Inside the Money Laundering Scheme That Citi Overlooked for Years

How Citigroup's Banamex USA unit turned a blind eye on the Mexican border.

Illustrator: Noma Bar

When Antonio Peña Arguelles opened an account in 2005 at Citigroup’s Banamex USA, the know-your-customer documents said he had a small business breeding cattle and white-tailed deer, ranch-raised for their stately antlers. About $50 a month would come into the account, according to the documents.

A week later, Peña Arguelles wired in $7.09 million from an account in Mexico, allegedly drug money from Los Zetas, a violent cartel founded by former Mexican soldiers, documents in his money-laundering case in Texas say. In all, Peña Arguelles shuttled $59.4 million through the account, according to a confidential report by banking regulators that berated Banamex USA in 2013 for its failure to comply with anti-money-laundering rules.

Banamex USA didn’t file a suspicious activity report about the account, according to regulators, even after Peña Arguelles’s brother Alfonso was killed in late 2011, his body dumped at the Christopher Columbus monument in Nuevo Laredo, Mexico, with a banner draped above it accusing Antonio of being a money launderer and stealing from the Zetas. The bank didn’t produce an activity report after U.S. prosecutors asked for the account documents at the end of that year or when Peña Arguelles was indicted in early 2012 for conspiracy to launder monetary instruments. And it didn’t file one until May 2013, months after the Federal Deposit Insurance Corp. and the California Department of Business Oversight issued a written order in August 2012 demanding the bank check old accounts.

Alfonso Peña Arguelles was murdered in 2011 and his body was dumped at the Christopher Columbus monument in Nuevo Laredo, Mexico, under a banner calling his brother Antonio 'a money-laundering murderer living in the U.S.'
Alfonso Peña Arguelles was murdered in 2011 and his body was dumped at the Christopher Columbus monument in Nuevo Laredo, Mexico, under a banner calling his brother Antonio 'a money-laundering murderer living in the U.S.'
Photographer: STR/AFP/Getty Images

So in June 2013, when more than a dozen Citigroup and Banamex USA executives walked into a meeting to discuss progress on satisfying that order, they faced a group of angry state and national regulators. “Management and board supervision of the bank’s affairs has been critically deficient,” the FDIC and the California agency wrote about Banamex USA in the confidential report, reviewed by Bloomberg, which has never been publicly disclosed. “The willingness to accept and maintain a customer relationship identified with major illicit activity is revealing as to the board’s appetite for reputational and money laundering risk.” The report blasted Banamex USA for looking the other way and for failing to fix problems despite budgeting $32 million that year alone to correct them.

Mark Costiglio, a spokesman for Citigroup in New York, said in an e-mail that Banamex USA has made a “comprehensive effort over a number of years” to address regulators’ concerns, including enhancing controls and ending certain customer relationships.

Seven years after the financial crisis laid bare Wall Street’s inability to contain risk, big global banks are still struggling to stamp out bad behavior and profitably manage their international operations. They’ve paid billions of dollars in fines after employees were found to have manipulated interest rate and foreign-exchange benchmarks, helped clients avoid taxes, and funneled money to countries such as Sudan and Iran. 

Antonio Peña Arguelles leaves court in San Antonio in 2014 after serving time for conspiracy to launder monetary instruments.
Antonio Peña Arguelles leaves court in San Antonio in 2014 after serving time for conspiracy to launder monetary instruments.
Photographer: Guillermo Contrerras/SAEN/Zuma Press

Big banks, including Citigroup, have continued to stumble over compliance with U.S. anti-money-laundering laws. Citigroup has been reprimanded repeatedly during the past two decades for inadequately monitoring groups that use the financial system to turn dirty funds into legal means of exchange. Since HSBC Holdings agreed in 2012 to pay $1.9 billion for Mexican money-laundering lapses and sanctions violations, it and other banks have severed ties to some foreign lenders and money-changers. “This is the kind of situation where, if you’re a top manager at Citi, you have to say, ‘What are we doing here?’” says Jack Blum, a former investigator for the U.S. Senate Foreign Relations Committee.

What the regulators’ account of the Peña Arguelles case and interviews with more than a dozen former Citigroup employees and consultants show is that Banamex USA tolerated a culture of negligence during years of moving money across the U.S.-Mexico border. And they provide a rare look into how Citigroup failed to oversee a small but risky business in one corner of its global operation. Regulators use the words failed and failure more than 60 times in their report to describe how Banamex USA didn’t comply with anti-money-laundering rules before and after being ordered to do so. The lapses are now the subject of a government investigation that could cost Citigroup hundreds of millions of dollars in fines, according to a person with knowledge of the matter.

