HSBC moved vast sums of dirty money after paying record laundering fine

In March 2014, three men kidnapped Reynaldo Pacheco and bludgeoned his head with rocks, leaving the 44-year-old father of a young daughter dead in a creek bed in California’s Napa County. Local authorities determined that his murder was a consequence of an investment fraud that targeted low-income Latino and Asian immigrants around the world.

Like other victims of the World Capital Market scheme, or WCM, Pacheco energetically promoted the deal to relatives and acquaintances. When the Ponzi scheme collapsed, an unlucky investor decided to have him killed.

Four days before Pacheco was beaten to death, compliance officers at the global banking giant HSBC raised a warning about millions of dollars flowing into a big-dollar account in Hong Kong controlled by the scammers. It was at least the third in a series of so-called suspicious activity reports that the bank’s internal watchdogs had lodged about WCM over several months.

Yet HSBC continued to handle the Ponzi network’s massive flow of dirty money into — and out of — its accounts at the bank.

HSBC was profiting from an international criminal scheme even while on probation for having served murderous drug cartels and other criminals. HSBC had admitted to U.S. prosecutors in 2012 that it had helped dirty money flow through its branches around the world, including at least $881 million controlled by the notorious Sinaloa cartel and other Mexican drug gangs.

In a controversial decision, prosecutors declined to seek an indictment of the bank but instead allowed it to pay a $1.92 billion settlement and serve five years of probation during which its efforts to prevent money laundering would be monitored by a court-appointed watchdog. The court named a former top New York state financial crimes prosecutor, Michael Cherkasky.

A 16-month investigation by the International Consortium of Investigative Journalists, BuzzFeed News and 108 other media partners has found that HSBC continued to provide banking services to alleged criminals, Ponzi schemers, shell companies tied to looted government funds and financial go-betweens for drug traffickers. This occurred even while the bank was on probation and under Cherkasky’s scrutiny.

The FinCEN Files investigation found that HSBC’s highly profitable branch in Hong Kong played a key role in keeping the dirty money flowing. Although providing only a partial view of HSBC’s suspicious activity reports, the records show that between 2013 and 2017, HSBC’s U.S. compliance staff, who are charged with monitoring customer activity, filed reports lacking crucial customer information on 16 shell companies that had processed nearly $1.5 billion in more than 6,800 transactions through the bank’s Hong Kong operations alone. More than $900 million of that total involved shell companies linked to alleged criminal networks, according to an analysis by ICIJ and its media partners.

In a statement, HSBC defended changes the bank made under the monitorship. “Starting in 2012, HSBC embarked on a multi-year journey to overhaul its ability to combat financial crime,” said Heidi Ashley, a spokesperson for the bank. “HSBC is a much safer institution than it was in 2012.”

The bank told ICIJ that it increased its compliance staff from a few hundred members in 2012 to several thousand in 2017 and invested more than $1 billion in compliance initiatives since 2015. “Though we have made significant improvements in our financial crime compliance programme, we are continually seeking ways to improve,” the bank said in a statement.

The investigation is based on a review of dozens of leaked suspicious activity reports, or SARs, as well as interviews with more than a dozen former HSBC anti-money-laundering employees. Banks doing business in the United States submit the confidential reports to an intelligence office within the U.S. Treasury Department known as the Financial Crimes Enforcement Network, or FinCEN. Suspicious activity reports reflect concerns of watchdogs within banks and are not necessarily evidence of any criminal conduct or wrongdoing.

Leaked records show HSBC processed at least $31 million between 2014 and 2015 for companies later revealed to have moved stolen government funds from Brazil; and more than $292 million between 2010 and 2016 for a Panama-based organization branded by U.S. authorities as a major money launderer for drug cartels. The organization, Vida Panama, denies wrongdoing and is fighting the U.S. designation. The records show HSBC worked with a bank in Tiraspol, within Moldova’s breakaway territory of Transnistria, for four years after the U.S. Treasury Department issued a 2011 advisory warning of the risks of doing business with the Tiraspol bank.

