FCA fines HSBC Bank plc £63.9 million for deficient transaction monitoring controls

HSBC used automated processes to monitor hundreds of millions of transactions a month to identify possible financial crime. However, the FCA found that three key parts of HSBC’s transaction monitoring systems showed serious weaknesses over a period of eight years from 31 March 2010 to 31 March 2018.

In particular, HSBC failed to:

• consider whether the scenarios used to identify indicators of money laundering or terrorist financing covered relevant risks until 2014; and carry out timely risk assessments for new scenarios after 2016;
• appropriately test and update the parameters within the systems that were used to determine whether a transaction was indicative of potentially suspicious activity;
• check the accuracy and completeness of the data being fed into, and contained within, monitoring systems.

HSBC did not dispute the FCA’s findings and agreed to settle at the earliest possible opportunity, which meant it qualified for a 30% discount. Otherwise, the FCA would have imposed a financial penalty of £91,352,600.

HSBC has undertaken a large-scale remediation programme into its anti-money laundering processes, which was supervised by the FCA.

Mark Steward, Executive Director of Enforcement and Market Oversight at the FCA, said:

'HSBC’s transaction monitoring systems were not effective for a prolonged period despite the issue being highlighted on numerous occasions. These failings are unacceptable and exposed the bank and community to avoidable risks, especially as the remediation took such a long time. HSBC continued their remediation to address these weaknesses after the relevant period.'

The FCA’s action relates to HSBC’s compliance with UK laws and the matters addressed in our Notice were not part of the action taken by the U.S Department of Justice in 2012.

Notes to editors

1. The Decision Notice for HSBC Bank plc[1].
2. HSBC Bank plc[2] is authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority[3].
3. The FCA’s findings relate to HSBC Bank plc, which was the UK authorised entity of HSBC Holdings plc prior to ring-fencing on 1 July 2018 at which point certain lines of business became a ring-fenced bank (HSBC UK Bank plc) with the other business lines becoming a non-ring-fenced bank and remaining as HSBC Bank plc.
4. The Money Laundering Regulations 2007[4] were in force in respect of conduct concerning anti-money laundering controls for the period that was under investigation. The Money Laundering Regulations, Terrorist Financing and Transfer of Funds (Information on the Payer) 2017[5] came into force on 26 June 2017.
5. Under the Money Laundering Regulations 2007, HSBC was required to establish and maintain appropriate and risk-sensitive policies and procedures relating to ongoing monitoring. These are needed to identify complex or unusually large transactions, unusual patterns of transactions which have no apparent economic or visible lawful purpose and any other activity that is regarded as particularly likely by its nature to be related to money laundering or terrorist financing. With hundreds of millions of transactions that needed to be monitored every month, HSBC used automated transaction monitoring systems as an anti-money laundering control to seek to comply with these requirements.
6. On 1 April 2013, the FCA became responsible for the conduct supervision of all regulated financial firms and the prudential supervision of those not supervised by the Prudential Regulation Authority (PRA). 
7. Find out more information about the FCA[6].