U.S. Senate Permanent Subcommittee on Investigations has

worked to strengthen U.S. AML efforts by investigating how money launderers, terrorists,

organized crime, corrupt officials, tax evaders, and other wrongdoers have utilized U.S. financial

in particular, on how U.S. banks, through the correspondent services they provide to foreign

financial institutions, had become conduits for illegal proceeds associated with organized crime,

institution provides services to another financial institution to move funds, exchange currencies,

cash monetary instruments, or carry out other financial transactions. The Subcommittee’s 2001

investigation showed not only how some poorly managed or corrupt foreign banks used U.S.

bank accounts to aid and abet, commit, or allow clients to commit wrongdoing, but also how

U.S. financial institutions could protect themselves and the U.S. financial system from misuse.

In response to that investigation and the money laundering vulnerabilities exposed by the

9/11 terrorist attack, Congress enacted stronger AML laws as part of the Patriot Act of 2002,

States,” S.Hrg. 111-540 (Feb. 4, 2010); “Tax Haven Banks and U.S. Tax Compliance,” S.Hrg. 110-614 (July 17 and

25, 2008); “Tax Haven Abuses: The Enablers, The Tools and Secrecy,” S.Hrg. 109-797 (Aug. 1, 2006); “Money

Laundering and Foreign Corruption: Enforcement and Effectiveness of the Patriot Act,” S.Hrg. 108-633 (July 15,

2004); “Role of U.S. Correspondent Banking in International Money Laundering,” S.Hrg. 107-84 (March 1, 2 and 6,

2001); and “Private Banking and Money Laundering: A Case Study of Opportunities and Vulnerabilities,” S.Hrg.

106-428 (Nov. 9 and 10, 1999). See also U.S. Senate Committee on Homeland Security and Governmental Affairs,

“State Business Incorporation – 2009,” S.Hrg. 111-953 (June 18 and Nov. 5, 2009).

to guard against

on Investigations, S.Hrg. 107-84 (March 1, 2 and 6, 2001)(hereinafter “2001 Subcommittee Hearing on

Correspondent Banking”), at 1.

opening accounts for foreign banks, with enhanced due diligence for offshore banks and banks in high risk

jurisdictions; prohibiting the opening of correspondent accounts for shell banks; and strengthening the ability of U.S.

regulators to obtain correspondent account records).

Financial Institutions Examination Council, “Foreign Correspondent Account Recordkeeping and Due Diligence,” at

2

money laundering through correspondent accounts. In response, over the next ten years, U.S.

banks substantially strengthened their correspondent AML controls. Before the 2002 Patriot Act,

for example, most U.S. banks opened correspondent accounts for any foreign bank with a

banking license; now, most U.S. banks evaluate the riskiness of each foreign bank’s owners,

business lines, products, clients, and AML controls before agreeing to open an account. They

also routinely monitor account activity and wire transfers for suspicious activity, with enhanced

monitoring of high risk correspondents. In addition, before the 2002 Patriot Act, some U.S.

banks readily opened accounts for foreign shell banks, meaning banks without any physical

presence in any jurisdiction; today, in accordance with the Patriot Act’s ban on shell bank

accounts, all U.S. banks take measures to ensure they don’t provide services to such banks, the

stand-alone shell banks licensed by the Bahamas, Cayman Islands, Nauru, and other jurisdictions

have virtually disappeared.

At the same time, the money laundering risks associated with correspondent banking

have not been eliminated. Correspondent accounts continue to provide a gateway into the U.S.

financial system, and wrongdoers continue to abuse that entryway. This investigation takes a

fresh look at the U.S. vulnerabilities to money laundering and terrorist financing associated with

correspondent banking, focusing in particular on the operations of global banks with U.S.

affiliates that enable foreign financial institutions to gain access to the U.S. financial system.

HSBC Case Study. To examine the current money laundering and terrorist financing

threats associated with correspondent banking, the Subcommittee selected HSBC as a case study.

HSBC is one of the largest financial institutions in the world, with over $2.5 trillion in assets, 89

million customers, 300,000 employees, and 2011 profits of nearly $22 billion. HSBC, whose

initials originally stood for Hong Kong Shanghai Banking Corporation, now has operations in

over 80 countries, with hundreds of affiliates spanning the globe. Its parent corporation, HSBC

Holdings plc, called “HSBC Group,” is headquartered in London, and its Chief Executive

Officer is located in Hong Kong.

Its key U.S. affiliate is HSBC Bank USA N.A. (HBUS). HBUS operates more than 470

bank branches throughout the United States, manages assets totaling about $200 billion, and

serves around 3.8 million customers. It holds a national bank charter, and its primary regulator is

the U.S. Office of the Comptroller of the Currency (OCC), which is part of the U.S. Treasury

Department. HBUS is headquartered in McLean, Virginia, but has its principal office in New

York City. HSBC acquired its U.S. presence by purchasing several U.S. financial institutions,

including Marine Midland Bank and Republic National Bank of New York.

A senior HSBC executive told the Subcommittee that HSBC acquired its U.S. affiliate,

not just to compete with other U.S. banks for U.S. clients, but primarily to provide a U.S.

platform to its non-U.S. clients and to use its U.S. platform as a selling point to attract still more

non-U.S. clients. HSBC operates in many jurisdictions with weak AML controls, high risk

117-129, 183-187, http://www.ffiec.gov/bsa_aml_infobase/documents/BSA_AML_Man_2010.pdf. Prior versions

of this Manual were issued in 2005 and 2007.

The FATF Recommendations,” issued by the Financial Action Task Force (2/2012), FATF Recommendation 13.

3

clients, and high risk financial activities including Asia, Middle East, and Africa. Over the past

ten years, HSBC has also acquired affiliates throughout Latin America. In many of these

countries, the HSBC affiliate provides correspondent accounts to foreign financial institutions

that, among other services, are interested in acquiring access to U.S. dollar wire transfers, foreign

exchange, and other services. As a consequence, HSBC’s U.S. affiliate, HBUS, is required to

interact with other HSBC affiliates and foreign financial institutions that face substantial AML

challenges, often operate under weaker AML requirements, and may not be as familiar with, or

respectful of, the tighter AML controls in the United States. HBUS’ correspondent services,

thus, provide policymakers with a window into the vast array of money laundering and terrorist

financing risks confronting the U.S. affiliates of global banks.

The Subcommittee also examined HSBC because of its weak AML program. In

September 2010, the OCC issued a lengthy Supervisory Letter citing HBUS for violating federal

AML laws, including by maintaining an inadequate AML program. In October 2010, the OCC

issued a Cease and Desist Order requiring HSBC to strengthen multiple aspects of its AML

identifying possible suspicious activity that had yet to be reviewed; ineffective methods for

identifying suspicious activity; a failure to file timely Suspicious Activity Reports with U.S. law

enforcement; a failure to conduct any due diligence to assess the risks of HSBC affiliates before

opening correspondent accounts for them; a 3-year failure by HBUS, from mid-2006 to mid-

2009, to conduct any AML monitoring of $15 billion in bulk cash transactions with those same

HSBC affiliates, despite the risks associated with large cash transactions; poor procedures for

assigning country and client risk ratings; a failure to monitor $60 trillion in annual wire transfer

activity by customers domiciled in countries rated by HBUS as lower risk; inadequate and

unqualified AML staffing; inadequate AML resources; and AML leadership problems. Since

many of these criticisms targeted severe, widespread, and longstanding AML deficiencies, they

also raised questions about how the problems had been allowed to accumulate and why the OCC

had not compelled corrective action earlier.

During the course of its investigation into HSBC’s AML deficiencies, the Subcommittee

issued multiple subpoenas and collected and reviewed over 1.4 million documents, including

bank records, correspondence, emails, and legal pleadings. The Subcommittee staff also

conducted over 75 interviews with officials at HSBC Group, HBUS, and other HSBC affiliates,

as well as with U.S. banking regulators. In addition, the Subcommittee received numerous

briefings from HSBC legal counsel, initiated inquiries with foreign banks that had HSBC

accounts, and consulted with experts on AML and terrorist financing issues. HSBC was fully

cooperative with the inquiry, producing documentation and witnesses from around the world,

including documents for which it could have claimed privilege.

As a result of its investigation, the Subcommittee has focused on five issues illustrating

key AML and terrorist financing problems that continue to impact correspondent banking in the

United States. They include opening U.S. correspondent accounts for high risk affiliates without

conducting due diligence; facilitating transactions that hinder U.S. efforts to stop terrorists, drug

holding company, HSBC North America Holdings, Inc. (HNAH), citing HNAH for an inadequate AML program

and requiring it to revamp and strengthen both its program and that of HBUS.

4

traffickers, rogue jurisdictions, and other from using the U.S. financial system; providing U.S.

correspondent services to banks with links to terrorism; clearing bulk U.S. dollar travelers

cheques despite signs of suspicious activity; and offering high risk bearer share corporate

accounts. Avoiding the money laundering risks involved in these activities requires an effective

AML program, with written standards, knowledgeable and adequate staff, the infrastructure

needed to monitor account and wire transfer activity for suspicious transactions, effective AML

training, and a compliance culture that values obtaining accurate client information. In addition

to focusing on these five issues at HBUS, the Subcommittee investigation examined the

regulatory failures that allowed these and other AML problems to fester for years.

Servicing A High Risk Affiliate. In 2001, the Subcommittee’s investigation debunked

the notion that U.S. banks should open a correspondent account for any foreign bank with a

banking license, establishing instead the need to use due diligence to evaluate the money

laundering and terrorist financing risks posed by a specific foreign financial institution before

opening an account. Today, some U.S. affiliates of global banks engage in an equally ill-advised

practice, opening correspondent accounts for any affiliate owned by the parent holding

corporation, with no analysis of the AML or terrorist financing risks.

Until recently, HSBC Group policy instructed its affiliates to assume that all HSBC

affiliates met the Group’s AML standards and to open correspondent accounts for those affiliates

without additional due diligence. For years, HBUS followed that policy, opening U.S.

correspondent accounts for HSBC affiliates without conducting any AML due diligence. Those

affiliates have since become major clients of the bank. In 2009, for example, HBUS determined

that “HSBC Group affiliates clear[ed] virtually all USD [U.S. dollar] payments through accounts

conduct due diligence on HSBC affiliates despite a U.S. law that has required all U.S. banks,

since 2002, to conduct these due diligence reviews before opening a U.S. correspondent account

for any foreign financial institution, with no exception made for foreign affiliates.

One HSBC affiliate that illustrates the AML problems is HSBC Mexico, known as

HBMX. HBUS should have, but did not, treat HBMX as a high risk correspondent client subject

to enhanced due diligence and monitoring. HBMX operated in Mexico, a country under siege

from drug crime, violence and money laundering; it had high risk clients, such as Mexican casas

de cambios and U.S. money service businesses; and it offered high risk products, such as U.S.

dollar accounts in the Cayman Islands. In addition, from 2007 through 2008, HBMX was the

single largest exporter of U.S. dollars to HBUS, shipping $7 billion in cash to HBUS over two

years, outstripping larger Mexican banks and other HSBC affiliates. Mexican and U.S.

authorities expressed repeated concern that HBMX’s bulk cash shipments could reach that

volume only if they included illegal drug proceeds.. The concern was that drug traffickers

unable to deposit large amounts of cash in U.S. banks due to AML controls, were transporting

U.S. dollars to Mexico, arranging for bulk deposits there, and then using Mexican financial

institutions to insert the cash back into the U.S. financial system.

In addition to its high risk location, clients, and activities, HMBX had a history of severe

AML deficiencies. Its AML problems included a widespread lack of Know-Your Customer

prepared by HSBC and provided to the OCC, at HSBC OCC 8874197.

5

(KYC) information in client files; a dysfunctional monitoring system; bankers who resisted

closing accounts despite evidence of suspicious activity; high profile clients involved in drug

trafficking; millions of dollars in suspicious bulk travelers cheque transactions; inadequate

staffing and resources; and a huge backlog of accounts marked for closure due to suspicious

activity, but whose closures were delayed. For eight years, from 2002 to 2010, HSBC Group

oversaw efforts to correct HBMX’s AML deficiencies, while those efforts fell short. At the

same time, HSBC Group watched HBMX utilize its U.S. correspondent account, without alerting

HBUS to the AML risks it was incurring.

HBUS compounded the AML risks it incurred from HBMX through its own AML

deficiencies, which included failing to investigate or evaluate HBMX’s AML risks. HBUS also

failed, from mid-2006 to mid-2009, to conduct any AML monitoring of its U.S. dollar

transactions with HSBC affiliates, including HBMX, despite the obvious well-known risks

attendant with large cash transactions. In addition, because HBUS deemed HBMX to be located

in a low risk country, HBUS failed until 2009, to monitor HBMX’s wire transfer or account

activity. HBMX illustrates the money laundering and drug trafficking risks that result when the

U.S. affiliate of a global bank serves as the U.S. gateway for a high risk affiliate allowed to

operate with no initial due diligence or ongoing monitoring.

Circumventing OFAC Prohibitions. The United States has devoted significant

resources to stopping some of the most dangerous persons and jurisdictions threatening the world

today from utilizing the U.S. financial system, including terrorists, persons involved with

weapons of mass destruction, drug traffickers, and persons associated with rogue jurisdictions

such as Iran, North Korea, and Sudan. To implement the law, the U.S. Treasury Department’s

Office of Foreign Assets Control (OFAC) has developed a list of prohibited persons and

countries which banks use to create an “OFAC filter” to identify and halt potentially prohibited

transactions. Transactions stopped by this filter typically undergo an individualized review to

see if the transaction can proceed or the funds must be blocked.

Because the OFAC filter can end up delaying or blocking transactions that are permitted

under U.S. law or by other jurisdictions, some non-U.S. financial institutions have used tactics to

circumvent it. Common tactics include stripping information from wire transfer documentation

to conceal the participation of a prohibited person or country, or characterizing a transaction as a

transfer between banks in approved jurisdictions, while omitting underlying payment details that

would disclose participation of a prohibited originator or beneficiary. In the case of Iran, some

foreign banks also abused what were known as “U-turn” transactions, which were allowable

transactions under Treasury regulations prior to November 2008. In recent years, the United

States has imposed steep penalties on banks that violated the OFAC prohibitions.

At HBUS, documents provided to the Subcommittee indicate that, for years, some HSBC

affiliates took action to circumvent the OFAC filter when sending OFAC sensitive transactions

through their U.S. dollar correspondent accounts at HBUS. From at least 2001 to 2007, two

HSBC affiliates, HSBC Europe (HBEU) and HSBC Middle East (HBME), repeatedly sent Uturn

transactions through HBUS without disclosing links to Iran, even though they knew HBUS

required full transparency to process U-turns. To avoid triggering the OFAC filter and an

individualized review by HBUS, HBEU systematically altered transaction information to strip

6

out any reference to Iran and characterized the transfers as between banks in approved

jurisdictions. The affiliates’ use of these practices, which even some within the bank viewed as

deceptive, was repeatedly brought to the attention of HSBC Group Compliance, by HBUS

compliance personnel and by HBEU personnel who objected to participating in the document

alteration and twice announced deadlines to end the activity. Despite this information, HSBC

Group Compliance did not take decisive action to stop the conduct or inform HBUS about the

extent of the activity. At the same time, while some at HBUS claimed not to have known they

were processing undisclosed Iranian transactions from HSBC affiliates, internal documents show

key senior HBUS officials were informed as early as 2001. In addition, HBUS’ OFAC filter

repeatedly stopped Iranian transactions that should have been disclosed to HBUS by HSBC

affiliates, but were not. Despite evidence of what was taking place, HBUS failed to get a full

accounting of what its affiliates were doing or ensure all Iranian transactions sent by HSBC

affiliates were stopped by the OFAC filter and reviewed to ensure they were OFAC compliant.

In addition, documents show that, from 2002 to 2007, some HSBC affiliates sent potentially

prohibited transactions through HBUS involving Burma, Cuba, North Korea, Sudan, and other

prohibited countries or persons. Other documents indicate that some HSBC affiliates may have

sent non-U.S. dollar messaging traffic through U.S. servers in which the OFAC filter was not

turned on or was restricted.

An outside auditor hired by HBUS has so far identified, from 2001 to 2007, more than

28,000 undisclosed, OFAC sensitive transactions that were sent through HBUS involving $19.7

billion. Of those 28,000 transactions, nearly 25,000 involved Iran, while 3,000 involved other

prohibited countries or persons. The review has characterized nearly 2,600 of those transactions,

including 79 involving Iran, and with total assets of more than $367 million, as “Transactions of

Interest” requiring additional analysis to determine whether violations of U.S. law occurred.

While the aim in many of those cases may have been to avoid the delays associated with the

OFAC filter and individualized reviews, rather than to facilitate prohibited transactions, actions

taken by HSBC affiliates to circumvent OFAC safeguards may have facilitated transactions on

behalf of terrorists, drug traffickers, or other wrongdoers. While HBUS insisted, when asked,

that HSBC affiliates provide fully transparent transaction information, when it obtained evidence

that some affiliates were acting to circumvent the OFAC filter, HBUS failed to take decisive

action to confront those affiliates and put an end to the conduct. HBUS’ experience

demonstrates the strong measures that the U.S. affiliate of a global bank must take to prevent

affiliates from circumventing OFAC prohibitions.

Disregarding Links to Terrorism. For decades, HSBC has been one of the most

active global banks in the Middle East, Asia, and Africa, despite being aware of the

terrorist financing risks in those regions. In particular, HSBC has been active in Saudi

Arabia, conducting substantial banking activities through affiliates as well as doing

business with Saudi Arabia’s largest private financial institution, Al Rajhi Bank. After

the 9-11 terrorist attack in 2001, evidence began to emerge that Al Rajhi Bank and some

of its owners had links to financing organizations associated with terrorism, including

evidence that the bank’s key founder was an early financial benefactor of al Qaeda. In

2005, HSBC announced internally that its affiliates should sever ties with Al Rajhi Bank,

but then reversed itself four months later, leaving the decision up to each affiliate. HSBC

Middle East, among other HSBC affiliates, continued to do business with the bank.

7

Due to terrorist financing concerns, HBUS closed the correspondent banking and

banknotes accounts it had provided to Al Rajhi Bank. For nearly two years, HBUS

Compliance personnel resisted pressure from HSBC personnel in the Middle East and

United States to resume business ties with Al Rajhi Bank. In December 2006, however,

after Al Rajhi Bank threatened to pull all of its business from HSBC unless it regained

access to HBUS’ U.S. banknotes program, HBUS agreed to resume supplying Al Rajhi

Bank with shipments of U.S. dollars. Despite ongoing troubling information, HBUS

provided nearly $1 billion in U.S. dollars to Al Rajhi Bank until 2010, when HSBC

decided, on a global basis, to exit the U.S. banknotes business. HBUS also supplied U.S.

dollars to two other banks, Islami Bank Bangladesh Ltd. and Social Islami Bank, despite

evidence of links to terrorist financing. Each of these specific cases shows how a global

bank can pressure its U.S. affiliate to provide banks in countries at high risk of terrorist

financing with access to U.S. dollars and the U.S. financial system.

Clearing Suspicious Bulk Travelers Cheques. Another AML issue involves HBUS’

clearing more than $290 million in bulk U.S. dollar travelers checks in less than four years for a

Japanese regional bank, Hokuriku Bank, despite evidence of suspicious activity. From at least

2005 to 2008, HBUS cleared bulk travelers cheques for Hokuriku Bank on a daily basis, at times

clearing $500,000 or more in U.S. dollars per day. The cheques were in denominations of $500

or $1,000, submitted in large blocks of sequentially numbered cheques, and signed and

countersigned with the same illegible signature. An OCC examination which determined that

HBUS was clearing travelers cheques with inadequate AML controls, discovered the stacks of

Hokuriku travelers cheques being processed on a daily basis, and directed HBUS to investigate.

When HBUS sought more information, Hokuriku Bank at first delayed responding, then

provided minimal information, and finally declined to investigate further, claiming to be

constrained by bank secrecy laws from disclosing client-specific information. HBUS eventually

learned that the travelers cheques were purchased by Russians from a bank in Russia, a country

at high risk of money laundering. HBUS also learned that the Japanese bank had little KYC

information or understanding why up to $500,000 or more in bulk U.S. dollar travelers cheques

purchased in Russia were being deposited on a daily basis into one of 30 different Japanese

accounts of persons and corporations supposedly in the used car business.

In October 2008, under pressure from the OCC, HBUS stopped processing the travelers

cheques, but continued the correspondent relationship, despite the Japanese bank’s poor AML

controls. Two years later, in 2010, an OCC examination uncovered the ongoing relationship,

between HSBC and Hokuriku, which the OCC thought had ended. In 2012, after the

Subcommittee inquired about the account, HBUS closed it. Since travelers cheques have been

misused by terrorists, drug traffickers, and other criminals, the HBUS experience shows how a

U.S. affiliate with ineffective AML controls can end up clearing suspicious bulk travelers

cheques and facilitating the movement of hundreds of millions of U.S. dollars across

international lines to unknown recipients.

Offering Bearer Share Accounts. Over the course of a decade, HBUS opened over

2,000 accounts in the name of bearer share corporations, a notorious type of corporation that

invites secrecy and wrongdoing by assigning ownership to whomever has physical possession of

the shares. At its peak, HBUS’ Miami office had over 1,670 bearer share accounts; the New

8

York office had over 850; and the Los Angeles office had over 30. The Miami bearer share

accounts alone held assets totaling an estimated $2.6 billion, and generated annual bank revenues

of $26 million. Multiple internal audits and regulatory examinations criticized the accounts as

high risk and advocated that HBUS either take physical custody of the shares or require the

corporations to register the shares in the names of the shareholders, but HBUS bankers initially

resisted tightening AML controls, and regulators took no enforcement action.

Two examples of the accounts illustrate the risks they posed. In the first, Miami Beach

hotel developers, Mauricio Cohen Assor and Leon Cohen Levy, father and son, used bearer share

accounts they opened for Blue Ocean Finance Ltd. and Whitebury Shipping Time-Sharing Ltd.

to help hide $150 million in assets and $49 million in income. In 2010, both were convicted of

criminal tax fraud and filing false tax returns, sentenced to ten years in prison, and ordered to pay

back taxes, interest, and penalties totaling more than $17 million. A second example involves a

wealthy and powerful Peruvian family which pressed HBUS to grant a waiver from its AML

requirements that bearer share corporations either register their shares or place those shares in

bank custody. Bank documents showed how HBUS bankers pressed Compliance personnel to

grant the waiver to please a wealthy client. These accounts demonstrate the AML risks

associated with bearer share accounts, whose owners seek to hide their identities. Today,

following an initiative that concluded in 2011, HBUS has reduced its bearer share accounts to

26, most of which are frozen, while at the same time maintaining a policy that allows the bank to

open new bearer share accounts in the future.

Regulatory Failures. HBUS’ severe AML deficiencies did not happen overnight; they

accumulated over time, even though its primary regulator, the OCC, conducted regular AML

examinations. Part of the reason HBUS’ AML problems were not cured is attributable to certain

peculiar and ineffective aspects of the OCC’s AML oversight effort.

First, unlike other U.S. bank regulators, the OCC does not treat AML deficiencies as a

matter of bank safety and soundness or a management problem. Instead it treats AML

deficiencies as a consumer compliance matter, even though AML laws and consumer protection

laws have virtually nothing in common. One consequence of this approach is that the OCC

considers AML problems when assigning a bank’s consumer compliance rating, but not when

assigning the bank’s management rating or its overall composite rating. As a result, AML

deficiencies do not routinely lower the ratings that national banks receive as part of their safety

and soundness evaluations, and so do not increase the deposit insurance that banks pay for

incurring heightened risk, contrary to how AML problems are handled at other federal banking

agencies. At HBUS, after citing the bank for severe AML deficiencies, the OCC lowered its

consumer compliance rating but not its management rating.

