The FCA has fined Commerzbank AG, London Branch ("Commerzbank") £37,805,400 for failing to put adequate anti-money laundering ("AML") systems and controls in place between October 2012 and September 2017 (the "Relevant Period"). Commerzbank agreed to resolve the matter at an early stage of the investigation and therefore qualified for a 30% discount.
Commerzbank was required to take reasonable care to organise and control its affairs responsibly and effectively, to establish and maintain an effective risk-based AML control framework and comply with the applicable Money Laundering Regulations.
Failings identified by the FCA include:
- Resource: The lack of compliance resource is an increasingly common theme in FCA notices. This was no exception. Commerzbank's first and second lines of defence tasked with carrying out key AML controls were, throughout the Relevant Period, understaffed and unable to complete KYC reviews for new and existing clients in a timely manner. This led to the development of a significant backlog of existing clients being subject to KYC refresh.
- Procedures: There were no set procedures in Compliance for approving extensions for clients' overdue KYC refresh, nor for how decisions were to be recorded or how those clients granted extensions could be monitored.
- Policies: Certain business areas did not always adhere to Commerzbank's policy of verifying the beneficial ownership of clients, including high-risk clients, from a reliable and independent source.
- Process: There was no comprehensive documented process or criteria for terminating a relationship with an existing client for financial crime risk.
- Politically Exposed Persons ("PEPs"): The way that Commerzbank identified and considered the risks associated with PEPs was inadequate.
- Suspicious transaction reporting: Commerzbank's Primary Transaction Monitoring Tool was not fit for purpose, and did not have access to key information from certain of Commerzbank’s transaction systems, creating the risk that potentially suspicious transactions were not identified.
Comment
In recent AML notices, the FCA has sought to illustrate its findings with actual examples of client relationships with strong evidence of money laundering. In this case, no specific examples were provided and the FCA noted that there was no evidence of financial crime having been facilitated by Commerzbank's failings. Unlike Proceeds of Crime Act offences, money laundering need not have taken place for the FCA to take action.
In calculating penalty, the FCA judged the seriousness of the failings to be level 4 (on its 5 level scale), which is comparable with other AML cases.
This would generally provide a starting point for penalty equivalent to 15% of the Bank's relevant revenue (in this case a starting point of £163,660,050). However, the FCA is entitled to decrease the level of penalty where it is disproportionately high for the breaches concerned. In this case the figure was reduced to £45,006,513 ("taking into account previous cases"). This is a reduction of 62.5%, although it is entirely unclear how that figure was chosen (for example in similar cases Deutsche Bank enjoyed a proportionality reduction of over 88% resulting in a satisfyingly round figure of £200 million, and Standard Chartered – reductions of 60% for the Consumer Bank's UAE branches and 80% for the Wholesale Bank's UAE branches.
The FCA considers that the local and global compliance landscapes are both key. The FCA's Director of Enforcement and Market Oversight, Mark Steward, appears keen on emphasising commonality and collaboration with international regulators (see, for example, Mark Steward Gives Speech on Strategy Approach to Market Integrity). Commerzbank's failings occurred against a background of heightened awareness within Commerzbank of weaknesses in its global financial crime controls following action taken by US regulators in 2015 against the Commerzbank group. This was considered an aggravating factor in the FCA's penalty calculation.
The severity of the consequences are also likely to increase when the FCA identifies failings, asks firms to address them and the firm does not. The FCA visited Commerzbank London in 2012, 2015 and 2017 to discuss issues relating to its AML control framework and identified weaknesses that Commerzbank was to address. Commerzbank did not address these and this was identified as an aggravating factor in the FCA's penalty calculation.
Notwithstanding the FCA's voiced desire to use its criminal enforcement powers in AML enforcement cases, this is yet another case where the FCA has exercised its civil powers. We still await the FCA's first criminal case.