HSBC Swiss Leaks: how a $100bn secret got out

Start here

Geneva sold one thing above all: silence.

HSBC's Swiss private bank was one of the sellers. By 2007 it ran EUR 112bn for its clients, says a French court document.

This story asks one thing. Who found out? The answer is odder than you expect.

First, what exactly was for sale?

Point 1

Privacy was the product.

A bank earns fees for holding money. A private bank sells a second thing: nobody finds out.

For some clients that meant no name on the account. Mail was kept at the bank, so nothing arrived at home.

Then a rule changed.

Point 2 · 1 July 2005

One tax rule covered people. It did not cover companies.

From 1 July 2005 the EU began taxing interest paid to people. Companies were left out.

So the fix looked simple: turn the person into a company. Same owner, same money, no tax.

France's court text says offshore companies were used for this. The bank kept its fees.

Source: French CJIP, paras 16 and 19; ICIJ

How much money used that door?

Point 3

Undeclared US money grew by about 1.6 times in five years.

The bank admitted this in a US court. At least 4 bankers flew to the US to meet at least 25 clients between 2005 and 2007.

In France, the seized lists held over 8,900 taxpayers and at least EUR 1.64bn of assets in 2006 to 2007. Different country, different currency, same habit.

Source: US Department of Justice, 10 Dec 2019; French CJIP

Surely an alarm went off somewhere.

Point 4 · A later case, same habit

One account. The alarm rang in 2006. The report came in 2020.

This is a different case from the tax files, in the same unit. Monitoring alerts began in 2006. A compliance officer flagged the account in Feb 2013, and senior managers kept it.

The bank closed it in early 2016 and told the Swiss authority in Sep 2020. That is 91 months from internal flag to report, or 7.6 years.

In June 2024 the Swiss regulator found a serious money-laundering breach on two such clients. HSBC said it would appeal.

Source: FINMA, 18 Jun 2024; Swissinfo, 25 Jun 2026; Public Eye. Lebanon. Order not yet in force when published.

So the bank did not catch itself. Who held the list?

Point 5

A state held the list for 73 months before the public saw it.

An ex-employee copied the data. It reached French authorities in 2008. France seized it in Jan 2009 and shared it with other states in 2010.

On 8 Feb 2015 journalists published it. The first bank settlement came 77 months after the seizure. The last came 131 months after.

Source: ICIJ; ICIJ, 2015. Our month counts, from those dates.

Who paid for all this?

Point 6 · The climax

The only person sentenced in Switzerland was the one who leaked.

The court sentenced him in his absence. Only the economic-espionage charge stood.

Geneva closed its case against the bank for CHF 40m (about $43m). The bank admitted nothing, and no current employee was prosecuted.

He calls himself a whistleblower. HSBC and the Swiss prosecutor said he tried to sell the data.

Source: AP, 27 Nov 2015; ICIJ, Jun 2015. Switzerland.

How could the bank pay so little?

Point 7

In Switzerland, not declaring your tax was not a crime.

Geneva's own prosecutors said laundering is hard to prove. Laundering needs a crime behind the money, and plain tax evasion was not one.

Swiss law changed on 1 Jan 2016. Serious tax fraud above CHF 300,000 a year now counts. It did not reach back to the HSBC years.

Source: CMS Law; The Local, 4 Jun 2015

Now the bill.

Point 8

Every penalty was about 2.4 to 3.5 times what the bank earned.

The bases differ, so read the labels. HSBC paid $192.35m in the US on $71.85m of fees. In France it paid EUR 300m on EUR 86.4m of disgorged profit.

In all, HSBC paid about $916m across four deals. That is 6.9% of its 2019 profit before tax ($13.35bn) alone.

Source: US DOJ; French CJIP; DOJ, Julius Baer; DOJ, Pictet; HSBC 2019 results. Ratios are our maths.

And the governments that held the list?

Point 9

Same list. The UK got the least.

The UK named about 1,100 evaders. It prosecuted one. That is 0.09%.

Belgium: 32.5% of the hoped-for sum.

Both Belgian figures are estimates from the authorities.

Source: Swissinfo, Jul 2014; UK Lords Hansard, 23 Feb 2015; ICIJ, 2025

Is HSBC a one-off?

Point 10

We checked 8 bank cases. None was caught by the bank's own alarm.

The pattern: a bank sells secrecy. The people who see the problem are overruled. It stops only when an outsider forces it.

One case does not fit. Julius Baer told its regulator and then reported itself to US prosecutors. It still paid $547.25m.

Source: our checks of the cases above; OCCRP; UBS, Sep 2025. This is our reading, not a court finding.

The newest case is from two months ago.

Point 11 · The twist

June 2026: France charged the Swiss unit again.

Alleged On 4 Jun 2026 French prosecutors placed HSBC Private Bank (Suisse) under preliminary charges: organised money laundering and criminal association. Bail was EUR 80m.

It is a different case from the tax files: more than $300m and a politically exposed client from Lebanon, 2002 to 2015.

A judge will decide later on trial or dismissal. Nothing here is proven.

Source: L'Orient Today, citing Le Monde; The National, 5 Jun 2026. Press reports only. No primary French document found.

What would you check in your own bank?

Point 12 · What a bank could check

Four red flags, in plain English.

• The shell flip. An account moves from a person to an offshore company within 12 months of a tax-rule change. Same owner, same manager, balance within 5%.
• The overruled alarm. A high-risk alert stays open past 90 days, or the client's own business line closes it with no second sign-off.
• The notes. Client notes that say "not declared", "black money" or "tax neutral".
• The trip. A banker visits a country, then new accounts from it appear with no local licence.

-- rule A, shortened
SELECT owner_id FROM account_history a
JOIN account_history b USING (owner_id)
WHERE a.holder='PERSON' AND b.holder='COMPANY'
  AND b.country IN (offshore_list)
  AND b.valid_from <= rule_date + 12 months;

Our reading. The thresholds are examples and need tuning. Flags are not proof.

The payoff

The bank never caught itself. A leak, a seizure and a newspaper did.

Silence was a product. One tax rule left a door open. Swiss law left the rest.

If your money system has a quiet room, ask who has the key, and who is allowed to knock.

Sources & method

What we could not find

We could not find who audited the unit, which agents formed the shells, what the board saw, banker pay, or a total for tax lost. These are gaps, not proof of absence.

Status ladder: Proven (court or admitted), Settled, Alleged. Fraud, laundering and control failure are kept apart.

Living people are named only where there is a conviction. Suspicious activity reports are not cited. Numbers keep their own currency and date.

• US DOJ: HSBC Private Bank (Suisse) deferred prosecution agreement, 10 Dec 2019
• French CJIP agreement, HSBC Private Bank (Suisse)
• FINMA press release, 18 Jun 2024
• ICIJ: Swiss Leaks main investigation
• ICIJ: Geneva settlement
• CNBC: Belgian settlement
• AP via KSL: Swiss court convicts ex-employee
• CMS: Swiss law change of 1 Jan 2016
• UK House of Lords debate, 23 Feb 2015
• The National: French charges, 5 Jun 2026
• Dutch prosecution service: EUR 5m settlement
• More vizmaya stories

Photos: Ank Kumar, user "Although" (public domain), Luigi Rosa, NAC, Tony Webster, Benh LIEU SONG, Prioryman, all via Wikimedia Commons. Licences are in each caption.