Why are we filing SARs? … Nothing is actually being done.– Alexis Grullon

In interviews with ICIJ and BuzzFeed News, more than a dozen former HSBC compliance officers expressed deep concerns about the bank’s anti-money-laundering program, even during its probationary period. Compliance officers said that the bank did not give them enough time to meaningfully investigate suspicious transactions and that branches outside the U.S. often ignored requests for crucial customer information. They said they were treated as a second-class workforce within the bank, with little power to shut down problematic accounts.

The FinCEN Files raise new questions about the U.S. Justice Department’s decision in 2012 to forgo indicting HSBC or any bank executives in the Sinaloa cartel case. The decision was opposed by rank-and-file prosecutors, who had prepared a list of up to 175 criminal charges against the bank that the government ultimately shelved. No one went to prison over the bank’s historic wrongdoing. The findings also raise questions about the department’s decision, five years later, to pronounce HSBC reformed and allow its probation to lapse. The investigation builds upon ICIJ’s previous Swiss Leaks project, which exposed how HSBC’s Swiss private banking arm profited from doing business with tax dodgers and criminals around the world prior to 2008.

FinCEN Files documents show that HSBC knew regulators were investigating its customer, the WCM Ponzi scheme, even as it helped move its money.

A federal class-action lawsuit brought by bilked investors alleged that HSBC Hong Kong was “instrumental in helping WCM777 to continue its Ponzi scheme.” A federal judge dismissed the suit last month, ruling it had been brought in an improper jurisdiction.

In an exclusive interview with ICIJ, the Ponzi scheme’s bow-tie-sporting founder, Ming Xu, said HSBC did not contact him to ask about massive money flows WCM was moving through the bank’s Hong Kong accounts.

Banks’ SARs form the backbone of U.S. authorities’ attempts to fight money laundering, but the system fails to stop deluges of dirty money. Banks can, but are not necessarily required to, block or close accounts suspected of being used for money laundering, and they can fulfill a key legal obligation by simply reporting the transactions to FinCEN. The office received more than two million of those reports last year, more than its agents could hope to read.

The SARs reviewed by ICIJ and its partners include 73 reports filed between 2012 and 2017 by HSBC. The documents contain information on more than $4.4 billion in more than ten years of transactions reported as suspicious. That amounts to a tiny fraction of the tens of thousands of SARs HSBC files each year but offers a window into the bank’s troubled compliance efforts.

The confidential records and interviews with former employees reveal that compliance officers often filed SARs lacking even basic information about who owned companies banking with HSBC, the nature of their businesses, and where the money came from. Sometimes, records show, they asked branches for the information and were ignored or rebuffed.

“It was impossible to do the job without this information,” said Alexis Grullon, a former compliance officer who monitored international suspicious activity for HSBC’s New York offices from November 2012 to August 2014. Grullon said that, in most cases, HSBC branches in other countries would simply ignore his requests for ownership information about suspicious accounts.

“They would say: ‘Sure, we’ll get back to you.’ But they’d never get back,” he recalled.

Grullon said that a key component of his job was submitting SARs to the federal government but that the reports did little to stop customers’ suspicious activities.

“Why are we filing SARs?” Grullon recalls wondering. “The account is still open. Nothing is actually being done.”

‘The world’s local bank’

Founded in Hong Kong as the Hong Kong and Shanghai Banking Corp. in 1865, HSBC prospered managing British government accounts across East Asia. By the mid-2000s, the bank had become one of the world’s most pervasive retail financial institutions, with thousands of branches in more than 70 countries, dubbing itself at one point, “the world’s local bank.”

It was more than a slogan. Under the global brand, HSBC operated as a loose confederation of largely autonomous fiefs. This degree of decentralization meant that the bank’s headquarters, which moved to London in 1941, extended its hands-off approach even to anti-money laundering questions.

One result: HSBC accepted clients whose massive wealth translated into big profits but who turned out to be criminals.

In 2003, HSBC agreed to a consent order drawn up by U.S. authorities in which the bank promised to fix its anti-money laundering program and empower compliance officers by providing better tools and information about customers.

