Industrial Bank of Korea Reaches $86 Million AML Resolution with DOJ, NY Attorney General, and NY DFS

On April 20, 2020, the U.S. Department of Justice (“DOJ”), the New York Attorney General (“NY AG”), and the New York State Department of Financial Services (“DFS”) announced a $86 million resolution with Industrial Bank of Korea (“IBK”) in connection with criminal violations of the Bank Secrecy Act (“BSA”) and violations of New York’s banking laws.[1] The resolution includes a two-year deferred prosecution agreement with the U.S. Attorney’s Office for the Southern District of New York (“SDNY”), a federal civil forfeiture of $51 million, a non-prosecution agreement with the NY AG, and a $35 million consent order with the DFS.[2] IBK is headquartered in South Korea with approximately $242 billion in global assets and has a New York branch (“IBKNY”) licensed by DFS.[3]

The matter relates to a scheme by Kenneth Zong, a U.S. citizen, who opened a small business account at an IBK branch in South Korea in 2011. Along with primarily Iranian co-conspirators, he allegedly circumvented U.S. sanctions by setting up shell companies in Korea and Iran and creating fictitious contracts, bills of ladings, and invoices to submit to IBK and other Korean banks, in order to transfer over $1 billion (USD) unlawfully to Iranian-controlled entities.[4] The transactions—which took place from January 2011 to July 2011—were largely processed through New York banks, including $10 million through IBKNY.[5] The funds were originally held in IBK’s Won-denominated restricted account, which was used for lawful trade with Iran.[6] Zong was prosecuted in South Korea and was indicted by the DOJ in 2016 for sanctions and money laundering violations.[7] 

The resolution is notable for providing insight (which has been limited so far) into DFS Superintendent Lacewell’s approach to financial crimes enforcement matters. Further, although DFS’s consent order is based on the branch’s failure under New York banking law to maintain an effective AML program and maintain accurate books and records, the order notes that the branch was faulted by a DFS examination for certifying its compliance with DFS’s Part 504 regulation despite deficiencies in the branch’s BSA/AML program; according to the DFS, the fact that the branch had put remediation plans in place was not sufficient. As far as we are aware, this order marks the DFS’s sole public statement of its views on Part 504 in recent times. DFS-regulated banks may wish to consider these views as they approach the upcoming, delayed certification deadline. Finally, the NY AG’s involvement in AML-related bank investigations is unusual and may indicate the NY AG’s growing interest in asserting itself in this space.

DOJ Deferred Prosecution Agreement

The SDNY charged IBK with violating the BSA by willfully failing, for the period from 2011 to 2014, to establish, implement, and maintain an adequate BSA/AML compliance program at IBK’s New York branch.[8] The SDNY stated that this failure permitted the processing of more than $1 billion in U.S. dollar transactions in violation of U.S. sanctions against Iran. Of that amount, $10 million was processed through IBKNY. According to the SDNY, as a result of IBKNY’s ineffective BSA/AML compliance program—including the lack of an automated transaction monitoring system—it failed to detect and report the illegal transactions until five months after they occurred. The SDNY also noted that, even after IBKNY reported those transactions, IBK failed to self-report the remaining $990 million to the authorities.[9] As part of its deferred prosecution agreement (“DPA”), IBK admitted to a statement of facts,[10] including:

• From at least 2006 until January 2013, IBKNY’s process for transaction monitoring was manual, even though regulators, IBKNY’s sole full-time Compliance Officer, and IBKNY’s internal auditor flagged deficiencies in this manual review process and the need to immediately enhance the branch’s transaction monitoring system with additional resources. No action was taken by the branch manager or the head office.[11]
• In 2010 and 2011, the Compliance Officer requested additional professional compliance staff for the branch, yet no meaningful action was taken by IBKNY senior leadership.[12]
• Although the first of the Zong transactions was processed by IBKNY as a correspondent bank for IBK on February 10, 2011, it was not until July 20, 2011 that a subset of the transactions were flagged as suspicious, based on their frequency and dollar amounts.[13]

The SDNY noted that after IBK was alerted to investigations by the SDNY and the NY AG in May 2014, it cooperated with those investigations.[14] The SDNY also stated that IBK, including both the head office and the New York branch, made significant efforts to remediate its BSA/AML programs including by enhancing its governance structure, hiring a new IBKNY Compliance Officer, and implementing a new compliance testing program.[15] As part of the two-year DPA, IBK agreed to pay a $51 million civil forfeiture, refrain from all future criminal conduct, implement remedial measures, and provide semi-annual reports.[16]

NY AG Non-Prosecution Agreement

According to its press release, the NY AG conducted an independent six-year investigation alongside the SDNY and also found that IBK had willfully failed to establish, implement, and maintain an adequate BSA/AML compliance program at its New York branch, which contributed to IBK’s failure to prevent Zong’s billion-dollar fraud.[17] The NY AG Crime Proceeds Strike Force began investigating IBK in 2014 for money laundering and bank fraud related to prohibited transactions with Iran.[18] The NY AG’s non-prosecution agreement (“NPA”) with IBK is not available on its website.