“You would certainly think, with all the going back and forth, that know-your-customer would have merited a much more aggressive or closer scrutiny of this client,” says Alonzo Peña, a former deputy director of the U.S. Immigration and Customs Enforcement agency who now works as a security consultant for companies doing business in Latin America.

Citigroup Chief Executive Officer Michael Corbat pledged in April to have 30,000 people working in regulatory and compliance functions by the end of 2015, an increase of about 15 percent from a year earlier. Since then, Citigroup has continued to be fined. In May, the bank settled probes into currency rigging, agreeing to pay the U.S. government $925 million, and its Citicorp unit pleaded guilty to a felony charge of conspiring to manipulate the price of U.S. dollars and euros. In July, Citigroup was ordered by the Consumer Financial Protection Bureau to pay $700 million to customers for illegal practices related to the marketing of credit card add-on products.

Citigroup is still under orders from its two main regulators, the Federal Reserve and the Office of the Comptroller of the Currency, to fix its anti-money-laundering practices and is the subject of a Justice Department investigation that focuses on money-laundering controls at Banamex USA.

Costiglio, the Citigroup spokesman, declined to comment on specific allegations made in the FDIC report and by former employees. More broadly, he defended the bank’s efforts. “Citi is committed to achieving the strongest possible system for anti-money-laundering and sanctions compliance,” Costiglio said. “We fully understand our obligation to be vigilant and respond to the changing patterns of criminal and terrorist behavior. Over the past several years, we have spent nearly a billion dollars annually and now employ more than 11,000 full-time employees to prevent money laundering.”

Banamex USA, based in Century City, California, was the U.S. arm of Banco Nacional de Mexico, the country’s third-largest bank, known as Banamex, when Citigroup bought the Mexican lender in 2001. The U.S. unit operated as California Commerce Bank for the next five years, offering U.S. dollar credit cards for Mexican customers traveling north, maintaining deposit accounts like the one used by Peña Arguelles, and wiring money to Mexico and elsewhere as part of an agreement with Western Union.

A Banamex USA branch in San Diego, now closed
A Banamex USA branch in San Diego, now closed
Photographer: CoStar Group

Although California Commerce was formally part of the U.S. banking division, Citigroup started using the Banamex name in 2006 to align it more closely with the Mexican operation. While the unit’s compliance group reported to New York, the banking operations worked closely with Mexico, former employees say.

In 2010, Banamex USA CEO Salvador Villar embarked on an expansion strategy that ultimately attracted regulatory scrutiny. In June of that year, the unit had just two branches, in Century City and Calexico, California. A year later, the number had grown to 17, from California to Texas, many along the Mexican border, according to the FDIC.

The CEO of Banamex when Citigroup bought it in 2001, Manuel Medina-Mora became head of consumer banking in the Americas and Citigroup’s co-president.
The CEO of Banamex when Citigroup bought it in 2001, Manuel Medina-Mora became head of consumer banking in the Americas and Citigroup’s co-president.
Photographer: Marco Ugarte/Bloomberg News

The strategy coincided with a push by Manuel Medina-Mora, 65, the CEO of Banamex when it was sold to Citigroup, who had at that point risen to become Citigroup’s head of consumer banking in the Americas. Medina-Mora, who didn’t respond to e-mails seeking comment, sent a memo to staff in July 2010 detailing “multi-year investments in people, infrastructure, and marketing” to expand the North American consumer business.

In 2012, the bank opened a branch in Laredo, Texas, in the bustling Mall del Norte, about a mile from the Rio Grande. In April of that year, Sonia de Pau opened an account. She said she was a Mexican housewife who wanted to save money in dollars and pay for personal expenses, according to the 2013 FDIC report. (The FDIC didn’t identify de Pau or Peña Arguelles by name; it called them Customer A and Customer B. But the report provided many details about their cases, including information about de Pau’s ex-husband, who had been indicted in the U.S. for money laundering and bank fraud, and the timing of Peña Arguelles’s indictment, which made it possible to identify them.)

In November 2012, de Pau deposited a $25,000 check. Then, 11 days after that, she deposited four cashier’s checks issued by the International Bank of Commerce in Brownsville, Texas, for a total of $1.44 million. “When someone says they are a housewife, and with that amount of money going through, that should raise questions,” says Peña, the former immigration official.