A second problem is that the OCC has adopted a practice of foregoing the citation of a

statutory or regulatory violation in its Supervisory Letters and annual Reports of Examination

when a bank fails to comply with one of the four mandatory components of an AML program.

The four minimum statutory requirements of an AML program are AML internal controls, an

AML compliance officer, AML training, and independent testing of the effectiveness of its AML

program. By consistently treating a failure to meet one or even several of these statutory

requirements as a “Matter Requiring Attention” instead of a legal violation, the OCC diminishes

9

the importance of meeting each requirement, sends a more muted message about the need for

corrective action, and makes enforcement actions more difficult to pursue if an AML deficiency

persists. In contrast, citing a violation of law when one critical component of a bank’s AML

program is inadequate sends a strong message to bank management that its AML program is

deficient, does not meet minimum statutory requirements, and requires remediation to ensure

compliance with the law. At HBUS, the OCC identified 83 Matters Requiring Attention over

five years, without once citing a legal violation of federal AML law. It was only when the OCC

found HBUS’ entire AML program to be deficient that the OCC finally cited the bank for a legal

violation.

Additional problems illustrated by the HBUS case history include the OCC’s practice of

conducting narrowly focused AML examinations of specific banking units without also assessing

HBUS’ overall AML program; the OCC’s reluctance, despite mounting AML deficiencies, to

make timely use of formal and informal enforcement actions to compel improvements in HBUS’

AML program; and the practice by some OCC examiners to issue Supervisory Letters that

sometimes muted AML examination criticisms or weakened recommendations for AML reforms

at HBUS.

While the OCC insists that its AML approach has merit, the HSBC case history, like the

the current OCC system has tolerated severe AML deficiencies for years, permitted national

banks to delay or avoid correcting identified problems, and allowed smaller AML issues to

accumulate into a massive problem before OCC enforcement action was taken. An experienced

OCC AML examiner told the Subcommittee: “I thought I saw it all with Riggs but HSBC was

the worst situation I’d ever seen,” yet during the six-year period from 2004 to 2010, OCC

officials did not take any formal or informal enforcement action to compel HBUS to strengthen

its AML program, essentially allowing its AML problems to fester. In 2009, after learning of

two law enforcement investigations involving AML issues at the bank, the OCC suddenly

expanded and intensified an ongoing AML examination and allowed it to consider a wide range

of AML issues. The OCC examination culminated in the issuance, in September 2010, of a

blistering supervisory letter listing numerous, serious AML problems at the bank. In October

2010, the OCC also issued a Cease and Desist Order requiring HBUS to revamp its AML

controls.

In response, HBUS has announced a number of key organizational and policy initiatives

to improve its AML program in the United States and globally. While those initiatives are

promising, HBUS announced similarly promising AML reforms in 2003, when confronted with

an AML enforcement action by the Federal Reserve Bank of New York and New York State

Banking Department. Even before the OCC lifted that order in 2006, HBUS’ AML program

deteriorated. Both HBUS and the OCC will have to undertake a sustained effort to ensure the

newest round of changes produce a better AML outcome.

HSBC is the quintessential global bank, operating hundreds of affiliates in 80 countries,

with its U.S. affiliate acting as the gateway into the U.S. financial system for the entire network.

Permanent Subcommittee on Investigations, S.Hrg. 108-633 (July 15, 2004).

10

The OCC allowed AML problems at HBUS to build up until they represented major AML

vulnerabilities for the United States. Going forward, HBUS needs far stronger controls to ensure

it doesn’t leave AML risks to the U.S. financial system unattended; the OCC needs a much better

approach to resolve AML problems in a more effective and timely manner.

This Report makes the following findings of fact.

(1) Longstanding Severe AML Deficiencies. HBUS operated its correspondent

accounts for foreign financial institutions with longstanding, severe AML

deficiencies, including a dysfunctional AML monitoring system for account and

wire transfer activity, an unacceptable backlog of 17,000 unreviewed alerts,

insufficient staffing, inappropriate country and client risk assessments, and late or

missing Suspicious Activity Reports, exposing the United States. to money

laundering, drug trafficking, and terrorist financing risks.

(2) Taking on High Risk Affiliates. HBUS failed to assess the AML risks associated

with HSBC affiliates before opening correspondent accounts for them, failed to

identify high risk affiliates, and failed for years to treat HBMX as a high risk

accountholder.

(3) Circumventing OFAC Prohibitions. For years in connection with Iranian U-turn

transactions, HSBC allowed two non-U.S. affiliates to engage in conduct to avoid

triggering the OFAC filter and individualized transaction reviews. While HBUS

insisted, when asked, that HSBC affiliates provide fully transparent transaction

information, when it obtained evidence that some affiliates were acting to

circumvent the OFAC filter, HBUS failed to take decisive action to confront those

affiliates and put an end to conduct which even some within the bank viewed as

deceptive.

(4) Disregarding Terrorist Links. HBUS provided U.S. correspondent accounts to

some foreign banks despite evidence of links to terrorist financing.

(5) Clearing Suspicious Bulk Travelers Cheques. In less than four years, HBUS

cleared over $290 million in sequentially numbered, illegibly signed, bulk U.S.

dollar travelers cheques for Hokuriku Bank, which could not explain why its clients

were regularly depositing up to $500,000 or more per day in U.S. dollar travelers

cheques obtained in Russia into Japanese accounts, supposedly for selling used

cars; even after learning of Hokuriku’s poor AML controls, HBUS continued to do

business with the bank.

(6) Offering Bearer Share Accounts. Over the course of a decade, HBUS opened

over 2,000 high risk bearer share corporate accounts with inadequate AML controls.

11

(7) Allowing AML Problems to Fester. The OCC allowed HBUS’ AML deficiencies

to fester for years, in part due to treating HBUS’ AML problems as consumer

compliance matters rather than safety and soundness problems, failing to make

timely use of formal and informal enforcement actions to compel AML reforms at

the bank, and focusing on AML issues in specific HBUS banking units without also

viewing them on an institution-wide basis.

This Report makes the following recommendations.

(1) Screen High Risk Affiliates. HBUS should reevaluate its correspondent

relationships with HSBC affiliates, including by reviewing affiliate AML and

compliance audit findings, identifying high risk affiliates, designating affiliate

accounts requiring enhanced monitoring, and closing overly risky accounts. HBUS

should conduct a special review of the HBMX account to determine whether it

should be closed.

(2) Respect OFAC Prohibitions. HSBC Group and HBUS should take concerted

action to stop non-U.S. HSBC affiliates from circumventing the OFAC filter that

screens transactions for terrorists, drug traffickers, rogue jurisdictions, and other

wrongdoers, including by developing audit tests to detect undisclosed OFAC

sensitive transactions by HSBC affiliates.

(3) Close Accounts for Banks with Terrorist Financing Links. HBUS should

terminate correspondent relationships with banks whose owners have links to, or

present high risks of involvement with, terrorist financing.

(4) Revamp Travelers Cheque AML Controls. HBUS should restrict its acceptance

of large blocks of sequentially numbered U.S. dollar travelers cheques from HSBC

affiliates and foreign financial institutions; identify affiliates and foreign financial

institutions engaged in suspicious travelers cheque activity; and stop accepting

travelers cheques from affiliates and foreign banks that sell or cash U.S. dollar

travelers cheques with little or no KYC information.

(5) Boost Information Sharing Among Affiliates. HSBC should require AML

personnel to routinely share information among affiliates to strengthen AML

coordination, reduce AML risks, and combat wrongdoing.

(6) Eliminate Bearer Share Accounts. HBUS should close its remaining 26 bearer

share corporate accounts, eliminate this type of account, and instruct financial

institutions using HBUS correspondent accounts not to execute transactions

involving bearer share corporations. U.S. financial regulators should prohibit U.S.

banks from opening or servicing bearer share accounts.

12

(7) Increase HBUS’ AML Resources. HBUS should ensure a full time professional

serves as its AML director, and dedicate additional resources to hire qualified AML

staff, implement an effective AML monitoring system for account and wire transfer

activity, and ensure alerts, including OFAC alerts, are reviewed and Suspicious

Activity Reports are filed on a timely basis.

(8) Treat AML Deficiencies as a Matter of Safety and Soundness. The OCC should

align its practice with that of other federal bank regulators by treating AML

deficiencies as a safety and soundness matter, rather than a consumer compliance

matter, and condition management CAMELS ratings in part upon effective

management of a bank’s AML program.

(9) Act on Multiple AML Problems. To ensure AML problems are corrected in a

timely fashion, the OCC should establish a policy directing that the Supervision

Division coordinate with the Enforcement and Legal Divisions to conduct an

institution-wide examination of a bank’s AML program and consider use of formal

or informal enforcement actions, whenever a certain number of Matters Requiring

Attention or legal violations identifying recurring or mounting AML problems are

identified through examinations.

(10) Strengthen AML Examinations. The OCC should strengthen its AML

examinations by citing AML violations, rather than just Matters Requiring

Attention, when a bank fails to meet any one of the statutory minimum

requirements for an AML program; and by requiring AML examinations to focus

on both specific business units and a bank’s AML program as a whole.

13

This section provides a general overview of HSBC Group, HSBC Bank USA (HBUS),

and the HBUS compliance and anti-money laundering (AML) program.

HSBC Group is one of the largest financial institutions in the world, with over $2.5

corporation, HSBC Holdings plc, often referred to by the bank as “HSBC Group,” is

headquartered in London. Despite its London headquarters, the principal office of the Group

and 7,200 offices in over 80 countries, including North America, Europe, Asia, Latin America,

United States Operations. Among other entities, the Group owns HSBC Overseas

Holdings (UK) Ltd. (“HSBC Overseas Holdings”), which oversees its operations in the United

States and Canada. HSBC Overseas Holdings owns, in turn, HSBC North America Holdings

Inc. (“HNAH,” pronounced “Hannah”), one of the ten largest bank holding companies in the

United States. HNAH has assets of about $345 billion, is headquartered in New York City, and

HSBC financial institutions in the United States: HSBC Bank USA N.A. (“HBUS”); HSBC

Securities (USA) Inc. (“HSBC Securities”); and HSBC Finance Corporation.

HBUS operates more than 470 bank branches throughout the United States, manages

bank charter and its primary regulator is the Office of the Comptroller of the Currency (OCC),

which is part of the U.S. Treasury Department. Because it holds insured deposits, its secondary

regulator is the Federal Deposit Insurance Corporation (FDIC). HBUS is the principal subsidiary

of HSBC USA Inc. (“HUSI”), a bank holding company which is a wholly-owned subsidiary of

content/assets/investor_relations/hsbc2011arn.pdf; “HSBC Holdings plc Annual Report and Accounts

2011,” at 1, http://www.hsbc.com/1/PA_esf-ca-app-content/content/assets/investor_relations/hsbc2011ara0.pdf

(hereinafter “HSBC Group 2011 Annual Report”).

http://www.hsbc.com/1/2/newsroom/news/2010/hsbc-announces-new-leadership.

prepared by HSBC, http://www.hsbc.com/1/2/newsroom/news/2010/hsbc-announces-new-leadership.

http://www.us.hsbc.com/1/PA_1_083Q9FJ08A002FBP5S00000000/content/usshared/Inside%20HSBC/About%20

HSBC/Corporate%20Information/Corporate%20Facts/hnah_factsheet_0911.pdf.

http://www.us.hsbc.com/1/PA_1_083Q9FJ08A002FBP5S00000000/content/usshared/Inside%20HSBC/About%20

HSBC/Corporate%20Information/Corporate%20Facts/hbus_factsheet_0911.pdf (hereinafter “HBUS Fact Sheet”).

14

HSBC Securities is a licensed broker-dealer regulated by the SEC. HSBC Finance

Corporation, formerly subprime lender Household International, provides credit cards,

automobile loans, consumer lending, and insurance products, and is overseen by several U.S.

regulators including the Consumer Financial Protection Bureau.

HNAH also owns an Edge Act corporation in Miami, HSBC Private Bank

engage solely in international banking operations, including holding deposits for non-U.S.

addition, HNAH sponsors the HSBC Latin American International Center, also referred to as

“HSBC Miami Offshore,” in Miami. This center, like HSBC Private Bank International, is

designed to help meet the needs of Latin American clients with banking needs in the United

HNAH owns several other subsidiaries as well, including HSBC Trust Company, N.A.,

of Delaware, and HSBC Bank Nevada, N.A., of Las Vegas Nevada.

HBUS Major Lines of Business. HBUS has six major lines of business in the United

checking, savings, mortgages, loans, brokerage products, and certificates of deposit (“CDs”) to

The HBUS “Private Banking” offers wealth management services for high net worth

banking, investment, custody, wealth planning, trust and fiduciary, insurance, and philanthropic

The HBUS “Commercial Banking” offers global banking services to financial

services include deposits, checking, remote deposit capture, payments and cash management,

pouch services, corporate loans and financing, merchant services, and insurance products.

Vivenzio to OCC colleagues, “HSBC FAQs,” OCC-PSI-00898845-857.

Subcommittee interviews of OCC examiners Joe Boss and Elsa de la Garza, January 30, 2012 and January 9, 2012.

15

The HBUS “Global Banking and Markets” line of business, with offices in more than 60

countries, provides a wide range of “tailored financial solutions” to major government,

correspondent banking relationships, in which HBUS provides banks from other countries with

U.S. dollar accounts to transact business in the United States. Due to its affiliates in over 80

countries, HSBC is one of the largest providers of correspondent banking services in the world.

In 2010, it had about 2400 correspondent customers, including for more than 80 HSBC

U.S. financial system by handling international wire transfers, clearing a variety of U.S. dollar

instruments, including travelers cheques and money orders, and providing foreign exchange

services. HBUS Payment and Cash Management (PCM) is a key banking division, located in

In addition, as part of this line of business, until 2010, HBUS housed the Global

Banknotes Department, which used offices in New York City, London, Hong Kong, and

Department derived its income from the trading, transportation, and storage of bulk cash, doing

business primarily with other banks and currency exchange businesses, but also with HSBC

Reserve Bank of New York (FRBNY) to operate U.S. currency vaults in several cities around the

world to assist in the physical distribution of U.S. dollars to central banks, large commercial

the wholesale U.S. banknotes line of business, later selling portions of the business to other

The HBUS “Global Asset Management” line of business offers worldwide investment

of the largest investment businesses in the world. Finally, “HSBC Insurance” provides a wide

In addition to these major lines of business, in recent years, HBUS has become a leader in

providing banking services to foreign embassies with a presence in the United States. HBUS

(‘BSA/AML’) Examination – Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21),” OCC-PSI-00864335-

365, at 7. [Sealed Exhibit.] Subcommittee briefing by HSBC legal counsel (6/20/2012).

Examination – Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21),” OCC-PSI-00864335-365, at 341-342

[Sealed Exhibit.]; Subcommittee interview of Michael Gallagher (6/13/2012).

Limited (UOB) for $11 million, and in 2011, sold its European banknotes business to HSBC Bank plc. It recorded

total closure costs of $14 million during 2010. Id.

16

began this business after Riggs Bank and Wachovia Bank stopped providing those services in

Through its correspondent banking and Payments and Cash Management (PCM)

businesses, HBUS has become one of the largest facilitators of cash transfers in the world.

Between 2005 and 2009, the total number of PCM wire transactions at HBUS grew from 20.4

million to 30.2 million transfers per year, with a total annual dollar volume that climbed from

provides over 95% of U.S. dollar wire transfers across U.S. borders and nearly half of all wire

HSBC Affiliates. HSBC has hundreds of affiliates located in over 80 countries. At least

80 HSBC affiliates have turned to HBUS for access to U.S. dollars and the U.S. financial system.

These affiliates typically interact with HBUS by opening a correspondent account at HBUS

headquarters in New York. Many use the account to clear U.S. dollars wire transfers; some use

the account to cash U.S. dollar instruments like travelers cheques or money orders; still others

use the account for foreign exchange purposes. In addition, some opened a separate account to

buy or sell physical U.S. dollars as part of HBUS’ wholesale banknotes business, until it was

shuttered in 2010.

HSBC affiliates have accounted for a large portion of HBUS’ U.S. dollar activities. In

2009, for example, HSBC determined that “HSBC Group affiliates clear[ed] virtually all USD

[U.S. dollar] payments through accounts held at HBUS, representing 63% of all USD payments

clearing business had increased over 200%, from processing an average daily amount of $185

affiliates in other countries. It has been estimated that, in 2009, HBUS processed 19.4 million

One of the largest HSBC affiliates is The Hongkong Shanghai Banking

Corporation Ltd., which is incorporated in Hong Kong and is Hong Kong’s largest

“HSBC to Open D.C. Branch, Pursue Embassy Clients,” Washington Post, Terence O’Hara (10/5/2004)(quoting

Riggs spokesperson: “As a service to our remaining embassy clients, Riggs is working closely with HSBC to ensure

a smooth transition.”), http://www.washingtonpost.com/ac2/wp-dyn/A7285-2004Oct4?language=printer.

(‘BSA/AML’) Examination – Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21),” OCC-PSI-00864335-

365, at 7. [Sealed Exhibit.]

01274962, at 4. [Sealed Exhibit.]

prepared by HSBC and provided to the OCC, at HSBC OCC 8874197.

(‘BSA/AML’) Examination – Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21),” OCC-PSI-00864335-

365, at 7. [Sealed Exhibit.]

17

founding member of the HSBC Group, but now operates as a subsidiary of HSBC

Holdings plc, the Group’s parent corporation. With more than 71,400 employees, it

oversees a network of hundreds of HSBC affiliates in 20 countries throughout Asia and

the Pacific Region, including Australia, Bangladesh, China, India, Japan, Malaysia, New

documents as HBAP, an abbreviation for HSBC Bank Asia Pacific.

A second key affiliate is HSBC Bank Middle East Ltd. (HBME). Incorporated in

Jersey in the Channel Islands and owned through a chain of subsidiaries reaching back to

the Group’s parent corporation in London, HBME oversees a network of financial

employees, HBME provides banking services through nearly 45 branches in Algeria,

Bahrain, Jordan, Kuwait, Lebanon, Oman, Pakistan, Qatar, and the United Arab

financial services division” designed to “serve the particular needs of Muslim

A third affiliate discussed in this Report is HSBC Mexico S.A. Banco (HBMX), the

principal operating company of Grupo Financiero HSBC, S.A. de C.V., which owns HSBC’s

businesses in Mexico. HSBC’s Mexican group is one of Mexico’s largest financial service

conglomerates, with over 1,000 branches throughout the country, nearly $2 billion in assets, and

over 8 million clients.

HBME offers Amanah banking

services to many of its clients in the Middle East and North Africa.

http://www.hsbc.com.hk/1/PA_1_3_S5/content/about/financial-information/financialreports/

bank/pdf/2011report.pdf.

http://www.hsbc.ae/1/2/about-hsbc/newsroom/eighth-best-cash-management, viewed 4/2/12; “HSBC Research

Picks Up More Regional Awards,” (1/12/12),

http://www.hsbc.ae/1/PA_1_083Q9FJ08A002FBP5S00000000/content/uae_pws/pdf/en/newsroom/euromoneyresearch-

awards-jan-12.pdf, viewed 4/12/12. HSBC provides banking services in Saudi Arabia through both HSBC

Saudi Arabia, in which it is a 49% shareholder, and Saudi British Bank (SABB), in which it is a 40% shareholder.

See “HSBC Research Picks Up More Regional Awards,” (1/12/12),

http://www.hsbc.ae/1/PA_1_083Q9FJ08A002FBP5S00000000/content/uae_pws/pdf/en/newsroom/euromoneyresearch-

awards-jan-12.pdf, viewed 4/12/12.

http://www.hsbc.com.mx/1/PA_1_1_S5/content/home_en/investor_relations/press_releases/infpress/hsbc_consuma.

pdf.

18

HSBC Leadership. Over the last few years, HSBC leadership has undergone significant

change. In 2010, HSBC Holdings plc appointed a new Chairman of the Board of Directors,

Group Chief Executive was also selected, replacing Michael Geoghegan, who retired, with Stuart

T. Gulliver. In 2012, HSBC Holdings plc also appointed a new Chief Legal Officer, Stuart

Levey, former Undersecretary for Terrorism and Financial Intelligence at the U.S. Treasury

Also in 2010, Sandy Flockhart, became Chairman of Europe, Middle East, Africa, Latin

first joined HSBC in 1974, is an emerging markets specialist and, among other posts, headed

Group Board of Directors in 2008, and became a director of HSBC Bank Middle East in July

HNAH Leadership. At HNAH, the U.S. bank holding company, the persons holding

leadership positions have often overlapped with those of HNAH’s key subsidiaries, HBUS,

HSBC Securities, and HSBC Finance Corporation. HNAH’s current Chief Executive Officer

predecessor at HNAH, for less than a year, was Niall Booker, who was preceded by Brendan

McDonagh, former Chief Operating Officer (COO) of HBUS. Before Mr. McDonagh, HNAH

was headed by Siddharth (“Bobby”) N. Mehta, who was also head of HSBC Finance

Corporation, but left the bank when HSBC Finance Corporation’s subprime mortgage portfolio

incurred huge losses during the recent financial crisis.

The current HNAH COO is Gregory Zeeman; the current General Counsel is Stuart

Alderoty; and the current Chief Auditor is Mark Martinelli, each of whom currently holds the

position at both HBUS and HSBC Finance Corporation.

HBUS Leadership. Over the last ten years, HBUS has undergone numerous changes in

http://www.hsbc.com/1/2/newsroom/news/2010/hsbc-announces-new-leadership.

The current head is Irene Dorner

http://www.hsbc.com/1/2/newsroom/news/2012/chief-legal-officer. Mr. Levey held his position at the Treasury

Department from July 2004 to February 2011. Id. Mr. Bennett had headed HSBC Group’s Legal and Compliance

department since 1998; in 2010, he had become General Counsel.

http://www.hsbc.com/1/2/newsroom/news/2010/hsbc-announces-new-leadership.

Flockhart as “a career banker, being an emerging markets specialist with over 35 years' experience with HSBC in

Latin America, the Middle East, US and Asia”); interview??.

https://www.us.hsbc.com/1/2/3/personal/inside/about/corporate-information/leadership/hnah.

19

who serves as HBUS’ Chairman of the Board, President, and CEO. She was appointed to those

positions in 2010, after having served as the CEO of HSBC Bank Malaysia and as a director on

the HBUS Board. Her immediate predecessor was Paul J. Lawrence who headed HBUS from

2007 to 2010. His predecessor was Sandy L. Derickson who served in the post for less than one

year and left the bank along with Mr. Mehta after HSBC Finance Corporation, where he was

second-in-command, incurred substantial losses. His predecessor was Martin J.G. Glynn who

headed HBUS from 2003 to 2006, and then retired.

HBUS has a six-person Board of Directors. Its current members are Ms. Dorner; William

R.P. Dalton, former CEO of HSBC Bank plc in London; Anthea Disney, former Executive Vice

President of NewsCorporation; Robert Herdman former SEC Chief Accountant; Louis

Hernandez, Jr., CEO of Open Solutions Inc.; and Richard A. Jalkut, CEO of TelePacific

Communications.

as the COO from 2004 to 2006. Some other key HBUS executives are Marlon Young, the head

of Private Banking Americas; Kevin Martin, the head of Retail Banking and Wealth

Chief Auditor has been Mark Martinelli. From 2000 to 2011, the head of HBUS Payments and

Cash Management (PCM) was Michael Gallagher. The head of Global Banknotes, from 2001 to

2010, was Christopher Lok.

