Canadian arm of China’s largest bank repeatedly broke money-laundering rules despite multiple warnings from regulators

The Canadian subsidiary of China’s biggest bank repeatedly broke the law by failing to review risky clients, report suspicious transactions and respect police production orders despite multiple warnings from FinTRAC about its faulty financial-crime controls, according to the regulator’s findings in confidential documents reviewed by The Globe and Mail.

Industrial and Commercial Bank of China Ltd., the world’s largest bank by assets, is a Chinese state-controlled financial institution headquartered in Beijing. Although some of its shares trade on stock exchanges in Asia, ICBC’s controlling shareholders are the Ministry of Finance of the People’s Republic of China and Central Huijin Investment Co., a Chinese sovereign-fund company.

For the past 15 years, ICBC has operated a Canadian subsidiary called Industrial and Commercial Bank of China (Canada). The lender is known as ICBK to distinguish it from the Insurance Corporation of British Columbia, which also uses the ICBC acronym.

ICBK provides a range of commercial and personal banking services, including loans, savings, currency exchange and cross-border transactions such as remittances denominated in renminbi (China’s currency). With a Toronto head office and nine branches in Ontario, B.C., Alberta and Quebec, its clientele includes businesses, Canadians of Chinese descent and foreign students.

The Canadian subsidiary has been a rewarding investment for its Chinese parent company. By the end of 2023, ICBK’s net income had increased by more than 11 times, to $44.4-million, from when ICBC took control of the business in 2010. Its total assets increased fivefold, to $3.07-billion, over that same period.

FinTRAC report shows examples of suspicious ICBK account activity

But as ICBK churned out fatter profits, it cut corners on financial-crime compliance. A previously undisclosed paper trail comprising regulatory and bank documents exposes ICBK’s failures to fix problems with its anti-money-laundering and anti-terrorist-financing controls despite repeated regulatory examinations.

ICBK is expected to undergo a fourth examination by FinTRAC, the Financial Transactions and Reports Analysis Centre of Canada, to assess its compliance with the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. FinTRAC, Canada’s financial crime watchdog, sent the bank a letter in 2023 to request documents in advance of a review.

FinTRAC has yet to publicly release any findings. But an investigation by The Globe has uncovered details about ICBK’s compliance problems. They include the bank’s failure to remedy certain deficiencies with its anti-money-laundering and anti-terrorist-financing controls after it was last sanctioned by FinTRAC nearly four years ago.

In 2021, FinTRAC closed ICBK’s case after the bank paid a financial penalty of $701,250 for what the regulator said were three “administrative violations” of the act.

But confidential regulatory documents reveal that FinTRAC’s third examination of ICBK, which resulted in that relatively small financial penalty, detected many more deficiencies and concluded the bank’s compliance program was in a state that required “urgent attention.”

Open this photo in gallery:

FinTRAC, for example, uncovered problems with ICBK’s handling of police production orders. In one instance, the RCMP was investigating a Beijing resident suspected of drug and money-laundering offences.

The regulator also found examples of unreported suspicious transactions that involved large sums of money and high-risk clients, including a B.C. business with links to a Chinese state-owned arms and explosives dealer subject to U.S. sanctions.

FinTRAC further determined that ICBK’s transaction-monitoring system was failing to scan for risks associated with correspondent banking – a lucrative service that allows a bank to facilitate cross-border transactions on behalf of a foreign lender.

Internal bank documents, meanwhile, affirm that certain problems with ICBK’s controls persisted for years after FinTRAC deemed the various deficiencies and related action items closed in 2021. Repeat deficiencies indicate the problems were never fixed to begin with because it is customary practice for banks to conduct a root-cause analysis followed by testing of any proposed solutions when remediating faulty controls.

A 2023 internal bank report cited problems with ICBK’s reporting of large cash transactions worth $10,000 or more. Though it is mandatory for all financial institutions to file large cash transaction reports (LCTRs) to FinTRAC, some ICBK branch employees advised customers on how to structure their deposits into smaller amounts over time to avoid having their transactions flagged to the regulator. Ottawa, however, had already announced it was creating a new criminal offence to catch people who structure transactions to evade regulators and police.

