Every case below starts from what a regulator, a court or a prosecutor recorded, and states only the costs that record states. Each then names the kind of check that tests for the same weakness, and what that check could not have caught. None says that any check would have prevented what happened.
Five cases, each with its primary source.
Airbus: what a company declares about its agents, and what it pays them#
What happened. On 31 January 2020 the President of the Queen's Bench Division, Dame Victoria Sharp, approved a deferred prosecution agreement between the Serious Fraud Office and Airbus SE. The indictment has five counts of failing to prevent bribery, under section 7 of the Bribery Act 2010, between 1 July 2011 and 1 June 2015. Four concern the purchase of aircraft by airlines in Malaysia, Sri Lanka, Taiwan and Indonesia; the fifth, the purchase of military transport aircraft by the Government of Ghana.
The matter surfaced through export credit. On 24 April 2015 UK Export Finance wrote to Airbus about its due diligence on agents, and noted that UKEF must report suspicious circumstances to the SFO. Airbus reviewed its declarations on the use of business partners in export credit applications, and reported issues to UKEF in January and March 2016. Airbus and UKEF both reported to the SFO on 1 April 2016, and the SFO opened a criminal investigation on 15 July 2016.
Airbus collected more than 30.5 million documents from over 200 custodians, and used predictive coding to prioritise them.
What it cost, on the record. €990,963,712 to the SFO, including costs: disgorgementTaking back a profit somebody made from breaking the rules. It strips the gain; it is not a fine, so no profit means no payment. of profit of €585,939,740 and a penalty of €398,034,571. The penalty carries a 50 per cent discount, which the court gave for the equivalent of a guilty plea and for Airbus's cooperation and remediation. With the parallel French and US resolutions, the total exceeds €3.5 billion. The agreement runs for three years; if its terms are met, the proceedings are discontinued.
What tests for it. A reconciliation of what a company declares about its agents and intermediaries, to export credit agencies, lenders and others, against the contracts and payments behind those declarations. It is run when someone the company relies on asks about its agents, as UKEF did here.
What that check could not have caught. It shows where declarations and payments do not match. It cannot establish that anyone was bribed; that took a joint investigation by the SFO and France's Parquet National Financier. Nor can it decide whether a company reports what it finds.
Where this sits in a matter. Collection: every item logged on arrival, with where it came from and whether it is complete. How a matter runs
Source: Director of the Serious Fraud Office v Airbus SE, approved judgment, Crown Court at Southwark, 31 January 2020, paras 1–2, 31–33, 36, 39–52 and 112.
Swedbank: what a board is told, and what it does with it#
What happened. On 19 March 2020 Sweden's financial supervisor, Finansinspektionen, issued Swedbank AB a warning and an administrative fine. Its investigation covered the bank's governance and control of anti-money-laundering work in its Estonian, Latvian and Lithuanian subsidiaries from 2015 to the first quarter of 2019.
Non-resident customers were a significant share of the subsidiaries' transaction volumes, and the subsidiaries classified a large part of them as high risk; the supervisor found that large parts of the subsidiaries' operations had been exposed to an elevated risk of money laundering. It found that from 2016 the bank's management, chief executive and board repeatedly received information about deficiencies in the central parts of that work, and did not take sufficient action. It also found that the bank did not fully provide information the supervisor requested, in this investigation and in two earlier cases, and that in March 2019 it gave the supervisor false information.
The supervisor did not investigate whether, or to what extent, money laundering took place in the Baltic subsidiaries.
What it cost, on the record. An administrative fine of SEK 4,000,000,000, with a warning. The supervisor considered withdrawing the bank's authorisation and decided a warning was enough, because the bank was making extensive changes.
What tests for it. A review of the group's exposure that starts from the transaction data, not from the reporting the board already receives: which customers drive the volumes, how the subsidiaries classify them, and whether the group's own risk assessment matches what the subsidiaries record. It is run when a group's reporting on a high-risk business looks reassuring and the volumes do not.
What that check could not have caught. It tests what the data shows. It cannot make a board act on what it is told, and the supervisor's central finding was that the board was told, repeatedly. Nor can it test a statement the bank later makes to its supervisor.
Where this sits in a matter. Collection and organisation: the source log and the entity-and-timeline map. How a matter runs
Source: Finansinspektionen, decision of 19 March 2020 (FI Ref. 18-21044, 19-7504), Summary, pp. 1–3.
FTX: what a platform says about customer money, and what it does with it#
What happened. On 28 March 2024 Samuel Bankman-Fried, founder of the cryptocurrency exchange FTX and the trading firm Alameda Research, was sentenced by US District Judge Lewis A. Kaplan. After a one-month trial he had been found guilty of two counts of wire fraud and five conspiracy counts, including conspiracy to commit money laundering. The Department of Justice records that he repeatedly told customers, investors and the public that customer deposits were held safe, in custody and separate from company assets, and that Alameda had no privileged access to FTX. Those statements were false.
Billions of dollars of customer deposits went from FTX to Alameda. He directed co-conspirators to alter FTX's code so that Alameda could withdraw effectively unlimited amounts of cryptocurrency, and directed false financial statements for Alameda's lenders.