Instead, the bank took part in one of the most notorious episodes in money laundering history. As the Mexican drug war metastasized in the mid-2000s, the bank provided essential U.S. dollar-denominated accounts to narco-gangs needing to clean hundreds of millions of dollars in drug earnings. The cartels designed specially shaped boxes that fit HSBC’s teller windows to deliver the massive amounts of illicit cash pouring in.

In 2010, the bank was forced to submit to another court order secured by its primary regulator, the U.S. Office of the Comptroller of the Currency. The bank promised to boost anti-money-laundering systems and provide compliance officers with more information about its clients — again.

In the summer of 2012, the U.S. Senate investigative panel released its 339-page report on the bank’s work with Mexican narco-gangs and its role in terrorist financing. Later that year, the Justice Department and HSBC reached their deferred-prosecution agreement. Critics cast the government’s decision to forgo indictment of the bank or any of its executives as a sign of big banks’ virtual impunity from meaningful consequences for their misdeeds.

Hong Kong

Although no longer the banking giant’s headquarters, Hong Kong remains the beating heart of HSBC. In 2015, its operations in the island territory, which include a subsidiary called Hang Seng Bank, accounted for nearly half of HSBC’s global profits, and its market share in Hong Kong dwarfs that of its competitors.

On June 20, 2012, the same day HSBC’s attorneys were describing the bank’s anti-money-laundering protocols to Senate investigators on Capitol Hill, HSBC’s Hong Kong branch began transmitting funds for a shell company called Trade Leader Corp. Ltd.

By February 2014, transfers into and out of the shell company’s Hong Kong accounts totaled more than $581 million.

Records from the FinCEN Files show that, when the bank’s U.S. compliance staff asked for information about who owned the big-dollar account, HSBC’s Hong Kong bankers simply responded that there was “none available.”

According to a review of data collected by an ICIJ media partner, the Organized Crime and Corruption Reporting Project, Trade Leader Corp. Ltd. was a major East Asian node in the “Russian Laundromat,” a sprawling network that moved criminally tainted money from former Soviet states to the West. Incorporated in Hong Kong, Trade Leader lists one company official in its 2015 filing in the Hong Kong corporate registry, a director whose address is an apartment unit in a decaying Soviet-era building in the far-eastern Russian city of Novosibirsk.

In 2014, Hong Kong’s corporate registry listed Trade Leader’s sole shareholder as a company called INHK Ltd. In an email to ICIJ, Trade Leader’s registration agent, a firm called Intercorp Asia, acknowledged that INHK’s only purpose was to hide Trade Leader’s true owner, known as the “ultimate beneficial owner,” or UBO.

INHK does not have “any business activity and [is] used to hide the real UBO information in [the] company registry of HK,” Alex Orso, an Intercorp representative wrote. He declined to share further information about Trade Leader.

Trade Leader was not an isolated case. Though documenting only a tiny fraction of HSBC’s activities during this period, the FinCEN Files reveal a striking tolerance of questionable customers within HSBC’s Hong Kong branch.

ICIJ analyzed nearly $1.5 billion in transactions that flowed through shell companies holding commercial accounts with HSBC Hong Kong between 2011 and 2016. In each case, HSBC filed SARs that failed to include fundamental facts about the bank’s own big-dollar customers, including who owned the accounts, what countries the owners lived in, and where the money came from.

The U.S. Senate’s 2012 report on HSBC highlighted the danger of bank compliance officers remaining in the dark about such basic information.

“Information sharing was one of the major things HSBC promised they were going to do,” said Elise Bean, lead author of the Senate report and former aide to then-Sen. Carl Levin, Democrat of Michigan.

The FinCEN files show that HSBC broke the pledge repeatedly.

In mid-2013, a shell company client, Vic Charm Ltd., sent or received more than $80 million through HSBC Hong Kong accounts during the first several months of the bank’s probation. HSBC compliance officers listed virtually nothing about the firm, aside from a series of Hong Kong addresses linked to it and the name of an owner, about whom the officers said they knew nothing, not even the person’s country of residence. In 2015, prosecutors in Malawi alleged that the shell company had received $3.8 million in a scheme to launder money out of the resource-deprived country.

