HSBC paid nearly $2 billion in 2012 after investigators found that Mexican drug-cartel money had moved through its banking system for years — hidden not in suitcases, but inside hundreds of billions of dollars in wire transfers

Somebody, at some point, took a tape measure to the teller windows at HSBC’s branches in Mexico.

Couriers carrying cartel cash had tired of feeding loose notes through a narrow slot, so they commissioned boxes built to the window’s exact dimensions. Hundreds of thousands of dollars, one account, one day. That detail surfaced in a year-long investigation by the US Senate Permanent Subcommittee on Investigations. Justice Department official Lanny Breuer repeated it when the settlement landed, and days later Senator Jeff Merkley cited it in a letter to the Attorney General. In coverage by NPR, staff at the bank’s Mexican unit wired seven billion US dollars north to correspondent accounts in New York across 2007 and 2008, more than larger Mexican banks were sending.

Those boxes are the part everyone remembers. They are also the smallest number in the story.

Mexico sat in the lowest risk category

The Justice Department’s own announcement lays out the timeline. From 2006 to 2010, HSBC Bank USA severely understaffed its anti-money-laundering function, and from at least 2006 to 2009 it rated Mexico as standard risk, the mildest label on the scale. A country then in the middle of a war between cartels and its own government was, on the bank’s internal ledger, unremarkable.

What followed from that rating was arithmetic. Standard risk meant no serious automated monitoring, so more than 670 billion dollars in wire transfers from the Mexican affiliate went unwatched, along with more than 9.4 billion dollars in purchases of physical US banknotes. Somewhere inside that flow sat at least 881 million dollars in drug proceeds, including money belonging to the Sinaloa Cartel in Mexico and the Norte del Valle Cartel in Colombia.

Much of it travelled through the Black Market Peso Exchange, a laundering circuit that turns American street cash into clean pesos on the far side of the border. Investigators from Homeland Security’s El Dorado Task Force had been pulling at those accounts since 2008, and arrests and extraditions of the people using them began years before the bank faced anything at all.

Sanctions and the stripped payment messages

Running alongside all of this was a second offence with no cartels in it. From the mid-1990s to September 2006, HSBC Group pushed roughly 660 million dollars of sanctioned money through American institutions by stripping identifying details out of payment messages. HSBC Group affiliates worked with the sanctioned entities themselves to attach cautionary notes to the payment messages, telling whoever handled them downstream to leave the country’s name out of the paperwork entirely. One note read simply, “do not mention Iran.”

People inside the bank flagged it early. As early as July 2001, HSBC Bank USA’s chief compliance officer raised the practice with the group’s head of compliance in London and was told the group would never allow anything so brazen. The practice continued anyway, for five more years. Protests from the American side were ignored, as the department itself later acknowledged.

What 1.9 billion dollars bought

On 11 December 2012 the bank agreed to forfeit 1.256 billion dollars and pay a further 665 million in civil penalties, 500 million of it to the Office of the Comptroller of the Currency and 165 million to the Federal Reserve. It waived indictment and accepted a four-count felony information, then submitted to an outside compliance monitor for five years. It also replaced almost all of its senior management and clawed back bonuses from its most senior compliance officers.

Nobody pleaded guilty. Rolling Stone, doing the sort of sum that makes press officers wince, reckoned the total came to roughly five weeks of income for the bank.

Why the case never reached a courtroom

For a while that outcome looked like ordinary prosecutorial caution. Then in July 2016 the Republican staff of the House Financial Services Committee published internal Treasury records that had taken three years and a pair of subpoenas to pry loose, and the caution acquired a motive. Prosecutors in the Asset Forfeiture and Money Laundering Section had recommended charging the bank. Senior leadership, including Attorney General Eric Holder, overruled them, citing concern that a prosecution could tip the wider financial system into crisis. CNBC’s coverage of the report noted its finding that Holder had misled Congress about the reasoning, having previously assured legislators that no bank was too big to jail. Britain’s Chancellor, George Osborne, had also written to the chairman of the Federal Reserve to convey UK concerns about American enforcement against British banks.

That finding comes from a Republican staff report, not a court ruling.

Five years of probation

HSBC left the agreement on schedule. In December 2017 the bank confirmed that its deferred prosecution agreement had expired. The Justice Department moved to dismiss the deferred charges shortly after, closing off criminal liability for the entire affair.

Three years later, a leaked cache of suspicious activity reports let the International Consortium of Investigative Journalists, working with BuzzFeed News and more than 100 other media partners, show that HSBC kept serving alleged fraudsters and shell companies while it was still on probation.

Deterrence assumes somebody learns something. A bank cannot learn. It can only be reorganised, and every individual capable of learning walked out of the decade without their name on a charge sheet.