Chapter 2: KYC shortfalls: JPMorgan and Deutsche Bank’s onboarding of Epstein

“Les never spent more than two months there,” one of Wexner’s financial advisers told the New York Times in 1996.

That adviser, enigmatically described as Wexner’s “protégé,” was none other than Jeffrey Epstein, who ensconced himself in the mansion that year.

It would be another 15 years before the deed to the property was transferred to Epstein. Even more curiously, Wexner empowered Epstein with a power of attorney (POA) in 1991, enabling him to make financial decisions and investments on Wexner’s behalf.

Epstein’s connection to Wexner came into play during his onboarding at JPMorgan Chase. The retail magnate had a pre-established relationship with the bank prior to granting Epstein POA, according to the New York Times. And much like Epstein’s sketchy ownership of the Manhattan town house, the details of Epstein’s onboarding at the bank are murky. Court documents reveal JPMorgan started doing business with Epstein from as early as 1998, though in what capacity—as a client in his own right or as Wexner’s POA—is unclear.

The president of the Wexner foundation did not respond to a request for comment.

However mysterious his induction into the institution, Epstein went on to have a long and flourishing relationship with JPMorgan. During the 15 years he was a client there, the bank opened and serviced 55 accounts for the man, cumulatively worth hundreds of millions of dollars.

‘Honorary politically exposed person’

By the time Epstein moved to Deutsche Bank in 2013, he was no longer simply a barnacle affixed to Wexner but an intensely private financier who could flaunt a Rolodex of prominent figures. For this reason, Deutsche Bank designated him as an “honorary politically exposed person” during onboarding, as opposed to the standard classification of PEP.

“‘There is no such thing as an honorary PEP. You are either a PEP or you aren’t,’” said a confidential witness in a 2022 U.S. shareholder lawsuit accusing the bank of ineffective know your customer (KYC) procedures and anti-money laundering (AML) controls while doing business with Epstein and other risky, ultrarich clients. “‘I suspect they use this term to fudge things. … I think the phrase “honorary PEP” has been dreamt up to explain away why [Epstein] wasn’t treated as a high-risk client—whose accounts should have been constantly reviewed.’”

In September 2022, Deutsche Bank agreed to pay $26.25 million to settle the suit. The bank declined to comment on the settlement.

Maria Vullo, former superintendent of the New York State Department of Financial Services (NYDFS), also weighed in on the “honorary” designation.

“I don’t think there’s a particular term of art in any of the laws or regulations about it, but I don’t think it was wrong for them to identify him as such because the news media had indicated that he had relationships with some very high-level political people,” she said. “… So, it was a good thing for that to be identified. I think the question is whether that ID led to sufficient additional monitoring.”

“I’ve found in my experience there is some confusion around PEPs,” said Ola Tucker, an experienced compliance professional with a career focus on financial crime compliance and risk management. “In the U.S., it’s not illegal to do business with a PEP. It is a requirement, however, to screen for foreign PEPs in the U.S. and in many other jurisdictions. Many U.S. financial institutions also screen for domestic PEPs. But the weird thing is there’s not really a clear or universal definition of what constitutes a PEP, at least not internationally.”

A lot of jurisdictions follow the Financial Action Task Force definition, she added.

“Honorary PEP” was not a term Tucker had heard before, either. Still, she argued if the term was used then it should have been clearly defined in Deutsche Bank’s policies and procedures and applied consistently, “so that it doesn’t seem like you’re just doing something one-off and favoring one client: ‘Oh, Epstein, he’s an honorary PEP, so we don’t have to do the extra diligence that we do for all other PEPs.’ That just looks bad, and you will get penalized for that.”

Reputational risk and enhanced due diligence

Deutsche Bank did classify Epstein as “high risk” from the time of onboarding because of his 2008 plea deal and prison sentence. That high-risk classification resulted, on paper, in enhanced due diligence (EDD).

For the record, a high-risk customer is not necessarily the same as a PEP or vice versa, Vullo said. And neither designation prohibits a bank from doing business with a potential customer.

“It wasn’t illegal for them to take on the customer. He had a prior conviction. Not everybody with a prior conviction is precluded from having a bank account, right? Of course not. He served his time. Whatever. But because of his circumstances, it was appropriate for the bank to label him as a high-risk customer with enhanced due diligence,” she said.

