Monthly op risk losses: AML failings cost banks $1.1bn

Also: Japanese crypto exchange loses ¥58 billion in hack; Deutsche, UBS, HSBC settle spoofing claims. Data by ORX News

US Bank expects bumper loss for AML breaches relating to convicted felon Scott Tucker (inset)

January’s largest loss was a $608 million liability racked up by US Bank for a penalty it expects to pay as a result of an investigation into the bank’s anti-money laundering and Bank Secrecy Act compliance. The investigation by the US Attorney’s Office in Manhattan centres on the bank’s relationship with Scott Tucker, a businessman who ran a $1.2 billion predatory payday loan scheme and was convicted of racketeering on October 13, 2017.

US Bank reported the liability in a filing with the SEC, revealing that the pending loss includes a deferred prosecution agreement and civil money penalties. US Bank first disclosed the investigation in August 2016 (see In focus below).

Tucker, a professional racing driver, was sentenced to 16 years and 8 months in prison for the scheme, which offered payday loans with interest up to 1,000% per annum. The scheme operated through companies that hid their beneficial ownership by exploiting a legal loophole in the status of Native American tribal territories. These tribes are considered sovereign states separate to the US and, as such, not subject to the full range of federal and state law. By cloaking the ownership of the payday loan companies behind the tribal entities, Tucker sought to sidestep legal and regulatory oversight, US enforcement agencies found.

In second place, a Japanese cryptocurrency exchange, Coincheck, lost around ¥58 billion ($530 million) of XEM tokens in a hack. XEM is a cryptocurrency unit, similar to bitcoin, that is issued by the platform NEM. The hackers obtained the private cryptographic key for the exchange’s hot wallet and extracted the funds. A hot wallet, as opposed to a cold wallet, is a place to store cryptocurrencies which is connected to the internet and therefore vulnerable to web-based attacks.

The exchange said it will refund around ¥46 billion to its customers from its own funds. Japan’s financial regulator, the FSA, conducted an on-site inspection of the exchange at the start of February, to assess the Coincheck’s response to the attack.

The third biggest loss continues a recent pattern of Chinese regulatory fines within the banking sector. Postal Savings Bank of China lost a total of 3.09 billion yuan ($488.5 million) in relation to a 7.09 billion yuan illegal bank bill trading scheme. An investigation by the China Banking Regulatory Commission revealed that PSBC’s employees had defrauded 3 billion yuan from the bank’s wealth management products to pay for the bill trading.

The regulator fined PSBC 90.5 million yuan, and 11 other banks almost 205 million yuan. This is the second consecutive month that PSBC has suffered one of the five largest op risk losses globally, after its 521 million yuan fine for illegal interbank lending.

In fourth place, Rabobank announced a provision of €310 million ($372 million) for a settlement it expects to reach with the US Department of Justice over an investigation into its anti-money laundering compliance. According to US authorities, the bank’s suspicious transaction reporting was inadequate and employees had withheld information during a 2013 inspection by the Office of the Comptroller of the Currency. Rabobank will likely plead guilty to one offence relating to the employees withholding information, it said.

Finally, hedge fund Pershing Square agreed to pay $193.8 million to settle allegations within two class action lawsuits that it engaged in insider trading with Valeant Pharmaceuticals during the attempted hostile takeover of Botox manufacturer Allergan in 2014.

Spotlight: Three banks fined over precious metals spoofing

Deutsche Bank, UBS and HSBC will pay a total of $46.6 million to the US Commodity Futures Trading Commission over allegations some of their traders used spoofing to manipulate the precious metals market for five years between January 2008 and December 2013.

Spoofing is the practice of logging orders to buy or sell a security without then executing a trade, in an attempt to trigger activity from other participants and manipulate prices within the market. Spoofers will position to benefit from those price movements.

Deutsche Bank agreed to a civil money penalty of $30 million, while HSBC and UBS were fined $15 million and $1.6 million respectively.

The US Department of Justice has also charged eight individuals in connection with their roles in the spoofing. Although exchanges have barred the practice for years, it was made illegal as part of the Dodd-Frank Act in 2010, particularly in response to concerns over the scale algorithmic trading could lend to possible manipulation.

In focus: AML fines stack up in 2018

In January, two provisions by US Bank and Rabobank related to anti-money laundering and legacy losses for Western Union and Mega Bank (see above) were joined by a $70 million fine levied on Citi by the Office of the Comptroller of the Currency for failing to comply with a 2012 consent order over AML compliance. This has pushed the total losses for AML violations to $1.1 billion in the first month of 2018, compared with a total of $1.3 billion for the whole of 2017, according to ORX News data.

Such a high loss severity so early in the year puts 2018 on track to overtake the previous record year for AML penalties – 2012 – when financial institutions lost almost $2 billion. The year after, 2013, saw losses plunge to $110 million. But bank chiefs who thought the low level of losses would become a trend were soon proved wrong as the total steadily grew over successive years (see chart).

A contributing factor to the increase is the higher average loss amount per event. In 2013, a typical AML loss event amounted to a measly $6.1 million. The figure for 2018-to-date stands at $210.6 million per loss event. So while the aggregate number of loss events dropped between 2016 and 2017, the total loss value rose.

Although authorities throughout western Europe, Asia-Pacific and in South Africa are active at penalising AML compliance violations, US regulators drive losses in this area. Regulators including the Office of the Comptroller of the Currency, financial crime agency FinCEN, and the New York Department of Financial Services levy enormous fines several times a year. For example, in 2017 the NYDFS fined Habib Bank $225 million for AML failures, following the regulator’s introduction of new risk-based anti-terrorism and AML legislation from January 1, 2017.

Cash clearing is the business line that carries the highest risk of large AML penalties, especially when paired with the risk of penalties for breaching US sanctions (not included in this analysis). Banks are all too aware of the danger this poses: in a 2015 World Bank survey, 95% of large banks gave concerns about AML and counter financing of terrorism (CFT) as a reason for withdrawing from correspondent banking relationships. Accordingly, the Financial Stability Board reported a 6% global fall in correspondent banking between 2011 and 2016.

Pulling out of risky banking relationships may not be enough to stop the AML risk for financial institutions, however. The know-your-customer challenges posed by anonymous cryptocurrency transactions open a new avenue to regulators for potentially heavy penalties. A possible precursor to these fines was a $110 million penalty FinCEN imposed on cryptocurrency exchange BTC-e in 2017 after it found the exchange’s AML controls were inadequate.

All information included in this report and held in ORX News comes from public sources only. It does not include any information from other services run by ORX and we have not confirmed any of the information shown with any member of ORX.

While ORX endeavours to provide accurate, complete and up-to-date information, ORX makes no representation as to the accuracy, reliability or completeness of this information.