The involvement of the NY AG in an AML-related bank investigation is unusual and may signal a growing interest by the NY AG in playing an enforcement role in this arena.

DFS Consent Order

The DFS determined that IBK and IBKNY “allowed serious deficiencies in the New York Branch’s Bank Secrecy Act/Anti-Money Laundering (“BSA/AML”) compliance programs that persisted over multiple examination cycles from as early as 2010.”[19] In particular, the DFS noted that, despite warnings in 2010 and 2011 by IBKNY’s Deputy General Manager and Compliance Officer of the need to increase compliance staff and update its antiquated software system that caused unreasonable delays in the transaction review process, the bank failed to timely address these warnings.[20] As a result, IBKNY relied on a deficient manual transaction monitoring system until 2013, when it finally commenced the use of an automated system. [21]

The DFS faulted both the head office’s and New York branch’s compliance practices. According to the DFS, IBK’s “inadequate and cumbersome compliance program” and failure to train employees on the permissible and impermissible uses of IBK’s restricted account resulted in IBK’s failure in 2011 to identify and prevent Zong’s fraudulent scheme.[22] IBKNY’s manual review of suspicious activity also failed to identify Zong’s “clear deviation from his expected banking activities” and failed to detect “patterns of inappropriate transactions” such as Zong’s large transfers of money within a short period.[23]

Even after discovery of the fraud in 2011, IBKNY’s BSA/AML compliance program did not improve and was repeatedly cited for a number of failings, including:

• serious delays with IBKNY’s implementation of its automated transaction monitoring system;[24]
• lack of a comprehensive approach to developing clear transaction monitoring rules;[25]
• significant delay in reviewing alerts generated by IBKNY’s new automated transaction monitoring system;[26]
• failure of IBKNY’s compliance committee to conduct effective oversight and elevate problems to the head office;[27]
• failure to incorporate trade finance reimbursements into the automated transaction monitoring system,[28] and
• lack of holistic analysis of foreign correspondent bank customers. [29]

As a result, in February 2016, the DFS and the Federal Reserve Bank of New York entered into a written agreement with IBK and IBKNY (the “Written Agreement”) that required them to develop plans and programs to make various enhancements at the branch, including corporate governance and management oversight, the BSA/AML compliance program, suspicious activity monitoring and reporting, and OFAC compliance.[30]

The DFS credited substantial improvements by IBKNY in parts of its compliance program between 2016 and 2018, but noted that subsequent examinations found that IBK and IBKNY’s compliance with the Written Agreement and BSA/AML laws and regulations had declined even further.[31] Four examinations from 2016 to 2019 revealed that:

• “Although [IBK and IBKNY] had engaged several consultants to help address issues in [their] compliance program, [they] had failed to adequately address issues identified in prior examinations or implement corrective measures required by the Written Agreement.”[32]
• IBK “(a) used stale data to tune its transaction monitoring system; (b) relied on testing scenarios that did not produce productive alerts; (c) relied on a suspicious activity monitoring program that was unable to flag multiple scenarios within one alert; (d) lacked sufficient documentation to support closure of alerts, particularly for transactions processed on behalf of the Bank’s home office; (e) lacked effective management oversight over the compliance program; (f) conducted inadequate testing; and (g) failed to adequately document the disposition of OFAC alerts.”[33]
• IBKNY appointed a BSA Compliance Officer with “no prior experience in that role and limited experience with transaction surveillance and AML audit testing,” and therefore was not qualified to lead the IBKNY effort to meet the requirements of the Written Agreement.[34]
• IBK and IBKNY failed to remediate issues relating to BSA/AML risk assessment, internal audit validation, training, OFAC alert disposition, quality control, and escalation of aging reports, which were identified in prior examination.[35]
• IBK and IBKNY failed to adequately document how it addressed a risk scenario gap analysis required by a prior exam.[36]

Notably, the 2018 examination found IBKNY not to be in compliance with DFS’s Part 504 regulation,[37] despite having certified in April 2018. The DFS noted that a consultant retained by IBKNY to assess certain BSA/AML and OFAC program elements identified a number of gaps. Although IBKNY developed a remediation plan to address these gaps, that plan was not fully implemented at the time the certification was filed.[38] The DFS cited to one of its Part 504 FAQs, which states: “The Department expects full compliance with the regulation. A Regulated Institution may not submit a certification under 3 NYCRR 504.7 unless the Regulated Institution is in compliance with the requirements of Part 504 as of the effective date of the certification.”[39]

This discussion of Part 504 marks the DFS’s first public written statements on the topic in some time. Despite noting that the branch improperly certified, the consent order does not cite IBKNY for a violation of Part 504.