ICBK declined to answer specific questions for this story. But the bank provided a statement in response to The Globe’s queries, saying it is committed to compliance, security and financial integrity, and to working with FinTRAC and the Office of the Superintendent of Financial Institutions, the federal banking regulator.

“We take our regulatory obligations seriously and engage directly with OSFI and FinTRAC, as required by law, to ensure full compliance with all applicable measures that promote transparency, accountability and the integrity of the financial system,” ICBK deputy chief compliance officer John Hamers wrote in an e-mail.

“Any matters related to compliance reviews, examinations, or regulatory expectations are strictly confidential and are addressed through these established channels. Where public reporting requirements apply, the results of regulatory decisions are disclosed in accordance with the law.”

Mr. Hamers added that the documents reviewed by The Globe “are out of context and contained outdated, misleading and inaccurate information.”

ICBK’s numerous violations raise questions about the Canadian government’s reluctance to severely crack down on a Beijing-controlled bank that has repeatedly flouted Canada’s anti-money-laundering and anti-terrorist-financing law. What’s more, the bank’s multiple failures to remedy its problems cast doubt on the effectiveness of regulatory processes.

As a subsidiary of a foreign bank, ICBK holds a Schedule II banking licence. FinTRAC and OSFI are both responsible for supervising the bank’s anti-money-laundering compliance. But neither FinTRAC nor OSFI has purview over ICBK’s Chinese parent company, which is ultimately controls the bank.

“Under the act, FinTRAC’s supervisory mandate is focused on the domestic operations of businesses. However, the Centre does consider a bank’s foreign associations in its risk assessment and ratings of banks, when selecting supervisory activities and setting examination scopes,” FinTRAC spokeswoman Mélanie Goulette Nadon said in an e-mailed statement.

She also said that FinTRAC and OSFI share information related to the compliance of federally regulated financial institutions with the act.

ICBC is of strategic importance to Beijing. Beyond its economic might – it had the equivalent of $9.6-trillion in assets in 2024 – the bank operates its own militia to support China’s security and defence.

OSFI, which is prohibited by law from disclosing information about individual banks, has warned that if banks are used as tools for foreign governments and their proxies, it would endanger Canada’s broader financial system.

“The Department of Finance does not comment publicly on a specific company, or on the existence of an inquiry or examination,” Marie-France Faucher, an official with the department, wrote in an e-mailed statement.

“The government is committed to safeguarding the integrity and security of Canada’s financial sector. This includes fostering strong legal and operational frameworks to combat financial crime and address national security risks, including foreign interference.”

Still, Ottawa’s lack of sophistication in mounting effective defences against transnational organized crime, terrorist groups and hostile foreign actors poses a national security threat, says Kim Manchester, founder of ManchesterCF, an online financial intelligence training company based in Toronto.

“Foreign influence is a component of that environment,” says Mr. Manchester.

The recent public inquiry into foreign interference, however, did not probe tampering through Canada’s banking system even though illicit financial flows are inextricably linked to meddling by rogue states.

“Foreign influence is a function of violence or money, or both,” Mr. Manchester says. “Either Canada addresses the problem as a whole, or we simply accept the consequences of the loss of our nation state as it submits to the will of others.”

---

Open this photo in gallery:

ICBC might be a global behemoth, but it’s still a relatively young bank. Founded on Jan. 1, 1984, it was central to Beijing’s strategy to reform China’s financial system and economy.

Specifically, ICBC was created to fill a void left by the People’s Bank of China, which stopped providing industrial and commercial services to function solely as a central bank. Facing increased demand for its services, ICBC later restructured as a publicly traded company. But Beijing did not relinquish control.

In the fall of 2006, the bank’s shares were listed on the Hong Kong and Shanghai stock exchanges. Its initial public offering, the world’s largest at the time, raised US$21.9-billion and paved the way for global expansion.

