HSBC Bank plc
FCA enforcement action, 2021
What failed
Automated transaction monitoring was deficient across several business lines, with weak scenario coverage and data-quality gaps.
Read the final noticeTurn this case into work
These actions save into your workspace. The first click creates a free, anonymous workspace for you; nothing is created until then.
Log an incident from this case
Start an incident record pre-linked to this enforcement case as its source.
Log an incidentCreate a control change
Adds the control to your workspace if it isn't already there, then opens a pre-filled change proposal referencing this case.
Add to a product risk assessment
Start a PRA with 4 case-specific typologies pre-selected.
Go to product risk assessmentCreate a follow-up action
The controls that would have caught it
These controls map directly to this failure. Open any one in the Control Builder to set your own thresholds, owners and systems, then export an implementation-ready spec.
In short, the firm needed
- Comprehensive monitoring scenario coverage
- Regular scenario tuning and gap analysis
- End-to-end data-quality assurance
- Independent assurance over monitoring effectiveness
Transaction-Monitoring Scenario Coverage Assurance
DetectiveTransaction Monitoring
Checks that the firm's monitoring rules actually cover the risks the firm faces, so no major money-laundering pattern is left with no rule watching for it.
- Starting threshold:
- Zero unmapped assessed risks and zero in-scope product/channel populations missing from TM data feeds; any single coverage gap is an exception requiring a remediation plan with an owner and date.
- First-line owner:
- TM / Detection Engineering Lead (scenario estate owner)
Transaction-Monitoring Threshold Tuning
CorrectiveTransaction Monitoring
Regularly tests and adjusts monitoring rule settings so the firm catches real risk without drowning analysts in pointless alerts, with evidence for every change.
- Starting threshold:
- Trigger a tuning review for any scenario whose true-positive yield falls below 5% (over-alerting) or whose below-the-line sample shows any productive (SAR-worthy) activity in the just-missed band (under-alerting); each change requires simulated impact and documented sign-off.
- First-line owner:
- TM Optimisation / Detection Engineering Analyst
Independent Assurance & Control Testing
DetectiveGovernance & Reporting
People independent of the day-to-day teams regularly test whether financial crime controls actually work, so weaknesses are found internally before a regulator finds them.
- Starting threshold:
- A risk-based assurance plan covering all high-residual-risk controls at least annually (lower-risk controls on a multi-year rotation); sampling sized to a defensible confidence level; every finding rated, owned, dated and re-tested at closure; no high-severity finding closed without independent verification.
- First-line owner:
- Control owners (remediate findings); first-line QA where it performs in-line checking
Typologies behind this case
Related enforcement cases
Next steps
Enforcement data is sourced from the FCA fines dataset. The control mapping is an analyst view of what would have addressed the failings described in the public notice, not a statement of the regulator's findings.