- Key insight: Three large banks waited years before filing suspicious activity reports on Jeffrey Epstein, even though they are required to do so within 30 to 60 days of detection.
- Supporting data: A bank must file a report to the government if it knows or has reason to suspect that a transaction has no business or lawful purpose.
- Forward look: If Democrats gain control of Congress, they may look to hold banks responsible for failing to report Epstein's suspicious activity in a timely manner.
A Senate investigation into Jeffrey Epstein's finances is casting a spotlight on how major banks monitor — and report — illicit financial activity by high-net-worth clients.
A
The report
Ross Delston, an independent attorney and expert witness who specializes in anti-money laundering, said one of the many mysteries about banks' involvement with Epstein is that regulators have largely been silent about the filing of suspicious activity reports, or SARs.
He noted that in 2020, when New York's Department of Financial Services fined Deutsche Bank $150 million in connection with Epstein, the
"Banks are always wrestling with the regulatory requirement to file SARs," said Delston. "On the one hand, if they file a SAR, they are expected to conduct increased monitoring and to follow up on their initial customer due diligence. On the other hand, there is a business line that is always pressing forward for more, more and more profit."
SARs are filed to provide information to law enforcement. When banks file the reports years after the fact, particularly if they file thousands of them at the same time, it is a sign of a past systemic reporting failure, financial crime experts say.
In response to the report,
Read more:
Should a bank ever be liable when a customer gets scammed ?OpenAI models' Hugging Face breach is a red flag for bankers The top-performing banks with $2B to $10B of assets in 2025 Inside Upstart's journey to get a bank charter approval
Epstein was arrested by federal law enforcement on sex trafficking charges in July 2019 and died nearly a month later. His death spurred
Wyden has called for the Department of Justice, the Treasury Department, the Federal Reserve and the Office of the Comptroller of the Currency to conduct investigations into the activities of the three banks and to levy fines or criminal penalties against the banks and specific bankers who looked the other way.
"This is not a matter of minor errors or occasional omissions," the report states. "Investigations into the crimes of Jeffrey Epstein have thus uncovered an important finding that extends beyond Epstein himself: Wall Street banks have been willing to turn a blind eye to the suspicious transactions of ultra-wealthy clients, even if the failure to scrutinize and report these transactions runs directly afoul of federal law."
What does the law say?
Banks are required under the Bank Secrecy Act to file suspicious activity reports within 30 days of determining that any transaction over $5,000 lacks a legal business purpose or shows red flags for criminal activity.
Dan Stipano, a partner at Davis Polk & Wardwell who heads the firm's anti-money laundering and countering the financing of terrorism practice, said that nearly all banks have automated detection systems that flag suspicious transactions such as large round-dollar wire transfers or repeated payments to young men or women. The monitoring systems identify fact patterns in an individual's transaction history and send alerts that get reviewed internally. Typically, a bank employee reviews the alert and determines whether to escalate it for further investigation.
"The clock starts running after the alerts are generated and investigated, and there's a determination that something is suspicious," Stipano said of Bank Secrecy Act requirements. Banks have between 30 to 60 days after identifying a suspicious transaction to file a SAR.
There may be reasons why a bank is late filing a SAR, including staffing issues or the complexity of a transaction or payment, Stipano said.
In some cases, banks can be outsmarted by criminals, and software may not detect a suspicious transaction. A more likely scenario is that a bank's internal compliance team detects an issue, but a business-side employee ignores the warnings because the client is too important or profitable.
"In my experience, relationship managers in cases like this are the enemy within," said Delston. "They are actively working to overcome the objections of the compliance unit, and their trump card is that the business line is a profit center, whereas the compliance function is a cost center."
Wyden plans to introduce legislation to deter compliance failures by requiring signed attestations by individual banks for accounts involving ultra-high net worth individuals. His report lists 13 people, many of them bankers, who were allegedly responsible for ignoring warnings and continuing to do business with Epstein, who'd been a convicted sex offender since 2008.
The Bank Secrecy Act requires banks to conduct due diligence on their customers, including by verifying their identity, their business and what types of transactions are typical. Suspicious activity reports get filed with the Financial Crimes Enforcement Network, or Fincen, a bureau of the Treasury Department.
Separately, the Federal Financial Institutions Examination Council, an interagency body of financial regulators that prepares anti-money laundering exam procedures, has specifically identified several red flags that banks should be aware of, including:
- A large number of incoming or outgoing funds transfers that take place through a business account where there appears to be no logical business or other economic purpose.
- Funds transfer activity that is unexplained, repetitive, or shows unusual patterns.
- Customers who establish multiple accounts in various corporate or individual names that lack sufficient business purpose.
- Funds transfer activity that occurs to or from a country known as a financial secrecy haven, or to or from a high-risk geographic location without an apparent business reason.
- Unusual transfers of funds among related accounts or among accounts that involve the same or related principals.
In one example, Epstein used his accounts at
To address the compliance failures, Wyden plans to introduce legislation that would require bankers to sign attestations for accounts involving ultra-high net worth individuals. Such a provision would be modeled on Sarbanes-Oxley, the law put in place after the Enron scandal that requires chief financial officers to certify that financial statements are accurate.
Wyden's report lists 13 people, many of them bankers, who were allegedly responsible for ignoring warnings and continuing to do business with Epstein.
In another example from Wyden's report,
"It is alarming that a major bank waved through $170 million in wire transfers from a billionaire to a registered sex offender, only to conclude they had no verifiable business purpose years later," the report said. "It is also emblematic of a larger pattern across Wall Street where financial institutions do not sufficiently scrutinize ultra-wealthy clients like Leon Black, for fear that clients who don't want to answer questions will simply take their business elsewhere."
Black's attorney, Susan Estrich, said that Wyden's report was "politically motivated," and that the senator's assertions are "outrageous and false."
The Trump administration has proposed reducing oversight and de-prioritizing customer due diligence requirements. In April, Fincen and prudential regulatory agencies issued a proposed rule that would no longer require bank boards of directors to approve anti-money laundering programs, potentially transferring oversight to senior management.
In addition, regulators would have to give Fincen at least 30 days' notice before making a formal determination of deficiencies in a bank's program to allow Fincen to provide input. Regulators also would be prohibited from taking enforcement actions against banks for minor or "technical issues."
