Casualties of War
The Unintended Consequences of America's Financial Weapon of Mass Destruction
staci warden, a former banker at JP Morgan, is the executive director of the Milken Institute's Center for Financial Markets as well as chairwoman of Rwanda's Capital Market Authority.
Published April 27, 2015
The dominance of the U.S. financial system in global economic activity generates huge benefits for the United States – not least by giving Washington a potent means to strangle terrorism. But, as is now becoming apparent, this capacity to project financial power to the ends of the earth is yielding unintended consequences that are not in the United States' interests. And keeping the metaphoric baby safe while throwing out the bathwater will not be easy.
First, a little history. Each of the 19 hijackers who carried out the 9/11 attacks had a checking account in his own name at a U.S. bank. They received wire transfers from all over the world to finance their activities, and the transfers went unnoticed because the support was funneled in small, regular sums through an elaborate network of front companies, wealthy donors and charities. The breadth and sophistication of these operations, carried out for years under the radar of the banks involved, was a wake-up call for Washington. And so began the United States' campaign to excise the bad actors from the networks that carry the financial lifeblood of the global economy.
After decades of dodging broader financial sanctions, a North Korean negotiator allegedly admitted to a U.S. official, "you finally found a way to hurt us."
With hindsight, the approach seems obvious. Criminal syndicates need to buy weapons, recruit and pay members, reward the families of soldiers and martyrs, and purchase intelligence. As with any global business, a robust, efficient financial supply chain is critical to operations, and that means unfettered access to global banking. The U.S. Treasury's key insight, Juan Zarate, the first head of the department's Office of Terrorism and Financial Intelligence (TFI), explained in his book, Treasury's War: The Unleashing of a New Era of Financial Warfare, was to leverage the self-interest of legitimate financial institutions to police illegitimate financial flows.
Treasury officials reasoned that the banks would close accounts and terminate correspondent-banking and trade-facilitation services with suspicious clients rather than risk fines or damage to their reputations. Moreover, all of this could create a virtuous circle: as bad actors were no longer able to hide in plain sight, their scramble for camouflage would actually make them easier to identify.
Financial sanctions and follow-the-money intelligence strategies had long been used by Washington to enforce trade and investment embargos – notably, against Cuba and Iran – while anti-money-laundering tools have been fundamental to the battle against narcotics trafficking. But after 9/11, the authority to wage financial warfare was sharpened. Enforcement agencies were given new authority to label wrongdoers, isolate financial institutions and seize assets.
Section 311 of the USA Patriot Act enabled the Treasury to designate a bank to be a "primary money-laundering concern" without having to prove criminal intent. And the power of the provision is beautifully illustrated by actions against North Korea designed to stop its counterfeiting, money laundering and narco-finance activities. The United States declared the country's principal international banker, Banco Delta Asia in Macau, a bad bank under Section 311, which transformed it into a financial pariah overnight. First, Macau's regulators froze the assets of all North Korean government accounts, causing a run by other depositors; simultaneously, the 311 designation induced banks around the world to sever relations with the Macau bank. The failing bank was subsequently taken over by the government and all North Korean government accounts were closed.
The secondary impact of the Treasury initiative proved as important as the initial strike. Banks across Europe and Asia shut down their own North Korean government accounts to avoid a similar bad-bank designation. And after decades of dodging broader financial sanctions, a North Korean negotiator allegedly admitted to a U.S. official, "you finally found a way to hurt us."
The case for the fundamental importance of access to the infrastructure of international finance was recently made forcefully (if histrionically) by Russia. When, in September 2014, the European Parliament urged member-states to consider banning Russia from the SWIFT network (a standardized electronic payments-messaging platform for correspondent banking), the head of VTB Bank, Russia's foreign-trade bank, said that he would consider such a move an act of war: "If Russian banks' access to SWIFT will be prohibited, the U.S. ambassador to Moscow should leave the same day. Diplomatic relations must be finished," he warned.
Prime Minister Medvedev recently doubled down, saying that "Russia's response would be unlimited" – a statement widely interpreted to mean that Russia would cut off gas supplies to Europe.
All told, the success of Treasury's tactics has transformed the Treasury from a minor player to the epicenter of U.S. financial intelligence and antiterrorism efforts. One symbol of that success: the appointment of David Cohen, undersecretary at TFI, to the position of deputy director of the CIA – the first time the job has been given to an intelligence outsider.
