The Isle of Man Financial Services Authority has imposed a civil penalty of £419,900 discounted by 30% to £293,930 on HSBC Bank PLC IOM Branch.
In a statement on 26 November, the island's regulator said the discretionary civil penalty was actioned in accordance with the Financial Services (Civil Penalties) Regulations 2015.
The penalty and public statement came after regulatory contraventions were "identified in relation to two unconnected matters (one of which was proactively self-reported to the Authority by HSBC)".
"HSBC has proactively brought about operational changes to address the issues identified. Further, the Authority acknowledges the constructive and pragmatic dialogue between HSBC and the Authority and gives credit for the engagement in this regard", the statement said, adding that "the level of the Civil Penalty reflects the isolated nature of the issues, HSBC’s proactive implementation of operational enhancements to address the issues identified and the fact that HSBC co-operated with the Authority and agreed settlement at an early stage."
The level of the civil penalty was calculated as a percentage of HSBC’s relevant income at the time that the contraventions noted within this public statement were identified.
"In this case, the Authority is assured that the contraventions were isolated in nature rather than being systemic across the business and that there were significant mitigating factors at play", the regulator said.
In the first matter, HSBC discovered in August 2023 that earlier the same month it had paid away funds in the form of three recurring payments for a client that were subject to a Restraint Order issued by the Isle of Man Courts pursuant to the Proceeds of Crime Act 2008 (the “Court Order”).
The Court Order restrained dealing with funds in respect of specified bank accounts in the name of a client of HSBC but permitted certain monthly payments to be made. HSBC notified the regulator of this matter pursuant to its obligations under Anti-Money Laundering and Countering the Financing of Terrorism (“AML/CFT”) legislation, and the Financial Services Rule Book 2016.
In the second matter, on 4 September 2023 the regulator became aware that HSBC had issued a cheque without the required consent from the Financial Intelligence Unit. Following a request from the Authority, HSBC subsequently submitted the relevant notification.
In relation to the first matter involving the Court Order, HSBC operates procedures such that it can apply ‘Blocks’ against selected accounts. Such ‘Blocks’ and related controls are designed to prevent transactions from being processed. For this purpose, these ‘Blocks’ and related controls are referred to as ‘preventative controls’.
The preventative controls that were applied at the time the funds subject to the Court Order were paid away required the manual lifting and replacement of a Block each time a permitted batch of monthly payments needed to be made. The contravention arose because the preventative controls were not manually reapplied to the account after consented monthly payments had been made resulting in three recurring payment transactions leaving the account.
In addition to preventative controls, banks also operate what are commonly referred to as “detective controls”; these being designed to find issues quickly, including where preventative controls may have failed.
The regulator further said HSBC had good detective controls as evidenced by the fact that the breach of the Court Order was discovered quickly by HSBC and it made prompt notifications to the Attorney General’s Chambers and the Authority. The funds were recovered in full, within two months of the notification to the Restrained Accounts.
In relation to the second matter involving the paying away of funds without consent, HSBC submitted a disclosure to the FIU in relation to a client’s bank account. HSBC advised that following a review of the customer relationship, HSBC’s Risk Committee had decided to exit the relationship and notice had been given to the client regarding the account closure. The balance on the account had been issued inadvertently to the client by way of cheque prior to the necessary engagement with the FIU to request consent to process the transaction.
