1. Introduction
THE IMF DEFINES money laundering as “the processing of assets generated by criminal activity to obscure the link between the funds and their illegal origins”; similarly, the Financial Action Task Force (FATF) defines it as “the processing of criminal proceeds to disguise their illegal origin.” There is, however, no widely recognized common definition of money laundering (Unger et al. 2006). The term “money laundering” is believed to originate from Al Capone, who used laundromats to obscure the origin of his criminal profits in the 1930s—a time when few had washing machines at home (Unger 2011: 615), making the cash-intensive business a perfect tool to “clean” dirty money.
The World Bank estimates that between 2% and 5% of global GDP is laundered annually. The total world GDP in 2018 was $84.84 trillion, which then suggests that between $1.69 trillion and $4.2 trillion is annually laundered. However, estimates vary considerably, depending on the adopted definition. Simultaneously, it is estimated that less than 1% of proceeds of crime laundered via the financial system are currently seized and frozen by regulatory and law enforcement agencies (UNODC 2011: 7).
Every case of money laundering has what is called a “predicate offense” or “predicate crime” behind it: meaning an illegal act, such as the selling of drugs, smuggling, tax evasion, or human trafficking, that produces profits that need to be laundered in order to be freely used in the international financial system. To curb money laundering, several institutions, including banks, are obligated to adopt preventive procedures to identify customers and transactions that may be involved in or related to money laundering. A primary concern for banks, the institutions on which this report focuses, is having adequate and updated information on their customers and their activities to prevent being used by criminals looking to launder their money.
Combating money laundering is vital because when uncurbed, it has significant adverse effects on society. Among other things, it enables criminals to enjoy the proceeds of crime, creating a base for further illegal activities; it facilitates government corruption; it makes it possible for dishonest leaders in countries with weak institutions to plunder local resources and developmental aid; it allows tax evasion to undermine fiscal policies, redistribution, and the provision of the most fundamental public goods; it plays an essential role in the funding of terrorist organizations; and it undermines international sanctions. An effective AML regime has the potential to contain these significant problems in societies.
Money laundering can take many forms, with cryptocurrencies playing an increasing role. This report focuses exclusively on AML deficiencies in banks and how to limit them, with particular attention paid to Europe and Scandinavia. The recent cases of failures of AML regimes in the Nordic countries have brought new attention to the topic, spurring a discussion on the effectiveness of the current European AML and Counter-Terrorist Financing (CTF) regime and the possibilities to improve it.
We mainly focus on compliance with the administrative set of rules for institutions covered by AML regulation to prevent or detect money laundering activities, rather than on the criminal side of laundering money and proactive attempts to obscure the criminal origins of funds. This is sometimes called the “preventive” side of money laundering regulation, in contrast to the “repressive” criminal law or “enforcement” side of the fight against money laundering (Reuter and Truman 2004, Svedberg Helgesson and Mörth 2018).
With respect to compliance with the preventive regulation, there is a spectrum of the level of severity of non-compliance. Less serious shortcomings, such as not having adequate staff or competence to ensure AML compliance, have been rather widespread. More serious issues include an extensive lack of knowledge about customers, careless onboarding of high-risk customers, and serving them for extended periods despite repeated internal and external warnings and red flags. Then there are arguably worse offenses, such as employees proactively aiding customers in laundering money, which appears to have been the case at HSBC where employees allegedly aided customers from Iran in avoiding a filter developed by the US Office of Foreign Assets Control to identify and halt potentially prohibited transactions (US Senate 2012).
Whereas customer-facing employees at banks on some occasions have intentionally aided criminals and are therefore guilty of criminal violations, our focus in this report is primarily on the lack of organizational responses to ensure that rank-and-file employees follow the correct procedures for customer onboarding and scrutinize suspicious transactions, as mandated by AML regulations. Banks are not the only institutions that can enable money laundering, and several other channels exist. However, many banks worldwide have historically been active in this profitable business, and in some “tax haven” countries, it has been their primary activity. Some countries have historically made themselves attractive as custodians of illegally obtained wealth by offering high levels of bank secrecy. Other countries have done so indirectly by allowing for opaque incorporation structures, such as limited liability partnerships, that make it easy for criminals to hide their identity and the origins of their assets.1
“Bank secrecy” used to be a neutral or even positive expression in relation to the banking business. While it may have some legitimate purposes, today it often carries a negative connotation and is considered—among other things—an obstacle to tax transparency that undermines governments’ ability to collect taxes from the wealthiest part of the population. In recent years, some countries have been effective in detecting and deterring tax evasion and money laundering arrangements. Consider the United States. Many US tax evaders used to hide and launder their undeclared wealth through Swiss banks, but it is widely believed that very few do so today. What happened?
Bradley Birkenfeld, a banker working for the Swiss bank Ubs, blew the whistle on how US citizens were evading taxes with the help of his bank. Under US law, persons bringing original information on tax avoidance are eligible for a percentage of the tax collections that their information aids in recovering. Birkenfeld was awarded $104 million for his information on Swiss banking practices; Ubs ended up paying a $780 million fine and agreed, together with the Swiss government, to turn over the names of thousands of Americans involved in tax avoidance. The revenues generated by the US government, largely due to Birkenfeld’s information, is estimated to be $16.19 billion (KKC 2020), and these whistleblower incentives were intended to and likely succeeded in undermining tax-evading Americans’ belief that their money would be safe in Switzerland (see, e.g., Ventry 2014).
