News

Federal and state regulators took different tacks Tuesday in penalizing Dubai-based Mashreq Bank for deliberately violating U.S. financial restrictions against Sudan on nearly 2,000 occasions beginning more than a decade ago.

The New York State Department of Financial Services, or DFS, imposed a $100 million penalty on the Dubai-based lender for helping banks and other firms in Sudan illegally route more than $4 billion through the U.S. financial system from 2005 to 2009, including by systematically omitting critical data from payment instructions.

Treasury’s Office of Foreign Assets Control and Federal Reserve also responded Tuesday by issuing a notice of violation and a cease-and-desist order against Mashreq, which not only do not carry fines, but praise the bank’s cooperation with U.S. authorities and ongoing remediation of the lapses.

Erich Ferrari, a sanctions attorney in Washington, D.C., told ACAMS moneylaundering.com in an email that the variances between DFS and the federal government’s respective approaches to Mashreq show different objectives.

“OFAC is interested in enforcing against actual violations, whereas DFS is enforcing against deficiencies in the compliance practices,” Ferrari wrote. “DFS went after Mashreq because they thought the conduct … needed to be public to warn other institutions, … while OFAC was likely interested in communicating all of the good things Mashreq had done to remediate its behavior.”

The scheme

In a 22-page consent order published Tuesday, DFS found that from January 2005 to February 2009, Mashreq Bank’s branch in London abused “the cover payment method” to disguise Sudan’s links to more than 1,700 transactions, most of which involved Nile Mashreg Bank, also known as Blue Nile, a private lender based in Khartoum.

Mashreq’s staff in London “purposefully failed” to identify the originating or beneficiary institution in MT 202 payment messages, and thus tricked the New York branch of an unspecified international bank into processing the underlying transactions for Sudan despite the country’s designation at that time as a state sponsor of terrorism by the U.S.

The Office of Foreign Assets Control, or OFAC, began lifting banking restrictions against Sudan in January 2017 and the State Department rescinded the nation’s designation as a terrorist state in December 2020.

“Because Blue Nile used Mashreq London to transfer funds to Blue Nile accounts at other non-U.S. banks, Mashreq simply sent another MT 202 to the bank making the final payment,” DFS found. “However, this MT 202 functioned like an MT 103 and fully identified the prohibited parties to the transaction.”

The Society for Worldwide Interbank Financial Telecommunication, or SWIFT, a Belgium-based consortium of global lenders, designed the MT 202 payment messages to handle bank-to bank payments and the MT 103 for customer-to-customer transactions.

“The originator and beneficiary information would be contained only in a separate bank-to-bank payment message … sent by Mashreq directly to the ultimate beneficiary bank,” DFS disclosed Tuesday. “The bank making the final payment … was a foreign bank, so that it could complete the OFAC-prohibited payment without necessarily violating U.S. law.”

Standard Chartered, Commerzbank, Societe Generale, Deutsche Bank and other global lenders have paid billions of dollars in penalties over the past 12 years for using similar methods to route impermissible payments through the U.S. financial system without raising alerts.

On several occasions, Mashreq’s employees in London deliberately tricked their coworkers in New York into enabling Sudan to send payments through the U.S. that should have been rejected, blocked or frozen.

“When Mashreq’s … correspondent account with a [U.S.] bank lacked the funds necessary to effectuate the transaction, the New York branch received an MT 202 from Mashreq London instructing it to transfer funds for further credit to the correspondent account requiring replenishment,” DFS claimed.

As with the other transactions, Mashreq London sent MT 202s to Mashreq in New York that showed no connection to Sudan so that staff would unknowingly clear the funds.

The origins

Mashreq’s failures to comply with U.S. sanctions ran long and deep.

The bank began concealing Sudan’s illicit, indirect use of U.S. correspondent services before 2001 despite having policies in place that recognized OFAC’s jurisdiction over the lender’s branch in New York, according to DFS.

“Bank procedures required employees to populate “Mashreqbank” as the ordering institution in the relevant field of the SWIFT payment message, instead of identifying the actual Sudanese ordering institution,” state regulators wrote in the consent order. “In addition, employees were to use ‘self’ as the ordering customer instead of the actual customer of the Sudanese institution.”