Depending on the customer’s risk profile and the financial institution itself, EDD should involve frequent media screenings; Office of Foreign Assets Control screenings, which are a requirement for U.S. organizations; and LexisNexis reviews and other lists that can be purchased through various screening companies.

EDD should be performed minimally once per month, said Vullo.

Deutsche Bank personnel’s overarching concern for reputational risk was apparent from the get-go, even if subsequent EDD was flawed. When, in 2013, Epstein’s relationship manager in the bank’s private wealth department chimed in on the reputational risk of onboarding Epstein, he allegedly suggested all Epstein-related accounts be for “entities” affiliated with Epstein, “not personal accounts.”

“Obviously, the mere assertion that they wanted the account[s] in the name of an entity, while still knowing he was the beneficial owner, suggests they had reason to believe the account relationships were, at a minimum, high risk,” said Robert Mazur, one of the world’s leading authorities on money laundering techniques.

“There are a number of potential reasons why an account might be set up as an entity, which is why understanding, verifying, and recording the purpose, nature, and context of the relationship is such an important part of the process,” AML technology expert Jeremy Swetenham of KYC360 said. “If it were simply to distance the identity of control … then on its own, this wouldn’t be a legitimate reason.”

One of the biggest impacts of creating an entity is that it makes it harder for the bank to fulfill its obligations and apply controls, Swetenham added.

“Monitoring the transactions … and ensuring they align with the profile and purpose of the relationship goes back to why it’s so important to understand why [an account] is set up as an entity,” he said. “A complex structure also makes it harder to apply enhanced controls on the approval of those transactions or, critically in this case, identify them as suspicious.”

The first accounts Deutsche Bank opened for Epstein were brokerage accounts for Southern Trust Company Inc., a self-described “‘database company and services’” founded in the U.S. Virgin Islands in 2011, and Southern Financial LLC, a wholly owned subsidiary of Southern Trust Company Inc., said the NYDFS in its 2020 consent order with the bank. According to the KYC record, the purposes of the brokerage accounts were to ‘“hold marketable securities and cash’” and “‘to invest long term [SIC] with the bank,’” respectively.

Court documents referenced in the 2022 U.S. Virgin Islands lawsuit against JPMorgan suggested Southern Trust Company was a fraud. The company never lived up to its stated purpose, instead acting as a conduit for payment to foreign women, credit cards, airplanes, and other instrumentalities.

To make matters worse, Southern Trust had received a 10-year package of economic incentives from the Virgin Islands Economic Development Commission. Consequently, the Epstein estate in 2022 agreed to pay the territorial government $105 million and return $80 million in economic tax benefits.

Despite the fate of this inaugural account Deutsche Bank opened for Epstein, the institution went on to service more than 40 other Epstein-related accounts over a span of five years.

Was the number of accounts Epstein opened at JPMorgan and Deutsche Bank a red flag in and of itself?

“It is certainly conceivable for people with large wealth or a large number of businesses to have numerous accounts. It’s common. However, when a financial institution is onboarding customers … they do need to assess the reason for each individual account and then apply transaction monitoring consistent with the reason for each individual account,” said Vullo.

“Initially, if a compliance analyst sees multiple accounts like, ‘Wow, 20 accounts, 40 accounts,’ whatever the number may be, that should be an initial red flag,” Tucker said. “More questions might need to be asked of that customer so that the bank can be secure in knowing that they’re not being misused. It’s the bank’s job to take those risk-based approaches, and they may need to follow up.

“So, I would say generally, it would be a red flag, but that red flag could lead nowhere. It could lead somewhere. But it’s definitely a reason to review further.”

In the end, no number of red flags led Deutsche Bank to kick Epstein to the curb. Only one catalyst provoked that outcome.

“The bank didn’t terminate the relationship because of suspicious activity or because of anti-money laundering activities, but rather because … there was a Miami Herald news article that reported on this (Epstein’s criminal enterprise) in 2018,” said Vullo.

Only after the scoop went viral did the bank decide to discontinue the relationship, she said.

Read on—Chapter 3: Egregious failures: Customer due diligence and transaction monitoring