HOUSE_OVERSIGHT_024128.jpg

▪ Failure to conduct monitoring of the high volume of monetary instruments through casas de
cambio and other foreign correspondent customers using Remote Deposit Capture (RDC)
service
▪ Failure to monitor sequentially numbered traveler's checks used by casas de cambio and other
foreign correspondent customers in a manner compliant with internal policy on these
transactions
▪ Failure to institute appropriate risk-based monitoring of foreign correspondent banking
customers – primarily as a result of setting alert parameters based on staffing capacity
▪ Failure to file timely SARs on several foreign correspondent banking customers
▪ Failure to report cash structuring activity

o HSBC: In October 2010, the Federal Reserve Board announced that it had issued a Cease and Desist
Order between HSBC North America Holdings, Inc. (HNAH), New York, New York, a registered bank
holding company (BHC), and the Federal Reserve Board. The order requires HNAH to take corrective
action to improve its firm-wide compliance risk management program, including its anti-money
laundering compliance risk management. Concurrent with the Federal Reserve Board’s announcement
of its enforcement action, the Office of the Comptroller of the Currency announced its issuance of a
Cease and Desist Order against HSBC Bank USA, N.A., McLean, Virginia (HBUS, a subsidiary of
HNAH), for violating the Bank Secrecy Act and its underlying regulations.

HSBC was directed to use its financial and managerial resources as a source of strength for its bank
subsidiaries, and in particular HBUS, to ensure that it complies with the OCC Consent Order regarding
HBUS’ BSA/AML program. It was also directed to “retain an independent consultant acceptable to the
[Chicago Federal] Reserve Bank to complete a review of the effectiveness of the firm-wide BSA/AML
Compliance Program adopted by HNAH (the ‘BSA/AML Review’), and to prepare a written report of
findings and recommendations (the ‘BSA/AML Report’).” In another section of the Order, HNAH was
directed to “submit to the [Chicago Federal] Reserve Bank an acceptable written program designed to
reasonably ensure the identification and timely, accurate, and complete reporting by HNAH and its
subsidiaries of all known or suspected violations of law or suspicious transactions to law enforcement
and supervisory authorities, as required by applicable suspicious activity reporting laws and
regulations.”

The OCC Order states that the agency found deficiencies in HBUS’ BSA/AML Compliance Program – in
particular, deficiencies in internal controls for customer due diligence, procedures for monitoring
suspicious activity and independent testing. The Order also cited aggravating factors “such as highly
suspicious activity creating a significant potential for unreported money laundering or terrorist financing.”
Specific cited deficiencies included special handling of wire transfers of customers domiciled in
countries risk-rated as “standard” or “medium,” resulting in limited and ineffective BSA/AML monitoring
of two-thirds of the bank’s wire activity; failure from 2006 to 2009 to monitor bulk cash transactions with
foreign affiliates; failure to perform customer due diligence or enhanced due diligence for its foreign
affiliates, inhibiting its assessment of customer risk and the identification of suspicious activity in
accounts of those affiliates; failure to address a backlog of suspicious activity alerts (due to inadequate
staffing), which caused the bank to file many late SARs; and failure to appropriately designate
customers as “high-risk” for BSA/AML monitoring, even when a customer’s association with PEPs could
harm the bank’s reputation. In July 2012, HSBC was the subject of a hearing held by the Senate
Permanent Subcommittee on Investigations entitled “U.S. Vulnerabilities to Money Laundering and
Terrorist Financing: HSBC Case History.”

o Citibank: In April 2012, the OCC issued a Cease and Desist Order against Citibank, N.A. for violations
of the Bank Secrecy Act (BSA) and underlying regulations. According to the OCC, the order requires
the bank to take comprehensive corrective actions to improve its BSA compliance program.

The compliance program allegedly had deficiencies with respect to internal controls, customer due
diligence, the independent BSA and the anti-money laundering audit function, monitoring of its remote
deposit capture and international cash letter instrument processing in connection with foreign
correspondent banking, and suspicious activity reporting related to that monitoring. These findings
resulted in violations by the bank of statutory and regulatory requirements to maintain an adequate BSA
compliance program, file suspicious activity reports, and conduct appropriate due diligence on foreign
correspondent accounts.

protiviti | 22

HOUSE_OVERSIGHT_024128