Thirteen years after HSBC’s ties with the Vatican Bank surfaced, the core question remains: how did a global bank keep accounts for an institution that had spent decades under scandal clouds?
The Vatican Bank, officially the Institute for the Works of Religion (IOR), operates from inside Vatican City. It is run by a Board of Superintendence. By 2012, the IOR had been embroiled in so many scandals that reform was no longer optional. That year, it gave its first presentation of its operations. In 2013, it launched a website and published its first-ever annual report. These were late, defensive moves.
HSBC had maintained correspondent accounts with the IOR. Those accounts let the Vatican Bank move money through HSBC’s systems. The risk was concrete. Illicit funds could travel from the IOR into the global financial system, laundered through a legitimate channel. HSBC’s anti-money-laundering and know-your-customer practices were suddenly under a harsh light.
The stakes were not abstract. Correspondent banking is the plumbing of international finance. A bank in one country holds accounts for a bank in another country, letting the second bank conduct transactions it could not otherwise do. When that plumbing carries dirty money, the consequences hit real people: drug traffickers launder proceeds, tax evaders hide assets, and sanctioned entities evade restrictions. HSBC’s relationship with the IOR opened a door. The question was who walked through.
Regulators took notice. HSBC faced significant pressure to clean up its correspondent banking relationships. The bank promised remediation. It pledged enhanced compliance reviews. It said it would close legacy correspondent accounts. These were not small promises. Closing a correspondent account severs a banking relationship entirely. It cuts off a flow of transactions. It is a blunt instrument.
What is not clear from available records is the specific penalty HSBC faced. The terms of any deferred-prosecution agreement or monitorship are not detailed in the source material. But the regulatory pressure was real. HSBC argued that its steps would prevent similar issues in the future. It insisted its correspondent banking relationships would be aligned with compliance standards.
Thirteen years on, the episode is a case study in how long reform takes. The Vatican Bank did not publish an annual report until 2013. That was decades after its first scandal. HSBC did not close problematic accounts until regulators forced the issue. The bank’s own compliance reviews were reactive, not proactive.
The risk that correspondent banking poses is structural. A single account can connect a scandal-plagued institution to the entire global system. The IOR was not a small, obscure entity. It was the bank of the Holy See. It was inside Vatican City. It had a Board of Superintendence. It had been in trouble for years. HSBC knew this. It kept the accounts anyway.
The lesson is not a tidy one. Banks will argue they need to serve all legitimate customers. Regulators will argue that compliance must come first. In between, the accounts stay open. The money moves. The scandals continue. Then, years later, someone asks what went wrong. That is where we are now.