What Banamex USA failed to note until after de Pau had drained the account, according to the FDIC report, was that she had been arrested in Mexico almost a year before she showed up at Banamex USA. She was alleged to be a financial operator for a former governor of Mexico’s Tamaulipas state, the FDIC report said. He was indicted in Texas in May 2012 for allegedly taking bribes from drug cartels and laundering funds. The bribes came from, or were on behalf of, the same Zetas cartel that Peña Arguelles had worked for, as well as the Gulf Cartel, according to a separate affidavit in the case against de Pau’s ex-husband. De Pau, who is in a witness-protection program in Mexico, couldn’t be reached for comment.

Citigroup and its subsidiaries have been cited for multiple anti-money- laundering lapses over the past two decades and under five CEOs. Click to enlarge.
Citigroup and its subsidiaries have been cited for multiple anti-money- laundering lapses over the past two decades and under five CEOs. Click to enlarge.

The bank had been alerted to a problem before de Pau took the money out of the account. On Dec. 3, 2012, Banamex USA contacted Banamex in Mexico and was told that de Pau had an account there and that it was blocked by a judicial order. Banamex USA did nothing until Dec. 20, when it filed a suspicious activity report with the U.S. Treasury’s Financial Crimes Enforcement Network, the FDIC report said. Even that was insufficient, because it didn’t mention that de Pau had already withdrawn most of the money. After the initial report, the bank neglected to conduct a review for continuing suspicious activity, as required by the rules governing the filing, preventing law enforcement from tracing where the funds were eventually deposited, according to the FDIC report.

Before the FDIC issued a formal agreement in August 2012 spelling out what the bank needed to fix, known as a consent order, management displayed only negligible interest or ability to detect or report suspicious transfers, the agency said in its report. Even after the order, the bank was slow to address shortcomings, regulators said. Many of the efforts it did make as of mid-2013 were ineffective.

By the time the FDIC presented its report to bank executives, the Fed had filed its own consent order with Citigroup, citing Banamex USA’s deficiencies. The document, like the FDIC consent order, called for a plan to plug the holes in the screening process and for funding personnel, systems, and other resources. The OCC, the regulator for Citigroup’s U.S. national bank, issued a separate order in 2012 demanding improvements in money-laundering controls.

In January 2015, the Justice Department sent a subpoena to Citigroup’s Mexico unit, following up on a probe into Banamex USA that focuses on fund transfers between the U.S. and Mexico. The information demanded in that subpoena highlights many of the issues raised by the FDIC.

It took the 2013 Fed order to get senior management at Citigroup to take action on Banamex USA, according to two people who worked at the bank at the time, and New York compliance staff soon descended on the Century City offices.

They weren’t the only ones. A slew of independent consultants arrived, with at least six firms working on various projects. As the workforce swelled from a couple of hundred to 700 or more, the bank ran out of space to house all of the additional people on the floors it occupied near the top of a 44-story skyscraper west of downtown Los Angeles. Some employees were forced to camp out in hallways, according to three people who worked there.

Progress was slow. Consultants operated in silos, and senior compliance officers were discouraged from sharing information within the department, according to one former Citigroup employee who worked on the project. Citigroup compliance and internal audit staff members weren’t able to check easily on correspondence within the unit because Banamex USA’s e-mails were kept on separate servers, two former employees say.

Less than two weeks after the Fed’s 2013 consent order, Citigroup placed Villar on leave, choosing as CEO Rebecca Macieira-Kaufmann, now 51, then president of Citigroup’s California operations. Villar, who declined to comment, left the bank in September of that year.

Rebecca Macieira-Kaufmann was named CEO of Banamex USA after the Fed’s consent order in 2013.
Rebecca Macieira-Kaufmann was named CEO of Banamex USA after the Fed’s consent order in 2013.
Photographer: Paolo Vescia /San Francisco Business Times

Macieira-Kaufmann hired a new Bank Secrecy Act officer in charge of making sure Banamex USA complied with anti-money-laundering rules. She also added employees to oversee transaction monitoring, know-your-customer procedures, and compliance with Office of Foreign Assets Control rules, which prohibit U.S. companies from doing business with certain individuals and firms.

The new team quickly got bogged down in the minutiae of responding to the consent orders, according to two former employees. Executives broke the documents down by paragraph and created lists of items to address each deficiency. When a bunch of those was completed, management would hold an ice cream social or bring a fruit basket into a conference room to celebrate with staff, says one person who attended. By the fall of 2014, the bank had completed only about half of what regulators demanded and didn’t fully comply until June 2015, another person said. Citigroup declined to make Macieira-Kaufmann available for comment.