In 2009, ICBC set its sights on Canada and later struck a deal to acquire a 70-per-cent controlling stake in the Bank of East Asia (Canada). The business, which then operated six branches, was the Canadian subsidiary of the Bank of East Asia Ltd., which is based in Hong Kong.

Jim Flaherty, then Canada’s finance minister, approved the transaction in January, 2010, and the bank was later renamed Industrial and Commercial Bank of China (Canada).

“The new name reflects the relationship with our parent bank,” the bank said at the time, describing itself as a bridge for Sino-Canadian relations.

Open this photo in gallery:

ICBC’s then chairman, Jiang Jianqing, praised Canada for having “an advanced and prudent financial regulatory system.”

Over the ensuing years, ICBK deepened its ties to Canada’s banking sector with an eye to increasing bilateral trade and commerce.

A 2014 agreement between Ottawa and Beijing, for instance, established Canada as the first North American renminbi hub. ICBK then became the hub’s official clearing bank.

That designation allowed ICBK to access the payment systems of China’s central bank and clear renminbi-denominated transactions flowing to and from Canada, including for other banks.

ICBC currently owns an 80-per-cent stake in ICBK, with the Bank of East Asia holding the remaining 20 per cent, according to ICBK’s website.

By the end of 2023, ICBK was roughly twice as profitable, based on its return on equity and return on assets, as it was when ICBC took control in 2010. The two measures are key metrics of profitability in the banking industry.

(ICBK follows the calendar year for financial reporting purposes, and its 2023 results were the latest full-year data available at the time of writing this article.)

---

ICBC has found itself in the crosshairs of financial regulators and law enforcement elsewhere in the world.

In 2020, four former employees and executives of the bank’s Madrid branch agreed to a plea deal with Spanish prosecutors in a money-laundering case, according to published reports.

The employees were found guilty of laundering large sums for Chinese organized crime groups. In addition to paying fines that totalled €22.7-million (about $34.7-million at the time), the culpable employees were sentenced to prison.

Then, in 2024, ICBC and its New York branch were ordered to pay fines that totalled US$32.4-million to settle investigations by the New York State Department of Financial Services (DFS) and the Federal Reserve Board.

The bulk of those fines – US$30-million – stemmed from a consent order, with the DFS resolving an investigation into deficiencies in the compliance program at the New York branch from 2018 to 2022.

The regulator also determined that an employee in New York was ordered by a colleague to backdate several compliance documents and the bank failed to report the misconduct in a timely manner.

The Fed, meanwhile, fined the bank US$2.4-million for its unauthorized use and disclosure of confidential supervisory information to an overseas affiliate, which, in turn, passed it on to a foreign regulator.

Open this photo in gallery:

Here in Canada, FinTRAC conducted its first compliance examination of ICBK in 2013, but the results were kept private. A second confidential assessment occurred in 2015 and resulted in a proposed notice of violation.

A 2016 legal precedent involving another company, however, hampered FinTRAC’s ability to levy financial penalties for nearly three years. The upshot for ICBK was that its notice of violation was quashed.

With a new penalty policy in place, the regulator conducted a third compliance examination in 2019, covering the period between Feb. 1, 2018, and Jan. 31, 2019.

FinTRAC reviewed ICBK’s entire compliance program and followed up on the deficiencies identified in 2015. It shared a draft of its findings with ICBK on July 7, 2020. Soon after, the bank provided a response, prompting the regulator to adjust its determinations.

Nonetheless, FinTRAC cited various problems, including with ICBK’s reporting of suspicious transactions. The regulator reviewed 95 case files and pinpointed seven unreported transactions that should have been disclosed to the regulator because of police production orders, “demarketed clients” (customers whose accounts were shuttered by the bank) and “adverse media reports” (news stories that raise red flags about clients).

FinTRAC determined that ICBK’s policies and procedures required enhancements, including those covering suspicious transaction reports (STRs), electronic funds transfers (EFTs) and police production orders.

Problems were also identified with ICBK’s transaction monitoring system, including how alerts were reviewed and how decisions were made to submit STRs.

