PRA fines HSBC units $73M over deposit protection failures

HSBC Bank (HBEU) and HSBC U.K. Bank failed to implement the Depositor Protection Rules (DPR) by improperly identifying deposits eligible for the Financial Services Compensation Scheme (FSCS), the PRA announced in a press release Tuesday.

The firms received a 30 percent discount for cooperation throughout the investigation, including early admission and for agreeing to resolve the matter, the PRA noted. The penalty represents the second largest fine imposed by the British banking regulator.

The details: Between 2015 and 2022, the firms failed to put in place “adequate systems and controls, and governance, to ensure the integrity of critical information which the FSCS relies upon to make prompt payments to depositors in the event of a firm failure,” the PRA alleged.

Further, HBEU “materially undermined the firm’s readiness for resolution” and failed to notify the PRA for approximately 15 months about problems identified in the incorrect marking of accounts as “eligible” for FSCS protection.

Other aggravating factors cited included:

• Failure to assign clear ownership for the processes required under the DPR;
• Lack of oversight by senior managers;
• Incorrectly marking 99 percent of eligible beneficiary deposits as “ineligible” for FSCS protection;
• Providing an incorrect attestation to the PRA confirming its systems satisfied certain requirements of the DPR; and
• Failing to produce finalized versions of annual reports required to be signed by its board of directors that confirmed compliance with the requirements of the DPR for multiple years.

Further, the firms’ failure to notify the PRA reporting errors had been uncovered reflected “serious issues with governance, identification, and escalation,” according to the final notice.

“It is vital that all banks comply fully with our requirements around preparedness for resolution,” Sam Woods, deputy governor and chief executive of the PRA, said in the release. “HBEU fell far short of its obligations in this area and failed to disclose its failings to us in a timely manner.”

Compliance considerations: The firms agreed to a remediation program as part of the settlement, which requires enhancements to core systems and single customer view (SCV) logic, as well as strengthening the control environment within front-line and operations teams, according to the final notice.

The PRA emphasized how an accurate SCV file can minimize the “adverse effect of firm failure on the stability of the financial system.”

Other mitigating factors included providing detailed internal audit reports, limited waiver of privilege, and targeted corrections.

Bank response: “HSBC is pleased to have resolved this historic matter, which relates to the bank’s compliance with certain parts of the PRA’s Depositor Protection Rules,” an HSBC spokesperson said in an emailed statement. “The PRA’s final notice recognizes the bank’s cooperation with the investigation, as well as our efforts to fully resolve these issues. We continue to remain focused on serving our customers.”