What it cost, on the record. 25 years in prison, three years of supervised release and forfeiture of $11 billion. The US Attorney put the customers' money taken at over $8 billion; investors in FTX were defrauded of more than $1.7 billion and lenders to Alameda of more than $1.3 billion. The judge authorised the use of forfeited funds to compensate victims.
What tests for it. A reconciliation of a platform's assets, on-chain and off, against what it owes its customers, with a review of the access any affiliated trading firm has to the platform's systems. It is run on a schedule, and whenever someone relies on what the platform says about custody.
What that check could not have caught. It shows whether assets cover liabilities on the day it is run, and what access an affiliate has. It cannot prove that statements made to customers and investors were deliberately false; that was proved at trial. Nor does a check run on one day say anything about the days between runs.
Where this sits in a matter. Organisation and analysis: one entity-and-timeline map, and the question tested against the evidence. How a matter runs
Credit Suisse and Archegos: what risk monitoring flagged, and what was done about it#
What happened. On 24 July 2023 Switzerland's financial supervisor, FINMAThe Swiss Financial Market Supervisory Authority. It licenses firms, inspects them and can shut them down — but it cannot fine anyone., found that Credit Suisse had seriously and systematically violated financial market law in its business relationship with the family office Archegos. In March 2021 the bank's own position from that relationship was worth USD 24 billion: four times its next largest hedge fund client's, and more than half the equity of Credit Suisse Group AG.
The members of the executive board were not informed of the facts. Risk monitoring regularly showed that limits had been exceeded, but the employees responsible acted in the client's favour, the overruns were insufficiently challenged, and the limits were raised repeatedly. Two weeks before Archegos collapsed, the bank paid it USD 2.4 billion under their contract; FINMAThe Swiss Financial Market Supervisory Authority. It licenses firms, inspects them and can shut them down — but it cannot fine anyone. found no indication that the bank examined not paying, suspending the payment until more collateral was provided, or offsetting it.
What it cost, on the record. FINMAThe Swiss Financial Market Supervisory Authority. It licenses firms, inspects them and can shut them down — but it cannot fine anyone. records that Credit Suisse suffered the biggest loss, of over USD 5 billion. It ordered measures against Credit Suisse AG and against UBS Group AG, as legal successor to Credit Suisse Group AG. Limits on own positions with individual clients now apply across the whole group. For staff with particular risk exposure, the risks taken are assessed before a bonus is set. It opened separate proceedings against a former Credit Suisse manager. The Federal Reserve Board and the Prudential Regulation Authority imposed fines of USD 268.5 million and GBP 87 million.
What tests for it. A review of one client's exposure, assembled from every part of the bank that holds it, against the limits set for that client, with a record of each limit breach and what was done about it. It is run when the same client's limits keep being raised.
What that check could not have caught. It sees only the bank's own book; it cannot see what a client holds elsewhere. Nor can it make the people who receive its findings act on them. FINMAThe Swiss Financial Market Supervisory Authority. It licenses firms, inspects them and can shut them down — but it cannot fine anyone.'s finding was that the overruns were reported, and the limits raised instead.
Where this sits in a matter. Organisation and analysis: one entity-and-timeline map, and the question tested against the evidence. How a matter runs
Source: FINMA, “Archegos: FINMA concludes proceedings against Credit Suisse”, 24 July 2023.
NatWest and Fowler Oldfield: what the system saw, and what staff saw#
What happened. NatWest pleaded guilty to three offences of failing to comply with the Money Laundering Regulations 2007, in the Financial Conduct Authority's first criminal prosecution under those regulations. The offences concerned its handling of Fowler Oldfield, a Bradford jewellery business, from 8 November 2012 to 23 June 2016. About £365 million was deposited over the relationship, about £264 million of it in cash, although the bank had initially understood it would not handle the customer's cash. The FCA recorded that staff handling the cash reported suspicions to the bank's anti-money-laundering team without appropriate action being taken, and that the automated monitoring system wrongly treated some cash deposits as cheque deposits, which carry lower risk. Sentencing at Southwark Crown Court, Mrs Justice Cockerill said the bank was in no way complicit in the money laundering, but was functionally vital to it.
What it cost, on the record. A fine of £264,772,619.95, after a one-third discount for the guilty plea.
What tests for it. Two checks, run on the bank's own records. The first replays known patterns through the monitoring system's actual configuration and records how each transaction is classified, so a cash deposit recorded as a cheque shows up. The second follows the reports that staff make to the money-laundering team, and records what happened to each. Both are run before a supervisor asks how the system performs, or when a customer's activity moves away from what was expected at onboarding.
What those checks could not have caught. They show where a system or a process fails. They do not establish that any customer was laundering money; that took a separate police investigation. They also cannot decide what the people who receive the reports then do.
Where this sits in a matter. Analysis: the question tested against the evidence, and the other explanations tested too. How a matter runs
Source: FCA, “NatWest fined £264.8 million for anti-money laundering failures”, 13 December 2021.
When a matter is already live, the same method runs it as a Rapid Independent Review.
Figures as stated in the record cited under each case.