Burak who served as the bank’s General Counsel from 2004 to 2010. In 2007, she was also

The compliance and anti-money laundering (AML) programs at HBUS have undergone

continual organizational and leadership changes since 2005. In April 2003, the Federal Reserve

and New York State Banking Department, which oversaw HBUS’ predecessor bank, cited the

bank for multiple, severe AML deficiencies and required it to enter into a written agreement to

leadership/hbus.

Administrative Officer from February 2007 to March 2007; prior to that he served as audit head at HUSI and HSBC

North America Inc from 2006 to 2007, and as Audit head of HSBC North America Holdings Inc. from 2004 to

2007. Mr. Dew currently works as Managing Director of the Saudi British Bank which is 40% owned by HSBC.

Subcommittee interview of David Dew (3/5/2012).

leadership/hbus, viewed 3/23/12.

leadership/hbus.

Examination – Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21),” OCC-PSI-00000230-259, at 256.

[Sealed Exhibit.]

20

converted to a national bank charter under the supervision of the OCC. During its first year

under OCC supervision, HBUS reorganized its AML program, revamping its AML controls,

country and client risk assessment criteria, Know-Your-Customer (KYC) due diligence

a new system for monitoring account activity, called the Customer Activity Monitoring Program

(CAMP) and established criteria to produce alerts requiring additional reviews. In addition,

HBUS created a system of KYC client profiles with standard due diligence information

requirements for each client and which was updated on a regular basis and had to be approved by

compliance and other bank officials for an account to be kept open. HBUS also established a

Financial Intelligence Group to conduct enhanced due diligence reviews.

issued a lengthy Supervisory Letter again citing the bank for numerous AML deficiencies and

requiring HBUS to revamp its AML program a second time. In response, the bank issued an

action plan to correct identified problems. HBUS has, for example, acquired a new AML

monitoring system, NORKOM to replace CAMP, and is working to refine its parameters for

detecting suspicious activity. In its first month of operation, NORKOM detected more than

100,000 transactions needing further review, demonstrating its ability to catch many transactions

that went previously unchecked under CAMP.

HBUS has also revamped its approach to HSBC affiliates, which make up an important

segment of HBUS’ correspondent banking, wire transfer, and cash management businesses and

previously operated without due diligence controls and at times with minimal or no AML

monitoring. Among other changes, HBUS now requires all subsidiaries to conduct due diligence

on all other HSBC affiliates, including by using internal audit information identifying their AML

risks and AML controls; identifies affiliates posing high AML risks and treat them accordingly,

thus ending all policies exempting affiliates from standard AML account and wire transfer

monitoring. In addition, HBUS has revamped its country and client risk assessment criteria,

which now identifies high risk clients in a more robust manner; reviewed its correspondent

banking business to reduce the number of high risk financial institutions; and closed some high

risk business lines including its U.S. banknotes program. HBUS has also hired new AML

leadership and significantly expanded its AML staffing and resources. HBUS currently employs

Some of HBUS’ changes have been criticized by the OCC as inadequate. HBUS has

been informed by the OCC that it must do additional work on its monitoring system in order to

implement the requirements of the 2010 Cease and Desist Order. The individual hired by HBUS

to serve as its Chief Compliance Officer was asked to leave by the bank shortly after starting in

No. 03-012-WA/RB-SM (Board of Governors of the Federal Reserve System, Washington, D.C.), Written

Agreement (4/30/2003), OCC-PSI-00907803-811.

00423650. [Sealed Exhibit.]

Executive Stuart Gulliver, PSI-HSBC-76-0001-002, at 002.

21

2010. Both HBUS and the OCC will have to work hard to ensure that the latest round of changes

will produce a better AML outcome than the changes made in 2004.

Over the last five years, HBUS has experienced high turnover in its Compliance and

AML leadership, making reforms difficult to implement. Since 2007, HBUS has had four

Compliance heads and five AML directors. Currently, both positions are held by the same

person, Gary Peterson. Mr. Peterson has extensive AML experience and was hired in 2010, to be

the AML director, but after the Compliance head was asked to leave in 2010, has since held both

posts. In 2012, Mr. Peterson is expected to relinquish his duties as AML director to his deputy,

Alan Schienberg, so that the top Compliance and AML positions at HBUS will each have a full

The top compliance position at HBUS is the Chief Compliance Officer who oversees all

compliance issues for the bank. In the AML field, HBUS has specified two posts which have

been held by the same person, the Anti-Money Laundering (AML) Directorwho is tasked with

Compliance and AML leadership positions were relatively stable until 2007, after which the

bank has struggled to hire and retain experienced compliance professionals.

HBUS’ Chief Compliance Officer from 2000 to 2007 was Carolyn Wind. Prior to that

position, Ms. Wind worked for Republic Bank of New York as a compliance officer and, before

that, as an OCC bank examiner. For the first three years she held the job, Ms. Wind also served

as the AML Director. In 2003, the bank hired a separate AML Director, Teresa Pesce, who

served in that post for four years, from 2003 to 2007. Before taking the position at the bank, Ms.

Pesce was a federal prosecutor with the U.S. Attorney’s office in New York. Ms. Pesce left the

bank in 2007, after which Ms. Wind headed both the Compliance and AML Compliance

functions until she left the bank later in 2007. As discussed below, Ms. Wind was dismissed by

HBUS after raising the issue of inadequate AML resources with the audit committee of the board

of directors of the bank’s holding company, HNAH.

In 2007, as part of a “Compliance Transformation Initiative,” HSBC established a North

appointed Janet Burak, then Regional Legal Department Head for North America, to also serve

HSBC Group Compliance head David Bagley expressed concern about combining the two roles,

https://www.us.hsbc.com/1/2/3/personal/inside/about/corporate-information/leadership/hbus.

Two years

(‘BSA/AML’) Examination – Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21),” OCC-PSI-00864335-

365, at 27. [Sealed Exhibit.]

HSBC Group’s most senior legal counsel, Richard Bennett, the concern of HBUS compliance personnel about “the

22

later, in March 2009, the Federal Reserve issued a negative critique of Ms. Burak’s performance,

The OCC also later criticized her performance as well as the decision to combine the regional

legal and compliance roles, noting in 2010, that Ms. Burak “has had to balance a wide range of

legal and compliance duties, including establishing the strategic direction for both functions and

a consequence, Ms. Burak had “not regularly attended key committee or compliance department

meetings” and had failed to keep herself and other bank executives “fully informed about issues

feet for a recently discovered backlog of 17,700 alerts indicating possible suspicious activity at

the bank, which had not been reviewed, noting that “[b]acklogged alerts needed to receive the

highest level of attention from senior bank management at a much earlier stage to ameliorate the

In the two years she held the regional posts, Ms. Burak oversaw three functional

compliance teams at HNAH called “Compliance Advisory,” “Compliance Center of Excellence,”

manager: Curt Cunningham, Anthony Gibbs, and Lesley Midzain.

Ms. Midzain was hired in 2007 to replace Carolyn Wind and so worked, not only for

HNAH, but also for HBUS as both its Compliance head and AML director. She held these

compliance posts for two years, from 2007 until 2009. Prior to being placed at the helm of the

bank’s AML program, Ms. Midzain had no professional experience and little familiarity with

U.S. AML laws. In December 2008, HNAH’s regulator, the Federal Reserve, provided a

negative critique of Ms. Midzain’s management of the bank’s AML program. The Federal

Reserve wrote that Ms. Midzain did “not possess the technical knowledge or industry experience

capability of one person to manage a very large legal function and a compliance function” and that “compliance

will be pushed down below Legal”). See also 7/28/2010 email from HSBC David Bagley to HSBC Michael

Geoghegan, HSBC OCC 8873871-75 (expressing to HSBC CEO Michael Geoghegan, that with regard to the 2007

decision to combine the two roles into one: “I fully accepted that Brendan [McDonagh], Paul [Lawrence] and

Richard [Bennett] had the right to make this call, although as I said to you in Vancouver I now wish I had been more

vociferous and in the current way my role operates I am confident that I would have a far stronger say.”).

governance review revealed that Janet Burak, HNAH Legal and Compliance chief risk officer has only broad

understanding of BSA/AML risk and relies on the HNAH BSA/AML officer [Midzain] to manage the risk. …

Midzain, as previously stated has weak BSA/AML knowledge and industry experience. Burak’s heavy reliance on

the inexperienced Midzain is a concern. An example of Burak’s limited management oversight of BSA/AML was

revealed when we recently met with her to clarify a few items from our Governance review she was unable to

respond to the question about the distribution and the purpose of annual AML statements. She subsequently

communicated via email that she does not review the annual AML statements provided to her by the

HNAH/BSA/AML officer (Midzain). Burak forwards the statements to Group.” 3/25/2009 “Summary of Ratings

for HSBC North America Holdings,” Federal Reserve Bank of Chicago, OCC-PSI-00899234.

Examination – Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21),” OCC-PSI-00864335-365, at 27.

[Sealed Exhibit.]

23

from another team and they supported the conclusion of the OCC resident staff that Midzain’s

knowledge and experience with BSA/AML risk is not commensurate to HNAH’s BSA/AML

In 2009, the OCC also concluded that Ms. Midzain did not have the requisite AML

expertise for her position. An OCC Supervisory Letter echoed the criticisms leveled earlier by

the Federal Reserve:

“Ms. Midzain was selected as the Compliance Director and BSA Officer although she

does not have the qualifications or the experience to manage a BSA program at an

institution with the size and amount of BSA compliance risk that HBUS has. She is a

Canadian lawyer (a barrister and solicitor) who formerly worked for HNAH. She is also

a member of Group’s executive development program. … Ms. Midzain’s assignment as

HBUS’ BSA Officer and Compliance Director has been her first assignment outside of

Canada as a part of that program. … During its 2009 compliance management

examination, the OCC determined that Ms. Midzain lacked the experience and expertise

to be the BSA Officer, and the OCC included an MRA in its supervisory letter that

required the bank to strengthen is BSA/AML compliance leadership by hiring a BSA

In response to the Federal Reserve and OCC criticisms, HBUS removed Ms. Midzain

from the AML post, but retained her as head of HBUS’ Compliance department. In the fall of

2009, HBUS hired a new AML Director, Wyndham Clark, a former U.S. Treasury official, who

assumed the post in the middle of an intensifying AML examination by the OCC and a host of

serious AML problems facing the bank. Mr. Clark was required to report to Curt Cunningham,

to Ms. Midzain, whom the OCC had also found to lack AML expertise. Shortly after he arrived,

Cunningham a brief memorandum with his observations, noting that HBUS had an “extremely

high risk business model from AML perspective,” had seen recent high turnover in its AML

directors, and granted only limited authority to the AML director to remedy problems:

“AML Director has the responsibility for AML compliance, but very little control over

its success.

OCC-PSI-00899234.

Examination – Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21),” OCC-PSI-00864335-365, at 28.

[Sealed Exhibit.]

resources,” OCC-PSI-00162661 (Mr. Clark commented after Janet Burak had recently approved three new

compliance personnel positions, “Clearly a positive, although I understand that these were requested quite a while

ago. I hope that isn’t the typical response time.” Ms. Bonosconi responded: “Oh, this was express time. Trust me

on that. Usually the response is ‘no.’”).

24

Operate under ‘crisis’ mode, actions are reactive rather than forward thinking.

AML Director unable to manage at high level.

As he continued his work, Mr. Clark grew increasingly concerned that the bank was not

effectively addressing its AML problems. In February 2010, Mr. Clark met with the Audit

Committee of the HNAH board of directors and informed the committee that he had never seen a

resources were “insufficient versus current risks and volumes,” and the bank’s systems and

more senior HBUS Compliance official that with regard to the bank’s AML compliance

In July 2010, less than a year after taking the post, Mr. Clark decided to resign. He sent

an email to the head of HSBC Group Compliance David Bagley explaining that he did not have

the authority or support from senior compliance managers needed to do his job as AML director:

“[T]he bank has not provided me the proper authority or reporting structure that is

necessary for the responsibility and liability that this position holds, thereby impairing

my ability to direct and manage the AML program effectively. This has resulted in most

of the critical decisions in Compliance and AML being made by senior Management who

have minimal expertise in compliance, AML or our regulatory environment, or for that

matter, knowledge of the bank (HBUS) where most of our AML risk resides. Until we

appoint senior compliance management that have the requisite knowledge and skills in

these areas, reduce our current reliance on consultants to fill our knowledge gap, and

provide the AML Director appropriate authority, we will continue to have limited

When asked about his experience at the bank, Mr. Clark told the Subcommittee that he did not

hired Gary Peterson, who was then an AML consultant to the bank, appointing him as HBUS’

new AML director.

Recommendations Report from AML Director,” HSBC PSI PROD 0065332.

Presentation,” by HBUS Wyndham Clark to the Audit Committee of the HNAH board of directors, HSBC OCC

3900290.

Audit Committee of the HNAH board of directors, HSBC OCC 3900290.

See also 5/9/2010 email from HBUS Wyndham Clark to HNAH Curt Cunningham, “AML Townhall,” OCC-PSI-

00672571 (“Essentially AML decisions are now being made without AML SME [subject matter expertise]. This

will be very apparent to the regulators.”).

left the bank in August 2010. Subcommittee interview of Wyndham Clark (11/30/2011).

leaving, the bank finally approved a number of new AML hires. Id.

25

Around the same time that Mr. Clark left the bank in 2010, Ms. Midzain also departed,

leaving open the post of Chief Compliance Officer. That post remained vacant until 2011, when

Peterson to serve, not only as HBUS’ AML Director, but also as its Compliance head, and as

HNAH’s Regional Compliance Officer following Ms. Burak’s departure in 2010. Mr. Peterson

agreed and has served in all three posts since 2010. Altogether, these personnel changes meant

that, over the last five years, HBUS has had four Chief Compliance Officers and five AML

Directors.

At HSBC Group, HBUS’ parent organization, for nearly ten years, from 2002 to the

present, David Bagley has served as the HSBC Group’s head of Compliance. He is located in

London and oversees both general and AML compliance issues. His second-in-command is

Warren Leaming, Deputy Head of HSBC Group Compliance, who has been in that position since

January 1, 2007. Susan Wright serves as the head of HSBC’s AML efforts. She is also located

in London and has served in that position for more than a decade. John Root is a senior Group

Compliance officer who has concentrated on compliance and AML issues in Mexico and Latin

America. Compliance personnel work with Matthew King who has served as the head of HSBC

Group Audit since 2002.

Federal law requires banks operating in the United States to have a minimum of four

elements, an AML compliance officer in charge of the program, AML internal controls, AML

AML program must address a wide range of AML issues, from customer due diligence, to

monitoring account and wire transfer activity, to reporting suspicious activity to law

enforcement. It must also cover a wide range of business lines and products, including

Correspondent Banking, International Private Banking, Domestic Private Banking, Embassy

Banking, Payment and Cash Management, and Banknotes services.

Inadequate Staffing. Despite its high AML risks, millions of customers, and

employment of more than 16,500 employees overall, from 2006 to 2009, HBUS’s entire

Compliance Department numbered less than 200 full time employees; its AML Compliance staff

OCC examinations

also routinely identified inadequate staffing as a key AML problem, including with respect to

that staffing was her biggest issue and that by March 2008 it was evident that more staff was needed. She made

several requests for additional resources); Subcommittee interview of HBUS Anne Liddy (2/22/2012) (Ms. Liddy

made a request for resources to Carolyn Wind, but was told that there was no appetite to bring on additional staff);

Subcommittee interview of HBUS Carolyn Wind (3/7/2012); Subcommittee interview of HBUS Teresa Pesce

(3/30/2012) (Ms. Pesce asked for business to provide funding for more AML Compliance positions because

Compliance did not have the money).

26

Bank documents show that Compliance and AML staffing levels were kept low for many

years as part of a cost cutting measure. In 2007, HBUS announced a “1509 Initiative,” to

increase the bank’s return on equity by 2009, largely through cost cutting measures. One

component of the plan was to ensure that 2007 and 2008 headcounts remained flat. This hiring

freeze caused HBUS Compliance and the AML staffing requests to be denied or unanswered. At

one point, HBUS Compliance and AML management resorted to requesting temporary staff

when persistent AML alert backlogs grew to unmanageable levels. In 2007, HBUS fired its

longtime AML head after she raised resource concerns with the HNAH Audit Committee; an

AML director hired in 2009 left after being denied the authority and resources he considered

necessary to do his job. After the OCC issued its lengthy Supervisory Letter criticizing multiple

aspects of HBUS’ AML program, bank management began to significantly increase AML staff

and resources.

AML Staffing Problems. In 2006, HBUS Compliance was already struggling to

“handle the growing monitoring requirements” associated with the bank’s correspondent banking

Compliance officer Alan Ketley wrote that despite having very efficient processes, each month

his Compliance team was “handling an average of 3,800 [alerts] per person and [was] becoming

1509 Initiative and Hiring Freeze. In 2007, against the backdrop of losses stemming

from its troubled acquisition of Household International and the beginning of the global financial

crisis, HBUS launched the 1509 Initiative which sought to achieve a 15% return on equity for the

Requests,” OCC-PSI-00851542-545. [Sealed Exhibits.]

OCC-PSI-00107624-625. [Sealed Exhibit.]

00107618-620. [Sealed Exhibit.]

01274962; 1/20/2009 OCC Supervisory Letter HSBC-2008-41, “Office of Foreign Asset Control Examination,”

OCC-PSI-00000434-436. [Sealed Exhibits.]

Examination,” OCC-PSI-00107567-571; 1/30/2006 OCC Supervisory Letter regarding HBUS Embassy Banking,

OCC-PSI-00107529-536. [Sealed Exhibits.]

00000341-345. [Sealed Exhibit.]

DelBusto, “Additional Compliance headcount needed to support PCM,” HSBC OCC 0616340-43, at 341.

DelBusto, Alan Ketley, and others, “Additional Compliance headcount needed to support PCM,” HSBC OCC

0616340-343; 9/25/2006 email exchange between HBUS Michael Gallagher and HBUS Teresa Pesce, Alan Ketley,

Charles DelBusto, and others, “Additional monitoring resources,” HSBC OCC 7688655-657.

27

bank by 2009, primarily by cutting costs. One facet of 1509 was the “$100 Million Dollar Cost

The hiring freeze began in September 2007, when HBUS Compliance had a headcount of

six open positions, David Dew, HBUS Chief Operating Officer (COO), informed Compliance

head and AML director Carolyn Wind that the positions could not be filled:

“This increase will be almost impossible to justify and therefore I must ask you to please

cancel the open positions and ensure that your FTE as at 31 Dec 2007 does not exceed

To make the case for increased staffing resources, in September 2007, HBUS

Compliance personnel reached out to compliance peers at other banks and learned that at the

three major banks that provided some information, each had a greater number of monitoring staff

noted that HBUS Compliance filed many fewer Suspicious Activity Reports (“SARs”) than its

peers filed 30 to 75 per month, and one major international bank disclosed that it filed

AML staff remained stagnant.

Fired After Raising Staffing Concerns to Board. After being turned down for additional

staff, Carolyn Wind, longtime HBUS Compliance head and AML director, raised the issue of

inadequate resources with the HNAH board of directors. A month after that board meeting, Ms.

Wind was fired.

“HEADCOUNT,” HSBC OCC 0616262.

more than HBUS.” 9/6/2007 email from HBUS Alan Ketley to HBUS Alan Williamson, Judy Stoldt, and George

Tsugranes, “Correspondent survey,” HSBC OCC 0616384-385. See also 9/6/2007 HBUS chart, “Correspondent

Banking Survey,” HSBC OCC 3400666. [Sealed Exhibit.] See also emails indicating HBUS Compliance personnel

were not compensated at levels consistent with its competitors, and risked losing qualified personnel. See, e.g.,

2/1/2007 email exchange among HBUS Carolyn Wind, HBUS Teresa Pesce and others, “MIP overages -

URGENT,” HSBC OCC 0616314-316, at 314 (“We are not at market with our current comp[etitors” and “[t]hese

officers and AML officers can get new jobs in a heartbeat”); 2/27/2007 email from HBUS Karen Grom to HBUS

Carolyn Wind, Denise Reilly, Teresa Pesce, David Dew and others, “HUSI Compensation Review,” HSBC OCC

0616318 (“The banks who are approaching our employees have deep pockets and are willing to pay to get the talent.

are in some cases double base salaries and double bonuses[.]”).

“Correspondent survey,” HSBC OCC 0616384-385 (Mr. Ketley wrote “Our competitors all acknowledge filing

more SARs than we do.”); 9/6/2007 HBUS chart, “Correspondent Banking Survey,” HSBC OCC 3400666. [Sealed

Exhibit.]

Alan Williamson, “Addressing negative information,” HSBC OCC 7688584-587, at 587.

28

On October 24, 2007, Ms. Wind met with the Audit Committee of the HNAH board of

directors and, during the meeting, raised the staffing issue, particularly with respect to the

Embassy Banking area which had been the subject of two recent OCC examinations uncovering

severe AML deficiencies. Her supervisor, Regional Compliance Officer Janet Burak, also

attended the Audit Committee meeting. The day after the meeting, in an email to HSBC Group

Compliance head David Bagley, Ms. Burak expressed displeasure that Ms. Wind’s comments

had caused “inappropriate concern” at the Audit Committee:

“I indicated to her [Ms. Wind] my strong concerns about her ability to do the job I need her

to do, particularly in light of the comments made by her at yesterday’s audit committee

meeting …. I noted that her comments caused inappropriate concern with the committee

around: our willingness to pay as necessary to staff critical compliance functions (specifically

embassy banking AML support), and the position of the OCC with respect to the merger of

A month after the board meeting, after seven years as HBUS’ Compliance head, Ms. Wind

was fired. In a January 22, 2008 letter to the head of HBUS Human Resources, Ms. Wind wrote:

“I was told on November 30, 2007 that I was being terminated effective 2/28/08, due to the

fact that the Board had lost confidence in me. … If the Board has lost confidence in me

based on my comments at the October, 2007 Audit Committee, why have I been allowed to

continue to run this critical department without additional supervision or any direct follow-up

from Group Compliance?”

Ms. Wind also wrote: “David [Dew] and I disagree on the extent to which my organization can

withstand cost cuts and still maintain an effective compliance risk mitigation program. I also

believe in an open dialog with the Board and its committees, which may go against the desires of

Subcommittee that she believed she was fired for telling the HNAH board about the need for

Hiring Freeze Continues. After her departure, the hiring freeze continued throughout

with HNAH COO Anthony Gibbs:

that she had been terminated due to Ms. Wind raising resource concerns to the board’s audit committee.

Subcommittee interview of Anne Liddy (2/22/2010). Also see, Minutes of the Audit Committee Meeting, October

24, 2007, OCC-PSI-0070680.

Committee [EXCO], “Attached is a draft of the non-hiring freeze note to be sent to all GCBs 0, 1, 2 and the final

headcount report for 2007 which we will discuss tomorrow at EXCO.” 1/17/2008 email from HBUS Jeanne

Ebersole to HBUS Chris Davies, David Dew, Janet Burak and others, “Draft Materials for EXCO,” HSBC OCC

0616259-260, at 259.

