Sealed HSBC report shows US managers battling clean-up squad

[NEW YORK] HSBC Holdings Plc, smarting from a US$1.9 billion fine for providing banking to money launderers and sanctions-dodgers, promised US officials it would clean up its act.

Within a year, its reform efforts met resistance from leaders of HSBC's US investment-banking unit - some of whom mounted a campaign of bullying, footdragging and discrediting against in-house watchdogs, according to previously unreported details from a report by the bank's court-appointed monitor.

HSBC agreed to submit to the monitor's oversight in late 2012, as part of a pact with the US Justice Department that required it to bolster its in-house controls. Armed with that directive, HSBC compliance officers singled out a half-dozen clients whose activities could put the London-based bank at risk - including a Saudi bank that had been linked to Sept 11, 2001, hijackers - and advised the US investment-banking division to consider dropping those relationships.

There was no indication that the US managers jumped to investigate. Instead, some of them requested that the six banks' alleged sins be omitted from an in-house audit that compliance- team members were preparing to submit to HSBC's top executives. The compliance team's final audit omitted specifics about the banks, according to the monitor's report.

As that audit took shape, U.S. investment banking managers put up other resistance, according to the court-appointed monitor's report: One manager shouted at a compliance officer for wasting his time and dismissed her findings. Overall, the report says, managers from the unit battled auditors with what one compliance officer characterised as a four-part strategy - Discredit, Deny, Deflect and Delay.

The monitor, Michael Cherkasky, submitted his 1,000-page review to the Justice Department earlier this year. His document, reviewed by Bloomberg News, is the first full-year report card of HSBC's progress as part of its five-year deferred-prosecution agreement, or DPA.

HSBC declined to comment on Mr Cherkasky's report, which was meant to remain private under the US deal, said bank spokesman Rob Sherman. Prosecutors had determined the bank was making progress, Mr Sherman added. HSBC has expanded its compliance staff to 7,200 people, more than doubling levels from 2012.

The Justice Department cut several deferred-prosecution deals with big banks from about 2009 to 2012 in an effort to force reform at big banks. As Mr Cherkasky's report shows, such change can be incremental, even in high-profile efforts overseen by the U.S.

Several lawmakers have singled out the HSBC agreement as an example of how soft the US has been on wrongdoing at big financial institutions. They've directed some of their most pointed challenges at Loretta Lynch, the newly appointed US Attorney General - who, in her previous job as top prosecutor in Brooklyn, oversaw the HSBC agreement. Justice Department spokesman Peter Carr declined to comment.

The Justice Department said the monitoring program was working. On April 1, prosecutors who'd seen Mr Cherkasky's report presented a six-page summary to John Gleeson, a federal judge in Brooklyn. The public summary nodded to the battle over the internal audit, saying investment-banking managers were inappropriately combative and showed "a basic lack of cooperation." But overall, prosecutors wrote, "the monitor believes that HSBC Group has made progress in developing an effective AML and sanctions compliance program." Mr Cherkasky's document speaks to the need for continued monitoring: At the current rate, he wrote, HSBC would have a hard time meeting its compliance targets within five years.

"Nearly two years after the entry of the DPA, the bank continues to struggle with a broad range of compliance and control deficiencies that pose an unnecessary level of financial-crime risk to the bank's continuing operations," Mr Cherkasky wrote in the report.

Now, the judge can decide for himself what constitutes progress. Mr Gleeson, who signed off on the deferred-prosecution deal and required quarterly updates from the Justice Department, asked in late April to review the full report. It was the first time the judge has asked for a direct look at any of Mr Cherkasky's work. Prosecutors filed it under seal.

The Justice Department's public summary recognised that HSBC "has made material progress toward meeting the most stringent compliance standards imposed to date upon a global financial institution," HSBC's Mr Sherman said in a statement. "We are committed to that objective and appreciate the monitor's ongoing work." Mr Cherkasky declined to comment through a spokesman for his monitoring company, Exiger.

Mr Cherkasky's report, which forms the basis for this account, is the product of five dozen people who conducted interviews, scoured e-mails and documented meetings to chronicle bank efforts to improve controls in places including Hong Kong, Oman, the Philippines and the US. The monitoring work led by Mr Cherkasky - a former prosecutor and investigator who ran Marsh & McLennan Cos a decade ago - is paid for by HSBC, under the terms of the Justice Department deal.

Internal audits of HSBC's US operation began in September 2013, with auditors' review of two business lines - commercial banking, and retail banking and wealth management - kicking off with introductory meetings attended by unit heads. Reports on those businesses were filed in February 2014.

The audit of the US investment-banking operation got off to a rockier start. Its former leader - US global banking and markets chief executive officer Patrick Nolan - didn't attend the first meeting with auditors, Mr Cherkasky wrote.

The need for the internal audit gained urgency in October 2013, when one of HSBC's US regulators, the Office of the Comptroller of the Currency, sent a supervisory letter to the bank, according to Mr Cherkasky's report. The previously unreported letter raised concerns about anti-money-laundering and sanctions compliance programs, the issues that led to the deferred- prosecution agreement less than a year before.