At its peak, Banamex USA was just one thread in a global bank that carpeted the globe. The unit never had more than $3 billion in assets, compared with Citigroup’s $1.8 trillion. Yet its compliance failures were a bellwether for lapses in risk controls in other parts of the bank, including a $400 million loan fraud and embezzlement scandal in 2014 at Banamex, Citigroup’s largest international subsidiary.

Citigroup’s money-laundering issues, and the regulatory rancor they bring, go back decades. The bank helped Raúl Salinas, the brother of Mexico’s president at the time, move as much as $100 million into Swiss and U.K. accounts in the mid-1990s and disguised the funds’ source, according to a 1998 report by the U.S. General Accounting Office, which was followed by Senate hearings the next year. In 2001, a Senate investigations committee said Citigroup allowed hundreds of millions of dollars to flow through an account of a correspondent bank operating in Argentina after U.S. law enforcement officials ordered the seizure of $7.7 million of alleged drug money. Japanese regulators shut down the firm’s private bank in 2004 for failing to conduct money-laundering checks. Five years later, Citigroup was barred for a month from marketing banking services to individuals in Japan because it didn’t have adequate money-laundering controls. Citigroup spokesman Costiglio said the bank has strengthened its compliance program “across business and geographic lines” and improved controls, technology, and audit operations to support a “zero-tolerance approach.”

Citigroup isn’t the only global bank to be punished for lax controls linked to operations in Mexico. Wells Fargo paid $160 million in 2010 after Wachovia, which it bought in 2008, admitted it had willfully failed to maintain an anti-money-laundering program linked to transactions with Mexican currency-exchange houses. HSBC agreed in 2012 to pay $1.9 billion for similar failures, as well as for sanctions violations. Both banks were found to have allowed Mexican drug cartels to launder money through their institutions.

It may take prison time for senior executives or even bigger fines to get more banks to focus on preventing money laundering, says Jerry Robinette, a former compliance officer at JPMorgan Chase who served as the agent in charge of Homeland Security Investigations in San Antonio. “Until you start sending people to jail, the pockets are there to satisfy the penalties,” he says. “It’s not until the ends don’t justify the means that you may start seeing people thinking differently.”

On the same day as the HSBC settlement, Banamex USA officers in Laredo failed to raise an alarm when Sonia de Pau took $1.4 million out of her account. But the biggest miss appears to be Antonio Peña Arguelles and the bank’s lack of action despite publicity around his brother’s 2011 murder, one of 27,213 in Mexico that year, the most homicidal in Mexico’s history, according to the national statistics agency.

“Still a money-laundering murderer living in the U.S., nice and peaceful,” read the banner hung above the body, taunting the dead man’s brother. Before relations with the Zetas soured—Peña Arguelles and his brother allegedly stole $5 million from the cartel, according to an affidavit by a Drug Enforcement Administration agent—he also had allowed the Zetas to use his ranch to move drugs, bypassing a federal checkpoint, and served as the conduit between the cartel head and several Mexican politicians, the affidavit said.

Peña Arguelles, 60, pleaded guilty in federal court in Texas in March 2014 to conspiracy to commit money laundering and was sentenced to 30 months in prison, most of that time already served. He agreed to forfeit about $5.5 million in cash and real estate. His lawyer, Gerry Goldstein, declined to make Peña Arguelles available for this story, citing a lawsuit he’s filed trying to get back some forfeited property. Charlie Strauss, the assistant U.S. attorney in San Antonio who led the prosecution, declined to comment on the case or on Banamex USA.

The FDIC and the bank's California regulator fined Banamex USA $140 million in July for violating anti-money-laundering laws. The FDIC didn’t provide an estimate of how much money, if any, was actually laundered. Barbara Hagenbaugh, a spokeswoman for the agency, declined to comment on the action or on the 2013 report.

If Peña Arguelles walked into a Banamex USA branch today, he’d find a much different institution. In fact, he’d likely be turned away—not just because of his record. In July, Citigroup said it was shutting Banamex USA’s remaining branches and winding down the business.—With assistance from Ben Bain.

(Updates second-to-last paragraph to show part of the July 2015 fine against Citigroup went to the California Department of Business Oversight.)

Before it's here, it's on the Bloomberg Terminal. LEARN MORE