Inside the Plumbing
Financial-warfare strategies do not succeed because the United States is a giant market and counterparty for trade and investment flows globally (though it is), but rather because most international financial transactions are in dollars. Every dollar transaction on the planet that involves bank deposits (as opposed to currency) must eventually find its way back to the balance sheet of one of the U.S. clearing banks. If a bank in, say, Nigeria, needs to make a dollar payment on behalf of one of its customers to a beneficiary in, say, Malaysia, it needs to have access to a correspondent bank account at a U.S. clearing bank. If it has direct access, it instructs the U.S. bank to debit its account and make a payment to the U.S. clearing bank used by the Malaysian bank. If the Nigerian bank does not itself have a correspondent account, it uses nested correspondent accounts with a series of banks until it reaches a U.S. clearing bank.
U.S. clearing banks have accounts directly at the Federal Reserve. And the Fed stands in the middle of each payment transaction, netting them out in the settlement process. So if a bank anywhere in the world serves as a go-between in a dollar transaction, it will, in some way, at some point, be subject to Fed oversight and U.S. banking regulations.
Note that because the Fed stands between each party to a clearinghouse bank transaction, there is no settlement or counterparty risk between the clearing banks. But throughout the rest of the financial system, correspondent banks are subject to significant counterparty risk – risk that the party on the other side of the transaction won't honor its contractual promises. Back in the day, personal relationships among the players was crucial to mitigating counterparty risk, and temporary liquidity shortfalls could often be settled with a phone call between bank CEOs. But globalization, data-driven risk analysis and heightened regulatory scrutiny have raised the bar on both compliance and risk mitigation in correspondent banking, and personal trust-based practices have become, for the most part, a thing of the past.
Unfortunately, at the turn of the millennium, technology-centric credit assessment and compliance systems still fell far short of hoped-for effectiveness in identifying and thwarting illicit flows. The U.S. Senate's Permanent Subcommittee on Investigations issued a blistering report six months before 9/11, finding that money-laundering surveillance practices at large U.S. banks were "often weak and ineffective" due to a lack of due diligence on services promising upfront fees and to the practice of nested (and thereby less-than-transparent) correspondent banking relationships. In the wake of 9/11, banks began to take steps to beef up their compliance systems. And then the Riggs Bank scandal exploded.
Upping the Ante
In 2002, improprieties were found in over 150 accounts held by the Kingdom of Saudi Arabia at the Washington-based Riggs Bank, including unexplained wire transfers in the millions of dollars. Separately, it came out that a Riggs Bank employee had accepted a $3 million deposit in shrink-wrapped currency, packed in suitcases, on behalf of the kleptocratic dictatorship of Equatorial Guinea. The final straw for Riggs was the discovery that it had actively managed accounts held in the name of Chile's General Augusto Pinochet. The Office of the Comptroller of the Currency the bank's regulator, issued it a cease-and-desist order, and Riggs, which had once billed itself as "the most important bank in the most important city in the world" was forced out of business, with its operations sold to PNC Bank in 2004.
The reverberations from Riggs were felt across U.S. correspondent banks. But regulatory fines for noncompliance remained affordable compared with the cost of beefing up compliance capacity. Since the global financial crisis, however, this is no longer true. The Justice Department has come down ever more aggressively against banks, and fines have skyrocketed. In 2012, HSBC agreed to pay almost $2 billion, a record at the time, for enabling drug cartels in Mexico and Colombia to launder almost $900 million through HSBC Mexico, and further, for effecting payments for a number of sanctioned countries. Two years later, JPMorgan Chase was also fined $2 billion for failure to report suspicious activity related to the operations of Bernard Madoff.
The list goes on and on. Over the past five years, Lloyds TSB, Credit Suisse, Barclays, ING, Standard Chartered and RBS have each been fined hundreds of millions of dollars for sanctions violations with respect to Iran, Sudan, Libya, Cuba and Burma. And in July 2014, BNP Paribas, France's largest lender, broke all records when it pled guilty to sanctions violations and agreed to pay fines totaling almost $9 billion for having cleared almost $200 billion in transactions for Iran, Sudan and Cuba since 2002. Since then, the Justice Department has also snared Germany's second-largest lender, Commerzbank, for sanctions violations associated with serving a state-sponsored shipping company in Iran. It will pay a fine of $1.45 billion.
