The Operational Risk Lesson from HSBC’s £63.9 Million Fine

"Operational risk is the risk of loss from failed processes, systems, or people. A control that merely exists gives false comfort. Every control needs a clear risk purpose, regular testing, reliable data and a known owner who fixes problems quickly."

In December 2021, the Financial Conduct Authority (FCA) fined HSBC Bank plc £63,946,800 for weaknesses in its transaction monitoring. The bank did have a system, and it screened hundreds of millions of transactions every month. The failure was in how that system was governed, which makes it a textbook operational risk case.

The Three Core Weaknesses Identified by the FCA

Between 31 March 2010 and 31 March 2018, the FCA found weaknesses across three vital operational areas:

• Scenario coverage: Until 2014, HSBC did not check whether its scenarios covered relevant money laundering and terrorist financing risks. After 2016, it did not risk-assess new scenarios in good time.
• Testing and tuning: The parameters that decide whether a transaction looks suspicious were not properly tested or updated.
• Data quality: The bank did not check that the data feeding its systems was accurate and complete.

HSBC settled early and received a 30% discount. Otherwise, the fine would have been £91,352,600. The FCA also noted that the issues had been raised on several occasions, and that remediation took a long time.

The Operational Risk Lesson

Operational risk is the risk of loss from failed processes, systems, or people. A control that merely exists gives false comfort. Every control needs a clear risk purpose, regular testing, reliable data and a known owner who fixes problems quickly.

How SecuroQ Uses Financial Crime Intelligence to Close This Gap

SecuroQ describes its platform as an explainable intelligence layer that brings customer, risk, transaction and investigation signals together, with human oversight at every step. This maps directly to each weakness the FCA identified:

• Scenario coverage: Its Transaction Engine uses adaptive monitoring tuned to a firm’s risk appetite and typologies. Its research team publishes intelligence briefs and horizon scanning, so scenarios keep pace with new laundering methods.
• Testing and tuning: SecuroQ’s service journey includes shadow analysis alongside a firm’s existing stack, followed by continuous model recalibration. Its Financial Crime Health Check™ benchmarks compliance maturity before a regulator asks.
• Data quality: The Customer Engine resolves customer, ownership and transaction data into one unified entity view, so monitoring works from context rather than disconnected data.
• Governance and remediation: Alerts carry explainable reasoning; decisions and overrides are traceable through audit trails, and MLRO advisory supports faster, owned fixes. AI proposes and accountable humans decide.