Cayman accounts embroiled in Senate investigation of HSBC

A Cayman Islands branch of HSBC’s Mexican subsidiary HBMX played a significant part in the year-long investigation by the US Senate’s Permanent Subcommittee on Investigations of anti money laundering weaknesses at one of the world’s largest banks.  

In a scathing report, the Permanent Subcommittee said HSBC provided a vehicle for “drug kingpins” and “rogue nations”, pointing to anti money laundering problems at the bank over the past decade involving many high risk business regions including Mexico, Iran and Syria.  

The Subcommittee found in particular a large number of high risk transactions with insufficient anti money laundering controls involving US dollar accounts held by Mexican residents at HSBC Cayman SA, a class B banking licence holder in the Cayman Islands. 

Internal documents from HSBC show that the Cayman accounts had operated for years with deficient anti money laundering and know your customer information, the report said. An estimated 15 per cent of the accounts had no KYC information at all, which meant that HSBC’s Mexican subsidiary HBMX did not know who was behind the accounts. Other accounts were, according to an HBMX compliance officer, “misused by organised crime”, the Subcommittee noted. Senator Carl Levin said HSBC’s lack of controls at its US and overseas units had been “a recipe for trouble”. 

In a statement released prior to Tuesday’s Senate hearing, HSBC Group said: “We will acknowledge that, in the past, we have sometimes failed to meet the standards that regulators and customers expect. We will apologise, acknowledge these mistakes, answer for our actions and give our absolute commitment to fixing what went wrong.” 

The Cayman branch, which has no local staff or customers, is operated from Mexico by HSBC subsidiary HBMX. Its services are not related to HSBC Premier, the retail arm of HSBC in the Cayman Islands. 

HSBC had acquired the Cayman branch through its purchase of Mexican bank Bital in November 2002, which in turn had received authorisation from Cayman banking regulators in 1980 to offer Cayman US dollar accounts to its customers. At its peak in 2008, HBMX maintained over 60,000 accounts with assets of $2.1 billion in its Cayman branch. 

Any HMBX branch across Mexico had the authority to open a Cayman account for clients. HBMX offered US dollar services through its correspondent account with HSBC in the US. The report said it had no evidence that HSBC US was ever informed of the use of the correspondent account in this way. 

The accounts allowed HSBC in Mexico to circumvent local regulations which prohibit Mexican residents from maintaining US dollar accounts in Mexico.  

The Subcommittee report, which relies extensively on HSBC internal documents and email correspondence, said HSBC knew about the weak AML controls and KYC information when it took over the branch from Bital. Separate audits of the compliance practices at the bank before the acquisition and again in 2006 concluded that existing KYC system was below standard, with missing, incomplete or wrong account holder information in a significant number of cases. Weaknesses were also found in the account opening and supervision processes. 

Although the internal audit highlighted these severe AML and KYC deficiencies, the report said, the audit remedial recommendations were ignored and closed out on HBMX’s internal management system in contravention of group policy. 

According to the report, HSBC Group Head of Compliance David Bagley, who offered his resignation in a US Senate hearing on Tuesday, remarked at the time to the head of Group Audit for Latin America and the Caribbean Graham Thomson: “I do find it surprising that there can have been no response and yet the audit was closed out. Is this a breach or are you in audit becoming softer.” 

Subsequently HSBC had to seek a one year extension until May 2008 to meet a deadline mandated by a new Mexican law to clean up its KYC information.  

In response to criticism by Mexican banking regulators of its poor KYC procedures in 2008, HBMX initiated “Project Restoration” monitored by senior HSBC group and HBMX officials. This however did not initially include the Cayman accounts. 

When in July 2008 HBMX’s monitoring system highlighted suspicious account activity in Cayman accounts in relation to a US company alleged to be involved in the supply of aircraft to Mexican drug cartels, HSBC Mexico suspended the opening of any new accounts in Cayman, pending a review of the transactions. The Subcommittee report quotes a HBMX compliance officer explaining the action with regard to the Cayman accounts with the “massive misuse of them by organised crime”. 

HBMX CEO Luis Pena also instructed staff in Mexico to carry out enhanced due diligence on all Cayman account holders with the objective of closing all accounts for which the necessary information could not be collected. 

In July 2008, HBMX separated all Cayman accounts, representing 49,935 customers with 61,586 accounts and a balance of about $2.1 billion into three risk categories.  

The Mexican bank categorised 1,314 customers representing 2,240 accounts worth about $205 million as “red” status, indicating that a customer was a special category client, on a black list or subject of a suspicious activity report. HMBX further identified 2,027 customers with 2,084 accounts worth about $180 million as yellow status, meaning they had been flagged by HBMX’s internal AML monitoring system with one or more alerts.  