In 2018, ICBK’s transaction monitoring system generated 1,091 alerts, and the bank filed four STRs with FinTRAC. That represented an STR conversion rate of approximately 0.37 per cent – a level that appeared empirically low.

“This low rate may suggest the Bank’s transaction monitoring system is not adequately tuned to alert the Bank to truly unusual or suspicious activity,” FinTRAC stated.

Although it’s difficult to generalize about STR conversion rates (they depend on a bank’s products, client base, geography and other factors), a 2020 study by the Royal United Services Institute and the SWIFT Institute cite statistics suggesting conventional transaction monitoring platforms have conversion rates of roughly 2 to 10 per cent.

FinTRAC also identified deficiencies with ICBK’s “risk-based approach,” another requirement of the bank’s compliance program. Of chief concern was ICBK’s ability to identify and appropriately scrutinize high-risk clients.

Banks are also required to conduct a comprehensive evaluation of their compliance programs at least every two years. But FinTRAC discovered that ICBK failed to properly evaluate all elements, including those relating to the reporting of suspicious transactions.

This was especially problematic because ICBK’s lack of testing of its STR process was also flagged during the regulator’s 2015 examination.

Open this photo in gallery:

As for ICBK’s overall state of compliance, FinTRAC concluded the identified deficiencies “have put the Program in a state that requires urgent attention.” The regulator further expressed concern about ICBK’s ability to stay abreast of evolving legislative changes.

“FinTRAC’s examination of the Bank’s Program in 2013, 2015 and 2019 confirms that it has not kept pace with these regulatory changes based on the deficiencies identified,” FinTRAC stated in a letter dated Aug. 6, 2020.

“Despite the fact the Bank has been operating within Canada at least 10 years, there are still deficiencies across key pillars of the Program.”

Ultimately, FinTRAC levied its $701,250 penalty on Oct. 4, 2021. When the regulator made the penalty public that December, FinTRAC stated the bank had committed three “administrative violations.”

They included the bank’s failure to treat activities of some entities as high risk; its failure to submit STRs; and its failure to institute and document the required review of some areas of its compliance policies and procedures.

ICBK downplayed the violations.

“A 2019 routine FinTRAC review identified gaps in the Bank’s anti-money-laundering/anti-terrorist-financing (AML/ATF) program in limited circumstances,” the bank said in a news release.

“The Bank reviewed the findings and concluded that they were human and administrative errors and has implemented an action plan to address and correct all concerns. There is no evidence of any misconduct related to the concerns that were identified.”

---

ICBK’s statement didn’t tell the whole story. A confidential copy of FinTRAC’s 2019 examination report and supporting documents stated the bank had “structural gaps” across most of its compliance program.

FinTRAC’s report further stated that three of the seven unreported suspicious transactions were connected to production orders from police.

FinTRAC report shows examples of suspicious account activity

One customer identified only as L.L., a Beijing resident, was purportedly a “hospital doctor.” The RCMP, however, notified the bank in 2018 that the individual was suspected of committing drug and money-laundering offences. Although the bank subsequently reviewed the client’s transactions, it failed to file an STR with FinTRAC, even though the activity had hallmarks of money laundering.

A second example involved an Ontario numbered company – ostensibly a property holding and management business – that was the focus of a fraud investigation by Toronto Police in 2018. Yet the bank filed no STRs because of that production order either.

The third instance involved a resident of Markham, Ont., who deposited counterfeit cheques. Days after closing the account in 2018, ICBK received a production order from Niagara Police about a fraud investigation. Even then, it failed to file an STR.

FinTRAC’s report also provided examples of how ICBK ignored media stories pointing to high-risk clients, which runs counter to the regulator’s guidance on spotting indicators of financial crime.

One business customer in B.C.’s arts sector was linked through its parent company to a Chinese state – owned arms and explosives dealer under U.S. sanctions. But Poly Culture North America Investment Corporation Ltd. still received millions of dollars in a U.S. deposit account. Those transactions continued for more than a year after ICBK discovered adverse information in media reports about PCNAIC and its Chinese sister company in 2017.