Banks have received the message and are now spending billions to improve their anti-money-laundering and compliance processes. According to a recent KPMG survey, large banks now collectively spend upwards of $10 billion annually to comply with global anti-money-laundering and combating-the-financing-of-terrorism sanctions. JPMorgan Chase, for example, said in a recent letter to shareholders that it spent $2 billion in 2014 and hired 13,000 (no misprint) compliance employees. Standard Chartered recently announced that regulatory costs were adding 1 to 2 percent – or $100 million to $200 million – to its costs every year. The bank has doubled the number of employees in its financial-crimes unit and increased its legal and compliance head count by 30 percent in the past year.
From Risk Management to Risk Avoidance
U.S. banks cannot conduct business with countries or individuals that appear on the U.S. Treasury's Office of Foreign Asset Control lists. The usual suspects – Iran, Cuba and North Korea – figure prominently. But in addition, the office's Specially Designated Nationals list covers individuals from all over the world and currently numbers over 6,000. Banks must further demonstrate that they have adequate processes in place. (JPMorgan, for example, was taken to task – and paid a nine-figure fine – for having weak systems, not for any actual wrongdoing.)
The regulations require banks to take a risk-based approach, using extra care with certain regions and industries as well as certain products and customer types. This means, among other criteria, shunning business in countries with weak regulatory-enforcement mechanisms, in countries where the banking sector is not well understood and in countries where information is limited and know-your-customer requirements are difficult to establish.
Consider, though, that core services like correspondent banking and trade finance pose a double problem for banks. On the one hand, they are high-risk activities from a money-laundering and terrorist-finance point of view, and thus demand costly oversight. On the other, they are low margin businesses that must generate high volume to be profitable. As a result, as compliance costs escalate, banks are wondering whether they should be in these businesses at all. As one senior banker who wished not to be identified complained, "to do a $50 million transaction, wherein we made $20,000, somebody on my team had to spend a week going through a negative media compilation as thick as a telephone book. That is not a sustainable business model for me."
The idea behind the United States' new strategy of financial warfare was that legitimate financial institutions around the world could effectively be forced to make a coordinated effort to preserve the integrity of the global financial system by making sure that criminals couldn't gain access. Nowhere, however, did the strategists contemplate what would happen if banks decided to exit correspondent banking and trade-finance altogether. But that is what's happening.
In a process that has come to be called "de-risking," large U.S. correspondent banks are exiting their correspondent and other core banking relationships in droves. According to a private survey of 17 clearing banks that was reported in The Financial Times, thousands of correspondent banking relationships have been severed since 2001, with a 7 percent average decline in relationships, and with several banks axing one-fifth of their relationships.
According to an International Chamber of Commerce report, in a survey of 300 banks in 127 countries, anti-money laundering and combating the financing of terrorism requirements were a "major inhibitor" to the provision of trade finance, resulting in an unwillingness to provide the service by 68 percent of the banks surveyed. For example, in January 2013, when the Office of the Controller of the Currency issued a cease-and-desist order against JPMorgan Chase for deficiencies in its compliance systems, the bank responded by closing over 500 correspondent banking relationships and, according to one knowledgeable observer, it hasn't opened a correspondent banking relationship since.
Some terminations were desirable – that's the whole point of getting banks to do their own policing. The problem, though, is that among the thousands of correspondent relationships that have been terminated by global banks worldwide, the majority of them were ended without cause, simply as a matter of benefit-cost-risk analysis rather than for malfeasance on the part of the corresponding bank or its clients.
"Because of regulatory burdens, of course we have repositioned to the biggest clients in the biggest markets," acknowledged one banker. Moreover, because regulatory requirements change with some frequency and different jurisdictions impose different regulations, it is probably impossible for a global bank to be fully compliant with anti-money-laundering and combating-the-financing-of-terrorism regulations in its core banking businesses globally. This naturally heightens each bank's overall level of risk aversion.
It used to be that bankers would rely on personal experience and judgment to assess risks and then set fees commensurate to those risks. They would have confidence that as long as their banks performed the risk analysis with reasonable due diligence, mistakes could be defended. Now, though, in an environment of high reputational risk and high financial penalties, risk is increasingly eschewed, period. To put it another way, a system of risk avoidance has displaced a system of risk management. Douglas Flint, HSBC chairman, recently acknowledged as much, stating that there was "an observable and growing danger of disproportionate risk aversion creeping into decision-making in our businesses."
