The Panama Papers broke in 2016. The New York Department of Financial Services (NYDFS) fined Skandinaviska Enskilda Banken $33 million in 2025. That nine-year gap highlights how AML/CFT Framework deficiencies can compound over time.
You can't treat a data leak as a one-time event. When the Panama Papers exposed SEB's weaknesses, the bank faced more than just reputational damage. It triggered a regulatory timeline that ended nearly a decade later with a hefty penalty. The mistakes revealed in 2016 became the evidence for enforcement in 2025.
This pattern is common in the industry. Historical leaks create permanent regulatory records. Your lookback obligations extend years into the past. A control gap you close today still leaves a trail of transactions, customer relationships, and documentation failures that examiners will scrutinize.
Here's what keeps going wrong, and how to fix it before your own timeline starts.
Why These Mistakes Keep Happening
AML programs often fail because teams treat compliance as a one-time task rather than a continuous obligation. You pass an exam, think you're done, remediate a finding, and move on. But your Customer Due Diligence (CDD) files, transaction monitoring rules, and governance documentation create permanent records. Regulators will measure you against the standards that existed when you onboarded a customer or processed a transaction, not the standards you meet today.
The Panama Papers didn't create new obligations. They revealed which institutions had been ignoring existing ones. The gap between what you should have done and what you actually did becomes evidence.
Mistake 1: Treating Enhanced Due Diligence as Optional for Complex Structures
Why it happens: Your risk assessment flags a customer with offshore entities, but the business relationship seems legitimate. The customer provides some documentation. You approve the account to avoid losing revenue, even though the customer hasn't done anything obviously suspicious yet.
Real consequence: When a leak exposes that customer's involvement in tax evasion or sanctions circumvention, your file shows you saw the red flags and onboarded them anyway. Regulators like NYDFS will review your entire book of business for similar patterns. Every customer with a comparable structure becomes suspect. Your lookback now covers years of transactions.
The fix: Apply Enhanced Due Diligence to any customer using legal structures that obscure beneficial ownership, regardless of their stated purpose. This means:
- Source of wealth documentation, not just source of funds
- Independent verification of beneficial owners through corporate registries or third-party data
- Documented rationale for accepting the relationship despite elevated risk
- Ongoing Due Diligence reviews at least annually, with transaction monitoring thresholds set lower than your standard customer segments
If you can't verify beneficial ownership to the natural person level, decline the relationship. The revenue isn't worth the enforcement exposure.
Mistake 2: Relying on Customer-Provided Documentation Without Independent Verification
Why it happens: Your CDD procedures require identity documents and business formation papers. The customer submits them. They look legitimate. You file them and move forward because you've checked the box.
Real consequence: Sophisticated money launderers provide real documents for fake structures. Shell companies have legitimate incorporation papers. Nominees appear on official registries. When those structures collapse in a leak or investigation, your file proves you never verified the information independently. You accepted what you were given.
The fix: Build independent verification into every CDD workflow:
- Cross-reference beneficial owners against corporate registries in the jurisdiction of formation
- Use adverse media screening on beneficial owners and related entities, not just the customer
- Verify business activity through public records, trade references, or site visits for high-risk relationships
- Document discrepancies between customer-provided information and your independent findings, and resolve them before account opening
Your CDD file should show what you verified, not just what you received.
Mistake 3: Failing to Connect Historical Red Flags to Current Risk Ratings
Why it happens: You conduct Periodic Reviews on a schedule. Your customer had suspicious activity two years ago, but it didn't result in a Suspicious Activity Report (SAR). The current review shows normal transaction patterns. You leave the Customer Risk Rating unchanged because you're looking at the present, not the pattern.
Real consequence: Historical red flags don't expire just because you didn't file a SAR. When regulators examine your program, they'll see the pattern you missed: structuring that stopped when you asked questions, then resumed six months later. Geographic exposure that shifts to match sanctions developments. The customer's risk didn't decrease; they adapted to your monitoring.
The fix: Incorporate historical red flags into every Periodic Review:
- Flag any customer who triggered alerts in the past 36 months, even if you didn't file a SAR
- Require documented analysis of why previous suspicious patterns haven't recurred or how the customer's activity has changed
- Escalate to your Money Laundering Reporting Officer (MLRO) any customer whose transaction patterns shift significantly between review periods
- Increase review frequency for customers with historical red flags, don't just maintain the standard cycle
Your risk rating should reflect the customer's entire relationship history, not a snapshot.
Mistake 4: Assuming Remediation Closes Historical Exposure
Why it happens: You discover a control gap, fix it, and document the remediation. You've addressed the problem going forward. You assume that's sufficient because you can't undo the past.
Real consequence: Remediation doesn't erase historical deficiencies. If you failed to conduct Enhanced Due Diligence on high-risk customers for three years, fixing your procedures today doesn't cure the relationships you already onboarded. Regulators will require lookback reviews covering the entire period of the deficiency. For SEB, deficiencies that came to light in 2016 still resulted in enforcement action years later because the underlying relationships and transactions remained problematic.
The fix: Treat remediation as the start of the work, not the end:
- Conduct lookback reviews on all relationships affected by the control gap, covering the full period of the deficiency
- Apply current Enhanced Due Diligence standards to historical onboarding decisions
- File SARs on any relationships or transactions that wouldn't meet current standards
- Exit relationships that can't satisfy current CDD requirements, even if they were approved under prior procedures
Document the scope of your lookback, the methodology, and the outcomes. Regulators will ask for this during exams.
Mistake 5: Separating Compliance from Business Strategy
Why it happens: Your business development team pursues high-growth markets and complex customer segments. Your compliance team reviews the relationships after onboarding. The two functions operate on separate tracks because you've organized them that way.
Real consequence: By the time compliance sees the risk, the relationship is active and generating revenue. Exiting becomes a business decision, not a compliance decision. You end up managing risk you should have declined, and your file shows compliance raised concerns that business overrode. When enforcement comes, that documented conflict proves you knew the risk and accepted it anyway.
The fix: Integrate compliance into business strategy before customer acquisition:
- Require compliance sign-off on new product launches, market entries, and customer segment expansions before business development begins outreach
- Include your MLRO in strategic planning discussions, not just operational reviews
- Build compliance costs (including Enhanced Due Diligence, ongoing monitoring, and potential Suspicious Activity Report) into customer profitability models
- Establish clear escalation paths that allow compliance to stop onboarding without business override
Compliance can't be a service function that supports business decisions. It sets boundaries for which decisions are permissible.
Prevention Checklist
Use this checklist quarterly to audit your program against the patterns that lead to long-term enforcement exposure:
- All customers with offshore entities, complex structures, or beneficial ownership chains have Enhanced Due Diligence files with independent verification of beneficial owners
- CDD procedures require independent verification, not just document collection, and your files show what you verified
- Periodic Reviews incorporate historical red flags from the past 36 months and document why risk ratings remain appropriate despite past alerts
- Any control gap remediation includes a documented lookback covering all affected relationships and transactions during the period of the deficiency
- Compliance has formal sign-off authority on new markets, products, and customer segments before business development begins outreach
- Your governance documentation shows compliance setting risk boundaries, not business overriding compliance concerns
The Panama Papers exposed deficiencies that institutions should have caught years earlier. The enforcement actions that followed punished the failure to maintain adequate controls over time, not just the failure to respond to the leak. Your program will be measured against the standards that existed when you made the decision, not the standards you meet when the examiner arrives. Close the gaps now, or defend them later with an eight-figure penalty attached.