A second customer, meanwhile, was a state-owned Pakistani bank for which ICBK provided correspondent banking services.

Correspondent banking – when a bank facilitates transactions such as wire transfers on behalf of another lender in a foreign market – is a money maker but considered risky from an anti-money-laundering compliance perspective.

ICBK’s customer, Sindh Bank Ltd., was involved in a massive money-laundering and fake-accounts scandal that led to the arrest of former Pakistani president Asif Ali Zardari in 2019. Some of those illicit funds flowed to Canada.

FinTRAC’s compliance exam determined that ICBK’s transaction monitoring system had “no rules or scenarios that cover correspondent banking services.”

Other suspicious transactions also slipped through the cracks. The bank, for instance, failed to detect transactions that benefitted a university student who received approximately $10,000 to $40,000 worth of EFTs each month.

FinTRAC also identified problems with the bank’s SWIFT Electronic Funds Transfer Reports (EFTRs). (SWIFT, or the Society for Worldwide Interbank Financial Telecommunications, is a secure payments messaging system used by banks around the world.)

Specifically, three incoming SWIFT EFTRs contained incomplete information about who received the funds.

There were also 83 reports consisting of EFTRs and LCTRs that had vague details about the occupations of people who sent and received money. FinTRAC noted “this is a repeat finding” from the 2013 and 2015 compliance exams.

“This further shows a trend of non-compliance with long-standing regulatory obligations,” the regulator said.

The bank’s effectiveness review, meanwhile, also had testing gaps in ICBK’s escalation process for terrorist property reports.

“FinTRAC identified structural gaps within most of the Bank’s compliance program, which ultimately led to the Bank failing to report suspicious transactions,” the report stated.

“Some of these gaps had been previously identified by FinTRAC in past compliance examinations, with the expectation that they had been addressed.”

---

On Oct. 5, 2022, the regulator informed the bank that FinTRAC’s follow-up process was complete, but warned it could revisit the issues in future exams to assess the effectiveness of the bank’s fixes.

Not all the problems were resolved. In 2023, an internal report prepared by ICBK staff indicated that some deficiencies continued. The report, which is dated June 8, 2023, covered branch activities from April 1, 2022, to March 31, 2023.

Staff in some branches, including those in Toronto, Richmond Hill, Ont., Mississauga and Vancouver-Richmond, still failed to grasp the requirement to file LCTRs to FinTRAC. They also struggled to handle customers who were making large cash deposits.

In the downtown Toronto branch, for instance, some tellers showed a lack of curiosity about clients making deposits just under the $10,000 reporting threshold and didn’t understand how to instruct customers to validate the source of funds.

Certain staff inappropriately informed clients about the bank’s internal screening and monitoring rules for LCTRs, the report added.

Some employees also coached clients on how to structure deposits in smaller amounts over time and advised them how long deposits should remain in their accounts to avoid breaking the rules. (The structuring or attempted structuring of financial transactions became an offence in 2023.)

The bank’s report additionally noted instances in which front-line staff caved to pressure from angry or impatient customers by fulfilling their deposit requests even if doing so meant violating regulations.

Roughly 60 per cent of staff demonstrated insufficient knowledge about LCTRs, the report said.

All branches, meanwhile, had staff who seemed confused about capturing other out-of-the-ordinary client activity in so-called Unusual Transaction Reports.

The report also said that ICBK branches had difficulties with account openings, closures, Canada Revenue Agency forms and customer due diligence. Such problems, it added, create an inherently high level of risk for the bank.

Some know-your-client forms, for example, were missing the customer’s employer and occupation, the report said, citing FinTRAC’s previous findings on issue.

In response to The Globe’s queries, FinTRAC reiterated its previously stated reasoning for imposing a $701,250 penalty on ICBK, adding the act and its associated regulations establish precise penalty ranges for each violation.