The fundamental issue lies in the reality that the payoff calculation for these business, and the individuals operating within them, is now akin to that of selling a put option: there is limited upside for success (the promised fee) and catastrophic downside for failure (including mega-fines and demotions). So, the bank examiner at the Office of the Comptroller of the Currency, the compliance officer at the bank and the banker who needs to get permission to do a deal all err on the side of caution, imposing a regulatory safety buffer around what they are willing to allow or undertake.
Everybody self-polices. As one senior banker explained, "the problem is that you have to go very far up the food chain to get to somebody who can make a thoughtful, nuanced decision if risk is involved, and there is a very small chance that somebody would be willing to stick their neck out for such a small piece of business. People would think I was weird if I did that."
That Baby And the Bathwater
Banks can still make money under such strictures. Indeed, in most industries facing tough regulation, some players (typically the very large ones) can thrive because the barriers to entry become more daunting and competition becomes less stiff. But profitability is hardly the proper measure of the societal value here. International banking and trade-finance systems are the lifeblood of the global economy, and the inability to participate in international finance can have major deleterious consequences for national banking systems, their clients and the countries in which they reside.
Note, moreover, that transactions in poor countries, post-conflict countries and already marginalized sectors pose the greatest risk to banks. But these are precisely the markets that depend most heavily on the services of international banks because their domestic banks are weakest. Africa is particularly vulnerable, for example, because it lacks solid financial systems and because its exports are disproportionately transacted in dollars.
Again, it's the U.S. dollar system that's critical, not the U.S. market. According to a SWIFT white paper, 39 percent of Africa's financial flows go through the United States, although only 9 percent of commercial flows do.
Global financial integration – of core banking services, securities services and in particular trade finance – is essential to the growth of emerging-market countries as well as to the decentralization of economic power within them – and their exclusion from the global financial system runs counter to the United States' broader goals of peaceful international cooperation, poverty alleviation and broad-based economic development.
For example, the United States has spent over $200 million per year in international aid to Liberia since a democratically elected government finally ended the brutal reign of warlord Charles Taylor (and funding levels have increased with the outbreak of Ebola in West Africa). Yet, at the same time, due to its small economic size and weak regulatory environment, Liberia is becoming financially isolated.
In 2007, the International Bank (Liberia) Limited (IBLL), Liberia's oldest and second-largest commercial bank, was acquired by a consortium of American and African investors, with a U.S.-owned entity taking the majority share. The new owners modernized the bank and increased its correspondent relationships to include Standard Chartered, Citibank, Commerzbank and Standard Bank, among others. But, beginning in 2012, the International Bank (Liberia) Limited's correspondent banks began exiting Liberia or closing its U.S. dollar accounts, or both.
In a memo last year to the bank's board, the associate director laid out the consequences for the bank:
Citibank was the first bank to close IBLL's account, citing the increased cost of doing business in non-presence countries. In 2013, Standard Chartered cited similar reasons for closing the bank's accounts. The bank shifted the majority of its U.S. dollar transactions to Commerzbank and Standard Bank, but in 2014, they also decided to close the dollar accounts of IBLL, citing the increased cost of compliance and the fear of U.S. regulatory action. Standalone banks like IBLL are increasingly unable to maintain correspondent banking relationships in U.S. dollars, which is leaving Liberia increasingly isolated and vulnerable.
Remittances from expatriate workers are another area of real concern, because many poor countries are so reliant on them. According to the World Bank, remittances this year will likely be three times the amount of official development assistance, reaching upwards of $450 billion. And the United States is, not surprisingly, the largest source of remittance funds globally. Transfers home make up about 20 to 30 percent of income in several of these countries and can range higher in conflict and post-conflict countries.
Indeed, recognizing the importance of these flows, the G20 made a formal commitment to reduce the transaction costs of remittances. But global banks are effectively undermining the effort by terminating their relationships with specialized money-transfer services in response to heightened regulation. The banks' logic is unassailable: money-transfer businesses put them in significant jeopardy. They often don't or can't distinguish licit from illicit flows because they serve the world's poorest, least institutionally developed countries and because they are not subject to the same regulatory requirements as banks. All of this has come together in a kind of financial tsunami for Somalia, a country on the Treasury Department's Office of Foreign Asset Control's sanctions list, where illicit flows of all kinds are high – but where remittances, which represent a startling 50 percent of Somali income, are vital to many families' survival.