29

“HBUS Compliance has been required to manage down overall FTE [full time

employees] while at the same time redeploying resources to priority needs. We also are

in the midst of a ‘hiring pause’ which means that approval from appropriate EXCO

members is required to fill any open position. I do not expect a lot of support for overall

HBUS Compliance headcount increasing even if a portion of the time is allocated to other

In June 2008, a senior PCM operations manager emailed senior HBUS Compliance

official Anne Liddy about growing backlogs in the OFAC Compliance program:

“I have put forth the suggestion of hiring up some first level checkers for OFAC

processing in the GSC…we’re strapped and getting behind in investigations (on OFAC

cases) and have some of our key managers in the queues releasing items…I’m told I

An OCC examination later found that eight Compliance officers were under “rigorous pressure”

In July 2008, however, HSBC Group senior management determined that the hiring

freeze would continue to the end of the year. CEO Michael Geoghegan wrote to HNAH CEO

Brendan McDonagh and others: “We have agreed that we will have a headcount freeze until the

HBUS Compliance personnel, with the support of their business units, attempted to

obtain an exception to the hiring freeze. In a September 2008 email, Michael Gallagher, PCM

head at HBUS, requested additional Compliance staff, explaining: “I have expressed

considerable concern for some time over the lack of resources both in compliance and within

pcm [Payments and Cash Management] to adequately support kyc [Know Your Customer] and

echoed his concerns and requested four additional full time employees:

“Given the hiring freeze in global businesses, I understand that it may also need approval

by Paul Lawrence, but this has continued to be an area of notable risk and regulatory

others, “Organizational Changes,” HSBC OCC 0616264.

GSC’s,” HSBC OCC 0616349-350, at 349.

01274962 (“the bank’s Compliance teams are under rigorous pressure to process alerts and determin[e] a disposition

in a timely manner”). [Sealed Exhibit.]

OCC-PSI-00727922.

Andrew Long, Chris Davies and others, “Kyc hires,” HSBC OCC 0616352-356, at 356. When asked about this

document, Mr. Gallagher said that Mr. Dew had informed him that broader concerns in the U.S. and at Group

necessitated a flat headcount. Subcommittee interview of Michael Gallagher (6/13/2012).

30

After expressing concern over how additional hires would impact operating expenses, Mr. Dew,

Hiring did not improve during 2009. Wyndham Clark, who had been hired in 2009, as

the new HBUS AML director, noted in an email that Janet Burak had recently approved three

new compliance positions. He wrote: “Clearly a positive, although I understand that these were

requested quite a while ago. I hope that isn’t the typical response time.” A senior PCM

operations officer responded: “Oh, this was express time. Trust me on that. Usually the

OCC Examination. During late 2009 and the first half of 2010, the OCC expanded and

intensified its examination of the bank’s AML program as a whole. Mr. Clark made increasing

use of temporary employees and contractors to answer OCC inquiries and address AML

deficiencies. In August, he left the bank. By then, he was using nearly 100 temporary

employees and contractors and had requested 50 additional permanent full time Compliance

Letter identifying AML deficiencies at the bank criticized HBUS’ failure “to provide adequate

staffing and resources to implement and maintain a BSA/AML compliance program

“Management is still in the process of determining an appropriate level of resources as they

consider recommendations from outside consultants and make strategic decisions about the

AML Monitoring Deficiencies. In addition to AML leadership problems and inadequate

AML staffing, another key component of HBUS’ AML program involved its monitoring

systems. During the period reviewed by the Subcommittee, dating from 2004, HBUS used a

monitoring system called the Customer Activity Monitoring Program (CAMP). This system had

many limitations and often required manual reviews by HBUS Compliance and AML staff.

By 2006, as indicated earlier, HBUS Compliance was already struggling to handle the

monitoring alerts generated by the bank’s growing correspondent banking and cash management

Backlogs of unreviewed

OCC-PSI-00162661.

Examination – Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21),” OCC-PSI-00864335-365, at 29.

[Sealed Exhibit.]

DelBusto, “Additional Compliance headcount needed to support PCM,” HSBC OCC 0616340-43, at 342.

31

alerts in different areas of the bank began to accumulate, including with respect to alerts

generated by CAMP monitoring of client accounts and wire transfer activity; alerts triggered by

the OFAC filter on transactions by potentially prohibited persons identified on OFAC lists of

terrorists, drug traffickers, and other wrongdoers; and alerts related to potentially suspicious

activity in Embassy Banking accounts.

With respect to the general CAMP system alerts for PCM, HBUS Compliance set a goal

that no more than 2% of AML alerts should remain in the system for over 120 days without

being resolved. In addition, the system notified increasingly senior management if the backlog

exceeded certain thresholds. For example, when the CAMP alerts hit 3%, bank compliance

officials like Anne Liddy were alerted; when it hit 4%, higher level compliance personnel such

as AML director Lesley Midzain were notified; if the backlog hit 6%, HNAH’s Regional

alerts in the system for longer than 120 days spiked from four percent in October to nine

In early 2010, as part of its expanded AML examination, the OCC discovered the CAMP

backlog of more than 17,000 unreviewed alerts as well as a backlog of requests for enhanced due

“offshore reviewers in India, HBUS staff in Delaware, HBUS temporary volunteers, [and]

found that 34% of the alerts supposedly resolved had to be re-done.

As Ms. Wind reported to the board in October 2007, backlogs were also an issue in

Embassy Banking. A 2008 OCC examination identified a backlog of over 3,000 alerts

response, HBUS initiated a concentrated effort to review and resolve those alerts prior to a

The followup examination found a backlog of about

Requests,” OCC-PSI-0085142. [Sealed Exhibit.]

Examination – Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21),” OCC-PSI-00864335-365, at 9.

[Sealed Exhibit.]

231. [Sealed Exhibit.]

Hughes. OCC-PSI-00409095. Also see 7/14/2008 Memorandum from HBUS Debra Bonosconi to HBUS David

Dew, Lesley Midzain, Cam Hughes, “As shown in the chart below, we currently (as of 7/15) have a total of 1,793

120 days and 147 open in excess of 90 days (350 combined) and we are concentrating our efforts on reducing those

first. We are closing an average of 84 alerts daily (including Saturday) and based upon current projections, we

should have total of 1,499 pending alerts when the OCC arrives on July 21, 2008.” OCC-PSI-00285742

32

1,800 alerts, some of which dated from 2007. The OCC examiners recommended issuance of a

cease and desist order to the bank in part due to the backlog, but the OCC instead issued a

Supervisory Letter, identified the backlog as a Matter Requiring Attention by the bank, and

A third category of alert backlog involved transactions that were stopped by the OFAC

filter as possible violations of OFAC regulations. Each transaction had to be manually reviewed

and resolved by two 4-person OFAC Compliance teams in New York and Delaware. In July

undergone several adjustments just prior to its launch, including changes to its OFAC filters,

backlog, but the problem still took weeks to resolve.

In December 2009, HBUS’ OFAC Compliance team in New York had accumulated a

resources to loan, and suggested asking the Compliance team in Delaware for help. The OFAC

Compliance team in New York indicated the Delaware Compliance staff was already “fully

deployed” dealing with general alerts from the CAMP monitoring system:

“We have considered all options at this point[;] the Compliance team in DE is already

fully deployed dealing with wire camp alerts and bank examiner requests for the current

exam. There is no bandwidth there at all[;] they are behind on the current alert clearing

Understaffed, HBUS Compliance and AML staff constantly battled alert backlogs while

requesting additional resources. These requests, if answered, generally resulted in additional

temporary staff dispatched only when backlogs grew to unmanageable levels. As the backlog

increased, tensions grew, and in February 2010, Mr. Clark, the AML Director who had been on

the job only a few months, wrote: “[W]e are in dire straights [sic] right now over backlogs, and

Examination,” OCC-PSI-00107607-611. [Sealed Exhibit.]

Examination – Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21),” OCC-PSI-00864335-365, at 9.

[Sealed Exhibit.]

OCC 7688680-682; 7/18/2007 email from HBUS Carolyn Wind to HBUS William Johnson, David Dew, Michael

Gallagher, Andrew Long, David Bagley and others, “HBUS GPS Day 2 and 3 Update,” HSBC OCC 7688676-678,

at 677.

Sandra Peterson, Thomas Halpin, Chris Davies, and Lesley Midzain, “OFAC Payments,” HSBC OCC 7688668-670,

at 670.

33

decisions being made by those that don’t understand the risks or consequences of their

The problems with HBUS’ AML monitoring system were not limited to the backlogs.

Additional issues involved an array of problematic decisions on what clients and countries

should be designated high risk and subject to enhanced monitoring; what accounts and wire

transfer activity should be subject to or excluded from routine AML monitoring; what

parameters should be used to trigger alerts, including dollar thresholds, key words or phrases,

and scenario rules that combine specified elements; and what “negative rules” should be used to

September 2010 Supervisory Letter identified multiple problems with each of these elements of

Current Status of HBUS AML Program. In the two years since the OCC issued its

September 2010 Supervisory Letter and both the OCC and Federal Reserve issued October 2010

Cease and Desist Orders to HBUS and HNAH regarding the many AML deficiencies in their

programs, both HBUS and HNAH, as well as HSBC, have made commitments to strengthen

their AML programs, including by directing more resources to compliance needs. HBUS told

the Subcommittee that Gary Peterson will remain as its Compliance head, and his deputy will

HBUS also informed the Subcommittee that as of July 2012, it had increased its Compliance and

an improved AML monitoring system, NORKOM. Additional reforms include scaling back its

correspondent banking and embassy banking relationships by closing higher risk accounts, as

email the next day, Mr. Clark wrote: “At this point the businesses are not accepting that they own the risk, I can

think of one exception, making the difficult decisions and taking the necessary steps to mitigate the risk. My view is

the risks are being ignored by the business, and they are simply waiting for compliance to tell them what the risks

are and to convince them as to what actions need to be taken. If they don’t know what the risks are, then why are

they opening accounts or continuing with the relationship?” On the same day, Anne Liddy responded: “[W]e spend

a lot of energy pushing our point and holding our ground and certainly Group member referred

relationships/transactions have increased our HBUS risk.” 2/27/2010 email exchange between HBUS Anne Liddy,

Wyndham Clark, and Debra Bonosconi, OCC-PSI-00165932.

With respect to HSBC affiliates, HBUS told

the Subcommittee it has initiated due diligence reviews of all such affiliates to identify those that

are high risk, enabled all affiliates to obtain internal audit findings and other information to

(‘BSA/AML’) Examination – Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21),” OCC-PSI-00864335-

365, at 10-21. [Sealed Exhibit.]

“HSBC to Testify at U.S. Senate Hearing.” letter by HSBC Group Chief Executive Stuart Gulliver, PSI-HSBC-76-

0001-002, at 002.

relationships. In August 2010, as part of this review to exit relationships, HBUS CEO Irene Dorner noted that she

was recommending closing relationships with 121 international banks that the bank “to withdraw from those which

do not meet either risk or return hurdles.” 9/20/2010 email from Irene Dorner to Andrew Long and others, HSBC

OCC 8876103-106.

34

improve affiliate risk assessments, ended any limits on the monitoring of affiliates, and increased

In addition, on April 30, 2012, HSBC Group issued a new Group Circular Letter 120014,

announcing the intention of the bank to use the highest global compliance standards for every

HSBC affiliate. The HSBC GCL stated:

“We must adopt and enforce the adherence to a single standard globally that is

determined by the highest standard we must apply anywhere. Often, this will mean

adhering globally to U.S. regulatory standards, but to the extent another jurisdiction

requires higher standards, then that jurisdiction’s requirements must shape our global

This new GCL could represent a groundbreaking approach for the bank if it, in fact, pushes its

affiliates toward uniform and high compliance standards.

These reforms, like those announced in 2004 after the bank’s last AML enforcement

action, have the potential to resolve the AML deficiencies at the bank and push HBUS to an

improved level of AML compliance. While HBUS has committed to making major changes, the

bank made similar commitments under the 2003 enforcement action, which the OCC lifted in

2006, after which the bank’s AML program quickly deteriorated. On many occasions since then,

HBUS responded to AML problems identified by the OCC by instituting new policies and

procedures that appeared to be effective remedies. However, it has often been the case that

regulators would subsequently cite HBUS for failing to comply with its own policies and

procedures. In 2006, for example, when the OCC lifted the AML enforcement action, HBUS

had already incurred over 30 AML-related Matters Requiring Attention, many of which cited

AML problems similar to those that had formed the basis of the written agreement.

In addition, not all of the AML reforms proposed since 2010 have proceeded smoothly.

The new compliance head hired by the bank left after fifteen months. The bank’s new

monitoring system has been the subject of OCC criticisms aimed at whether its monitoring

parameters have been correctly set to identify suspicious activity and provide adequate AML

While the recent GCL could represent

an important advance in requiring bank affiliates to adhere to the highest AML standards

globally, as this report documents, it can take months, if not years, for HSBC affiliates to come

into compliance with HSBC GCL directives. The burden of proof is on HSBC Group to show

that its latest directive is taking hold and its affiliates are complying with the highest AML

stands, and on HBUS to show that it is moving from an ineffective AML program to one that

safeguards the U.S. financial system from abuse.

Secrecy Act and Anti-Money Laundering (BSA/AML) System Examination,” PSI-OCC-37-0004. [Sealed Exhibit.]

See also 6/25/2012 HSBC response letter, “Supervisory Letter HSBC 2012-19 Payments and Cash Management

(PCM); Bank Secrecy Act and Anti-Money Laundering (BSA/AML) System Examination,” HSBC-PSI-PROD-

0200315-341.

35

HBUS has opened correspondent accounts for approximately 80 HSBC affiliates around

the world, providing them with access to the U.S. financial system through clearing U.S. dollar

wire transfers, cashing U.S. dollar checks, buying and selling physical U.S. dollars, and other

high risk clients, or offer high risk financial products. Until recently, HSBC Group policy,

however, allowed its affiliates to assume that any HSBC affiliate owned 50% or more by the

Group met Group AML standards, were low risk, and required no due diligence prior to opening

not conduct any due diligence analysis or risk assessment of an HSBC affiliate prior to supplying

it with a U.S. account. HBUS took that approach, even though U.S. statutory and regulatory

requirements explicitly direct U.S. banks to conduct due diligence prior to opening a

correspondent account for any foreign financial institution, with no exception for foreign

HBMX, an HSBC affiliate in Mexico, illustrates how providing a correspondent account

and U.S. dollar services to a high risk affiliate increased AML risks for HBUS. HBMX was

created when HSBC Group purchased a Mexican bank known as Bital in 2002. A pre-purchase

review disclosed that the bank had no functioning compliance program, despite operating in a

country confronting both drug trafficking and money laundering. For years, HSBC Group knew

that HBMX continued to operate with multiple AML deficiencies while serving high risk clients

and selling high risk products. HSBC Group also knew that HBMX had an extensive

correspondent relationship with HBUS and that suspect funds moved through the HBMX

account, but failed to inform HBUS of the extent of the AML problems at HBMX so that HBUS

could treat HBMX as a high risk account. Instead, until 2009, HBUS treated HBMX as low risk.

Contrary to its designation, HBMX engaged in many high risk activities. It opened

accounts for high risk clients, including Mexican casas de cambios and U.S. money service

businesses, such as Casa de Cambio Puebla and Sigue Corporation which later legal proceedings

showed had laundered funds from illegal drug sales in the United States. HMBX also offered

See 9/13/2010 OCC Supervisory Letter HSBC-2010-22, “Bank Secrecy Act/Anti-Money Laundering (‘BSA/AML’)

Examination – Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21),” OCC-PSI-00864335-365, at 7.

[Sealed Exhibit.] In June 2012, HBUS had a total of nearly 1,200 correspondent clients, of which 80 were HSBC

affiliates. The HSBC affiliates had 395 HBUS accounts, of which 7 or 8 related to HBMX. Subcommittee briefing

by HSBC legal counsel (6/20/2012).

“Order of Investigation – HSBC Bank USA, N.A., New York, NY,” OCC-PSI-00899482-485, at 2 (citing HBUS’s

12/1/2008 AML Procedures Manual at 12: “The only exception to the KYC Profile requirement is any client who is

an HSBC Group affiliate in which HSBC has an ownership interest of 50% or more.”). After the Setember 2010

OCC Supervisory Letter criticizing its practice, HSBC Group changed its policy and now requires all affiliates to

perform due diligence on all other affiliates.

“Order of Investigation – HSBC Bank USA, N.A., New York, NY,” OCC-PSI-00899482-485, at 2 (“The Bank is

obligated to conduct due diligence, and, where necessary, EDD [Enhanced Due Diligence], on foreign

correspondent accounts. 31 U.S.C. § 5318(i)(1). … Section 5318(i) does not exempt foreign correspondent

accounts that a bank maintains for its affiliates.”).

36

high risk products, including providing U.S. dollar accounts in the Cayman Islands to nearly

50,000 clients with $2.1 billion in assets, many of which supplied no KYC information and some

of which misused their accounts on behalf of a drug cartel. HBMX was also the single largest

exporter of U.S. dollars to HBUS, transferring over $3 billion in 2007 and $4 billion in 2008,

amounts that far outstripped larger Mexican banks and other HSBC affiliates. Mexican and U.S.

law enforcement and regulatory authorities expressed rconcern that HBMX’s bulk cash

shipments could reach that volume only if they included illegal drug proceeds that had been

brought back to Mexico from the United States. In addition, for a three-year period from mid-

2006 to mid-2009, HBUS failed to conduct any AML monitoring of its U.S. dollar transactions

with HSBC affiliates, including HBMX, which meant that it made no effort to identify any

HBMX conducted these high risk activities using U.S. dollar correspondent and

banknotes accounts supplied by HBUS. HBMX used those accounts to process U.S. dollar wire

transfers, clear bulk U.S. dollar travelers cheques, and accept and make deposits of bulk cash, all

of which exposed, not only itself, but also HBUS, to substantial money laundering risks. HBMX

compounded the risks through widespread, weak AML controls, while HBUS magnified them by

omitting the due diligence and account monitoring it applied to other accounts. HSBC Group

also compounded the AML risks by failing to alert HBUS to HBMX’s ongoing, severe AML

deficiencies.

In November 2002, HSBC Group purchased Mexico’s fifth largest bank, Banco

Internacional, S.A., then part of Grupo Financiero Bital, S.A. de C.V. (Bital), for about $1.1

changed the name of the bank to HSBC Mexico S.A. Banco (HBMX) and the name of the

holding company to Grupo Financiero HSBC, S.A. de C.V. (GF HSBC). GF HSBC is now one

of Mexico’s largest financial service conglomerates, owning not only HBMX but also a network

HBMX currently has over 1,100 branches, $2 billion in assets, and

http://www.hsbc.com.mx/1/PA_1_1_S5/content/home_en/investor_relations/press_releases/infpress/hsbc_consuma.

pdf; “HSBC Buys Mexican Bank Bital,” CNN.com (8/25/2002),

http://archives.cnn.com/2002/BUSINESS/asia/08/21/uk.hsbc.

http://www.hsbc.com/1/2/newsroom/news/2002/hsbc-agrees-to-acquire-grupo-financiero-bital.

(Mexico) S.A. See 10/21/2011“Doing Business in Mexico,” HSBC publication, at 34,

http://www.hsbc.com/1/content/assets/business_banking/111021_doing_business_in_mexico.pdf.

Mexico website, “Grupo HSBC Mexico,” http://www.hsbc.com.mx/1/2/grupo. Former HBMX head Paul Thurston

told the Subcommittee that HBMX experienced rapid growth from its purchase in 2002. Subcommittee interview of

Paul Thurston (5/1/2012).

37

HSBC Mexico.

Since the purchase of Bital, three persons have served as the head of HSBC Mexico. The

first was Alexander (Sandy) Flockhart who served as Chairman and Chief Executive Officer

(CEO) of HBMX, and later also as CEO of HSBC’s Latin America operations, from 2002 to

headed the Mexico operations for just over a year, from February 2007 to May 2008. When he

Mexican banks, including HBMX, are regulated by the Comision Nacional Bancaria y de

Valores (CNBV) which oversees Mexican banks and securities firms. The Mexican central

bank, Banco de Mexico, the Mexican Ministry of Finance, the Mexican Treasury Department

(SHCP), and the Mexican Financial Intelligence Unit (FIU) also perform oversight functions.

Mexico has a well-developed set of AML laws and regulations. Mexican regulators and law

enforcement agencies work with their U.S. counterparts to combat drug trafficking and money

laundering in both countries.

HBMX is a large, sophisticated bank offering a full range of banking services, including

deposits, checking, foreign exchange, commercial banking services, private banking and wealth

management, and correspondent banking. HMBX offers correspondent accounts to a wide range

of financial institutions. HBMX also maintains correspondent accounts for itself at other banks

around the world, including in the United States. In 2002, at the time Bital was purchased, the

bank had $647 million in correspondent banking deposits in Mexico, $700 million in the

http://www.hsbc.com/1/content/assets/business_banking/111021_doing_business_in_mexico.pdf; “Grupo HSBC

México,” HSBC website, http://www.hsbc.com.mx/1/2/grupo.

Group Managing Director Latin America from 2006 to July 2007. See his biography on the HSBC website,

http://www.hsbc.com/1/PA_esf-ca-appcontent/

content/assets/newsroom/media_kit/biogs/100223_sandy_flockhart.pdf. HSBC also has affiliates in

Colombia, Panama, Peru, and Uruguay, among other Latin American locations.

See his biography on the HSBC website, http://www.hsbc.com/1/PA_esf-ca-appcontent/

content/assets/newsroom/media_kit/biogs/100223_sandy_flockhart.pdf.

See his biography on the HSBC website, http://www.hsbc.com/1/PA_esf-ca-app-content/content/

assets/newsroom/media_kit/biogs/101210_paul_thurston.pdf; “HSBC makes key international appointments,”

(4/15/2008), http://www.hsbc.com/1/2/newsroom/news/2008/hsbc-makes-key-international-appointments.

commercial banking operations in the United Kingdom. See “HSBC makes key international appointments,”

(4/15/2008), http://www.hsbc.com/1/2/newsroom/news/2008/hsbc-makes-key-international-appointments.

worked for 25 years at Banamax/Citigroup in Mexico. Id. Emilson Alonso was appointed Chief Executive of

HSBC Latin America. Id.

38

in the Cayman Islands, HSBC Mexico S.A, which was established by Bital in 1980, with

which has no offices or employees of its own and is run by HBMX personnel in Mexico, had

HBMX has had an extensive relationship with HBUS, obtaining U.S. dollar services

through both correspondent and banknotes accounts. HBMX used its HBUS correspondent

account primarily to process international wire transfers and clear U.S. dollar monetary

instruments such as travelers cheques. It also made use of HBUS’ Remote Deposit Capture

service which enabled HBMX to send monetary instruments to HBUS electronically for

processing. HBMX interacted at times with the HBUS Payment and Cash Management (PCM)

division regarding this account. In addition, HBMX interacted with the HBUS Global

Banknotes division, until the Global Banknotes business was discontinued in 2010. HBMX used

its banknotes account primarily to sell U.S. dollars received from its customers to HBUS, which

HBMX typically transported to HBUS via armed car or aircraft. In one three-month period from

November 2006 to February 2007, HBMX shipped nearly $742 million in U.S. dollars to HBUS;

at its peak, HBMX exported $4 billion in bulk cash shipments to HBUS over the course of one

year, 2008. Until it sharply curtailed its U.S. dollar services in Mexico in January 2009, HBMX

shipped more U.S. dollars to HBUS than any other Mexican bank or HSBC affiliate.

To understand HBMX’s AML risks and, therefore, the risks HBUS incurred as its U.S.

correspondent, it is necessary also to understand the AML risks in its home country, Mexico.