The bank largely focused any remediation efforts on these accounts, but several months later hardly any progress had been made in the enhanced KYC completion, the Subcommittee wrote referring to an internal HSBC presentation.  

“[A] October 2008 assessment indicates that at least 75 per cent of the Cayman files still had incomplete KYC information six years after HBMX assumed control of the accounts,” the report said. 

In November 2008, HSBC Group CEO Michael Geoghean prohibited all HBMX branches, including the Cayman branch, from offering US dollars to customers, except at automated teller machines in Mexican airports. 

The measure came in response to strong criticism of HMBX’s AML and KYC regime and the huge volume of US dollars exported by the bank to the US by senior Mexican regulators, who specifically referred to US dollars sent from the Cayman Islands. 

HBMX took nearly another year to complete KYC remediation of the Cayman accounts, finally completing the work in July 2009. This included the closure of approximately 9,000 Cayman accounts, due in many cases to incomplete KYC information. 

However, HBMX’s Cayman branch remains in operation and the ban on new accounts has been lifted. Today, over 20,000 HBMX clients have over $657 million in Cayman US dollar denominated accounts. 

The bank said it is in the process of closing these 20,000 bank accounts as result of the money laundering investigation. 

HSBC sign

Lax controls at Europe’s largest bank, HSBC, allowed Mexican drug cartels to launder funds through its United States operations, a US Senate investigation has found. – Photo: AP

Support local journalism. Subscribe to the all-access pass for the Cayman Compass.

Subscribe now


  1. The international exposure on this matter is going to be a major black eye for Cayman’s banking image. Perceptions of weakness in Cayman’s compliance and risk management oversight will be of concern. Cayman leadership has recently made declarations of having a high level of discipline and more than adequate controls in place particularily in AML risk management. Regulators need to explain their roles and accountabilities. Material financial penalities should be placed on any violators of Cayman laws.

  2. It seems inconceivable that a CIMA onsite inspection would not have indicated that there were serious issues. On the basis of the information available, this incident, in the perception of the rest of the World, makes a nonsense of all the self righteous claims about the strength of our regulatory system. It also seriously questions the effectiveness of CIMA and it’s staff.

  3. CIMA does not inspect Class B licences such as HBMX: these are regulated by the home country, in this case Mexico, a Schedule 3 country meaning it is deemed by international regulatory bodies as having comparable AML compliance rules and requirements as Cayman. So, this is not a Cayman problem but Cayman gets the black-eye ….

  4. OK Kmanite – point taken – if correct. Meanwhile, would you like to be the person to give that explanation to the US Senate Committee of Enquiry, and tell them that you allow Third Parties complete autonomy in regulating a bank in Cayan. In the face of the almost daily reports that Mexico is a country where large areas are no longer under Government control, corruption in government, the police force and army is rampant, and officials live in fear of their own and the lives of their families – as a regulatory body in Cayman, would you just accept the rubber stamp confirmation that Mexico can be treated as a Schedule 3 country. This is the Nelsonian blind eye philosophy par excellence. The responsibility of a Regulatory Authority is to take into account ALL of the factors relating to the operations of Financial Service Providers in Cayman. On the basis of your assessment of the issues with HBMX I do hope that you are not responsible for any Compliance function.

  5. @Jabbawocky: the US are complicit in continuing to fail to acknowledge Mexico regulatory and corruption failures etc: all of these regulatory lapses and passing the buck are inherent in the system of international regulation. You can usefully direct your vitriol to CIMA to implement a requirement that they start inspecting class b licensees – not at me, I’m not the problem nor in any position to influence policy. Always happy to point out the gaps.

  6. Kmanite , both of my submissions were made in the hope, however unlikely, that they would catch the eye of somebody at CIMA. If you were offended by my personal comment, it was made only in the context that I felt your posting was rather naive.

  7. Hey Kmanite, how is the US complicit? It is the only country in this story trying to enforce the law. If Cayman wants to be the domicile of such institutions and take their money, it must expect to be trashed when they turn out to be corrupt.

  8. Hey Kmanite, how is the US complicit? It is the only country in this story trying to enforce the law. If Cayman wants to be the domicile of such institutions and take their money, it must expect to be trashed when they turn out to be corrupt.

  9. Noted that HSBC’s own internal documents reveal that for years Cayman accounts operated with deficient anti money laundering information. It begs the question, were regulators aware of the situation and looked the other way. Or, they merely assumed that the bank was in full compliance with the law.

    One would have thought that the notorious drug cartels operating in Mexico and the clout they have with the sale of drugs to the USA, closer scrutiny would be given to all transactions with HSBC Mexico.