De-risking is hampering international private aid, peacekeeping and charity efforts for similar reasons. These organizations need to conduct business in the world's riskiest, most marginalized places. But it is increasingly difficult for even well-established global charities to access banking services in countries where they are needed most – for example, in Syria. Last October the Financial Action Task Force (FATF), the international body overseeing the rules of terrorist finance and anti-money laundering, acknowledged the collateral damage:
What is not in line with the task force's standards is the wholesale cutting loose of entire classes of customer[s]. … The FATF expects financial institutions to identify, assess and understand their money-laundering and terrorist-financing risks and take commensurate measures in order to mitigate them.
This does not imply a "zero failure" approach. The FATF is committed to financial inclusion, and effective implementation of AML/CFT measures through proper implementation of the risk-based approach. [Emphasis added.]
Affected parties are beginning to fight back as well. In Britain, Dahabshiil, Africa's biggest remittances provider, won an injunction against Barclays after Barclays tried to shut its account over anti-money-laundering and combating-the-financing-of-terrorism concerns. But the agreement was just a stay of execution; Barclays was only forced to give Dahabshiil a transition period in which to make other arrangements. Similarly, in Australia, 20 remittance firms joined in a lawsuit against Australia's WestPac Banking Corp. to prevent it from exiting the remittance business, arguing that such a move would cripple them. Affected parties lament, in particular, the fact that there is no mechanism through which to plead for a reversal of a bank's decision. They are not legally entitled to some means of access to the global banking system, even if they can prove their hands are clean.
Because banks tend to share risk-information sources and because they monitor each other's decisions, being dropped by one correspondent bank sharply increases the difficulty of finding another. Worse, one expert relates, because global banks have closed their correspondent banking relationships in waves, "there is a kind of global gossip about which banks were dropped in which wave, with an assumption that if a bank was in the first wave it must be in the worst shape."
It's also worth noting that de-risking can boomerang, undermining intelligence-gathering and anti-money-laundering efforts. While it is true that forcing illicit flows out of the legitimate financial system has been the point of these efforts, the isolation of legitimate actors decreases the transparency and the integrity of the system, and its resistance to penetration by bad actors. A letter to shareholders from the International Bank (Liberia) Limited, for example, goes on to explain:
U.S. businesses active in Liberia, which include the likes of Exxon and Chevron, now are unable to bank with a U.S.-owned bank in Liberia, and are instead forced to bank with one of the Nigerian-owned banks, many of which have severe governance issues, but which are able to maintain their international correspondent relationships by using their African banking franchises to move funds from Liberia to another country and then transmit [and] clear the funds in the U.S.
U.S. authorities are aware of these risks. The U.S. Treasury's Financial Crimes Enforcement Network recently issued a statement to "reiterate expectations" regarding banking institutions' obligations toward money-services businesses under the Bank Secrecy Act, couching it, in part, in counterterrorism terms.
Currently, there is concern that banks are indiscriminately terminating the accounts of all MSBs, or refusing to open accounts for any MSBs, thereby eliminating them as a category of customers. …
Refusing financial services to an entire segment of the industry can lead to an overall reduction in financial sector transparency that is critical to making the sector resistant to the efforts of illicit actors. [Emphasis added.]
A Middle Way?
Banks argue that they are responsible to their shareholders to weigh the cost of compliance (high) against the business upside (low), and they don't appreciate the problematic policing role that has been foisted upon them. Jaspal Bindra, head of Standard Chartered's business in Asia, recently gave voice to that view, noting that when "we have a lapse we don't get treated like a policeman, we are treated like a criminal." For their part, U.S. authorities argue that banks are reading too much precedent into fines that were levied for egregious sanctions violations (and in the case of BNP Paribas, willful obstruction of justice).
* * *
The fundamental issue is one that's well understood by economists: the benefits of the international financial system can't be fully captured by the providers – and thus the system as a whole delivers less service than one would expect from an efficient market. Howard Mendelsohn, a former Acting Assistant Secretary of TFI, has outlined the broad contours of a practical way forward:
Institutions must have confidence that they can take a reasonable, risk-based approach, have their defenses penetrated from time to time and not trigger a punitive regulatory response. The way forward lies in resetting the regulatory framework in a way that produces greater transparency and standardization and creates the incentives for sustainable investment to understand and manage risk.
As concerned parties grope for a pragmatic middle, though, it is very much worth keeping in mind that there is more to security than deterring or catching the bad guys. With globalization, financial inclusion of both individuals and sovereign nations is critical to their economic prosperity. And, of course, prosperity is one of the most effective bulwarks against terrorism.