From 2000 until 2009, HSBC Group and HBUS gave Mexico their lowest AML risk rating,

despite overwhelming information indicating that Mexico was a high risk jurisdiction for drug

trafficking and money laundering. In May 2009, HBUS suddenly increased its risk rating for

HSBC Group did not follow suit until 2012 when it raised its risk rating for Mexico from

Root, HSBC OCC 8877802-807, at 5.

offshore banks authorized to do business only with non-residents of the Cayman Islands. See list of Cayman

offshore banks at http://www.offshore-library.com/banking/cayman_islands/page_3; Subcommittee briefing by

HSBC legal counsel on the Cayman accounts (4/20/2012).

“Cayman Accounts,” HSBC OCC 8876784.

“Order of Investigation – HSBC Bank USA, N.A., New York, NY,” OCC-PSI-00899482-485, at 484.

39

(INCSRs), which contain a country-by-country assessment of drug trafficking and money

laundering risks, the U.S. State Department has consistently classified Mexico as a country of

Department described Mexico’s drug trafficking and money laundering risks as follows:

“Mexico faces a myriad of drug-related problems that include the production and

transshipment of illicit drugs, money laundering, consumption and illicit firearms

trafficking. ... The Government of Mexico’s (GOM) longstanding commitment to

combat drug trafficking and related crimes resulted in tangible successes against the

Arellano Felix Organization (AFO), the Carrillo Fuentes Organization (CFO), and the

Gulf Cartel – widely considered the top three drug groups in the country. … Mexico

remains a major supplier of heroin, methamphetamine, and marijuana, and the transit

point for more than one half of the cocaine sold in the U.S. … The industrial-scale drug

trade has transformed narcotrafficking into one of Mexico’s deadliest businesses. …

These organizations have demonstrated blatant disregard for human life as the executions

of law enforcement personnel, government officials, and innocent bystanders have

increased. … In recent years international money launderers have turned increasingly to

The State Department also wrote:

“The smuggling of bulk shipments of U.S. currency into Mexico and the movement of

the cash back into the United States via couriers and armored vehicles, as well as through

wire transfers, remain favored methods for laundering drug proceeds. Mexico’s financial

institutions engage in currency transactions involving international narcotics-trafficking

proceeds that include significant amounts of U.S. currency or currency derived from

illegal drug sales in the United States. Although drug trafficking continues to be the

principal source of the laundered proceeds, other crimes including corruption,

kidnapping, firearms trafficking, and immigrant trafficking are also major sources of

Equally negative assessments of Mexico’s drug trafficking and money laundering risks

appeared in the State Department’s annual INCSR reports over the next four years. In 2006, for

example, the State Department wrote:

“The illicit drug trade continues to be the principal source of funds laundered through the

Mexican financial system. Mexico is a major drug producing and drug-transit country.

Mexico also serves as one of the major conduits for proceeds from illegal drug sales

INCSR”), at 621; 2002 INCSR at XII-60; 2006 INCSR Vol. II at 39; 2008 INCSR Vol. II at 62; 2012 INCSR Vol. II

at 33.

40

leaving the United States. Other crimes, including corruption, kidnapping, firearms

trafficking, and immigrant trafficking are also major sources of illegal proceeds. The

smuggling of bulk shipments of U.S. currency into Mexico and the movement of the cash

back into the United States via couriers, armored vehicles, and wire transfers, remain

favored methods for laundering drug proceeds. …

According to U.S. law enforcement officials, Mexico remains one of the most

challenging money laundering jurisdictions for the United States, especially with regard

to the investigation of money laundering activities involving the cross-border smuggling

of bulk currency from drug transactions. While Mexico has taken a number of steps to

improve its anti-money laundering system, significant amounts of narcotics-related

proceeds are still smuggled across the border. In addition, such proceeds can still be

introduced into the financial system through Mexican banks or casas de cambio, or

The State Department’s relentlessly negative assessments of Mexico’s drug trafficking

and money laundering vulnerabilities continued unabated. In 2008, the State Department wrote

that “U.S. officials estimate that since 2003, as much as U.S. $22 billion may have been

later, in 2012, the State Department wrote that drug cartels were using Mexican and U.S.

financial institutions to launder as much as $39 billion each year: “According to U.S. authorities,

drug trafficking organizations send between $19 and $39 billion annually to Mexico from the

Warnings. The State Department is far from the only governmental agency to have

warned about the money laundering risks in Mexico. The U.S. Congress has held repeated

hearings over the years highlighting money laundering and drug trafficking problems in

Department, Federal Bureau of Investigations, Drug Enforcement Administration (DEA),

Financial Crimes Enforcement Network (FinCEN) of the U.S. Treasury Department, Internal

Revenue Service (IRS), Customs and Border Patrol, and Coast Guard, among others. From 1996

to 2011, these hearings have painted the same grim picture drawn in the State Department’s

annual reports regarding the drug trafficking and money laundering threats in Mexico.

Banking and Financial Subcommittee on General Oversight and Investigations, Serial No. 104-72 (9/5/1996); “Drug

Control: Update on United States-Mexican Counternarcotics Efforts,” Senate Caucus on International Narcotics

Control, S.Hrg. 106-60 (2/24/1999); “Federal Strategies to End Border Violence,” Senate Judiciary Committee,

S.Hrg. 109-556 (3/1/2006); “Antidrug Package for Mexico and Central America: An Evaluation,” Senate

Committee on Foreign Relations, S.Hrg. 110-311 (11/15/2007); “Escalating Violence in Mexico and the Southwest

Border as a Result of the Illicit Drug Trade,” House Judiciary Subcommittee on Crime, Terrorism, and Homeland

Security, Serial No. 111-25 (5/6/2009); “Exploring Drug Gangs’ Ever Evolving Tactics to Penetrate the Border and

the Federal Government’s Ability to Stop Them,” Senate Homeland Security and Governmental Affairs Ad Hoc

Subcommittee on Disaster Recovery and Intergovernmental Affairs, S.Hrg. 112-384 (3/31/2011).

41

In addition, warnings about money laundering problems in Mexico have been directed

specifically to financial institutions operating in the United States. In 2005, multiple U.S.

agencies worked together to produce a U.S. Money Laundering Threat Assessment which

identified thirteen key money laundering methods and specifically identified Mexico as a high

risk jurisdiction for several of them, including bulk cash smuggling, misuse of money orders, and

to all U.S. financial institutions to “better guard against an increasingly prevalent money

laundering threat involving the smuggling of bulk U.S. currency into Mexico,” warning in

advisory explained that drug traffickers were smuggling bulk cash from the United States into

Mexico, then depositing the funds with casas de cambios who were sending the cash back to the

also warned about multiple wire transfers that “bear no apparent business relationship” with a

particular casa de cambio, and U.S. deposits by casas de cambio of sequentially numbered

Wachovia Prosecution. Criminal prosecutions also alerted U.S. financial institutions to

the money laundering problems in Mexico. In 2008, for example, news articles warned how

Mexican drug cartels sent millions of dollars in illegal drug proceeds through a major U.S.

agreement detailing how Wachovia Bank had been used by Mexican foreign exchange

from 2003 to 2008, Wachovia Bank provided a variety of services for 22 Mexican casas de

cambio (CDCs), despite evidence of suspicious activity. Those services included processing

three-year period, the wire activity exceeded $374 billion and the bulk cash shipments exceeded

Assessment Working Group, which included the U.S. Departments of Treasury, Justice, and Homeland Security,

Federal Reserve, and Postal Service.

Wachovia Bank also processed $20 billion in

States,” FinCEN Advisory No. FIN-2006-A003 (4/28/2006), at 1.

http://www.fincen.gov/statutes_regs/guidance/pdf/advis04282006.pdf.

Simpson (4/26/2008)(describing AML cases involving not only Wachovia Bank, but also American Express

International Bank, which forfeited $55 million as part of a 2007 federal deferred prosecution agreement, and Union

Bank of California, which forfeited $21.6 million as part of a 2007 federal deferred prosecution agreement, both of

which were also charged with inadequate AML programs and suspected of being used by Mexican drug cartels to

launder funds).

Agreement (3/16/2010) and Information (3/12/2010).

42

sequentially numbered travelers cheques, the majority of which contained illegible names and

detailing numerous AML deficiencies including a failure to conduct due diligence on high risk

clients; a failure to monitor wire transfers, pouch activities, and bulk cash shipments; and a

Bank acknowledged responsibility for its conduct, paid $160 million in criminal and civil fines,

Despite the overwhelming information available about substantial money laundering

risks in Mexico, from 2002 until 2009, HBUS gave Mexico its lowest risk rating for AML

subjected to enhanced monitoring by HBUS, unless they were also designated a Special

Category Client (SCC), a relatively rare designation that indicates a client poses high AML risks.

Had Mexico carried one of the two highest risk ratings, all Mexican clients at HBUS would have

been subjected to enhanced due diligence and account monitoring. Instead, HBUS failed to

conduct AML monitoring of most Mexican client account and wire transfer activity involving

substantial funds.

Risk Rating Process. Until recently, HSBC Group and HBUS issued AML country risk

assessments using four categories of increasing risk, “standard,” “medium,” “cautionary,” and

“high.” HSBC Group created a chart listing its country risk assessments, sent the chart to its

affiliates characterizing its assessments as recommendations, and then allowed each HSBC

compiled every six months by an AML compliance officer who gathered information from a

number of sources, assigned numerical scores to each source, and then compiled aggregate

Agreement (3/16/2010), at ¶¶ 3-4.

Prosecution Agreement (3/16/2010); “Wachovia Enters into Deferred Prosecution Agreement,” U.S. Attorney’s

Office for the Southern District of Florida press release, (3/17/2010), http://www.justice.gov/usao/fls/

PressReleases/100317-02.html.

Simpson, April 26, 2008; “How a big U.S. bank laundered billions from Mexico’s murderous drug gangs,” The

Observer, Ed Vulliamy, (4/2/2011), http://www.guardian.co.uk/world/2011/apr/03/us-bank-mexico-drug-gangs.

countries and territories).

0096390-397.

43

Those scores were then supposedly used to assign risk ratings. In fact, however,

countries receiving similar scores often received different risk ratings. Those differences were

attributable, in part, to an “HBUS discretion” factor which was listed as an official factor in the

risk assessment process, included in the risk assessment chart, and used, according to the OCC,

discussion or documentation as to what constitute[d] permissible reasons to change the risk

risk-rating methodology “in a consistent manner.” The OCC wrote that, in 2009, of 73 countries

that received a zero risk assessment score:

“32 (44 percent) were rated standard, 32 (44 percent) were rated medium, 1 (1 percent)

was rated cautionary, and 8 (11 percent) were rated Unclassified. The OCC found no

documentation or support for the difference between the final ratings and the scores.

While the bank elevated the risk ratings versus the scores, the bank has not adopted a

The OCC criticized the HSBC country risk assessment process for not taking into

account readily available country-specific information on money laundering and drug trafficking

was often included in HBUS KYC client profiles, the INCSR country-specific risk ratings were

Still another OCC criticism was the HSBC Group’s “unacceptable practice of assigning

an overall risk rating to its non-SCC customers based solely on the risk rating that the bank has

OCC, was that HSBC had excluded from its routine AML monitoring “more than $60 trillion of

wire transfers each year for customers domiciled in countries risk rated as ‘standard’ or

With respect to Mexico, the HSBC policy meant that, due to its low risk rating, all clients based

in Mexico were considered low risk, unless rated an SCC, an outcome that the OCC viewed as a

critical AML deficiency. One consequence was that high risk clients residing in low risk

countries routinely escaped enhanced due diligence and account monitoring.

2009 Change in Mexico Risk Rating. In February 2009, HBUS issued a chart with its

(‘BSA/AML’) Examination – Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21),” OCC-PSI-00864335-

365, at 19. [Sealed Exhibit.]

The chart provided risk scores and categories for 239

Examination – Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21),” OCC-PSI-00864335-365, at 18.

[Sealed Exhibit.]

44

asked about this low score, the HBUS compliance officer then responsible for country risk

assessments, Ali Kazmy, told the Subcommittee that, since 2006, HBUS’ assessments had

inadvertently failed to take into account a 2006 FinCEN advisory related to Mexico that would

This low risk rating was awarded despite a May 2008 email from Susan Wright, AML

Compliance head for the HSBC Group, singling out AML concerns related to Mexico.

Referencing “RMM – Country Risk,” Ms. Wright wrote to HSBC Group Compliance head

David Bagley and other colleagues:

“I believe you have sight of our Country Reputational Risk Table but, as previously

discussed, unless there are some specific concerns it is not proposed to highlight the

highest risk countries as a matter of course. …

Mexico – there are specific risks in relation to pressure from the US with regard to the

laundering of the proceeds of drug trafficking through Mexican cas[a]s de cambios.

HBMX have a number of customers who are cambios/money service businesses (MSBs)

with links to the US and consequently payments from HBMX are made through HBUS.

… [T]hese are notoriously difficult businesses to monitor …. [T]here is also US concern

with regard to the amount of USD cash deposits and transactions between the US and

Mexico and HBMX has been identified as one of the banks with the highest level of

This email shows that the head of HSBC AML Compliance was aware of and communicated to

other Compliance personnel the serious AML risks related to Mexico involving drug trafficking,

suspect casas de cambio, and bulk cash smuggling, yet the February 2009 HBUS country risk

assessments again assigned Mexico the lowest possible risk rating.

Three months after issuing the country risk assessments in February 2009, however, on

May 1, 2009, HBUS suddenly revised Mexico’s risk rating, increasing it by three notches from

Kazmy explained that, “in early 2009,” he had been asked by his supervisor, Anne Liddy, to take

HSBC-PSI-PROD-0096390-397. Mr. Kazmy took over the country risk rating process from Lynda Cassell who left

HBUS in mid-2006. The FinCEN Advisory was issued in April 2006, just before Ms. Cassell left.

HSBC-PSI-PROD-0096398-441 and 422.

Leatherdale, and others, “RMM – Country Risk,” HSBC OCC 8873750.

“Order of Investigation – HSBC Bank USA, N.A., New York, NY,” OCC-PSI-00899482-485, at 484.

45

Ms. Liddy’s request coincided with an intensifying law enforcement interest in Mexican

casas de cambio suspected of laundering illegal drug proceeds through U.S. financial institutions,

including HBUS. In February 2008 and again in November 2008, as detailed below, Mexican

regulators confronted HBMX with suspicions that drug proceeds were moving through its

accounts at HBUS. In January 2009, according to an internal HBUS email, a U.S. Homeland

Security Department’s Immigration and Customs Enforcement (ICE) agent met with HBUS

month, in response to Mexican AML regulatory concerns, HBMX stopped accepting U.S. dollar

deposits at any of its Mexican branches.

In June 2009, ICE also informed the OCC that ICE was investigating possible money

traffickers appeared to be using the black market peso exchange in New York to transfer funds

through a particular Mexican financial institution, which then sent the funds through its U.S.

scheme to the OCC Examiner-In-Charge at HBUS as follows:

“The scheme … is similar to activity that we have seen at Union Bank, Wachovia, and

Zions. Basically, the way it works is that drug money is physically hauled across the

border into Mexico, then brought back into the United States through wire transfers from

casas de cambio or small Mexican banks, or else smuggled across the border in armored

cars, etc., before being deposited in US. Institutions. According to AUSA [Assistant U.S.

Attorney] Weitz, most U.S. banks, recognizing the risks involved, have gotten out of this

business, but HSBC NY is one of the last holdouts (although, interestingly, he said that

What U.S. law enforcement officials had found was that, because drug traffickers in the United

States were having difficulty finding a U.S. financial institution that would accept large amounts

of cash, due to strict U.S. AML controls, many were instead transporting large volumes of U.S.

dollars to Mexico, and depositing the dollars at Mexican financial institutions. The drug

traffickers could then keep their deposits in U.S. dollars through the Mexican financial

institution’s correspondent account at a U.S. bank, or exchange the dollars for pesos. The

Mexican banks, casas de cambio, and other financial institutions that were the recipients of the

cash typically shipped the physical dollars back to the United States for credit to their own U.S.

dollar correspondent accounts at U.S. banks. HBUS’ awareness of the increasing U.S. law

Mexico Press Release and Q&A,” HSBC OCC 3633806-807. In a Subcommittee interview, HBUS AML

Compliance officer Daniel Jack indicated that he attended the meeting, and the ICE agent expressed concern about

possible money laundering through Consultoria, a former Mexican casa de cambio that had converted into a bank.

Mr. Jack told the Subcommittee that HBUS closed the Consultoria account six months later. Subcommittee

interview of Daniel Jack (3/13/2012).

conversations, prepared by OCC Jim Vivennzio, OCC-PSI-00928759-761 (noting ICE agents had met with HBUS).

[Sealed Exhibit.]

Exhibit.]

46

enforcement and regulatory interest in Mexico may have contributed to its decision to review

and, ultimately, in May 2009, to increase its risk rating for Mexico.

One key consequence of the higher risk rating for Mexico was that, under Group AML

policy, HBUS was required to conduct enhanced monitoring of all of its Mexican clients.

HBUS’ higher risk rating may have also put pressure on HSBC Group and other HSBC affiliates

to boost their risk rating of Mexico as well.

On June 18, 2009, Ms. Wright sent an email to Ms. Liddy asking her about the higher

rating for Mexico. Ms. Wright wrote:

“It has been drawn to my attention that in the latest US Country Risk Assessment Mexico

has gone from a lower risk to high. I have received a number of queries from around the

Group as to the reason for what they see as quite a dramatic change.

Whilst I appreciate the risks involved in doing business with Mexico I would be grateful

for some further and more detailed clarification as to why the change has been so

In response, Ms. Liddy asked Mr. Kazmy, the AML officer responsible for compiling the

country risk ratings, to write up the reasoning for the higher risk rating. He wrote:

“A number of sources are reviewed, a majority of which are government and

international agencies, such as World Bank, IMF, FATF, CFATF, BIS, Central Banks,

Transparency International, etc. in order to determine risk levels …. The U.S.

Department of State issues detailed annual assessment[s] of each country via the

International Narcotics Control Strategy Report highlighting, inter alia, money

laundering, terrorist financing, corruption, and regulatory regime/oversight. An excerpt

of such a report on Mexico … is attached below. …

As a result of events occurring in Mexico during the past several months with respect to

drug trafficking and money laundering, as well as the general unrest these developments

have caused, we have downgrade[d] Mexico to ‘high’ risk. The deteriorated situation is

recognized by the Government of Mexico as evidence through the involvement of

agencies tasked with the Anti-Money Laundering and Counter Financing of Terrorist

(AML/CFT) efforts towards drafting an AML/CFT National Strategy … expect to be

Assessments,” OCC-PSI-00652829. See also 6/9/2009 email from HSBC David Bagley to HBMX Emilson Alonso,

copies to HSBC Michael Geoghegan and others, “GMO Business reviews – LATAM,” HSBC OCC 8874895 (“I

fully acknowledge the level of priority and focus that you and the team have given to these issues and the progress

that has been made particularly in Mexico and have taken all of this into account. … The basis for the rating is

however: The inherent AML risk in Mexico is still very high and [t]here are not many other parts of the Group that

have what is effectively a drugs war being conducted on the streets and also have the risk posed by potential sting

and other operations by the US authorities. We have of course remediated our high risk accounts, but the historic

weak account opening processes mean that we have overall lower levels of KYC across the customer base as a

whole. … Happy to discuss further.”).

47

issued sometime during 2009. … Our rating is in conformity with the view of the U.S.

Ms. Liddy asked him how Mexico had been rated by the State Department in 2009, and

whether that rating was worse than in the previous report, apparently not realizing that the State

Ms. Liddy, incorrectly, that the State Department INCSR report did not rate countries for risk,

but also provided numerous details from the 2009 INCSR report indicating that money

In 2010, when the OCC sent HBUS a supervisory letter on AML deficiencies at the bank,

Ineffective Procedures for Country Risk Ratings,” the OCC listed “significant flaws” with the

scoring and risk rating methodology, as well as with HBUS’ decision not to monitor wire

transfer activity for foreign financial institutions or other clients located in a standard or medium

risk country, unless designated as an SCC client. The OCC wrote:

“The bank’s country risk ratings for its PCM [Payment and Cash Management division]

wire monitoring are critical, due to the bank’s unacceptable practice of assigning an

overall risk rating to its non-SCC customers based solely on the risk rating that the bank

has given the country where the customer is located. However, compounding this

deficiency, the bank’s procedures for determining the critical country risk ratings are

inadequate and ineffective.

To determine the country risk rating, the bank employs a point system based on fifteen

factors. HBUS’ methodology appears straightforward … [h]owever … there are

significant flaws in the implementation of the point system. …

The bank’s failure to risk rate countries appropriately has a significant impact on HBUS’

BSA [Bank Secrecy Act] compliance, because customers’ risk ratings affect a number of

variable requirements relating to due diligence for foreign correspondents. For example,

these variable requirements include the frequency with which the bank conducts site

visits (every 12 months versus every 24 months) and the level of due diligence performed

Assessments,” OCC-PSI-00652829.

Assessments,” OCC-PSI-00652829.

Assessments,” OCC-PSI-00652829.

(‘BSA/AML’) Examination – Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21),” OCC-PSI-00864335-

365, at 18-20. [Sealed Exhibit.]

Committee, “Order of Investigation – HSBC Bank USA, N.A., New York, NY,” OCC-PSI-00899482-485, at 3-4.

The problems with HBUS’ country risk assessments extended beyond Mexico to other countries as well. Some of

the countries that should have been rated as having a high risk of money laundering, but were instead rated standard

or medium, included Antigua, the Bahamas, Cayman Islands, and Switzerland. See Feb. 2009 “Rating 2009,”

48

When asked why past risk assessments of Mexico had been so low, Mr. Kazmy told the

In addition to the substantial money laundering and drug trafficking risks plaguing

Mexico for a decade, HBMX itself had a history of weak AML controls and a poor compliance

culture, which the HSBC Group worked for years to improve, with limited success. While

HSBC Group officials in London were well aware of HBMX’s AML deficiencies and immersed

in an effort to strengthen them, it did not inform its worldwide affiliates, including HBUS, of the

problems. From 2002 until recently, HBUS remained largely ignorant of the extent of HBMX’s

AML and compliance deficiencies, despite providing HBMX with extensive correspondent

services and giving it free access to the U.S. financial system.

Non-Existent Compliance Function in 2002. In 2002, as part of its decisionmaking

process to purchase Bital, HSBC Group reviewed Bital’s compliance function, found it wholly

inadequate, and determined that a major effort would be needed for the new bank to meet Group

standards. In an email to his colleagues, David Bagley, head of HSBC Group Compliance, put it

this way:

“Sandy [Flockhart, HSBC Mexico head,] acknowledges the importance of a robust

compliance and money laundering function, which at present is virtually non-existent. …

There is no recognizable compliance or money laundering function in Bital at present ….

Sandy thinks it is important to look both at issues affecting Mexico City, but also closer

to the border where there appears to be substantial cross-border flows of monies,

His comments followed a July 2002 audit performed by HSBC Group auditor prior to

purchasing the Mexican bank providing a negative assessment of the bank’s compliance

program. The HSBC internal audit report detailed a wide range of specific problems as well as

broader AML deficiencies:

82 of the 248 accounts reviewed lacked full documentation.

branch … found that 41% of the accounts reviewed (92 of 224 reviewed) lacked

full client information. 37 files had no client information. …

prepared by HBUS, HSBC-PSI-PROD-0096390-397. As a consequence, clients from those jurisdictions were

treated as low risk, and wire transfers involving those countries were not routinely monitored by HBUS.

Bennett, “Bital,” HSBC OCC 8877797-798.