FinTRAC “is limited in what it can share publicly in relation to the activities and operations of businesses outside of the context of an administrative monetary penalty,” said spokeswoman Ms. Goulette Nadon. Companies that fail to take corrective measures risk further enforcement actions including additional penalties, she added.

ICBK, meanwhile, declined to say if the bank had fixed all the deficiencies outlined in its 2023 internal report.

“At ICBK, our focus remains on serving our customers and Canada with integrity while maintaining a strong compliance framework that aligns with evolving regulatory standards,” said the bank’s Mr. Hamers.

“We will continue working with the appropriate authorities to ensure our operations meet all the requirements for compliance, security, trust and responsible banking in Canada.”

Its Chinese parent company, ICBC, did not respond to a request for comment from The Globe.

The Bank of East Asia, meanwhile, confirmed that it still owns a minority stake in ICBK but noted that it does not participate in the day-to-day management of operations.

“We understand that ICBK has been pro-actively addressing FinTRAC’s concerns,” stated Marcella Yeung, acting head of corporate communications for the Hong Kong-based bank.

---

Open this photo in gallery:

Canada’s spy agency, the Canadian Security Intelligence Service, has previously warned the federal government that Chinese companies are compelled by law to share information with Beijing, including customer data.

At least three pieces of legislation – China’s National Security Law (2015), China’s National Intelligence Law (2017) and China’s Cyber Security Law (2017) – compel commercial entities and individuals to assist government and intelligence entities with security issues when required.

ICBC already plays a security and defence role in China. A branch in the province of Qinghai has assembled its staff into a part-time militia, The Economist reported last year.

The bank’s goal was to “contribute its strength towards national defence,” the story said. The ICBC militia included uniforms, a command centre and storage for military equipment, according to the report.

The Chinese government began putting pressure on banks and other companies to form private militias in 2023.

That same year, Canada raised national-security concerns about another lender, Wealth One Bank of Canada, over fears its founding shareholders could be susceptible to foreign influence by Beijing.

It is unknown whether government officials raised similar concerns about ICBK, which has direct ties to the Chinese government.

Ottawa, however, gave OSFI new powers to thwart foreign interference through the financial system in 2023.

OSFI released an Integrity and Security Guideline the following year. Its guideline, though, only applies to financial institutions, including the branches of foreign lenders and insurers, “to the extent it is consistent with applicable requirements and legal obligations related to their business in Canada.”

Moreover, OSFI’s guidance only encourages – rather than requires – financial institutions to report suspected instances of foreign interference to authorities that include CSIS and the RCMP.

“OSFI is a principles-based regulator that focuses on broad, overarching principles, meaning it focuses on outcomes and principles rather than rigid rules, allowing flexibility for different institutions and risk profiles,” wrote spokesman Shane Diaczuk in an e-mail.

Still, he stressed that OSFI has put anti-money-laundering at the core of its integrity and security mandate.

“To be clear, AML deficiencies are a threat to an institution’s safety and soundness, and to public confidence in the financial system,” said Mr. Diaczuk. “When we find deficiencies, we take swift and decisive action, which includes increasing the level of supervisory oversight for the institution.”

The Department of Finance said “the government has undertaken significant reforms and investments in recent years” to detect and deter financial crime, including strengthening FinTRAC’s supervision of federally regulated financial institutions (FRFIs).

“Canadians must be confident that FRFIs and their owners act with integrity, and that Canada’s financial institutions are protected, including from foreign interference,” added the department’s Ms. Faucher.

Although it is law enforcement’s responsibility to counter violence, Canada’s anti-money-laundering compliance regime plays a role in disrupting foreign influence by monetary means, says Mr. Manchester, the anti-money-laundering expert who runs a financial-intelligence training company.

“Yet Canada’s efforts to combat money laundering, terrorist financing and national security threats to the financial services industry remain woefully inadequate,” Mr. Manchester says.

“Our regulators are chronically underfunded and are constrained by a legal and regulatory environment that falls behind those of our peers in the G7, NATO and other groups.”

---

With files from David Milstead and Stephanie Chambers