THE CENTRAL BANK has fined Danske Bank more than €1.8 million for transaction monitoring failures in respect of its anti-money laundering and terrorist financing systems.

It relates to three breaches of the Criminal Justice (Money Laundering & Terrorist Financing) Act (CJA) for a period of almost nine years, between 2010 and 2019. 

In a statement, the Central Bank said the “root cause of these failures”  was the historic data filters that were applied within Danske’s automated transaction monitoring system.

These were rolled out by in 2006, but Danske Bank “failed to consider the appropriateness of these historic data filters within the system to take account of the specific requirements of the CJA when it came into force in Ireland in 2010”.

The Central Bank said this led to the “erroneous exclusion of certain categories of customers from transaction monitoring, including some customers rated by Danske as high and medium risk, which caused the three breaches”. 

The Central Bank added: The procedures and controls put in place by Danske did not operate to identify the erroneous exclusion of certain categories of customers from automated transaction monitoring.”

‘Inadequacies’

In May 2015, Danske “became aware, as a result of an internal audit report, of the inadequacies in its transaction monitoring system and the nature of the risks they posed”.

However, “it failed to notify the Irish branch or the Central Bank of these issues and to take adequate action for almost four years”.

The Central Bank estimates that between 31 August 2015 and 31 March 2019, close to 350,000 transactions, equating to around one in forty of all transactions processed through the Irish branch, were not monitored for money laundering and terrorist financing risk.

A fine of €2.6 million was determined by the Central Bank, but this has been reduced by 30%to €1,820,000 in accordance with the early settlement discount scheme.

Danske is a credit institution incorporated in Denmark and this is the first penalty that the Central Bank has imposed on a financial institution incorporated outside of Ireland.

The three breaches have been admitted by Danske.

By the end of March 2019, Danske Bank had fully deactivated the erroneous historic filters which gave rise to the breaches.

Danske also confirmed that by April 2020, it completed a third party review for the period from 2016 to 2019.

It advised that the outcome of the review showed that the risk of suspicious transactions amongst those examined was very low. 

Global fight

The Central Bank’s Director of Enforcement and Anti-Money Laundering, Seana Cunningham, said: “The importance of transaction monitoring in the global fight against money laundering and terrorist financing cannot be overstated.”

She continued: “It is imperative that firms implement robust transaction monitoring controls which are appropriate to the money laundering risks present”

While Cunningham recognised that “firms may rely on automated solutions for transaction monitoring,” she added that they “must ensure that systems employed for this purpose are appropriately monitored”. 

She noted that Danske became aware of the issue in May 2015, but failed to notify the Irish branch.

“It was only in October 2018 when the Irish branch identified the issue,” Cunningham added, “that steps were taken to rectify it, which were completed in March 2019.”

The Central Bank was not informed of the issue until February 2019.

Cunningham described the “failures to rectify the issue and to notify the Central Bank promptly” as aggravating factors in this case.

She said: “The Central Bank expects firms to bring failures to its attention at the earliest opportunity and to act expediently to address identified errors.

“The Central Bank will hold firms, including those operating in Ireland on a passporting basis, fully accountable where they fail to take such actions.

“This case demonstrates our willingness to pursue enforcement actions and impose sanctions where firms fail in their anti-money laundering/countering the financing of terrorism compliance.”