49

activity for any period other than a given day … [and] does not identify high risk

clients as such. …

government undercover sting operation undertaken to combat drug trafficking and

money laundering activities in the US and Mexico. A former GFB account

executive was found willing to establish fictitious accounts and moved illegal

money through them. … GFB forfeited $3.1 [million] to the US government in

1998. …

Conclusions

The GFB Compliance effort is weak, and it appears that the target organization

does not have a strong Compliance culture.

have to be established and implemented ….

sporadic, and the reviews normally do not encompass large populations of

client files or activities. This effort needs to be strengthened.

account managers to identify and report unusual and suspicious

transactions of their clients is a serious internal control shortcoming. …

High risk clients receive no special monitoring coverage. …

regulatory reports do not receive proper respect and action. ...

GFB’s Code of Conduct lacks content, detail and spirit. …Appropriate

staff related policies would have to be implemented immediately as part of

the overall effort to install a dedicated Compliance and internal control

Despite Bital’s weak compliance function, HSBC Group completed the purchase on November

Five Years of Effort. Over the next five years, from 2002 to 2007, HSBC Group

initiated a number of efforts to strengthen Bital’s compliance and AML programs. While

improvements were made, significant deficiencies persisted.

In November 2002, immediately before purchasing Bital, John Root, a senior HSBC

Group Compliance expert whom David Bagley asked to help work on AML issues at HBMX,

visited the bank for a week and prepared a report cataloguing compliance issues and needed

OCC 8873846 -852.

50

The report noted that “some of his harshest criticism” were directed at the Bital Legal

According to the report, the Mexican regulator recommended “sweeping changes in

The report noted that Bital had 83 correspondent relationships with other financial

institutions, including 20 well known and reputable banks and some institutions that required

or closing some of those accounts by March 2003. The report also noted that Bital had accounts

lodged at its own Cayman branch office, which operated as an offshore shell entity and was

managed by Bital employees in Mexico City. The report recommended undertaking an analysis

of all of the correspondent banking deposits, “particularly those in the Cayman Islands,” by June

2003. It also recommended an analysis of “all existing Private Banking, with particular attention

addition, it recommended developing a better electronic screening system for all account activity

to identify suspicious transactions and a better process for investigating suspicious activity

In 2002 and 2003, HSBC Group appointed a new Compliance head for HBMX, Ramon

Garcia Gibson, formerly AML Director at Citibank’s Mexican affiliate, Banamax; established an

HBMX Compliance Department; hired additional staff; and installed a new monitoring system

known as Customer Account Monitoring Program (CAMP) to detect suspicious activity. HBMX

also hired a Money Laundering Deterrence (MLD) Director Carlos Rochin. Nevertheless, in

2003, two inspection reports from Mexican authorities in January and August identified ongoing

problems with the detection of suspicious transactions and the adequacy of the bank’s Money

Root, HSBC OCC 8877802-807. See also 11/25/2002 email from HSBC John Root to HSBC Richard Bennett and

HSBC Matthew King transmitting the report, HSBC OCC 8877800 (“There is very little of what we would call a

Compliance function. … I did not encounter anybody at Bital who I thought immediately capable of building a

Compliance department.”).

Root, HSBC OCC 8877802-807, at 1.

thought they were servicing Cayman residents. Subcommittee interview of John Root (4/26/2012).

David Bagley, “MLD Regulatory Report,” HSBC OCC 8873393-394

51

In January 2004, HSBC Group’s Board of Directors met in Mexico to allow Board

Committee reviewed HBMX’s ongoing internal control issues. The Audit Committee’s minutes

stated that, “after being part of the Group for some 15 months,” HBMX had made “very

significant progress in raising the standards of its controls. It will, however, probably take

another two years to fully reach Group standards. From experience with other acquisitions this is

Five months later, in May 2004, HBMX’s internal auditors filed a report containing a

number of criticisms of the bank’s compliance and AML efforts, indicating that much still

operating “Below Standard,” the internal audit report stated:

“HBMX has insufficient controls to detect money laundering transactions in all areas of

the Group in a timely manner. The implementation of the CAMP system is in process yet

it only includes the Bank’s transactions that have been registered in the Hogan system

and fails to monitor those registered in other IT systems/HBMX subsidiaries.

Direccion de Prevencion de Lavado de Dinero [Direction of Money Laundering

Deterrence] has identified high-risk areas of money laundering transactions, which are

not being monitored.

The communication between LCOs [Local Compliance Officers] and Compliance does

not enable the timely detection of the needs and weaknesses of the areas and subsidiaries.

There are inadequate internal controls over the IT systems used to send information to the

regulator on suspicious or relevant transactions to authorities.

In our opinion, based upon the foregoing, the Direction of Money Laundering Deterrence

Three months later, in August 2004, John Root, HSBC Group Compliance head for Latin

America, again visited HBMX to examine the status of its compliance and AML efforts,

report indicated that, while substantial progress had been made over the past 18 months, AML

deficiencies remained:

HSBC Group’s internal audit (“Auditoria Interna Del Groupo”), HSBC OCC 8874376-381.

8/10/2004 email from HSBC John Root to HSBC David Bagley, Richard Bennett, Matthew King, David Leighton,

and Susan Wright, and HBMX Sandy Flockhart and Ramon Garcia, transmitting the report, HSBC OCC 8875565-

575.

52

“Senior management has made significant progress in introducing Group Compliance

Policy and Standards in HBMX. The head of the Compliance department, Ramon Garcia

Gibson, has set the foundation for an effective Compliance function.

HBMX controls are much improved from the situation that existed 12-18 months ago[.]

However, Treasury back-office operations are a source of major regulatory concern, as is

accurate and timely reporting to regulators. …

[O]ne of the five commissioners of the CNBV … states, ‘In the business area [of

HBMX], the resources have arrived. In the area of controls, the resources have not

arrived.’

The CNBV gave us a ‘fact sheet’ in English with the following ‘main concerns’ ….

Anti-money laundering processes – Although improvements have been seen,

some concerns remain regarding deficiencies in process (no system for unusual

operations detection and a poor identification of public figures and high risk

customers) and over control of Panama’s branch operations. …

In a wide-ranging discussion, CNBV regulators commented that any outsourcing must be

able to be audited from Mexico. They do not want outsourcing to jurisdictions with

strong banking secrecy. …

The Trusts department is struggling to improve the poor condition of its files.

Notwithstanding a senior manager’s optimism [‘Most of them, KYC is okay’ and ‘Most

deficiencies are not related to KYC’], by far the greatest problem is missing KYC

documentation.

Of a total of 15,434 trusts, only 6,868 (41%) have completed documentation. 2,955

(20%) of trusts have no documentation at all. ...

Around USD 16 billion arrive from the United States each year, mostly through the

branch network. Money laundering risk is mitigated by several factors: (1) remittances

are generally small (US200-300), according to two senior managers; (2) due diligence

appears to be adequate on the AML procedures of US third-party money services

businesses; and (3) CAMP Retail, a software programme to detect suspicious

transactions, is scheduled to be installed in the branch network in NOV04.

Recommendation: HBMX CMP [Compliance] should sample periodically remittances

from the United States to determine if, in fact, remittances are generally small and in the

In September 2004, the CNBV conducted an inspection of HSBC’s AML efforts and,

contrary to the more positive tone described by HBMX internally, found them unsatisfactory.

original).

53

According to an internal HBMX compliance report, a CNBV report summarizing the 2004

inspection criticized HBMX for:

“not considering the risk exposure of the customer to determine the appropriate visitation

process, not implementing procedures to update annually the files of high-risk customers

and politically exposed persons, not defining internal criteria to determine customers’ risk

exposure and a delay in formalizing the Communication and Control Committee …

responsible for sending SARs to the CNBV … and issuing money laundering deterrence

The Communication and Control Committee (CCC Committee, also called the Money

Laundering Deterrence or MLD Committee), which was mandated by a 2004 Mexican law, was

intended to act as the bank’s primary internal unit to deter money laundering, so the delay in

getting the committee underway was seen as a major AML deficiency. CNBV later fined

HBMX more than $75,000 for the AML deficiencies identified in 2004, a fine which HBMX

In early 2005, an internal HBMX whistleblower hotline disclosed that HBMX

compliance officials had fabricated records of mandatory monthly meetings by the CCC

investigation determined that the false records consisted of attendance sheets and minutes for

were fabricated by a junior employee at the direction of the HBMX Money Laundering

Ramon Garcia, head of HBMX Compliance and the CCC Committee chair, received a written

warning and was barred from receiving what would have been a substantial bonus for his work in

2004. David Bagley, head of HSBC Group Compliance, wrote:

“Overall RG [Ramon Garcia] has performed credibly, has worked very hard, and would

otherwise be hard to replace. In the circumstances whilst we will need to keep his

position under review at this stage I endorse the decision to retain his services given that

his failure is limited to one of failing to supervise a very senior and trusted

Banking and Markets (Private) Audit Committee, HSBC OCC 8873286-287 (describing CNBV criticisms).

Exception,” HSBC OCC 8873671.

– HBMX CMP,” HSBC OCC 8873673; Feb. 2005 “HSBC Whistleblower Item 15 – HBMX: Investigation Report –

Executive Summary,” prepared by Head of Group Audit Mexico (GAQ)(hereinafter “Whistleblower Report”),

HSBC OCC 8877877-885.

HBMX CMP,” HSBC OCC 8873673.

54

Mr. Bagley’s internal report found that the HBMX AML staff was riven by dissension

and resentment and may have “exact[ed] retribution” against the MLD director for the dismissal

of a colleague. His report concluded that Mr. Garcia would have to rebuild a “shattered Money

Mexican financial institutions, HBMX CMP [Compliance] appeared to be understaffed” and

In May 2005, John Root, HSBC Group Compliance head for Latin America, made

another visit to HBMX for several days to evaluate its compliance and AML efforts. As before,

he later prepared a report and provided it to colleagues at HSBC Group and HBMX. In a

separate email transmitting the report six weeks later, Mr. Root noted that the HBMX MLD

director who resigned in January 2005, had not been replaced despite the passage of six months,

and a new director needed to be appointed “as soon as possible in order to reorganize promptly a

independent, effective professional in the sensitive role of head of AML in Mexico.” He also

observed that “[p]rojects are started but seldom completed, perhaps because of the many

ministerial tasks that have accrued since the departure” of the MLD director. Mr. Root wrote:

“As you of course know, the work has piled up in the Compliance department, and

Ramon needs help with the backlog. It is true that we have increased staff in the

department, but they are mostly entry-level analysts in need of direction. It is important

we hire an MLCO [Money Laundering Control Officer] as quickly as possible, and

perhaps also a sort of ‘operating officer’ for Ramon to enable him to bring the department

Mr. Bagley forwarded the Root email to a colleague and commented that “until we have the right

Leopoldo R. Barroso was appointed MLD director for HMBX.

In November 2005, Richard Bennett, then HSBC Group General Manager of Legal and

Compliance and the person to whom David Bagley, head of HSBC Group Compliance, reported,

a variety of compliance issues. According to an email sent by Mr. Bagley, the concerns included

the nature of the HBMX accounts in the Cayman Islands; the referral of clients to Mexico by

other HSBC affiliates, especially in France; and access to HBMX AML information from other

countries, in particular the United Kingdom.

HBMX – 18 – 25 May 2005,” HSBC OCC 8876670-671.

HSBC OCC 8876670.

OCC 8873264-266.

55

In December 2005, HBMX’s internal audit group produced a 55-page report identifying a

improved, but still rated it “Below Accepted Levels.” Major deficiencies included a failure to

make full use of the new CAMP monitoring system, a failure to ensure its monitoring parameters

met local requirements, inefficient monitoring processes which made detection and analysis of

alerts difficult, failure to apply CAMP to foreign remittances and HBMX subsidiaries,

The audit report was actually issued to HBMX in the spring of 2006, and its findings

views to HSBC Group Compliance and complained that the bank would be required to forward

the audit report to the CNBV, which would not only create a “misleading” impression, but also

would contradict a recent presentation HBMX had made on how its AML controls had

response to the audit findings to Susan Wright, head of AML and David Bagley, head of

“[T]he audit points are being strongly rejected by HBMX AML. AML is also alleging

errors of procedure …. Many, if not most, of the recommendations were ‘rejected’ or

downgraded in importance by AML, which is certainly a heartfelt, but rather unusual

formal reaction, to an audit. Most of just accept audit recommendations, whether

perceived to be ‘fair’ or not, and proceed to implement them.

I have let the dust settle a bit, as AML management clearly feel aggrieved, but closer

monitoring is warranted on the specific audit recommendations. …

[T]he one that most sticks out is apparent lack of monitoring of the (relatively few) AML

staff in the field. This raises a ‘red flag’ in a place like Mexico, where the drug cartels

are very powerful and ubiquitous. … To aver, as the audit does, that ‘we do not really

know what our man in the field is doing’ is a warning sign, if true. AML of course

vigorously deny this.”

Mr. Barroso’s email responding to the internal audit noted that HBMX MLD had also recently

been audited by CNBV and expected to receive a satisfactory rating, with only two requirements

HSBX’s internal audit group continued to conduct compliance and AML examinations of

HBMX offices and branches. In September 2006, for example, it examined operations at four

Audit, HSBC OCC 8876223-280.

attaching 5/8/2006 email from Leopoldo Barroso and a chart entitled, “Internal Audit Main Findings to MLD,”

HSBC OCC 8874383-392.

56

HBMX district offices, each with more than 15 branches, located in the cities of Puebla,

with respect to their risk controls, which was the same low rating each had received the prior

year. For example, all four were found to have KYC and “file integrity” issues that “failed to

six repeat recommendations from prior audits that had yet to be resolved. All four summary

In October 2006, HBMX’s Compliance head Ramon Garcia informed HSBC Group

Compliance that HBMX’s Money Laundering Deterrence (MLD) Committee had adopted a

policy that would require HBMX to consider closure of an account after four Suspicious Activity

senior HSBC Group Compliance officer, responded: “4 SARs seems awfully indulgent, even by

local standards. At any rate, it is against Group policy, as Susan [Wright] points out, so you will

Policy No. GPP25 required accounts to be closed after two SARs were filed. The next day,

HBMX informed HSBC Group Compliance that, rather than seek an official exception, it had

decided to adopt the Group policy and would consider account closure after two SARS were

Unimed and Ye Gon Scandal. In 2007, HBMX learned that one of its longstanding

clients was accused of involvement with illegal drug trafficking. On March 15, 2007, in a joint

effort with the U.S. Drug Enforcement Administration (DEA), the Mexican Government seized

Puebla Z01 C31 District Office (with 17 branches), PFS Puebla Z01 C23 District Office (17 branches), PFS Morelos

Z01 A20 District Office (19 branches and 1 Module), and PFS Ciudad Juarez Z03 B02 District Office (21 branches

and 1 custom module), HSBC OCC 8876717-720.

King, “HBMX B/S and U Audit Report Summary for SEP06,” HSBC OCC 8876715 (transmitting audit report

summaries). See also August 2005 “General Audit Report: HBMX – PFS Torreon District (Z04 C01),” prepared by

Group Audit Mexico, HSBC OCC 8876677-680 (finding a district office with 22 branches operating “Below

Standard,” with “[n]o significant progress … since the previous audits and 11 repeat recommendations”).

David Bagley, Susan Wright, and Emma Lawson, “2Q06 HBMX Compliance Report,” and “Compliance with GPP

25,” HSBC OCC 8876711-713.

Susan Wright, “2Q06 HBMX Compliance Report,” HSBC OCC 8876713.

David Bagley, Susan Wright, and Emma Lawson, “Compliance with GPP 25,” HSBC OCC 8876711-713. GPP 25

stated: “Where the customer is the subject of more than one validated suspicious transaction/activity report, then

serious consideration should be given to closure of the relevant account/s and any other connected accounts.”

Despite adopting the Group policy generally to close an account after two SARs, HBMX apparently did a poor job

of implementation. In November 2007, Mr. Garcia revealed at an HSBC conference that HBMX had “numerous

cases of accounts with multiple SARs (16 in one case!!) in Mexico that remain open.” In response, Ms. Wright

asked Warren Leaming to “follow up with Ramon” to strengthen compliance with the Group policy on closing

accounts with SARs. 11/16/2007 email from HSBC Susan Wright to HSBC Warren Leaming, copy to David

Bagley, “Mexico,” HSBC OCC 8875423.

57

over $205 million in U.S. dollars, $17 million in Mexican pesos, firearms, and international wire

Mr. Ye Gon, a prominent businessman, was the owner of three Mexican corporations

involved in the pharmaceutical field, Unimed Pharm Chem Mexico S.A. de C.V.; Constructora e

of using his corporations to import, manufacture, and sell chemicals to drug cartels for use in

accused of displaying “significant unexplained wealth,” despite reporting no gross income for his

2007, he was arrested in the United States, imprisoned, and indicted by U.S. federal prosecutors

remained imprisoned, however, subject to proceedings to extradite him to Mexico to stand

Mr. Ye Gon and his corporations were longtime clients of HBMX as well as other banks

and casas de cambio in Mexico. One news article reported that the Mexican Ministry of Finance

and Public Credit (SHCP) had determined that, from 2003 to 2006, Mr. Ye Gon and his

Extradition (9/15/2008) (hereinafter “Ye Gon Extradition Complaint”), at 13; “Mexican Fugitive and Co-

Conspirator Arrested on U.S. Drug, Money Laundering Charges,” U.S. Drug Enforcement Administration press

release (7/24/2007), http://www.justice.gov/dea/pubs/states/newsrel/wdo072407.html.

Money Laundering Charges,” U.S. Drug Enforcement Administration press release (7/24/2007),

http://www.justice.gov/dea/pubs/states/newsrel/wdo072407.html. See also DEA testimony, “Violence Along the

Southwest Border,” (3/24/2009), at 8, before the U.S. House Appropriations Subcommittee on Commerce, Justice,

Science and Related Agencies (describing seizures from a “pharmaceutical company CEO who facilitated the

importation of metric-ton quantities of ephedrine for the Sinaloa cartel’s methamphetamine-manufacturing

operations”).

dollars in U.S. currency abroad, Mr. Ye Gon engaged in a “lavish lifestyle, which included purchasing expensive

cars and jewelry, and gambling (and losing a net sum of approximately $125 million U.S. dollars) in Las Vegas,

Nevada.” Id. at 12-13.

Co-Conspirator Arrested on U.S. Drug, Money Laundering Charges,” U.S. Drug Enforcement Administration press

release (7/24/2007), http://www.justice.gov/dea/pubs/states/newsrel/wdo072407.html.

Carrasco (10/29/2008), http://www.washingtonpost.com/wp-dyn/content/article/

58

companies moved $90 million through 450 transactions involving four major Mexican banks,

HBMX, Banamex, BBV Bancomer, and Banco Mercantil Del Norte, and multiple currency

The March 2007 seizure of cash and weapons from Mr. Ye Gon’s residence triggered an

documents, the Unimed accounts were opened by Bital, retained by HBMX, and housed in

HMBX’s Personal Financial Services (PFS) division, even though the official clients were

designated as high risk, despite unusual transactions that had attracted bank attention several

timeframe, the Unimed account had attracted the attention of HBMX regulators, and Susan

Group did not realize the account was still open, until he and Ms. Wright saw the press articles

regarding Unimed in 2007.

When the scandal broke, Paul Thurston, who had been appointed in February as HSBC

Mexico CEO after the former head, Alexander Flockhart, was promoted, wrote: “This is a very

serious, and high profile, case which has potential reputational damage to the HSBC Group, and

Mr. Thurston personally oversaw an extensive review of the accounts and HMBX’s AML

asked to summarize the AML deficiencies that contributed to the bank’s maintaining such a high

risk account, Mr. Thomson wrote in part:

“The main systemic weaknesses in HBMX, which I believe remain outstanding, are as

follows:

KYC as identified in branch and continuous audit reports.

The lack of adequate documentation and filing systems which remain from the former

Bital days ….

Universal, Francisco Gómez, http://www.eluniversal.com.mx/nacion/155016.html, cited in 7/18/2008 Report of

Findings (Update) for Consultoria Inernacional Banco, prepared by HBUS Financial Intelligence Unit, HSBC OCC

1822420-434, at 422.

Garcia and others and HSBC David Bagley, Matthew King, and others, “Management Letter: HBMX-[subject

redacted by HSBC],” HSBC OCC 8875010-014.

HSBC],” HSBC OCC 8874315-16.

“[subject redacted by HSBC],” HSBC OCC 8874317-18; 4/20/2007 email from HSBC Matthew King to HSBC

Michael Geoghegan, and copy to David Bagley, “Managerial Letter: HBMX-[redacted by HSBC],” HSBC OCC

8874762.

by HSBC], HSBC OCC 8874316-17.

HSBC colleagues, “[subject redacted by HSBC],” HSBC OCC 8874315-330 and HSBC OCC 8875010-014.

59

His criticisms about the lack of a compliance culture and poor KYC documentation echoed the

criticisms made five years earlier, when HSBC first purchased Bital.

HBMX’s internal review determined that, in 2005 and several times thereafter, concerns

about suspicious activity involving the Unimed account had been brought to the attention of the

HBMX Money Laundering Deterrence Communication and Control Committee (“CCC

then relented, in part because the Personal Financial Services (PFS) division where the account

was located had, as one HBMX email put it, “argued that the client was fine, properly

uncovered falsified “KYC visit reports,” documenting site visits to the client which had not

Unimed accounts “had not reported the customer to the authorities, despite hosting apparently

As a result of the Unimed scandal, Mr. Thurston developed seven action items to

APR07,” HSBC OCC 8874328-329.

They included reviewing the personnel assigned

to the HBMX CCC committee and reminding CCC members of the need to take “an independent

view” and to be “prepared to challenge their colleagues”; ensuring CCC minutes clearly

identified the decisions taken; revamping KYC “analysis, assessment and reporting procedures”

to ensure “higher risk cases are brought to senior management attention”; providing additional

training on KYC assessment reports; transferring all corporations out of the Personal Financial

Letter: HBMX-[subject redacted by HSBC],” HSBC OCC 8875010-011; 3/20/2007 email from HBMX Leopoldo

Barroso to HBMX Paul Thurston and others, “[subject redacted by HSBC],” HSBC OCC 8874315-16; 3/16/2007

email from HBMX Leopoldo Barroso to HSBC David Leighton and HBMX Ramon Garcia, “[subject redacted by

HSBC],” HSBC OCC 8874317-18.

redacted by HSBC],” HSBC OCC 8874317-18.

HBMX-[subject redacted by HSBC],” HSBC OCC 8875010-011. See also 4/18/2007 email from HSBC Matthew

King to HBMX Graham Tomson, “Managerial Letter: HBMX-[redacted by HSBC],” HSBC OCC 8875013-014.

HBMX-[subject redacted by HSBC],” HSBC OCC 8875010-011; 4/18/2007 email from HSBC Matthew King to

HBMX Graham Tomson, “Managerial Letter: HBMX-[redacted by HSBC],” HSBC OCC 8875013-014;

Subcommittee interview of Paul Thurston (5/1/2012).

HBMX-[subject redacted by HSBC],” HSBC OCC 8875010-011; 4/18/2007 email from HSBC Matthew King to

HBMX Graham Tomson, “Managerial Letter: HBMX-[redacted by HSBC],” HSBC OCC 8875013-014.

HBMX-[subject redacted by HSBC],” HSBC OCC 8875010-013.

OCC 8875011-014.

