I. LEGAL FRAMEWORK

1. United States – Birthplace of Banking DPAs

Introduced by Clinton DOJ in 1993, formalized in US Attorneys' Manual 9-28.000.
Purely prosecutorial discretion – no judicial approval required initially, now limited court review.
Used for: BSA violations, AML, sanctions evasion, FCPA.

Key Features for Banks:

• Must file Information / criminal complaint but defer prosecution
• Financial penalty + forfeiture
• Replacement of leadership, compliance overhaul
• Independent monitor for 3-5 years
• Breach = immediate prosecution

2. United Kingdom – SFO DPA Regime

Crime and Courts Act 2013, Schedule 17, and DPA Code of Practice.
Difference from US: Requires High Court approval. Judge must be satisfied DPA is in interests of justice and terms are fair, reasonable, proportionate.

First used 30 Nov 2015.

3. Singapore – New Regime

DPAs introduced into Singapore's Criminal Procedure Code (CPC) in 2018 via Criminal Justice Reform Act, new Part VIIA.

Under DPA framework, companies can seek to avoid criminal prosecution in exchange for compliance with certain conditions, restricted to offences in Sixth Schedule to CPC – i.e., offences relating to corruption, money laundering, dealing with stolen property or proceeds of crime, and falsification of records.

• Applies only to corporates, not individuals
• Public Prosecutor agrees to defer prosecution in exchange for remediation, adequate compliance procedures, appointment of monitor.
• Self-reporting is factor in decision to offer DPA and on penalty.
• No bank DPA has been concluded yet in Singapore, but MAS and CAD have indicated it will be used for financial institutions for corruption and money laundering offences.

4. India

India has NO formal DPA statute for banks. Closest analogues:

• Compounding under FEMA, PMLA Sec 42, Companies Act Sec 441
• Plea Bargaining under CrPC Chapter XXI-A (only for individuals, max 7 years)
• Settlement Commission under SEBI and RBI
• Consent mechanism before SEBI – for securities law violations

Law Commission Report 2024 and SFIO proposals have recommended introducing DPA-like regime for corporate fraud to avoid collateral damage to banks.

II. WHY BANKS GET DPAs – THE RATIONALE

Courts accept DPAs because:

• De-risking: If HSBC lost its US dollar licence in 2012, global payments would freeze.
• Deterrence through monitor is more effective than fine alone.
• Encourages self-reporting.

III. LANDMARK CASE LAWS IN BANKING

A. US BANKING DPAs – The Sanctions & AML Wave

1. United States v. HSBC Bank USA, N.A. & HSBC Holdings plc – DPA 11 Dec 2012 – $1.9 Billion – THE LARGEST AML DPA

Facts: DOJ investigation found HSBC failed to monitor $200 trillion in wire transfers, allowed $881m of Mexican cartel drug money through Mexican subsidiary HBME, stripped sanctions references for Iran, Sudan, North Korea. Falsified records of New York financial institutions.

Terms: DOJ entered 5-year DPA. Terms included:

• Forfeiture $1.256 billion criminal penalty
• Plus $660m civil – FinCEN and OCC – total $1.9b
• Replacing top leadership executives
• Retaining independent compliance monitor (Michael Cherkasky)
• Enhanced AML controls

If prosecution had occurred, HSBC could have lost its US charter. DOJ stated DPA allowed HSBC to demonstrate compliance. In 2017, DOJ filed motion seeking dismissal after HSBC lived up to all commitments. HSBC today claims it combats financial crime much more effectively as result of reforms.

2. Standard Chartered Bank – DPA 2012 ($327m) and Extended DPA 2019 ($1.1bn)

First DPA: 10 Dec 2012 – SCB admitted violating NY law by falsifying records of NY financial institutions to hide $250bn Iranian transactions. Settlement $327m with DOJ, NYDFS.