The DFS’s 2019 examination found IBKNY to be compliant with the Written Agreement and to have remediated previously-identified deficiencies. However, the consent order stated that “[w]hile the Department applauds the Bank for its ultimate efforts after eight examination cycles of noncompliance, one positive examination report does not equate to a sustainable, safe and sound financial institution.”[40] The DFS deemed it “necessary and appropriate to ensure IBK and the New York Branch’s continued commitment to maintain both an effective and sustainable compliance program that addresses BSA/AML laws, regulations and requirements.”[41] It did, however, recognize “the Bank’s very substantial cooperation during the course of the Department’s extensive, long-term investigation” and gave “substantial weight to the commendable conduct of the Bank” when determining the terms and remedies of the consent order, “including the amount of the civil monetary penalty imposed.”[42]

The consent order cites violations of New York Banking Law 200-c for failure to maintain appropriate books, accounts, and records reflecting all transactions and actions, and 3 N.Y.C.R.R. § 116.2 for failure to maintain an effective and compliant AML program.[43] In addition to a $35 million penalty, IBK and IBKNY must submit status reports and quarterly updates for a two-year period regarding the branch’s BSA/AML compliance program, suspicious activity monitoring and reporting, and customer due diligence, as well as IBK and IBKNY’s corporate governance and management oversight.[44] Notably, the DFS did not impose a monitor or independent consultant.

We will continue to monitor AML and sanctions developments and look forward to providing you with further updates.

                                                                                                                        *      *      *

[1]      U.S. Dep’t of Justice, Press Release, Manhattan U.S. Attorney Announces Criminal Charges Against Industrial Bank Of Korea For Violations Of The Bank Secrecy Act (Apr. 20, 2020), available here (“DOJ Press Release”); N.Y. Attorney General, Press Release, Attorney General James Announces Agreement with Industrial Bank of Korea Related to Illegal Transfer of Over $1 Billion to Iran (Apr. 20, 2020), available here (“NY AG Press Release”); N.Y. Dep’t of Fin. Servs., Press Release, DFS Superintendent Linda A. Lacewell Announces Industrial Bank of Korea to Pay $35 Million to New York State for Violations of New York Anti-Money Laundering and Recordkeeping Laws (Apr. 20, 2020), available here (“DFS Press Release”).

[2]      Id.; Jonathan Stempel, Industrial Bank of Korea settles U.S., New York criminal probes over $1 billion Iran transfer, Reuters (Apr. 20, 2020), available here.

[3]       N.Y. Dep’t of Fin. Servs., Consent Order Under New York Banking Law §§ 39 and 44 at 1 (Apr. 20, 2020), available here (“DFS Consent Order”).

[4]      Id. at 4-5; DOJ Press Release.

[5]      Id.; DFS Consent Order at 5.

[6]      DFS Consent Order at 5.

[7]      Zong’s indictment is discussed in our year-in-review memo, available here.

[8]      DOJ Press Release.

[9]      Id.

[10]     U.S. Dep’t of Justice, Industrial Bank of Korea - Deferred Prosecution Agreement, Exhibit C (Statement of Facts) (Apr. 13, 2020), available here (“DOJ Deferred Prosecution Agreement, Statement of Facts”).

[11]     Id. at 4-6.

[12]     Id. at 6-7.

[13]     Id. at 11-12.

[14]     Id. at 14.

[15]     Id. at 15.

[16]     U.S. Dep’t of Justice, Industrial Bank of Korea - Deferred Prosecution Agreement (Apr. 13, 2020), available here.

[17]     NY AG Press Release.

[18]     Id.

[19]     DFS Consent Order at 1-2.

[20]     Id. at 4.

[21]     Id. at 3; DOJ Press Release.

[22]     DFS Consent Order at 5.

[23]     Id.

[24]     Id. at 6.

[25]     Id.

[26]     Id.

[27]     Id.

[28]     Id. at 6-7.

[29]     Id. at 7.

[30]     Id.

[31]     Id.

[32]     Id. at 8.

[33]     Id.

[34]     Id. at 8-9.

[35]     Id. at 9.

[36]     Id.

[37]     See Banking Division Transaction Monitoring and Filtering Program Requirements and Certifications, 3 N.Y.C.R.R. § 504 (2017) ("Part 504").

[38]     DFS Consent Order at 10.

[39]     Id.

[40]     Id. at 11.

[41]     Id. at 2.

[42]     Id. at 11.

[43]     Id.

[44]     Id. at 12-16.