60

Services division; and dismissing all branch staff involved with completing the falsified KYC

procedures, account opening and file maintenance into “one coherent programme” with

The most senior levels of HSBC Group were kept informed about the case. On April 20,

2007, for example, Matthew King, head of HSBC Group Audits, sent an email to HSBC Group

CEO Michael Geoghegan with this update:

“I am told the Mexican authorities are taking a relatively benign attitude to our

involvement with this customer, which is fortunate because the review has revealed a

number of weaknesses. A series of inaccurate, and possibly fabricated, visit reports seem

to have been filed by the business which resisted any reporting of suspicions a number of

times. For its part, the Moneylaundering Department failed to act as a proper check and

balance. I have suggested a thorough review of processes within the Moneylaundering

Department and of the Moneylaundering Committee to ensure they are robust. … There

The Unimed scandal broke nearly five years after HSBC first began working to

strengthen HBMX’s AML controls and create a compliance culture. It showed that, while

progress had been made, HBMX still had multiple AML deficiencies and a poor compliance

culture.

2007 AML Efforts. For the rest of 2007, HSBC Group Compliance devoted attention

and resources to strengthening AML controls at HBMX, with limited success.

One step taken was to task the new HBMX Chief Operating Officer, John Rendall, with

overseeing HBMX’s KYC remediation effort for existing client files, an effort mandated by

Mexican regulators had given Mexican banks until

Subcommittee interview of Paul Thurston (5/1/2012).

Transactional Banking Audit: HBMX – Money Laundering Deterrence,” prepared by Group Audit Mexico, HSBC

OCC 8874802-810.

“Managerial Letter: HBMX-[redacted by HSBC],” HSBC OCC 8874762.

Update,” HSBC-PSI-PROD-0198510-511.

61

2007, to update the KYC information in all customer files; HBMX had obtained an extension

In June 2007, David Bagley, HSBC Group Compliance head, visited HBMX for several

days, met with CNBV officials, and circulated a report on the outstanding compliance and AML

issues. In an email transmitting his report, Mr. Bagley wrote:

“[T]here do appear to be a number of issues to be resolved, particularly those relating to

accurate ongoing account opening, prompt effective and complete remediation in

accordance with CNBV requirements for existing accounts, and completion of the

recommended enhancements to the working of the MLD committee. … [W]e will need

on an ongoing basis to consider the nature and extent of the resources currently available

in CMP [Compliance]. … I suspect we are already stretched given the apparent growth

that has already, or is intended to take place in this area which appears to be growth of

HBMX’s anticipated failure to meet a Mexican regulatory deadline for reviewing the KYC

information for all existing accounts to ensure compliance with regulatory requirements. The

report noted: “There appeared to be differing opinions as to how many accounts were affected,

how many accounts were outstanding and therefore no real tracking of the progress being made.”

The report recommended reaching a consensus on the method for tracking accounts and

completing the task. The report also expressed concern about KYC weaknesses in opening new

accounts. It noted: “If we are opening new accounts badly it will only add to the remediation

exercise required by CNBV …. Accurate and complete account opening is a key AML control,

particularly in emerging markets.” A third key issue was “confusion as to the stated aims and

purpose of the MLD Committee.” A fourth was that “the CAMP monitoring system produces

significant numbers of ‘false’ alerts. This is a feature of all AML monitoring systems. Having

said this, steps are being taken across the Group to seek to minimize this,” and recommended

that similar steps be taken in Mexico. A fifth concern was that the compliance team was “lightly

resourced.”

The report also discussed a “cordial” meeting held with CNBV regulators. It said that the

regulators were “overall extremely positive about the bank” but also “had a fairly lengthy list of

a 1-year extension to MAY08 for HBMX to regularize customer identification files for account[s] opened or

contracts signed before MAY04.”); 12/2007 audit of “HBMX-Money Laundering Deterrence (MLD),” No. HBMX

GAQ 070086, prepared by HSBC Group Audit, Executive Summary, HSBC OCC 8876347 (“HBMI has been given

an extension by the Regulator from May 07 to May 08 to ensure that a portion of the client files (known as the UBA

project – about 1.8m customers) are completed.”).

Paul Thurston,

head of HSBC Mexico, thanked Mr. Bagley for the “constructive report.” He wrote:

8874967-968. Mr. Bagley visited Mexico and Panama from June 11 to June 14, 2007. See 7/27/2007 Minutes of

LAM Regional Audit Committee, HSBC OCC 8875086-090, at 3.

974.

62

“I agree with your comment that we need to review the role and resources in the

Compliance function. … For all Ramon’s strengths, I have equally seen weaknesses in

addressing key issues … and in my view the jury is out on his ability to do all that we

need in HBMX, let alone try to oversee other countries in the region. … [W]e should

review between the three of us in a few month’s time, when we see what progress is

The very next month, July 2007, John Root, head of Latin American Compliance, sent a

blistering email to Ramon Garcia condemning HBMX’s CCC Committee for “rubber-stamping

unacceptable risks”:

“A number of items jump out from your most recently weekly report (02JUL-06JUL) but

everything pales in comparison with the ML items on page 4. It looks like the business is

still retaining unacceptable risks and the AML committee is going along after some initial

hemming and hawing. I am quite concerned that the committee is not functioning

properly. Alarmed, even. I am close to picking up the phone to your CEO.

an ‘assumption responsibility letter’ and how would it protect the bank if the client is a

money launderer? Please note that you can dress up the USD10 million to be paid … to

the US authorities as an ‘economic penalty’ if you wish but a fine is a fine is a fine, and a

hefty one at that. What is this, the School of Low Expectations Banking? (“We didn’t go

to jail! We merely signed a settlement with the Feds for $ 10 million!”) …

three. (I hope you like baseball.)

The same person who is giving the sancrosanct ‘assumption responsibility letter’ for

[Redacted by HSBC] … is being asked by the CEO to explain why he retained the [Casa

The AML Committee just can’t keep rubber-stamping unacceptable risks merely because

someone on the business side writes a nice letter. It needs to take a firmer stand. It needs

OCC 8874965.

referring to Unimed. Subcommittee interview of John Root (4/26/2012).

from Wachovia Bank in Miami indicates that the client is Casa de Cambio Puebla. See discussion below.

and Warren Leaming, “Weekly Compliance Report 02JUL-06JUL07,” HSBC OCC 8875925-927.

63

Mr. Garcia responded that he was escalating the two cases involving high risk clients as

essentially required the CCC committee to give great weight to the opinion of the business side

of the bank, because “they are the ones that really know the customer.” He said that he had

escalated the cases to the HBMX CEO, because MLD had “a different opinion” from the

business “about reporting the case to authorities.” Essentially, he said that the final decision

belonged to the HBMX CEO, rather than the CCC Committee.

The next week, Paul Thurston, HSBC Mexico CEO, supported the CCC Committee’s

recommendation to close one of the accounts, but not the other. He supported closing the

account of Casa de Cambio Puebla, which had been a client for more than 20 years, but whose

funds at Wachovia Bank had been seized by the U.S. Justice Department and Drug Enforcement

second account involved a U.S. money services business, Sigue Corporation, which specialized

in remitting funds from the United States to Mexico and Latin America. Mr. Thurston, on the

Later in July, the HSBC Latin American (LAM) Regional Audit Committee held a

Robertson, David Bagley, and Matthew King; LAM/HBMX officials Paul Thurston, Emilson

Alonso, and Graham Thomson; HBMX Compliance head Ramon Garcia; and others from HSBC

affiliates throughout Latin America. Mr. Thomson, head of LAM Internal Audit, discussed risk

and compliance issues in several countries, and noted that Regional CEOs were now required to

“take disciplinary action should a manager record 2 consecutive Below Standard control risk

Thomson noted that although 96% of HBMX electronic records reportedly met regulatory

requirements, there was a “high level of exceptions and variance between the paper and

electronic records” which would require “a large rectification effort” to meet the regulatory

HSBC OCC 8875925.

He also noted that branch offices were not sufficiently familiar with

SCC requirements, and criticized the CCC Committee for failing to followup on instructions to

close client accounts. Mr. Thurston noted that the CCC Committee was introducing an

redacted by HSBC], HSBC OCC 8875132-135.

8875139. Six months later, in January 2008, Sigue Corporation entered into a deferred prosecution agreement with

the U.S. Justice Department, admitting that some of its agents had been laundering drug proceeds. See United States

v. Sigue Corp. and Sigue LLC, Case No. 4:08CR54 (USDC EDMO), Deferred Prosecution Agreement Factual

Statement (1/28/2008). HBMX’s relationship with Sigue Corporation is discussed further below.

64

Garcia also reported that automation problems were causing delays in the issuance of Suspicious

Activity Reports (SARs), but that interim manual reviews had not detected activity requiring any

management and control of account documentation using electronically imaged documents.

CNBV Escalates Concerns. Two months later, in October 2007, the CNBV asked to

meet with Paul Thurston, the HSBC Mexico CEO, to express ongoing concerns about HBMX’s

compliance and AML efforts. Mr. Thurston summarized the meeting in an email to the HSBC

“At their request, I met today with the Head of Banking Supervision, and the Supervisor

for HSBC, from our regulator, the CNBV, following their on site examination of various

aspects of our business, including cards, money laundering, and treasury operations. …

They walked me through a presentation pack which firstly set out specific points … but

then moved on to more general concerns of the CNBV with HSBC in Mexico. These

centered on:

– weaknesses in internal controls … slow progress in tackling KYC data problems and

anti money laundering procedures.

– corporate culture, where they comment that … HSBC has driven growth in credit

products and launched new products without adequate controls. …

They also expressed concerns at senior management having dual responsibilities for

Mexico and the region, stating that ‘there are many concerns on how management will be

able to implement strong controls within the bank in Mexico, while keeping an eye on

other countries.’ ...

I indicated to them we were aware of these issues and were progressively tackling

His email then outlined the steps he told CNBV that HBMX was taking, including new

hires, “customer file centralizing and imaging which would give us more robust KYC data for

anti-money laundering,” and working to change the culture of the bank which “would not happen

dispute would be escalated to the HBMX COO, and then to the CEO. In addition if a business wanted to close an

account, a higher ranking Executive Director would have to make the decision. Subcommittee interview of Paul

Thurston (5/1/2012).

Mr. Thurston wrote that the CNBV officials told him that was “what they wanted

to hear and that they would report back positively” to the head of the CNBV. Mr. Geoghegan

HSBC OCC 8873338-342.

65

responded: “This is disturbing and clearly we will need to look at the management structure and

practices. … I am copying this to the Group Chairman and Matthew King for their

In December 2007, the internal audit group for Mexico issued a report that had been

“[r]egulatory breaches in KYC issues such as the large number of incomplete client files and the

HBMX had a May 2008 deadline for bringing files into compliance with KYC regulations set by

the CNBV, and that regulators had been told 86% of client files already met regulatory

requirements, while audit work over the past year suggested a much lower percentage, “as low as

46%.” The audit report also noted that the KYC effort was remediating only 1.8 million files

involving high risk, excluding another almost 6 million clients “that the Group has in Mexico

The 2007 audit report also disclosed SAR filing and alert review backlogs. It noted

“4,890 accounts that reported unusual transactions that took place between APR [April] and

AUG07,” but which had yet to be reported to Mexican authorities, “thereby breaching the

The report also noted 7,217 alert warnings of which 858 (12%) had not been reviewed at all,

“posing a potential risk that criminal transactions may not be identified which may have an

review these alerts had been going on for one year due to “insufficient Operations staffing.” The

report also criticized “Senior Management” for attending few AML committee meetings,

delaying decisions on cancelling accounts, and delaying the imposition of sanctions when cases

understanding” of the AML IT systems and inadequate AML training as evidenced by the

seriousness of the weaknesses identified,” the report recommended creating an HBMX Money

Laundering Committee to undertake the effort needed to address the widespread AML

shortcomings.

GAQ 070086, prepared by Group Audit Mexico, HSBC OCC 8874802-810.

66

Confronted by this long list of AML deficiencies, HSBC Group sent Warren Leaming,

CNBV and FIU Dissatisfaction Deepens. As 2007 drew to a close, HSBC Group and

HBMX worked to strengthen HBMX’s AML efforts, but CNBV dissatisfaction with the bank

seemed to deepen and the list of AML concerns broaden in 2008, encompassing for the first time

concerns about HBMX’s participation in bulk cash services.

In February 2008, Mr. Thurston, HSBC Mexico CEO, met again with CNBV officials, at

email he sent summarizing the meeting, CNBV handed him a draft report detailing multiple

“It is clear in this that our Head of Compliance is not as highly regarded by the CNBV as

had been thought by local and Group management, and indeed appears to have misled us

about the extent to which the CNBV have been informed of, and/or are satisfied with, our

HSBC Group CEO Geoghegan responded: “This is most disturbing and we will need to have the

The report provided by the CNBV stated that “[a]s a result of the increase in bank’s

variety of problems. With respect to AML issues, the report concluded that “little improvement”

client files reviewed, “55 files (50%) were incomplete,” and 5 files were not provided at all. It

noted a “[l]ack of closer supervision to high profile risk clients”; a lack of risk criteria to classify

clients during the account opening process; and missing client updates for high risk customers

HBMX DEC Visit Issues,” HSBC OCC 8875837 (“I am keeping a list of issues that you might want to raise during

your December visit to HBMX,” including deteriorating audits of treasury operations, resourcing concerns, “Sinaloa

massive money-laundering scheme (+USD 100 million),” “HBMX Trusts backlog,” “Banistmo business in

regulatory and tax havens,” and “AML systems integration”).

Another deficiency was that the CAMP and HOGAN

monitoring systems did not collect transaction profiles for new accounts, as required by law, and

and Matthew King, “Confidential – CMBV/FIU Meeting,” HSBC OCC 8873331-333.

8966021-026, at 6. [Sealed Exhibit.]

Chairman Stephen Green, “Confidential – CMBV/FIU Meeting,” HSBC OCC 8873331.

8966021-026, at 1. [Sealed Exhibit.]

67

the CCC Committee delayed closing suspicious accounts, citing the example of a $2.8 million

The report also described a number of AML deficiencies identified by the FIU, stating:

“Evidence obtained by the Financial Intelligence Unit of Mexico (UIF) on a frequent basis has

provided a chart showing that HSBC had much more bulk cash transactions using U.S. dollars

than other Mexican banks, and expressed U.S. and Mexican law enforcement concern that the

HBMX frequently failed to provide requested information, claiming the files or basic account

documents could not be located, providing a chart showing HBMX’s response record was worse

cases” it had investigated in 2007, “many transactions were carried out through HSBC,” and in

noted that it had been able to obtain copies of account documents that HBMX had claimed it

could not locate. “These last cases may imply criminal responsibility of HSBC and its personnel

– such as that relating to false statements to administrative authorities and complicity – that the

Internal HBMX and HSBC Group documents indicate that senior management

immediately began to investigate the allegations. HSBC Group CEO Michael Geoghegan spoke

to HSBC Group Chairman Stephen Green, as well as senior HSBC Group and HBMX personnel,

Mexico immediately for a two-week stay. Mr. Thurston directed the head of Latin American

Security to investigate certain allegations, and the head of Latin American internal audit to

Mr. Geoghegan prior to an upcoming HSBC Group Board meeting.

Three days later, on February 22, 2008, Matthew King composed a draft email as a way

to organize the information that should be conveyed to Mr. Geoghegan in a telephone call, and

circulated his self-described “brain dump” to Mssrs. Thurston, Bagley, Bennett, and Graham

The email indicated that the AML concerns raised by the CNBV

were “pretty similar” to issues raised earlier, but the CNBV had “suddenly become more

aggressive.” The email speculated on whether that was due to political pressure, FIU concerns,

or possibly a separate disagreement with the FIU regarding reimbursing a public utility for a

Corporation.

to Stephen Green and David Bagley, “HBMX – ML Review,” HSBC-PSI-PROD-0198506-507.

HSBC-PSI-PROD-0198505-506.

HSBC Richard Bennett and HSBC David Bagley, “CNBV,” HSBC-PSI-PROD-0198508-509.

68

fraud. Mr. King also wrote: “It is also the case that Mexico is suffering a major problem with

drugs dealers and the Government is being very robust about dealing with them.”

The King email then went through the issues. It noted that the December 2007 internal

AML audit of HBMX was “Below Standard,” and that the AML Director Leopolodo Barroso

would be replaced, “albeit the FIU apparently regard him as trustworthy” so his replacement

was account KYC, which had been “a systematic problem for some time.” Among other matters,

the email noted that a pilot project to centralize account documentation through electronic

imaging was underway, but “Audit is continuing to identify a high level of exceptions for that

“Given the concerns now raised by the CNBV and FIU (which apparently includes tapes

of a drug lord recommending HBMX as the place to bank) we now have to decide:

whether the imaging process can be made to work to everyone’[s] satisfaction[;] how

quickly it can be rolled ou[t] across the whole network[; and] in the meantime, whether

The email also described account documentation as “a problem since we bought Bital,” and

noted that CNBV had again questioned having HBMX personnel handle compliance issues for

that trends still needed to be clarified, but he thought the United States had “a general concern

rather than a specific one about us.”

The next day, February 23, 2008, Paul Thurston sent an email to Michael Geoghegan

with additional information. He wrote:

“Firstly, to answer your question of why is this being raised now? The intelligence that

we have been able to gather is that with President Felipe Calderon declaring war on the

drugs gangs, crime and corruption the judicial authorities have heightened the focus on

financial investigations and have been putting increasing pressure on the bank regulators

because the banks have been seen as not providing good enough support. … HSBC has

historically, and continues to have, a worse record than the other banks, so we have

become a focus of attention. The new Head of the FIU has told us that his staff have told

him that HSBC has been the most difficult bank to obtain accurate and timely data from

the purported tapes, but none was provided. Subcommittee interviews of David Bagley (5/10/2012) and Paul

Thurston (5/1/2012).

Matthew King, Richard Bennet and David Bagley, “CNBV/FIU Update,” HSBC-PSI-PROD-0197872-873.

69

Mr. Thurston wrote that HBMX had taken more corrective action than the regulators

addressed, in part, by a new centralized electronic imaging procedure which was taking effect

Mexico-wide that month. In addition, he wrote that “stronger disciplinary procedures” were

being put in place for branch managers who signed off on account openings without personally

letters per week from the CNBV asking for account information, and that more resources had to

be dedicated to responding to them.

Finally, on the bulk cash issue, Mr. Thurston wrote that the United States had a general

concern, “not aimed specifically at HSBC,” about the flow of U.S. banknotes from Mexico and

analysis of the cash flows, and initial indications were that its handling of U.S. dollars “had been

On February 27, 2008, Mr. Bagley conducted an exit interview with the HBMX AML

Director Leopoldo R. Barroso, who was being replaced. Mr. Barroso provided a negative view

of HBMX AML performance. According to a meeting summary written by Mr. Bagley, Mr.

Barroso said that, while in his position, he had felt civil and criminal “litigation exposure” due to

“the continued poor controls in the bank, the fact that there were allegations of 60% to 70% of

laundered proceeds in Mexico went through HBMX and because he did not think that senior

was only a matter of time before the bank faced criminal sanctions and cited a number of cases.”

Mr. Bagley wrote:

“It was clear that LRB [Leopoldo R. Barroso] felt very strongly that relevant business

heads within HBMX had absolutely no respect for AML controls and the risks to which

the Group was exposed and had no intention of applying sensible or appropriate

approaches. Again he cited a number of examples where despite strong

recommendations with the CMP [Compliance] business heads had failed or refused to

close accounts or indeed on occasions file SARs. He thought that there was a culture that

pursuing profit and targets at all costs and in fact had seen no recent improvement in the

standard of controls or the types of decisions being taken.

He was critical of the level of resources in his team and felt that his team had done much

to keep the bank out of trouble by working extra hours against impossible deadlines and

handling significant volumes of alerts including those from CAMP. …

[H]e thought he needed at least 35 new headcount.…

Update,” HSBC-PSI-PROD-0198510-512.

70

He was extremely critical of RG [Ramon Garcia] who he described as being indecisive,

Mr. Bagley later forwarded his summary of the meeting to Mr. Thurston who responded

that “the jury is still out on Ramon” and a discussion was needed on structuring the Latin

On March 3, 2008, HBMX issued a 12-page response to the internal control issues raised

actions” being taken by the bank to address each concern. Among the actions discussed were the

new centralized process for ensuring account opening documentation was obtained and

electronically recorded; a new effort to centralize PEP files, obtain missing documentation, and

strengthen annual PEP reviews; new disciplinary procedures for opening accounts with

incomplete documentation; the re-engineering and strengthening of the alert reporting process;

replacement of the AML director; and strengthening of the AML staff. The response also

indicated that management changes had been made to split responsibilities for Mexico from the

rest of the Latin American region. On the issue of U.S. banknotes, the response indicated that

HBMX U.S. dollar volumes had not increased, but were marginally lower than in 2003. It also

announced a new policy, effective immediately, to deem all customers who deposit more than

$100,000 in a month as SCC clients subject to enhanced due diligence. The response said that

312 customers met that criteria and were being subjected to a KYC review.

Mr. Thurston and Mr. Bagley met with CNBV and FIU officials on March 4, 2008, to

deliver the response and discuss the bank’s actions. They reported to Mr. Geoghegan that the

Mr. Bagley returned to London, he also discussed the matter with the Financial Services

Authority (FSA), HSBC’s UK regulator, which had communicated with CNBV. Mr. Bagley

reported that “CNBV confirmed that they were satisfied with the reaction and steps we have

Group Board of Directors, Mr. Bagley briefed the HSBC Group Audit Committee about HBMX,

Restoration Project. HBMX spent the next six months working to carry out the

corrective actions outlined in its March response to CNBV. HBMX also underwent personnel

changes. In May 2008, Paul Thurston was promoted and returned to London, having spent a

little more than one year in Mexico. Luis Pena Kegel took over as HSBC Mexico CEO and head

of HBMX. Emilson Alonso was appointed head of HSBC Latin America, carrying out the

HSBC OCC 8874821-822.

HSBC-PSI-PROD-0198513.

71

commitment made to CNBV to split the two sets of responsibilities. In the summer of 2008, a

One key AML activity undertaken by the bank was to work on bringing the KYC

documentation for existing accounts into compliance with CNBV requirements, an effort HBMX

deemed “Projecto Restauracion” or the Restoration Project. HBMX was supposed to have

completed the KYC effort by May 2008, after having obtained a one-year extension, but was far

behind schedule. HBMX appointed John Rendall, HBMX COO, to oversee the new project.

began pressing branch personnel to complete their KYC updates. John Root, HSBC Group

Compliance head for Latin America, attended a meeting of the Restoration Project team during a

Also in July 2008, Mr. Rendall provided a progress report to the Latin American regional

audit committee on a number of AML and compliance efforts, outlining “9 workstreams.” He

described several milestones, including implementing the centralized account opening process

for all HBMX branches, initiating the KYC Restoration Project “focused on high risk accounts,”

achieving a “90% reduction (from 34,700 to 3,300)” in the 2008 CAMP alert backlog, requiring

enhanced KYC for customers with over $100,000 in U.S. dollar deposits, and improving FIU

On a more negative note in July, HBMX’s internal monitoring system generated a

number of alerts identifying “significant USD [U.S. dollar] remittances being made by a number

of customers to a US company alleged to have been involved in the supply of aircraft to drugs

“precaution” pending review of the account activity, HBMX stopped opening new Cayman

accounts should be included in the Restoration Project “as a priority area,” and should “be seen

In September 2008, HBMX’s internal audit group reviewed the Restoration Project and

quickly identified multiple, growing problems. In an email describing the audit findings,

Graham Thomson, head of the Latin American internal audit group, wrote:

OCC 8873487-489.

Timeline,” HSBC-PSI-PROD-0198514-516.

Timeline,” HSBC-PSI-PROD-0198514-516.

andothers, “HBMX – Cayman Accounts,” HSBC OCC 8874832-833.

72

“The key issues … include slow progress with remediating PEPs/SCCs and other high

risk customers, with some 40% of the KYC records of PEPs/SCC customer segment …

not yet remediated. These accounts are now in the process of closure by HBMX Legal.

