The report, based on leaked documents obtained by BuzzFeed News and shared with the consortium, said that in some cases the banks kept moving illicit funds after receiving warnings from U.S. officials.

Bank stocks in Europe were down sharply on the news.

The documents identified more than $2 trillion in transactions between 1999 and 2017 that were flagged by financial institutions’ internal compliance officers as possible money laundering or other criminal activity, the report said. The top two banks are Deutsche Bank, which disclosed $1.3 trillion of suspicious money in the files, and JPMorgan, which disclosed $514 billion, the analysis found. Other lenders include HSBC Holdings Plc, Standard Chartered Plc and Bank of New York Mellon Corp., it said.

A wave of hefty fines against major banks in the past decade spurred an explosion in the number of transactions that lenders flag as suspect to the U.S. government. Still, it’s not clear all the scrutiny is making a difference. Banks moved money for people or entities they couldn’t identify, and in many cases failed to file the required suspicious activity reports until years afterward, according to the investigation released over the weekend.

“They need to do a better job of shutting down these accounts once they see repeated reasons for filing suspicious activity reports,” Tom Cardamone, managing director of Global Financial Integrity, a Washington-based organization tracking illegal money flows worldwide, said in a telephone interview. There are “clients so bad that numerous SARs are being filed about them, but no one ever does anything about it.”

The documents revealed Sunday shed light on a faulty system where banks complain about reports that get no follow-up from authorities, while critics say lenders are checking off boxes without taking meaningful steps to stop financial crime. It all risks another black eye for major international banks that paid a total of $20 billion from 2012 through 2015 for having lax controls against money laundering, helping clients evade taxes or violate U.S. sanctions.

Investigative journalists across 88 countries

The investigation was based on more than 2,100 “suspicious activity reports” filed by banks with the U.S. Department of Treasury’s Financial Crimes Enforcement Network. The report, dubbed the FinCEN Files, was the result of an investigation by more than 100 news organizations in 88 countries, Buzzfeed said. Bloomberg News wasn’t included in the consortium and hasn’t seen the leaked documents.

Large fines of HSBC and Standard Chartered in 2012 helped spur a spike in suspicious activity reports, from about 60,000 that year to more than 2 million annually in recent years. Yet law enforcement agencies inquire about only 4% of those alerts, according to a Bank Policy Institute survey. And only 1% of illicit money in the financial system is confiscated, the United Nations estimates.

“Filing SARs is not a get-out-of-jail-free card,” said Dan Stipano, partner at law firm Buckley and former OCC deputy chief counsel. “Many banks have faced major enforcement actions after having filed many SARs if they failed to take the appropriate action on their clients. SARs don’t cover your back necessarily.”

While regulators require banks to file suspicious activity reports within 30 to 60 days, many firms took months or even years on average to flag the suspect transactions they saw, the report said.

Bank Policy Institute, an industry group, said banks are legally prohibited from talking about SARs. Based on past instances, some cases are likely connected to requests by law enforcement to keep a so-called suspicious account open so authorities are able to follow the money trail before mounting an arrest or conviction, it said.

“It’s the nature of banking”

Banks have hired thousands of employees to beef up anti-money laundering and financial crime teams, and some withdrew from certain countries and dropped correspondent-banking ties with hundreds of smaller lenders. But executives have conceded they won’t be able to stamp out all illicit activity.

“It’s the nature of banking: They move money,” Jim Richards, former head of anti-money laundering at Wells Fargo & Co. and Bank of America Corp., who now runs his own advisory firm RegTech Consulting. “So despite all the efforts to crack down on this, there’ll always be some criminal money moving through the banking system. It’s very small portion of the trillions of dollars they handle every day.”

One example highlighted in the report: JPMorgan moved more than $1 billion for the fugitive financier behind Malaysia’s 1MDB scandal, based on records. The bank also processed payments for Paul Manafort, the former campaign manager for President Donald Trump, after he resigned from the campaign amid money laundering and corruption allegations from his work with a pro-Russian political party in Ukraine, according to the investigation.

JPMorgan told ICIJ that it was legally prohibited from discussing clients or transactions. It said it has taken a “leadership role” in pursuing “proactive intelligence-led investigations.”

“We report suspicious activity to the government so that law enforcement can combat financial crime,” the bank said in a statement to Bloomberg News. “We have played a leadership role in anti-money laundering reform that will modernize how the government and law enforcement combat money laundering, terrorism financing and other financial crimes.”

Compliance staff in big banks, often overworked and lacking in resources, relied on basic Google searches to find out the identity of the people behind money transfers, the ICIJ said. Banks often filed suspicious activity reports only after a transaction or customer became the subject of a negative news report or a government probe, when the funds are long gone, ICIJ says, citing the documents.

Standard Chartered, Bank of New York and Barclays Plc were other lenders that flagged more than $20 billion of suspicious activity in the files obtained by ICIJ. A spokesman for Bank of New York said the firm “takes its role in protecting the integrity of the global financial system seriously, including filing Suspicious Activity Reports.” Barclays said in a statement to Buzzfeed that they invest significant resources in detecting and flagging suspicious activity.

As markets open in Asia, shares of banks fell. Standard Chartered slumped 6.2% at the close in Hong Kong, while HSBC plunged 5.3% to its lowest in a quarter of a century.

In a statement Monday, HSBC said it started a “multi-year journey” eight years ago to overhaul its ability to fight financial crime in more than 60 jurisdictions, making it “a much safer institution than it was in 2012.” Standard Chartered said in a statement it takes the responsibility to fight financial crimes “extremely seriously and have invested substantially in our compliance programs.”

In reaction to the report, Deutsche Bank said ICIJ raised “a number of historic issues” and those related to the bank are “well known” to regulators. “The issues have already been investigated and led to regulatory resolutions in which the bank’s cooperation and remediation was publicly recognized,” it said.

That firm’s former chief executive officer, John Cryan, in 2016 summed up the industry’s unique role, with all the challenges that brings.

“We’ve been slow to recognize that we are an extension of law enforcement,” Cryan said.