Our focus in this report is to understand whether and how whistleblowers can assist supervisors and investigators in the early detection of extensive AML non-compliance within financial institutions by playing a continuous monitoring role.2 Like many other forms of regulatory violations and white- collar crimes, AML non-compliance has no victims who directly suffer damages, leading to an absence of an injured party with an incentive to report the infringement to the police or supervisory authority. Supervisory authorities and law enforcement agencies are at a particularly strong informational disadvantage with respect to these infringements relative to crimes with direct victims, making insider information more important.3
Whistleblower reward programs, that provide financial incentives to insiders who report valuable information on in-fringements to regulators have proven highly effective in uncovering and deterring a wide range of corporate misconduct in the US, remain absent in Europe. On January 1, 2021, the US Congress extended these programs to AML non-compliance, under which whistleblowers would receive up to 30% of the government collections and monetary sanctions imposed on wrongdoing institutions. These rewards only apply to particularly severe misconduct that leads to enforcement actions where the sanction against the wrongdoer exceeds $1 million.
In the US, rewards of millions of dollars to individuals who bring agencies information on infringements are frequently handed out. The Securities and Exchange Commission (SEC) has since 2012 provided more than $738 million in rewards to individuals who reported infringements of financial regulations. Since 2007, the Internal Revenue Service (IRS) has paid out over $1 billion in rewards to whistleblowers revealing conspicuous episodes of tax evasion. The False Claims Act, which rewards those who report fraud against the US government, has a ten-year average of $515 million per year paid to whistleblowers. As we will see when discussing independent research, these programs have increased both the detection and deterrence of the infringements they target, with no burden for the taxpayer.
Whistleblower reward programs can be implemented by any supervisory agency in any regulatory area, while in recent times they have primarily been used in the US. Our focus is on whistleblowers and AML in the European context. That said—whistleblower rewards and effectively incentivizing whistleblowers are relevant to any nation seeking to enhance regulatory compliance. To increase the effectiveness of whistleblowers in detecting AML non-compliance, global organizations with significant “soft power” such as the FATF could develop recommendations in this regard, based on the extensive independent research that emerged in the last decade and is reviewed in this report.
The rest of the report is structured as follows. In Section 2, we consider three cases of AML non-compliance in depth and briefly discuss a few additional incidents. In Section 3, we outline the global AML regime, discussing the increasing criticisms and concerns regarding its effectiveness and the costs for financial institutions. In Section 4, we survey the current state of whistleblower protection and reward laws in the EU and US. In Section 5, we review the evidence on the effectiveness of whistleblower reward programs, consider some objections against them, and possibilities for using them for AML enforcement in Europe. In Section 6, we conclude with some policy recommendations.
2. Case Studies
MANY EUROPEAN financial institutions, including Deutsche Bank, bnp Paribas, Barclay’s Bank, and HSBC, have been fined for AML or sanctions violations in recent years, and several large international banks are recidivists with respect to AML non-compliance. In this report, we focus on recent AML issues within Danske Bank and Swedbank. We also consider a “classic” case, that of HSBC, which is particularly illustrative of the soft stance regulators and governments often adopt with respect to these practices, and at the same time what kind of crimes banks may help enable if they turn a blind eye toward the identity and activities of their customers. In the HSBC case, the bank entered a deferred prosecution agreement over prolonged AML non-compliance that enabled Mexican drug cartels to launder hundreds of millions of dollars through the bank.
It may be challenging to comply with all the rules mandated by the complex AML regulations on any given occasion, so it is probably more appropriate to think of compliance as degrees on a spectrum, with minor violations on one end and severe ones on the other. One could distinguish between: (i) banks complying with the law but unwittingly being used by clever criminals to launder illegal profits while having adequate AML controls; (ii) banks being used by money launderers while having inadequate AML controls or not paying proper attention to red flags (negligence); (iii) banks consciously turning a blind eye to evident and persistent AML deficiencies (intentional negligence); (iv) banks deliberately engaging in typically highly profitable money laundering—proactively helping clients conceal their identity or the origins of their assets. The cases we consider almost exclusively involve AML non- compliance in categories (ii) and (iii), while HSBC is probably more appropriately classified as (iii) and (iv).
In the remainder of this section, we first consider the case of HSBC (Section 2.1), then the recent Scandinavian cases of Danske Bank (Section 2.2) and Swedbank (Section 2.3). In reviewing these cases, we focus on i) each bank’s awareness of AML risks at the group/branch level, ii) the prolonged nature of the offenses while AML deficiencies were known to be present, and iii) communication with and effectiveness of bank supervisors. We end by discussing AML fines against other banks (Section 2.4), how whistleblowers are treated within banks (Section 2.5), and then briefly conclude (Section 2.6). We rely on public sources, including internal investigations by banks, external investigations by supervisors, settlement and sanctions decisions, and complementary information from research and newspapers.
2.1 HSBC
Our first case concerns HSBC Holdings, or “HSBC Group,” and its US affiliate HBUS with respect to HSBC’s activities in Mexico, a country that has been a member of the FATF since 2000. The section is based primarily on reports from a US Senate investigation from 2012, settlements from US enforcement agencies, and subpoenaed ...