… [C]hecks done by CMP [Compliance] on visit reports … continue to reveal an

Mr. Alonso, head of HSBC Latin America responded that the audit results were “disappointing”

The audit report found that the Restoration Project had “major weaknesses … that could

It said that resources dedicated to the project “appeared insufficient to deliver the quality and

timeliness required,” and clients engaged in high risk businesses “had not been identified for

“The impact of account cancellation on the business, customers and costs should be

analysed against the risks that have been mitigated and accepted, as this will allow having

adequate balance between control and business, particularly where cancellations may be

This recommendation appears to suggest that some high risk accounts not be closed, even

where the bank was unable to review the account by the regulatory deadline and KYC

deficiencies might exist. Mr. Thomson’s email indicated, however, that unremediated files for

PEP and SCC clients subject to the Restoration Project were already in the process of being

“7,941 KYC files for high risk customers had been reviewed & updated, or scheduled for

with various risk flags” were being reviewed, with plans for a third phase to examine “83,000

accounts with historic CAMP alert profiles.” These figures were well below, however, the 1.8

million in high risk accounts that were supposed to be reviewed to ensure KYC documentation

met CNBV requirements.

November Meeting with CNBV. On November 26, 2008, a high level meeting took

place between HSBC and CNBV. Michael Geoghegan, HSBC Group CEO, traveled to Mexico

others, “HBMX – Projecto Restauracion,” HSBC OCC 8873464-465.

Restauracion,” HSBC OCC 8873463.

Internal Audit, HSBC OCC 8876417-424, at the Audit Report Summary Schedule, HSBC OCC 8876424.

others, “HBMX – Projecto Restauracion,” HSBC OCC 8873464-465.

Timeline,” HSBC-PSI-PROD-0198514-516.

73

to attend. Along with Emilson Alonso, head of HSBC Latin America, and Luis Pena, head of

HSBC Mexico, Mr. Geoghegan met with the President of CNBV, Guillermo Babtz; the head of

CNBV bank supervision, Patricio Bustamante; and the head of CNBV AML oversight, Pablo

the CNBV concerns identified in February 2008.

According to an email prepared by the Deputy Head of HSBC Group Compliance,

Warren Leaming, who had accompanied Mr. Geoghegan to Mexico and remained there for

but remained “very concern[ed]” about the U.S. dollar accounts at HBMX’s Cayman branch, the

slow KYC review of those accounts, and the “sheer volume of US Dollars that HBMX

HBMX had repatriated $3 billion to the United States, which represented 36% of the market and

double what the biggest bank in Mexico, Banamax, had repatriated, even though HBMX was

“concerned that when-ever there is a serious MLD [Money Laundering Deterrence] scheme

Mr. Geoghegan told the Subcommittee that his meeting with the Mexican regulators did not go

as he had expected, he told the CNBV that HBMX would address the issues raised, and he

Stopping U.S. Dollar Services. After the meeting, Mr. Alonso sent an email to Mr. Pena

asking him to examine the “export of cash USD to the USA,” including the volumes of U.S.

dollars being exported, the types of clientele using the HBMX branch network to make U.S.

dollar deposits for remittance to the United States, and the branches involved in more frequent

service in our branches. Corporate clients that require such service should be approved by you

Later that same night, Mr. Geoghegan sent an email to Mr. Alonso stating: “It occurs to

me: We should stop any Dollar remittances or accept any Dollar payments unless they are done

HSBC OCC 8875605-607.

He also wrote: “We should

bench mark HBMX CAMP and other search engine systems with HBUS (they have some very

HSBC-PSI-PROD-0197874 (indicating Mr. Leaming visited HBMX from Nov. 25 to Nov. 28).

OCC 8875606.

and others, “Visit to CNBV – Findings and Required Actions,” HSBC OCC 8874846-847.

OCC 8874849-850. Mr. Geoghegan told the Subcommittee that he made a unilateral decision to stop these U.S.

dollar services. Subcommittee interview of Michael Geoghegan (5/24/2012).

74

sensitive behavior monitors) and see whether we are finding as many suspicious transactions as

we should be.” Mr. Alonso forwarded the email to Mr. Pena, who responded the next day:

“The two immediate actions we are taking are:

Starting December 1. We will no longer buy or sell dollars in cash at ANY branch

(customers or non customers). We will, as an alternative, offer travelers cheques to

customers only. Also customers can withdraw dollars at HSBC ATMs located at airports

or from any ATM in the world with their debit card.

Starting January 1. We will no longer accept deposits of cash dollars to any dollar

account at any branch.

We are quantifying the impact of lost revenues. On the flipside, we will save the

operating cost of transporting and exporting dollar bills.

Mr. Pena also proposed continuing indefinitely the freeze on opening new U.S. dollar

accounts through HBMX’s Cayman branch, and prohibiting the acceptance of new cash deposits

noted in an email to his supervisor, David Bagley, that when Mr. Pena commented that the

actions being taken “could result in lost profits of many billions Mike[‘]s clear response [was]

actions were “considered extremely sensitive here in Mexico and local management want to get

their ducks in a row … so it will be much appreciated if the above could not be … disseminated

without discussing further.”

Account Closing Backlog. Mr. Leaming also noted that “there appears to be a huge

back-log in closing accounts,” with customers continuing to use accounts in November that had

been ordered closed eight months earlier in March. He wrote that those accounts, which were

still being used by customers, may be “part of the reasons for multiple SARs” being filed for

some accounts, potentially putting HBMX in breach of HSBC policy on account closure after

Mr. Bagley responded: “What I find most frustrating is the way in which new issues

changing USD in the branches pres[u]mably with little or no ID for non customers is in breach of

Group policy. When looking at our USD exposure how can this have been missed.” He also

asked Mr. Leaming to consider challenging the involvement of the Legal Department in the

account closing process so that it could proceed more quickly.

“Money Launderying,” HSBC OCC 8874849.

OCC 8875605-607.

8875605.

75

The next day, November 28, 2008, Mr. Geoghegan sent an email to top HBMX and

HSBC Group Compliance officials stating that it should be made clear to all HBMX personnel

“that if there are persistent breaches of KYC in a particular branch, the branch will be closed and

required HBMX’s compensation scorecard to include implementing the CAMP monitoring

system to the maximum extent possible and closing accounts with two or more SARs. He wrote:

“[I]f you demonstrate zero tolerance of lapses in implementing KYC then the operations

standards of the whole business improves at the same time. What we are doing in Mexico needs

AML Shock Plan. Mr. Pena responded that in January 2009, he was planning to close

two branches and fire all staff “as exemplary measures” and was working to identify the

wrote:

“Last but not least, I will address the issue of funding. After all, Cayman and Mexican

dollar accounts provide us with US$2.6 billion of cheap funding. We are likely to lose a

big portion of this if we tell customers we no longer receive dollar notes. We have to

provide an alternative to our customers for this: Miami accounts may be an alternative

but we will have to talk to HBUS of how we get this ch[eap] funding back to Mexico to

In December 2008, at the conclusion of his latest visit to Mexico, Mr. Leaming drafted a

letter to Mr. Pena summarizing a number of AML issues and sought input from other HBMX

Bagley, HBMX Luis Pena, and others, “Final draft for Mike’s Letter,” HSBC OCC 8874857.

His draft letter discussed the late filing of SARs, the backlog in

closing accounts, the failure to close accounts after two SAR filings, slow and weak decisions by

the CCC Committee, the need to clarify transaction limits, and the need for further refinement of

the CAMP alert system. He noted that the account closing backlog consisted of over 3,600

accounts, of which 675 involved suspicion of money laundering and had been ordered closed by

the CNBV, yet were still open. He also noted that 16 of the accounts remaining open had been

ordered closed in 2005, 130 in 2006, 172 in 2007, and 309 in 2008. He wrote that he’d been

advised that the law did not permit the accounts to be blocked pending closure, which meant

account activity was continuing. To speed up closures, he advised that his research had indicated

the Legal Department did not have to participate and clients could be notified of the account

closing by certified mail. Mr. Leaming also noted that 3,000 Cayman accounts had been

proposed for closure which would further stress the process. In addition, he warned that the

switch from U.S. dollar deposits to travelers cheques could also raise AML concerns, advised

lowering the $25,000 ceiling on the amount of travelers cheques that could be purchased by a

Geoghegan, David Bagley, and Matthew King, “Final draft for Mike’s Letter,” HSBC OCC 8874856.

David Bagley, John Root, Susan Wright, and others, “Mexico Visit,” HSBC-PSI-PROD-0197874-876.

76

customer, and creating a new limit on the amount of travelers cheques that could be deposited at

one time to a client account. He recommended setting dollar limits on cashiers cheques as well.

Later in December, HBMX prepared to implement the new AML policies and procedures

branches “as disciplinary actions,” with another 10 to 20 branches that, in January, would have

January 31 was set as the date to complete the Restoration Project and begin closing accounts

On December 22, 2008, an HBMX employee alerted the HBUS regional head of

Banknotes, Gyanen Kumar to the HBMX’s plan to stop buying and selling U.S. dollars in the

“I have not been told anything firm as to why this decision is being taken as much as it is a

HBMX apparently did not explain, leaving HBUS uninformed about the compliance and

regulatory pressures and AML risks behind HBMX’s decision to end its U.S. dollar business.

Law Enforcement and Regulators Converge. In January 2009, HBMX began

implementing the planned AML changes. It stopped buying and selling U.S. dollars and began

That same month, U.S. regulators began contacting HBUS to get clarification about

the decision had been based primarily on cost considerations, without mentioning the compliance

Root, David Bagley, and others, “Anti Money Laundering: Shock plan – Update 081215,” HSBC OCC 8875786-

790; 12/23/2008 email from HSBC Warren Leaming to HBMX Caterine Bussery, with copies to HSBC David

Bagley, John Root, and Richard Bennet, “Anti Money Laundering: Shock plan – Update 081215,” HSBC OCC

8873474-476; 1/27/2009 email from HSBC David Bagley to HSBC Susant Wright with copy to Warren Leaming,

“Press Release,” HSBC OCC 8873485.

The regional head of HBUS’ Banknotes

Bagley, and others, “Anti Money Laundering: Shock plan – Update 081215,” at HSBC OCC 8875786.

completed by the January 31 deadline. Id.

Mexico,” HSBC-PSI-PROD-0095869-870.

Mexico,” HSBC-PSI-PROD-0095869.

large reputable Mexican banks, Banamex, Banorte and Ixe, in effect making its first exceptions to the new policy.

See 12/22/2008 email from HBMX Mario Langarica to HBUS Gyanen Kumar and others, “USD cash in Mexico,”

HSBC-PSI-PROD-0095869-870.

Lawrence, Gyanen Kumar, and others, “HBMX Banknotes business,” HSBC OCC 3633806-812.

77

department, Gyanen Kumar, who was traveling to Mexico the next week, was asked by his

banknotes accounts used by two Mexican clients, but to retain accounts with the same clients in

that the Mexican clients could no longer make bulk cash sales of their U.S. dollars to HBUS, but

the continued operation of their PCM accounts meant that both Mexican clients could still

deposit U.S. dollars, execute U.S. dollar transactions, exchange U.S. dollars for Mexican pesos,

and access the U.S. wire transfer system.

Around the same time, the Immigration and Customs Enforcement (ICE) arm of the U.S.

Department of Homeland Security (DHS) held a meeting with HBUS in New York, and

informed it that ICE was conducting an investigation of a particular Mexican casa de cambio that

HBMX.

Six months later, in June 2009, HSBC Group increased its risk assessment for its Latin

head, protested, HSBC Group Compliance head David Bagley explained:

“I fully acknowledge the level of priority and focus that you and the team have given to

these issues and the progress that has been made particularly in Mexico and have taken

all of this into account. …

The basis for the rating is however:

The inherent AML risk in Mexico is still very high and [t]here are not many other parts

of the Group that have what is effectively a drugs war being conducted on the streets and

also have the risk posed by potential sting and other operations by the US authorities.

We have of course remediated our high risk accounts, but the historic weak account

opening processes mean that we have overall lower levels of KYC across the customer

A week or so later, HBUS suddenly reclassified Mexico from its lowest to its highest risk rating.

HBMX personnel in Mexico protested, but HBUS did not change its rating. One consequence

was that its Mexican clients were automatically deemed to be located in a high risk country,

triggering enhanced scrutiny.

“An obvious learning point for HBMX is that if they were contacted by US authorities then they should have

thought to advise HBUS. They can go round the web, not just through the middle of the web. 1/30/2009 email from

HSBC David Bagley to HSBC Susan Wright, “US issues – Various,” HSBC OCC 8873759.

and others, “GMO Business reviews – LATAM,” HSBC OCC 8874895.

78

Later in June 2009, ICE contacted HBMX about its investigation into a particular

the OCC began intensifying its regulatory scrutiny of HBUS, in particular with respect to its U.S.

In the meantime, AML deficiencies continued to surface at HBMX. For example, in June

2010, HBMX noted that “certain transaction types were not being captured” by its AML account

the CAMP software had not been updated “since its installation in 2005.” In September 2010,

the OCC issued a Supervisory Letter detailing massive AML deficiencies at HBUS, derived in

part from its dealings with Mexico. The OCC followed with a cease and desist order in October.

Eight Years of HBMX AML Deficiencies. HBMX and HSBC Group internal

documents demonstrate that HBMX’s AML deficiencies were longstanding and widespread.

Audit after audit detailed long lists of problems, including inadequate compliance resources,

missing KYC information, manufactured site visits, inadequate account monitoring, unread

alerts, poor training on the monitoring system and assigning SCC designations, internal disputes

over closing accounts with suspicious activity, accounts left open despite multiple SARs and

orders by regulators to close them, a SAR filing backlog, and an account closure backlog that

spanned three years. AML leadership at HBMX was also weak. One AML director was

dismissed for manufacturing notes of AML committee meetings that never took place; another

was dismissed for inadequate performance; several long periods went by without any AML

director in place at all. Even AML projects with resources and high level backing were

unsuccessful, such as the Restoration Project which reported in 2008, that 75% of high risk client

files still had inadequate KYC documentation.

The evidence obtained by the Subcommittee shows that HSBC Group was fully aware of

the years-long, substantial AML and compliance problems at HBMX, originating with the bank’s

purchase in 2002. The evidence also indicates that HSBC Group executives and compliance

personnel worked to build a compliance culture, but repeatedly faced a workforce in Mexico that

disregarded the Group’s AML policies and procedures, delayed obtaining required KYC data,

delayed closing suspect accounts, and delayed reporting suspicious activity to regulators. In

2009, under pressure from regulators, HSBC Group took drastic measures, including prohibiting

HBMX branches from buying or selling U.S. dollars, shuttering entire branches with checkered

histories, and scheduling for closure thousands of accounts with incomplete KYC

declining, HBUS’ banknotes business with Mexico had been increasing at the same time, due to its banknotes

business with HBMX and former clients of HBMX. Subcommittee interview of Paul Thurston (5/1/2012).

“RMM action point,” HSBC OCC 8875492-493 (attaching Compliance Report on Mexico, numbered 53.2.1).

79

documentation. Even with those actions, HSBC Group acknowledged internally that HBMX

The evidence also indicates that while HSBC Group was fully informed about HBMX’s

AML and compliance deficiencies, little of that information was conveyed to HBUS, despite

HBMX’ extensive correspondent relationship with HBUS. When asked about the lack of

communication, HBMX CEO Paul Thurston indicated that he reported HBMX’s AML problems

HSBC Group CEO Michael Geoghegan told the Subcommittee that HBMX problems were

discussed at HSBC Group Management Business (GMB) meetings, which HBUS CEO Brendan

Compliance head David Bagley told the Subcommittee that Group Compliance could have

Instead, he reported the information to HSBC Group’s senior management. Several senior

HBUS executives told the Subcommittee that the bank was not informed of the extent of AML

problems at HBMX. The result was, at the same time HBUS was handling hundreds of billions

of dollars in cash transactions for HBMX, processing U.S. dollar wire transfers, clearing U.S.

dollar travelers cheques, and opening U.S. dollar accounts for HBMX clients, HBUS was left in

the dark by its own colleagues about the extensive AML and compliance problems at HBMX. In

addition, in conformance with HSBC Group policy and practice, HBUS conducted no due

diligence assessment of HBMX, did not evaluate its riskiness, did not review its audit findings,

and did not monitor its wire transfers, cash letter activity, or banknotes transactions for

suspicious activity. HBUS had rendered itself blind to the fact that it was servicing a high risk

financial institution.

HBMX made extensive use of its correspondent relationship with HBUS. From its

acquisition in 2002, HMBX worked with HBUS’s Payments and Cash Management (PCM)

division and, until 2010, with HBUS’ Global Banknotes division, both headquartered in New

York. HBMX used its correspondent and banknotes accounts to process U.S. dollar wire

transfers, clear U.S. dollar monetary instruments like travelers cheques, and deposit bulk cash

shipments of U.S. dollars on behalf of itself and its clients. Three examples of HBMX high risk

clients help illustrate how HBMX’s AML deficiencies also created risk for HBUS. They include

high risk Mexican and U.S. money service businesses, clients using offshore U.S. dollar accounts

in the Cayman Islands, and purchasers of millions of dollars in U.S. dollar travelers cheques.

Mexican casas de cambio (CDCs) are money service businesses licensed by the Mexican

Treasury Department (SHCP), through the CNBV, to exchange foreign currencies for a fee. In

Geoghegan and others, “GMO Business reviews – LATAM,” HSBC OCC 8874895.

80

Mexico, CDCs are not licensed as banks and do not hold deposits, maintain checking or savings

currency from a customer, exchanging it for another currency, and then either handing it over to

the customer or wiring it to a financial institution in another country, such as the United

In the United States, some money service businesses perform similar cross-border

services, enabling individuals in the United States to wire U.S. dollars to Mexico, where the

dollars may be converted into Mexican pesos and paid out to a designated recipient. Those U.S.

money service businesses are sometimes referred to as money remitters. Both Mexican CDCs

and U.S. money service businesses often perform their services for walk-in customers, although

they may also have established customers who use their services on a regular basis. In both

establish AML programs to safeguard against laundering criminal proceeds.

Until 2007, Casa de Cambio Puebla (Puebla) was a licensed casa de cambio, founded in

warrant from a federal court in Florida and froze or seized all Puebla funds on deposit with

Wachovia Bank in Miami, as well as with Wachovia Bank in London, affecting funds totaling

14 months in prison, while the other defendants, including Puebla, were placed on fugitive

with the U.S. Department of Justice for having failed to maintain an effective anti-money

Exhibit A to Deferred Prosecution Agreement (3/16/2010), at ¶ 12.

in connection with its casa de cambio business, including with respect to

Exhibit A to Deferred Prosecution Agreement (3/16/2010), at ¶ 11.

Funds (7/12/2007)(hereinafter “Puebla Petition”), at 4.

Vasquez, Pedro Alfonso Alatorre Damy, a/k/a “Pedro Barraza Uruguastegui,” and Leonardo Vasquez Estrada, Case

No. 08-20097-CR-Graham (USDC SDFL), Indictment (2/1/2008, unsealed 11/4/2009).

Agreement (3/16/2010), at ¶ 3.

81

Puebla was a longtime customer of HBMX, having first begun a relationship with

May 2007, HBUS suspended the Puebla account two weeks later and closed the account in June

Mexican Attorney General served an order on the bank seizing Puebla funds.

Puebla at HBMX. At the time of the May 2007 seizure of more than $11 million in

Puebla funds at Wachovia Bank, HBMX was already reeling from another money laundering

scandal involving a March 2007 seizure of cash, weapons, and wire transfer records from the

Mexican residence of longtime customer, Zhenly Ye Gon and his pharmaceutical companies,

seizure had triggered an intensive review by senior HBMX officials of the Ye Gon-related

accounts as well as HBMX’s overall AML program. The Puebla case added another high profile

In late May 2007, HBUS learned of the seizure of Puebla funds at Wachovia Bank, and

It is not clear when

HBMX first learned of the seizure, but by early June, both banks were considering whether to

close their Puebla accounts. On June 5, 2007, Leopoldo Barroso, HBMX’s AML head, received

(6/9/2007); see also “Wachovia is under Scrutiny in Latin Drug-Money Probe,” Wall Street Journal, Evan Perez and

Glen R. Simpson, April 26, 2008. In addition, the U.S. State Department discussed the Puebla case in its 2009

International Narcotics Control Strategy Report. See 2009 International Narcotics Control Strategy Report, U.S.

Department of State at 356-357.

“[subject redacted by HSBC], HSBC OCC 8875132-135.

Compliance & Casa de Cambio,” HSBC-PSI-PROD-0095913.

HBUS Denise Reilly, “Wall Street Journal Article Regarding Wachovia,” OCC-PSI-01358515.

Extradition (9/15/2008) (hereinafter “Ye Gon Extradition Complaint”), at 13; “Mexican Fugitive and Co-

Conspirator Arrested on U.S. Drug, Money Laundering Charges,” U.S. Drug Enforcement Administration press

release (7/24/2007), http://www.justice.gov/dea/pubs/states/newsrel/wdo072407.html.

money”), El Universal, Francisco Gómez, www.eluniversal.com.mx (reporting that the Mexican agency SHCP had

determined that, from 2003 to 2006, Mr. Ye Gon and his companies had moved $90 million through four major

Mexican banks and multiple casas de cambio, including HBMX and Puebla), cited in 7/18/2008 Report of Findings

(Update) for Consultoria Inernacional Banco, prepared by HBUS Financial Intelligence Unit, OCC-PSI-00247712.

are suspending all activity with the subject client,” HSBC PSI PROD 0095908-910; 6/6/2007 email from HBUS

Daniel Jack to HBUS Alan Ketley, Re: HSBC in Mexico – AML Compliance and Casa de Cambio, HSBC-PSIPROD-

0095912.

82

an email from a senior AML Compliance officer at HBUS, Daniel Jack, asking if Mr. Barroso

was the new AML director at HBMX and “wonder[ing] what relationships” HBMX had with

days” whether to terminate its relationship with Puebla, and asked Mr. Jack to let him know if

Mr. Jack noted in a later email that he did not tell Mr. Barroso during the June 5 email

exchange about “the DEA seizure or Wachovia closing [Puebla] acc[oun]ts,” although it is

Subcommittee that, soon after the June 5 email exchange, he told Mr. Barroso that HBUS had

a list of their banknote customers in Mexico and the amount of U.S. dollars they exported from

Mexico to the United States, Mr. Jack demurred, responding that there were “privacy issues” but

Compliance personnel at HBUS and HBMX suggests that information sharing between the two

banks was guarded, rather than automatic.

In early July 2007, HBMX Compliance head, Ramon Garcia, disclosed in an internal

weekly report that went to HSBC Group Compliance that the HBMX CCC Committee had

considered closing the Puebla account, but decided instead to retain the client. In response, John

Root, head of Latin American Compliance at HSBC Group, sent him a blistering email

criticizing the CCC Committee for “rubber-stamping unacceptable risks.” This email, cited

earlier in a discussion of HBMX’s CCC Committee, is relevant again, because it applies to the

Puebla account. Mr. Root wrote:

“It looks like the business is still retaining unacceptable risks and the AML committee is

going along after some initial hemming and hawing. I am quite concerned that the

committee is not functioning properly. Alarmed, even. I am close to picking up the

Mr. Root’s email went on to harshly criticize the CCC Committee’s decisions to keep

open accounts for Mr. Ye Gon and another accountholder under suspicion for money laundering,

and Casa de Cambio,” HSBC-PSI-PROD-0095914.

Casa de Cambio, HSBC-PSI-PROD-0095912.