The case remains pending, according to a statement from the Reserve Bank of Malawi, which is involved in pressing the laundering charges.

In February 2016, well into HSBC’s probation period, bank compliance officers asked the Hong Kong branch about a suspected laundering operation involving a customer called Enjoy Trading Shanghai Co., but had received no response before filing a SAR one month later.

In May of that year, the bank’s compliance staffers filed a report on a former HSBC Hong Kong customer called Alahdin Limited, saying that documents posted to the internet alleged that more than half a trillion dollars in transactions had flowed through the firm. Relying on information received from HSBC’s Hong Kong branch, the report offered almost no information about the company’s ownership, listing Alahdin’s owner with merely a first name and initials — “SHAHUL H H M” — along with an email address.

The report did not note that Alahdin, a company registered in Hong Kong, had two years prior changed its name to the Abu Dhabi National Oil Company Ltd. Little is known about this company, but it shares its name with one that decades ago created Pakarab Fertilizers Limited, a subsidiary of Pakistan’s Fatima Group, according to the group’s website. In 2012,  U.S. military officials accused Fatima’s fertilizer operations of providing chemicals used to make Taliban roadside bombs targeting U.S. and other coalition forces in Afghanistan.

Profit Accounting Company Limited, a firm that Hong Kong registry documents say acted as Alahdin’s corporate secretary, told ICIJ it had no record of ever having worked with the firm. Fatima Group did not respond to multiple requests for comment.

In July 2016, HSBC filed a suspicious activity report on a customer called Cool Distribution Ltd., which had sent or received more than $92 million between 2011 and 2015 through the bank’s accounts. ICIJ’s research found that $19 million of that amount went to a company run by a businessman who had been convicted in a 2015 tax fraud case in Bologna, Italy, involving Italian organized crime.

The SAR lists three names for Cool Distribution’s owners, but without addresses, country of residence or other basic information. Two of the names have been linked to a Hong Kong financial fraud scandal, another belongs to a Russian intellectual property tycoon who denied to ICIJ knowing anything of Cool Distribution. HSBC’s report listed a Dubai address for the company but searches of corporate registries in Dubai and the United Arab Emirates found no record of the firm.

In March 2017, HSBC filed a report on another suspected money laundering account — a shell company called Well Fortune HK Ltd., which had moved more than $167 million in transactions through HSBC accounts over more than five years. The bank listed addresses for the company in Russia and Hong Kong, an email address and the name of a purported owner but no other identifying information, including the person’s country of residence.

Well Fortune’s 2014 filing in the Hong Kong corporate registry lists Adrian Matthew Bradley, a resident of Belize, as its sole shareholder. Bradley’s name appears on records of dozens of shell companies around the world, according to leaked documents and public records. ICIJ sent requests for comment to Bradley’s apparent email address, but received no response. Bradley is a “decoy name” for a Ukrainian oligarch named Serhiy Kurchenko, according to an article published by the Atlantic Council, a Washington-based think tank. Ukrainian prosecutors have accused Kurchenko of amassing millions of dollars via tax evasion and stealing from bank investors. In March 2014, the EU sanctioned him for his alleged links to state corruption. The following year, the U.S. sanctioned Kurchenko.

In September 2013, not long before financial regulators around the world announced investigations into the business, the leaders of WCM moved the Ponzi scheme’s headquarters from Los Angeles to Hong Kong.

In October, Colombia’s then-President Juan Manuel Santos announced that the national police would launch an investigation into allegedly illegal activities by the business. Three days later, HSBC compliance officers filed the first of several suspicious activity reports related to WCM accounts, noting that more than $6 million in transactions had moved through a single account over the preceding three months. The SAR said an internet search had revealed “Ponzi allegations” against the business.

Four months later, in February 2014, HSBC filed another suspicious activity report on the scheme, saying WCM had received or sent $15 million between 2013 and early 2014 through its HSBC Hong Kong account and company accounts with other banks to which HSBC provided U.S. dollar services. By then, authorities in Peru, Colombia, California and Massachusetts had publicly launched civil or criminal investigations into the company.

