Build a Watch List of Precedent Cases for Every High-Risk Customer Category You Serve

A customer category with a documented history of money laundering or financial crime exploitation does not become less risky simply because your institution has not yet experienced an incident involving that category.

That is one of the most important lessons compliance teams can take from the Wachovia case.

The question is not whether your institution has already experienced the same failure.

The question is whether another institution has already shown you how that failure can happen.

Learn From a Case That Was Not Yours

Compliance teams should maintain a living reference of enforcement actions connected to every high-risk customer category they serve.

This could include:

• Currency exchange houses • Precious metals and stones dealers • Correspondent and respondent banks • Money services businesses • High-risk jurisdictions • Real estate businesses • Other customer categories identified through the institution's risk assessment

The list should not simply record the name of the institution, the regulator, and the penalty.

It should capture what actually went wrong.

What customer type was involved?

What products or services were used?

What transaction patterns were identified?

Which controls failed?

What information was available but not acted upon?

And, most importantly, could the same mechanism exist within your own customer base?

The Mechanism Matters More Than the Penalty

An enforcement action should not become relevant only because the penalty is large.

The underlying mechanism may be far more valuable than the dollar amount.

A smaller enforcement case can provide an early warning of a much larger failure that occurs years later.

That is exactly why precedent cases should be incorporated into the institution's risk management process.

When a regulator identifies a specific weakness involving a customer category your institution also serves, the appropriate response is not simply to record the case.

The institution should ask:

"Do we have the same exposure?"

If the answer is potentially yes, the relevant controls should be reviewed before the same weakness develops internally.

A Smaller Case With the Same Mechanism

The Wachovia case provides a useful example.

Between 2004 and 2007, Wachovia processed transactions for Mexican currency exchange houses without applying the level of scrutiny required by its own policies.

According to the U.S. Department of Justice, at least $110 million in drug trafficking proceeds moved through the bank through bulk cash transactions and wire transfers connected to these exchange houses. Some of the funds were also connected to aircraft later used to transport cocaine.

In March 2010, Wachovia, which had subsequently been acquired by Wells Fargo, entered into a deferred prosecution agreement and agreed to pay $160 million.

The case exposed a specific risk mechanism involving customers connected to Mexico and weaknesses in the controls applied to those relationships.

Two years later, a similar mechanism appeared on a much larger scale in the HSBC case.

HSBC faced allegations involving inadequate AML controls and the handling of transactions connected to Mexico and other high-risk environments. The resulting settlement reached approximately $1.921 billion.

The lesson is not simply that one case involved $160 million while another involved nearly $2 billion.

The deeper lesson is that the warning existed before the larger case arrived.

Your EDD Protocol May Already Be Outdated

This creates an important question for every compliance function:

When was the last time your enhanced due diligence process was reviewed against an actual enforcement case involving the customer categories you serve?

If the answer is "we have not reviewed it since the last major case," there may already be a gap.

Generic EDD questionnaires and standard risk-rating procedures cannot capture every risk mechanism.

A currency exchange house, a precious metals dealer, a correspondent bank, and a real estate business can present very different vulnerabilities.

Their EDD should reflect those differences.

If an enforcement case identifies a particular weakness in one category, that weakness should become a consideration in the institution's own control framework.

For example:

If a precedent case identifies unusual bulk cash activity as a key vulnerability, should your EDD process specifically examine the customer's cash profile and expected transaction behaviour?

If the case identifies unexplained third-party payments, does your customer review process adequately address third-party funding?

If the case highlights a particular geographic exposure, is that geography properly reflected in your risk assessment?

The objective is not to copy another institution's controls.

It is to learn from another institution's failure.

Turn Enforcement Cases Into Control Improvements

A strong precedent-case watch list should ultimately connect directly to your AML/CFT framework.

For each relevant enforcement action, compliance teams can document:

1. Customer Category Which high-risk customer type was involved?

2. Risk Mechanism How was the financial crime risk actually carried out?

3. Control Failure Which AML/CFT control failed or was insufficient?

4. Warning Indicators What red flags could have identified the activity earlier?

5. Internal Exposure Do similar customers, products, jurisdictions, or transaction patterns exist within your institution?

6. Control Response Does your current KYC, EDD, transaction monitoring, or case management process address the identified risk?

7. Review Date When was the relevant control last reviewed?

This turns enforcement cases from historical information into practical compliance intelligence.

Make the Watch List Part of the Risk Assessment

The watch list should not sit in a forgotten compliance folder.

It should become part of the institution's periodic risk assessment and control review process.

When new enforcement actions are published, compliance teams should determine whether they affect:

• Customer risk classifications • EDD requirements • KYC documentation • Transaction monitoring scenarios • Alert thresholds • Geographic risk assessments • Customer onboarding procedures • Periodic reviews • Training requirements

This creates a feedback loop between external regulatory experience and internal control design.

Do Not Wait for Your Own Enforcement Case

One of the most expensive mistakes in compliance is treating enforcement actions as stories about other institutions.

They are also warning signals.

Your institution does not need to experience the same incident before taking the lesson seriously.

If another financial institution has already demonstrated how a particular customer category can be exploited, that information is available to you before the risk reaches your own organization.

The goal of a mature AML/CFT function is not simply to respond when a problem appears.

It is to identify patterns early and strengthen controls before those patterns become an internal incident.

The Practical Takeaway

Build a precedent-case watch list for every high-risk customer category your institution serves.

Keep it updated.

Review it during your periodic risk assessment.

Map the cases to your customer types, products, jurisdictions, transaction patterns, and controls.

And when a new enforcement action appears, ask one simple question:

"Could the same mechanism happen here?"

Because the next major enforcement case may not introduce a completely new risk.

It may simply be a larger version of a risk that the industry has already been warned about.

Official Sources

U.S. Department of Justice, Wachovia Enters into Deferred Prosecution Agreement, March 17, 2010.

U.S. Senate Permanent Subcommittee on Investigations, U.S. Vulnerabilities to Money Laundering, Drugs, and Terrorist Financing: HSBC Case History, July 2012.