Superintendent Maria T. Vullo today announced that the Department of Financial Services (DFS) has entered into two consent orders with Société Générale SA and its New York branch under which the bank will pay fines totaling $420 million for violations of laws governing economic sanctions and New York anti-money laundering laws. A DFS investigation found that the bank executed billions of dollars in illegal and non-transparent transactions to parties in countries subject to embargoes or otherwise sanctioned by the United States, including Iran, Sudan, Cuba and Libya, and its New York branch violated New York Anti-Money Laundering (AML) and recordkeeping laws in the New York branch’s operations. In addition, the bank and the New York branch violated provisions of the banks’ 2009 agreement with DFS to implement and maintain an effective Bank Secrecy Act/Anti-Money Laundering Law (BSA/AML) compliance program and transaction monitoring system. Société Générale will pay DFS $325 million for sanctions violations and $95 million for the BSA/AML violations.

“The absence of an effective, global sanctions-compliance infrastructure and lack of management oversight allowed Société Générale employees to ignore the scope and applicability of laws governing economic sanctions, as well as New York anti-money laundering and recordkeeping laws,” said Superintendent Vullo. “With these consent orders, DFS is holding Société Générale accountable for complying with U.S. and New York anti-terrorism and anti-money laundering laws and ensuring its vigilance against illicit activity. The Department appreciates the bank’s cooperation in resolving these matters and commitment to full remediation of its compliance deficiencies.”

Sanctions Violations

A DFS investigation found that from 2003 to 2013 Société Générale failed to take sufficient steps to ensure compliance with U.S. sanctions laws and regulations in a timely manner. Individuals responsible for originating U.S. dollar transactions outside of the U.S. had a minimal understanding of U.S. sanctions laws and regulations as they related to Sudan, Iran, Cuba, North Korea, or other U.S. sanctions targets. DFS conducted its investigation in conjunction with the Department of Justice, the Manhattan District Attorney, the Federal Reserve Board, and the Office of Foreign Assets Control (OFAC), which are also announcing resolutions for sanctions violations today.

During the review period, Société Générale executed, in an improper, non-transparent manner, more than 9,000 outbound U.S. dollar payments, valued at over $13 billion. More than $12.5 billion of these non-transparent payments involved Iran, nearly $130 million were connected to Cuba, and approximately $29 million were tied to Sudan.

In violation of applicable laws governing economic sanctions, Société Générale executed more than 2,600 outbound U.S. dollar payments, valued at approximately $8.3 billion, during the review period. Nearly $7.7 billion of these impermissible transactions related to the bank’s Cuban credit facilities, approximately $333 million implicated sanctions against Sudan, and nearly $140 million involved sanctions against Iran. The remaining impermissible payments were made in violation of sanctions against Libya (approximately $145 million), Myanmar (approximately $14 million) and North Korea ($500,000).

Iran

Many of the payments to Iran were so-called “U-Turn payments,” which were allowable under laws governing economic sanctions until November 2008. Under the exception, U.S. financial institutions were authorized to process certain funds transfers for the direct or indirect benefit of Iranian banks, other persons in Iran, and the government of Iran, provided that such payments were initiated offshore by a non-Iranian, non-U.S. financial institution and only passed through the U.S. financial system en route to another offshore, non-Iranian, non-U.S. financial institution. However, executing compliant U-Turn transactions often triggered alerts at U.S. financial institutions, possibly subjecting the flagged transactions to further review and taking longer than the bank’s customers expected or desired. The bank also corresponded with customers to assure them that U.S. sanctions would have a minimal impact on customer service despite existing sanctions laws.

Elevating customer service over compliance, the bank’s Paris Operations Department developed a procedure specifically for what it called “international settlement with countries under USD embargo” when processing U.S. dollar payments involving Iran. This procedure frequently involved using “cover-payments” to avoid detection in the U.S. by dividing the payment instructions involving Iranian bank treasury transactions or customer payments into two message streams. The first SWIFT payment message, known as an MT103, included all details about the transaction, which Société Générale would send directly to the Iranian beneficiary’s bank. The bank would then send a second message, known as an MT202, or “cover payment” message, to the bank’s New York branch. The cover payment message did not include details about the underlying parties to the transaction and was sent to allow a transaction to be settled in U.S. dollars. If such information was inadvertently included in the MT202 payment message, it would sometimes be removed or “stripped” from the message, a practice known as “wire stripping.”