Yet massive dollar amounts kept flowing into the Hong Kong account.

Shane Riedel, a former HSBC compliance executive who now runs a Berlin-based anti-money-laundering consultancy, says a bank in this situation should take action.

“If a Ponzi scheme is flagged in one country and the accounts are not closed in another, that’s not a mistake,” Riedel said, citing banks’ often inadequate systems for analyzing and sharing compliance information.

In March 2014, HSBC compliance officers filed yet another suspicious activity report on WCM, whose business continued to hum despite intense law enforcement scrutiny around the globe. Four days after the report was filed, the U.S. Securities and Exchange Commission obtained a restraining order that sought to freeze the company’s bank accounts.

But even after the SEC order, WCM’s accounts at HSBC remained highly active. According to court documents later filed by attorneys appointed by the SEC to seek restitution for the scheme’s victims, WCM drained more than $7 million from the accounts during the following week, drawing its balance to zero.

HSBC’s 2010 cease-and-desist order stipulated that the bank must examine its handling of subpoenas and law enforcement inquiries. Eleven days after the restraining order, HSBC Hong Kong formally declined to comply with a U.S. court’s subpoena for records.

“Our bank is outside the jurisdiction of U.S. courts,” HSBC Hong Kong’s law firm said in a letter to lawyers seeking money for victims. By February 2015, the bank had not provided account information to the attorneys. As a result, “the cost of tracing these funds overseas will be very expensive,” the lawyers said in a court filing of the HSBC accounts and an account with UBS bank that had allegedly moved more than $2 million in transfers relating to the scam.

The SEC alleged that the scheme had used accounts at a variety of banks in addition to HSBC, but little is known about those accounts, including exactly how long they remained active. A summary of the forensic accounting report filed by the SEC-appointed lawyers focused largely on the HSBC Hong Kong accounts.

Meanwhile, WCM executives bought golf courses in Southern California, million-dollar homes and vacant land in Santa Barbara County that the scheme’s zealously religious founder, Ming Xu, told ICIJ was supposed to become a Christian “community of caring and sharing.”

In early 2014, 29-year-old Elvis Callejas was working toward his dream of building a set of retail stores in Bolivia’s rural northernmost region. But he was forced to lay off the men helping to construct the project when his savings of $10,000 evaporated in WCM’s collapse. “I realized that I had fallen into a trap,” Callejas told ICIJ.

Callejas found himself taking out loans to cover the sudden loss. “That is a very large amount of money here,” Callejas said.

Reynaldo Pacheco, the WCM investor murdered in Napa County, was also not a rich man. According to local law enforcement, he had searched for years for business opportunities and believed that WCM was a legitimate investment. Three people were later convicted for his kidnapping and murder.

Ming Xu, denies that WCM was a Ponzi scheme and told ICIJ that the SEC had “plundered” him. When he returned to mainland China in early 2015, he started a new version of WCM there, according to Chinese court documents. In November of that year, Chinese authorities arrested Xu for related financial crimes. He was subsequently convicted and spent three years in prison.

The Chinese court documents in Xu’s case state that his venture in China had accounts with a list of Chinese banks, along with a single global bank: HSBC.

You can’t get a man to believe in something when a salary depends on him not believing it.– Mike Coates

HSBC’s 2012 deferred prosecution agreement (DPA) was cast by Justice Department prosecutors as serious punishment – akin to a criminal reporting to a probation officer – bringing both serious consequences and strict oversight. It required, for instance, the bank to tie executive bonuses to the progress of its anti-money-laundering systems. Top salaries were supposed to be reduced if compliance fell short.

By 2014, HSBC was back to paying huge executive bonuses, including more than $2.5 million for then-Chief Executive Stuart Gulliver. The bonuses were so large that the bank had to exploit a loophole in EU regulations meant to keep bank executive bonuses from exceeding twice their yearly salary. The bank circumvented this by providing its senior executives with large “allowances.”