Second: 9 Apr 2019 – Extended DPA for 2 years, forfeiture $240m + fine $480m approx total $1.1b for continued sanctions violations and falsifying records. Shows breach of first DPA leads to extension.

3. ING Bank N.V. – DPA 2012 – $619m
ING admitted stripping payment messages to conceal Iranian and Cuban sanctions violations – largest at time. Used to create precedent for SWIFT message stripping as crime.

4. Commerzbank AG – DPA 2015 – $342m
Similar sanctions evasion, failure to maintain adequate BSA compliance.

5. Credit Agricole, BNP Paribas (2014 – $8.9bn – Guilty Plea, not DPA)
Shows limit – when conduct too egregious, DOJ refused DPA and required guilty plea. BNP lost USD clearing for 1 year.

B. UK – FIRST UK DPA

SFO v ICBC Standard Bank Plc (now ICBC Standard Bank) – Southwark Crown Court – Approved by Lord Justice Sir Brian Leveson – 30 November 2015

Facts: Standard Bank failed to prevent bribery under Sec 7 Bribery Act 2010. Sister company Stanbic in Tanzania paid $6m bribe to Tanzanian government to secure $600m sovereign note placement. Bank charged with failure by commercial organization to prevent bribery.

This was first ever UK DPA.

Terms approved by High Court:

• Indemnity payment $6m + fine $16.8m + disgorgement $8.4m profit
• 3-year term
• Independent review of anti-bribery controls
• Cooperation with SFO
• Simultaneous settlement with SEC for anti-fraud provisions of Securities Act 1933 – $4m

Judge Leveson held pre-conditions in Crime and Courts Act 2013 met, DPA was in public interest. Established UK test:

1. Is DPA in interests of justice? (seriousness, collateral impact, self-reporting)
2. Are terms fair, reasonable, proportionate?

Lessons: Self-report within days, full cooperation, limited history. Financial services organizations now know what could happen instead of prosecution.

Subsequent UK Banking DPAs:

• SFO v Rolls-Royce (2017) – not bank but established monitor model used for banks
• SFO v Tesco Bank, Barclays – Deferred – discussions

C. Other Banking Examples

Lloyds Bank – DPA 2014? Shadow Regulatory State debate: Lloyds settled LIBOR manipulation via DPA – showed DPAs ensnared 300+ businesses including 10 of 100 largest US companies.

Halkbank – 2024 Proposed DPA – Criticized: US offered DPA to Turkish Halkbank for Iran sanctions evasion with zero consequence, no monitor, unlike HSBC and Standard Chartered which paid $1.1b-$1.9b and accepted monitoring. Critics said normalization of zero-consequence DPA for state-linked banks.

IV. KEY DISTINCTIONS – DPA vs NPA vs Guilty Plea

For banks, DPA preserves license, NPA even better, Guilty Plea risks debarment.

V. COMPLIANCE CONDITIONS IMPOSED ON BANKS – COMMON TEMPLATE

From HSBC and Standard Bank DPAs:

1. Financial: Criminal fine + forfeiture + restitution to victims
2. Governance: Replacement of senior management, Board oversight committee
3. Compliance Program: Transaction monitoring uplift, sanctions screening, KYC remediation, SAR filing improvements
4. Independent Monitor: 3-5 years, quarterly reports to DOJ/SFO
5. Cooperation: Must cooperate in prosecution of individuals
6. Reporting: Annual self-certification, breach notification
7. Clawback: Forfeiture of executive bonuses

VI. CRITICISM & FUTURE IN ASIA

Critics argue DPAs create "too big to jail" – 300+ American and foreign businesses including Standard Chartered, HSBC, GSK avoided prosecution. Deterrence weak if fine is less than profit.

Singapore introduced DPAs to increase corporate accountability for acts of bribery, corruption, money laundering – aligning with global trends, but also requires court approval to avoid US-style criticism of unchecked prosecutorial discretion.

India – if introduced, likely to follow Singapore/UK model with High Court approval, not US.