Cuba

DFS’s investigation also found that during the review period, the bank’s Global Finance Department maintained a number of U.S. dollar-denominated credit facilities related to Cuban parties or assets in violation of U.S. laws restricting business with Cuba. During the review period, the bank maintained approximately 30 such facilities, some of which involved Cuban entities and others implicated financing of foreign trading companies exchanging Cuban commodities. As with its Iranian business, the bank worked during the review period to ensure that U.S. sanctions did not interfere with its Cuba-related business. General guidelines applicable to the bank’s handling of U.S. dollar transactions on behalf Iranian parties were equally applicable to U.S. dollar transactions possibly implicating Cuban restrictions.

Sudan

To facilitate USD transactions involving a Sudanese entity, Société Générale personnel at its Paris Rive Gauche Enterprises branch sent payment instructions to U.S. financial institutions through the SWIFT payment messaging system, omitting the Sudanese entity’s address to avoid triggering the bank’s transaction monitoring and sanctions filtering tools or raising red flags at the U.S. dollar clearing institution. Instead, nearly all of the relevant SWIFT messages transmitted to the U.S. listed an address for the Sudanese entity in Paris associated with one of its shareholders.

Consequently, the nexus between the transaction and the sanctions target was not apparent on the face of the payment message, and regulators and others involved in the transaction flow were deceived.

The DFS investigation determined that from May 2007 through March 2012, the bank illegally conducted 260 outbound USD transactions on behalf of the Sudanese entity totaling more than $22 million. All but two of these illicit transactions listed the Paris address for the Sudanese entity in the outbound payment message, and 20 of these transactions, totaling approximately $2 million, cleared directly through the bank’s New York branch.

Inadequate Controls

The DFS investigation determined that a principal factor that allowed these unlawful practices to flourish at the bank was the inadequacy of the Société Générale’s sanctions-related internal controls. In 2003, the bank issued a group-wide policy on combating terrorist financing that discussed sanctions compliance. The policy focused primarily on French and European Union requirements and mentioned laws governing economic sanctions only in passing. However, the policy did state that laws governing economic sanctions “apply to transactions denominated in US dollars, regardless of the location of the issuing institution, if these transactions transit through United States territory.” Despite the fact that this information was circulated to compliance officers group-wide, wide-ranging prohibited and non-transparent transactions continued through the bank’s New York branch.

Under the consent order announced today, Société Générale must submit to DFS a written Sanctions Compliance Plan, acceptable to DFS, to improve and enhance the bank’s compliance with applicable OFAC and New York laws and regulations relating to sanctions compliance.

The bank must also develop a Corporate Oversight Plan to enhance oversight by the management of Société Générale and the New York branch, including the branch’s compliance with applicable OFAC and New York laws and regulations relating to sanctions compliance. DFS recognizes Société Générale’s substantial cooperation with the Department’s investigation, including the bank’s own internal investigation and the voluntary disclosure that the bank submitted to OFAC in February 2013 and which was subsequently shared with the Department.

Bank Secrecy Act/Anti-Money Laundering Violations

On March 4, 2009, Société Générale and its New York branch entered into a written agreement with DFS through its predecessor, the New York State Banking Department and the Board of Governors of the Federal Reserve System, acknowledging that bank examinations had identified deficiencies in the branch’s compliance and risk management programs.

While the Branch made substantial gains in improving its compliance program between 2009 and 2013, subsequent targeted DFS examinations found that the branch’s compliance with the written agreement and New York’s anti-money laundering laws and regulations had fallen off precipitously. DFS examiners discovered fundamental deficiencies in the branch’s policies and procedures governing suspicious activity reporting and remaining flaws in the branch’s customer due diligence protocols.

Under the consent order announced today, Société Générale must submit to DFS written plans to revise its BSA/AML compliance program, and enhance its customer due diligence program as well as oversight by the management of the bank and the New York branch of the New York branch’s compliance with BSA/AML requirements and relevant state laws and regulations.

The bank must also engage an independent consultant to conduct an evaluation of Société Générale’s and the New York branch’s implementation of the remedial steps outlined in the consent order.

DFS acknowledges Société Générale’s sound cooperation in this matter, including demonstrating a commitment to remediating the shortcomings identified, and to building effective and sustainable BSA/AML and OFAC compliance programs.

Société Générale is an international banking and financial services company with about $1.5 trillion in assets as of June 30, 2018. Its New York branch provides corporate and investment banking services principally to commercial and institutional customers. The branch conducts U.S. dollar clearing for Société Générale’s branches and affiliates, having cleared nearly two million transactions totaling approximately $21 trillion in 2017.

• Read a copy of the Société Générale consent order related to the sanctions violations.
• Read a copy of the Société Générale consent order related to the BSA/AML violations.