Mashreq tweaked its procedures for handling potentially problematic transactions in May 2001 after U.S. employees raised concerns over the incomplete messages.

“Future payment instructions … must contain [identifying information for both the originator and beneficiary],” a New York-based compliance officer wrote in a “strongly worded email” to the head office in April 2001. “Not doing so is a direct violation of [the Bank Secrecy Act].”

Mashreq subsequently banned direct transactions from blacklisted individuals and entities to beneficiaries in the United States, while at the same time instructing employees to channel “all other” potentially illegal transactions through an unspecified Swiss bank.

For those transactions, Mashreq directed staff to omit the names of the ordering institutions from the optional field 52 of the MT 202 to fool the Swiss bank into thinking the payments originated from Mashreq instead of Sudan, according to DFS.

The bank then incorrectly interpreted a legal opinion by a U.S. attorney as confirming the validity of its policy that as a non-U.S. financial institution, it could route Sudan-linked, U.S.-bound transactions through Switzerland without violating sanctions.

Managers and compliance staff in New York, London and Dubai over the next eight years engaged in an on-again, off-again discussions on the controls Mashreq needed to move Sudanese funds through the United States, and whether continuing to do so was advisable or even legal.

The end

In January 2009, a second unidentified Swiss bank through which Mashreq had funneled the prohibited Sudanese payments for three years rejected one such transaction for the first time, just one day before news emerged that New York state prosecutors were investigating the Alpine lender for allegedly violating U.S. sanctions.

“Upon learning this news, Mashreq officials decided to close all USD [U.S. dollar] accounts held by Sudanese banks with Mashreq,” DFS found. “Although the last Mashreq account held by a Sudanese bank was not closed until June 2013, it was frozen effective February 2009 and processed no transactions between February 2009 and its closing.”

Despite knowing of the lapses for several years, executives at Mashreq Bank did not report them to DFS until after OFAC subpoenaed the lender in 2015.

From 2010 and 2014, Mashraq separately handled 91 additional prohibited payments worth a combined $2.5 million that showed less obvious connections to Sudan, such as payments involving Sudanese parties based outside of the country.

Tuesday’s consent order marks the second time in three years that DFS has tagged Mashreq with a large penalty for compliance-related failures.

In October 2018, the bank landed a $40 million fine after consecutive examinations by the state regulator unearthed a backlog of thousands of unprocessed transactional alerts, many of which involved customers in high-risk jurisdictions.

In a substantially shorter finding Tuesday, OFAC determined that Mashreq had acted “recklessly” by helping Sudan evade U.S. sanctions and that senior employees in key branches of Mashreq knew of the illegal scheme.

But OFAC also credited Mashreq for cooperating with investigators, making significant investments in compliance since at least 2007 and ceasing nearly all prohibited dealings in 2009, six years before the agency’s inquiry began.

OFAC further acknowledged in the 3-page finding that it refrained from imposing a fine on Masheq after the lender waived the statute of limitations on the violations in question, which would otherwise have prohibited the agency from bringing any enforcement action at all.

While institutions often enter into “tolling” agreements that suspend the deadline by which OFAC must bring an enforcement action, a full waiver of the statute of limitations is possibly unprecedented, said Jeremy Paner, a former sanctions investigator with the agency.

“OFAC considers tolling a mitigating factor because it stops the clock,” said Paner, now with the Squire Patton Boggs law firm in Washington, D.C. “So you may want to toll three, four times, but eventually you can just say no, and then the violations that occurred five years prior start dropping off.”

In a cease-and-desist order, the Federal Reserve separately gave Mashreq 90 days to outline how it intends to assess its sanctions-related risks more effectively going forward, and empower staff to flag and escalate suspected violations. The 8-page order also permanently bans Mashreq from employing any individual who participated in the 15-year-old misconduct.

The federal government’s decision not to fine Mashreq probably does not mark an especially significant departure from DFS, which in years past has tagged banks with much larger penalties for the same types of infractions, said Brian O’Toole, a former senior official OFAC official.

“The cease-and-desist order from the Fed is a pretty big deal independent of any fines, since it puts restrictions on Mashreq,” said O’Toole, now with the Atlantic Council in Washington, D.C.

Contact Valentina Pasquali at vpasquali@acams.org