The size and scope of HSBC's record-setting $1.92 billion penalty to federal regulators for a slew of anti-money laundering problems surprised many in the financial industry, who warned it could set a new precedent for targeting other institutions.

The British bank (HBC) agreed Tuesday to pay several amounts to various U.S. regulators for a total that will be the largest corporate penance thus far for inadequate compliance with anti-money laundering laws.

It also should put other large banks on notice, industry observers said.

"It's an extremely large dollar amount, and it should send a very strong message to all size banks that they cannot avoid taking the necessary steps" to overhaul their anti-money laundering compliance systems, says Bob Pasley, a former longtime assistant director of the OCC's enforcement and compliance division. "The Department of Justice and the banking agencies are going to continue to look at compliance at a number of banks. It's going to increase, and it's going to feed upon itself."

Both lawmakers and federal regulators were quick to support that idea. Sen. Carl Levin, D-Mich., who first revealed many of HSBC's problems during hearings this summer, called the settlement a "powerful wakeup call to multinational banks about the consequences of disregarding their anti-money laundering obligations."

"It also shows the value of congressional oversight in exposing wrongdoing and the ongoing need to hold banks accountable," he said.

He was joined by Comptroller of the Currency Thomas Curry, who declared that the fine should "send  a strong message to the bank and the financial services industry to make compliance with the law a priority.

"The action also highlights the importance of banks' effectively managing operational risk and the consequence of failing to do so," Curry said in a press release.

Other institutions have already been hit.

On Monday, fellow British bank Standard Chartered agreed to pay $327 million for violating U.S. sanctions against countries including Iran and Libya, adding to the $340 million it paid New York's Department of Financial Services in September. In June, Dutch bank ING agreed to pay $619 million over charges of similar sanctions violations.

Still, HSBC's fines were far larger, reflecting the massive amount of problems uncovered by Levin's staff and regulators. HSBC's compliance understaffing and lax monitoring of its U.S. and Mexican operations allowed drug traffickers to launder some $881 million through its systems between 2006 and 2010, according to the Justice Department.

For over a decade, the bank also helped customers in countries like Iran and Sudan illegally skirt U.S. sanctions when processing their payments, the agency said. "Do not mention our name in NY," one cautionary note on an HSBC payment message read, according to the Justice Department.

The settlement includes a deferred prosecution agreement for HSBC, which will conduct an extensive overhaul of its anti-money laundering operations in the next five years.

The $1.9 billion settlement is relatively affordable for HSBC, which reported $2.8 billion in third-quarter profit and which has been reserving against just this likelihood.

HSBC has also overhauled its leadership and its systems in the past couple of years, and has committed to doing more under the deferred prosecution agreement. It said Tuesday that it has begun a review of all "Know Your Customer" files, the first phase of which will cost an estimated $700 million over five years.

"We accept responsibility for our past mistakes," HSBC chief executive Stuart Gulliver said in a statement. "We have said we are profoundly sorry for them, and we do so again. The HSBC of today is a fundamentally different organization from the one that made those mistakes."

Some anti-money laundering compliance experts see the HSBC settlement as the ending of a regulatory grace period.

"Eight or nine years into the push for AML, [there was] leeway or graciousness from the regulators to allow banks to fix problems before the regulators take action. The regulators are going to stop being gracious about it," says David Caruso, CEO of anti-money laundering consulting firm Dominion Advisory Group.

"The issue of identifying and detecting suspicious activity is very difficult, and it would appear as though some banks … don't understand just how difficult it is," he adds. "AML is a multi-faceted complex operation, it is not a set of policies and procedures, and that's where we see banks fail – they adopt the viewpoint that this is a more traditional compliance arena in which well-written policies and procedures will fulfill the obligations."

Michael Dawson, a managing director of consulting firm Promontory Financial Group, agreed that overhauling anti-money laundering systems is trickier than it appears.

"The critical thing that differentiates banks that want to do a good job of managing their AML risks and those that actually do is, significantly, ownership of the AML risk by line-of-business management," he says. "It's only when you have the business leaders and management themselves owning the risk that it's effectively managed."

HSBC's $1.92 billion payment includes $1.256 billion for the Justice Department, $500 million for the Office of the Comptroller of the Currency and $165 million for the Federal Reserve. The U.K.'s Financial Services Authority is "pursuing a separate action," the Justice Department said.

Meredith Rathbone, a partner in Steptoe & Johnson's DC office who handles AML cases, says that U.S. banks with international operations have historically been more compliant with U.S. sanctions than international banks with U.S. operations, which she sees as more at risk of future enforcement actions.

The Office of Foreign Assets Control, the Justice Dept. and the New York district attorney's office "seem to be continuing to focus on this, and there appear to be no shortage of targets for them. Non-U.S. banks are really starting to sit up and take notice," she says.

Several industry members suggested that future government actions could seek more scalps instead of higher and higher dollar amounts.

"If $1.9 billion isn't enough to persuade institutions to manage these risks effectively, prosecutors and regulators will have to turn to other tools. Increasingly, they will turn to personal liability, in the form of criminal and civil actions" and to tactics including compensation clawbacks, Promontory's Dawson says, pointing to British authorities' decision to make three arrests Tuesday in the Libor-manipulation scandal.

"It is possible that this [HSBC] enforcement action represents a sort of bookend in the era of escalating monetary policy against institutions. While the penalties will remain large, they will increasingly be coupled with other enforcement mechanisms, principally mechanisms to impose personal liability on the people involved."

But Pasley remains skeptical, noting that no major U.S. financial executives have been held criminally or civilly responsible for the 2008 financial crisis.

"I really haven't seen much appetite for that to date," he says. "The question is, how do you top $1.9 billion? Perhaps with that … but you have the complaint that since the 2008 financial collapse on Wall Street, nobody has been held responsible. I don't see any signs of that changing."

Subscribe Now

Access to authoritative analysis and perspective and our data-driven report series.

14-Day Free Trial

No credit card required. Complete access to articles, breaking news and industry data.