The next Epstein is probably already here, hidden in plain sight

Photographer: Louis Lanzano/Bloomberg

Summer 2025 once again brought Jeffrey Epstein's name to the front pages of leading financial outlets. His 50th birthday album resurfaced, containing letters from prominent figures, and former Barclays Chief Jes Staley saw his career finally unravel over the extent of his relationship with Epstein.

Officially, Epstein's death in a Manhattan detention center in 2019 closed the criminal proceedings against him. Yet the more important question for U.S. banks is whether the conditions that enabled his financial operations have truly been dismantled. On close inspection, the answer remains troubling. The uncomfortable truth is that the vulnerabilities exposed by his case were not unique. This was not a mere oversight or the failing of a rogue employee; it was a systemic breakdown in which the normal rules of compliance were suspended for a VIP client. They are rooted in a banking culture that too often gives ultra-wealthy individuals a pass on the very controls imposed on everyone else. That leaves a sobering conclusion: The financial system is probably still vulnerable. This is why the key vulnerabilities deserve closer attention.

The Epstein saga stands as the most glaring failure in handling high-risk clients since the collapse of Riggs Bank in 2005. But unlike Riggs, the banks at the center of Epstein's story, JPMorgan and Deutsche Bank, were not struggling institutions. They were global leaders, presenting private banking as a core commercial pillar alongside retail, corporate and investment banking. That strategic framing underscores the structural tension: the segment catering to ultra-high-net-worth and politically exposed clients is both the most lucrative and the most exposed to compliance risk.

In practice, this tension meant compliance rarely carried decisive weight. Deutsche Bank, for instance, approved Epstein's accounts in 2013, despite his 2007 conviction, reportedly projecting "revenue of $2–4 million annually." Years later, the New York Department of Financial Services would fine the bank $150 million, citing a "fundamental failure" to monitor accounts for activity "obviously implicated by Mr. Epstein's past." JPMorgan reached a $290 million settlement with victims, after plaintiffs alleged the bank "ignored obvious red flags" because of the relationship's profitability. The arithmetic was simple: projected millions outweighed compliance warnings, illustrating the recurring imbalance between business priorities and risk management.

The AML risk profile of ultra-wealthy clients differs sharply from that of retail customers. Money mules channel nearly 100% of their activity into high-risk flows, ensuring rapid detection and closure. By contrast, Epstein and his peers intersperse questionable transfers with vast volumes of legitimate activity, rendering the illicit share just a sliver of total turnover. Between 2003 and 2013, Epstein maintained roughly 50 JPMorgan accounts that processed more than $1 billion. Of this, regulators cited only a few million dollars as suspicious. That ratio made the problematic flows nearly invisible within aggregate volume. The concealment was not accidental. High-net-worth clients typically employ top-tier counsel to design contracts, payment rationales and corporate structures. On his Deutsche Bank accounts alone, Epstein paid more than $7 million to lawyers. Each individual payment, viewed in isolation, appeared lawful. Only when investigators reconstructed the full chain did the red flags emerge. Regulators later concluded that the failure was not in missing one anomalous transfer, but in ignoring the obvious implications of Epstein's history when assessing his broader activity.

Regulation and compliance

Inside JPMorgan's year of being haunted by Jeffrey Epstein

With the firm's $75 million settlement this week with the US Virgin Islands, the echoes from the bank's association with the convicted sex offender continue to reverberate.

September 29

Large banks frequently tout the robustness of their AML frameworks. Yet scale can become a liability, because responsibilities diffuse across committees, panels and scoring systems. Everyone is responsible, so no one is accountable. At Deutsche Bank, the Americas Reputational Risk Committee approved Epstein's accounts in 2013 and 2015, despite prior convictions. The conditions it imposed were vague, poorly enforced and lacked follow-up. The North American Client Screening Committee oversaw risk scores but failed to ensure heightened monitoring. DFS later emphasized the absence of an audit trail: Conditions were imposed but never embedded into actual controls. This illustrates a paradox of modern compliance: Sprawling infrastructure can create inertia.

Finally, Epstein's case reveals a deeper flaw in AML methodology itself. Traditional monitoring is built to catch illicit cash entering the system through anonymous deposits, smurfing, shell companies and the like. Epstein's activity inverted that model. His credits came from reputable banks and well-known individuals. The risk lay in debits: outward transfers of ostensibly clean money into opaque destinations. DFS investigators found more than 100 cash withdrawals under $7,500, totaling over $800,000, executed by Epstein's attorney and rationalized as "tips, travel and expenses." More than 120 outward payments of $2.65 million went to women. Regulators noted these red flags "were not reasonably identified or escalated." JPMorgan allowed Epstein to withdraw $1.75 million in cash to pay victims, even as it serviced accounts for those same victims. The warning signs were visible, but the systems were not designed to interpret them. In retail contexts, structured cash withdrawals or repetitive payments to unrelated individuals would trigger alerts. For a high-profile client, surrounded by legal justifications and vast wealth, the same activity blended into the background.

As of 2025, regulatory standards in the U.S. have certainly advanced. Supervisors now demand more granular screening of politically exposed persons, sharper sanctions controls and closer monitoring of transactional flows. These are meaningful improvements. Yet for all the progress, private banking structures continue to reveal the same imbalance that defined the Epstein saga: The business imperative to preserve and expand ultra-high-net-worth relationships still outweighs the discipline of holistic risk assessment.

That imbalance leaves the industry in an uncomfortable position. Where vulnerabilities persist, bad actors will exploit them. The architecture that allowed Epstein's network to thrive was never dismantled so much as patched. It left sufficient room for similar abuses to emerge in new guises, hidden behind layers of wealth and influence. The lesson is clear: Unless compliance models move beyond transactional monitoring and address integrity risks at the level of leadership and governance, the sector risks repeating history. It is not implausible that the "next Epstein" is already being discreetly serviced by private banking somewhere in the U.S.