“HSBC substantially revised its approach to remuneration in the context of our financial crime reforms to ensure that it captured our expectations for employees around risk and compliance,” HSBC’s Heidi Ashley said. “As disclosed in our annual report and accounts, since 2013, a portion of our Executive Directors’ variable pay awards have been expressly linked to risk and compliance measures to underscore the Group’s commitment.” Ashley noted that the new executive pay plan was assessed by the monitor and approved by U.K. financial regulators.

The DPA had given wide latitude to the bank’s independent monitor, Michael Cherkasky, who submitted to prosecutors annual reviews of HSBC’s anti-money-laundering performance. The reviews are secret, but short summaries published in court documents offer glimpses of Cherkasky’s dissatisfaction at times. In 2016, for instance, the monitor mentioned, “instances of potential financial crime” occurring within HSBC’s accounts. It also questioned whether HSBC was satisfying all requirements of the DPA.

As HSBC’s probation neared its end in 2017, prosecutors mulled whether to let the probation lapse.

In December of that year, the Justice Department agreed to allow the bank’s probation to end. The bank claimed that it had “lived up to all of its commitments” under the DPA.

The news stunned one HSBC senior anti-money-laundering executive, who left the bank shortly after the DPA expired. The executive, who asked to speak anonymously for fear of retaliation by the bank, identified Hong Kong as the epicenter of the bank’s financial crime problems and said the issues there had remained “largely untouched” during the monitorship.

The former executive credited HSBC for bringing in top talent to address the DPA, including former FinCEN chief Jennifer Calvery, but said the bank’s leadership often appeared unaware of how difficult the changes were to implement on the ground level.

Six former HSBC employees interviewed by ICIJ said the ending of the DPA coincided with a broad cultural shift at the bank toward profit-making over compliance. The shift, they said, included layoffs, lapsing contracts of anti-money-laundering staffers and the closing of a transactions-monitoring office in New Castle, Delaware.

HSBC declined to share numbers regarding its staffing after the DPA, but noted that its financial crime compliance personnel had grown to roughly five thousand in 2017. In comments to ICIJ, the bank also touted initiatives to fight laundering it made after the DPA’s lifting, including a platform it launched in 2018 to analyze social networks to make it easier for the bank to identify customers potentially involved with criminal networks. The bank says it screens 689 million transactions across 236 million accounts per month.

In a statement to ICIJ and its reporting partners, the department of justice defended its record of enforcement actions against big banks.

“The Department of Justice stands by its work, and remains committed to aggressively investigating and prosecuting financial crime — including money laundering — wherever we find it,” Matt Lloyd, a spokesperson for the department’s Criminal Division, said.

Since the DPA’s conclusion, the bank and U.S. authorities have vigorously fought to keep Cherkasky’s monitoring reports secret.

In November 2015, Hubert Dean Moore Jr., a homeowner who sued HSBC, alleging that the bank had mishandled his request for mortgage relief, asked a federal judge in New York to unseal one of Cherkasky’s reports on HSBC. The judge agreed, but an appeals court panel overturned the decision, siding with the Justice Department’s argument that the report was not a releasable document. Cherkasky’s reports remain under seal.

In 2019, ICIJ partner BuzzFeed News sued for the release of Cherkasky’s final report, arguing that the public’s interest in understanding the government’s handling of the HSBC case demands that it be unsealed. The Justice Department continues to fight to keep the Cherkasky report sealed and has sought repeatedly to delay preliminary hearings, citing the coronavirus pandemic. The suit is pending.

Mike Coates, a former HSBC employee who worked on financial crime compliance during the DPA and left the bank in 2018, said the industry’s profit-focused incentive structures can still override the fight against financial crime.

“You can’t get a man to believe in something when a salary depends on him not believing it,” said Coates, who declined to provide specifics about his time at the bank. “That’s the biggest challenge you have in this industry.”

Contributors: Jason Leopold, Anthony Cormier, Kyra Gurney, Roman Anin, Emilia Diaz-Struck, Agustin Armendariz, Delphine Reuter, James Oliver, Golden Matonga