Mr Nolan's unit focused on the OCC's concerns and dismissed the audit as an annoying distraction, Mr Cherkasky wrote. Mr Nolan, in an e-mail to a subordinate about the OCC's concern, said his group "knew way more about it than any internal audit team who are piggybacking" on the OCC letter.

It wasn't until early February 2014, as the compliance team was trying to finalise its audit, that Mr Nolan attended a meeting with them. Rather than accept their view of his business, he shouted at team leader Karen Fischer for wasting his time.

"Although he later apologised to Ms Fischer," Mr Cherkasky wrote, "the message to his people was unmistakable and set the tone for months to come."

Such antagonism, Mr Cherkasky wrote, took a toll. Two months after the meeting, Ms Fischer e-mailed a colleague: "I am feeling more bullied than I ever have before in my career." Ms Fischer didn't respond to inquiries placed to her HSBC office, and the bank declined to make her available for comment. Mr Nolan, through HSBC's spokesman, declined to comment.

Mr Nolan, in an e-mail to two of his deputies cited by the Mr Cherkasky report, said the auditors' draft report made "bold, sweeping statements which lack clarity, precision and in some cases reality." In Mr Cherkasky's view, the auditors' factual errors were minimal. Managers in the global banking and markets unit, he wrote, had "tried to frame their gripes as 'factual,' when in reality, they were principally objecting to the substance" of auditors' conclusions.

The audit also focused on the North American investment bank's broker-dealer unit, which had dozens of foreign financial institutions as clients. HSBC had worked with several such clients despite evidence that several had links to terrorist financing, according to a Senate investigation in 2012.

In April 2014, in a draft version of their report, auditors called attention to so-called know-your-client files, which often include press clippings or other documentation. Files of six out of 35 non-US financial institutions under review contained references that associated these banks with terrorist financing, money laundering or embezzlement.

"The client files did not adequately explain the rationale for maintaining the account and/or how the incremental risks these clients present to HSBC are being mitigated," the auditors wrote in their draft report, according to Mr Cherkasky. Mr Cherkasky's report didn't claim wrongdoing by the banks.

The Saudi bank's former owner, for example, had been part of the "Golden Chain of Financiers" that supported Osama Bin Laden, according to information in its file, the auditors wrote. In August 2001, two wires were sent from the Saudi bank to one of the 9/11 hijackers' bank accounts in the United Arab Emirates, according to the auditors' reading of the file.

There was also a Mexican bank that maintained offshore accounts for then-Venezuelan President Hugo Chavez. Its file contained items asserting that the bank had been accused of money laundering by two countries and that its parent company was partially owned by an entity based in Cuba, which was under US sanctions.

Mr Nolan's team downplayed the auditors' observations. An early draft of the audit cites his deputy saying the links to the Sept 11 attacks were dated and other allegations were unsubstantiated. An auditor asked why Mr Nolan's unit had neither responded to suspicious-activity reports on the Saudi bank nor established that allegations about the bank were false; the deputy responded that his unit had referred the issue to a review committee.

Mr Nolan told Mr Cherkasky's team in an interview that his primary concern was the auditors' "sensational" language about Sept. 11links, according to Mr Cherkasky's report.

Another question arose as the compliance lapses made their way into the audit: Who would get credit for uncovering them? US banking team members pushed to have the majority of the problems raised as "management self-identified issues." That desire was shared by Irene Dorner, chief executive of HSBC's US operations, one auditor wrote.

Ms Dorner retired last year and attempts to reach her through the bank weren't successful.

The US investment-banking team also made it clear to auditors that a nonsatisfactory management grade would be "highly unwelcome," according to the Mr Cherkasky report.

The final audit, dated May 23, 2014, gave Mr Nolan's team a "needs improvement" grade, slightly higher than the "not satisfactory" mark floated in the draft audit. Of 19 problems raised in the audit, 11 were ultimately said to have been self- reported, according to Mr Cherkasky's report.

And while the initial audit said HSBC should consider ending its relationships with the red-flagged banks, the final report didn't raise questions about whether it should maintain those clients, Mr Cherkasky wrote.

Executives at the global banking and markets unit claimed victory, Mr Cherkasky observed. "FYI One for the management team this week," Gary McClure, global head of client on-boarding account maintenance, wrote in an e-mail to his team. Mr McClure declined to comment through HSBC spokesman Mr Sherman.

Mr Cherkasky filed his report with federal prosecutors on Jan 20, concluding the bank "must redouble its efforts if it is to have any appreciable chance" of developing lasting compliance and anti-money laundering programs.

Federal prosecutors, in their April 1 summary, assured Judge Gleeson that the bank had taken action.

Once senior HSBC executives learned about the problems, prosecutors wrote, they promised to reassign the regional head of the Americas for the Global Banking and Markets unit and cut his bonus. The bank also trimmed the salary of another senior executive in the unit, they said.

Later that month HSBC transferred Mr Nolan to a different position inside the global banking unit. He is now a London- based vice chairman, according to the bank.

As for the status of the flagged banks, HSBC's Mr Sherman said the bank doesn't comment on clients or confirm the existence of client relationships.

BLOOMBERG