Deutsche Bank's compliance team identified the mirror trading risk. $10 billion moved anyway.

Issue #10 | July 1, 2026 | 7 min read

Deutsche Bank's mirror trading scheme ran for approximately four years through the Moscow and London equity desks before regulators moved. The mechanics were simple: buy Russian equities in Moscow for rubles, sell the same equities in London for dollars. Each transaction looked like normal equity business. Together, they moved approximately $10 billion out of Russia for clients whose beneficial owners Deutsche Bank couldn't adequately identify.

In January 2017, the New York Department of Financial Services and the UK's Financial Conduct Authority issued findings on the same day. The NYDFS assessed $425 million. The FCA assessed £163 million, its largest AML penalty at that point. Both orders document a compliance program that identified the risk, escalated it, and watched the business continue anyway.

This issue covers how the scheme worked, where the controls failed, and what the enforcement record tells us about detection at the relationship level versus the transaction level.

CASE STUDY

$425 million from U.S. regulators. £163 million from the UK. Both orders issued the same day. Both document the same failure: functioning controls at the transaction level, none at the relationship level.

The structure of the mirror trade is easy to explain. A client engages Deutsche Bank's Moscow desk to purchase Russian equities in rubles; liquid, well-known names, real shares. Simultaneously, a related entity engages the London desk to sell the same equities for dollars. Both transactions are real. The equities are legitimate. The settlement is legitimate. What isn't legitimate is the relationship between the buyer and the seller, and the purpose the combined transaction serves: rubles converted to dollars, offshore, without going through a currency market or triggering the reporting that conversion would require.

Deutsche Bank executed this structure for roughly four years beginning around 2011. The clients on the Moscow side were Russian legal entities. The clients on the London side were offshore entities, typically with beneficial owners who were never adequately verified, and who, in a number of cases, turned out to be the same parties as on the Moscow side. The bank was, in effect, facilitating transactions between parties with common ownership while treating them as independent counterparties. The total volume was approximately $10 billion.

What transaction monitoring didn't catch

Individual equity trades don't generate the monitoring flags that wire transfers do. There's no structuring pattern in the payment flow. The volumes weren't anomalous for a bank with significant Russian institutional business. No sanctions hits on the trades themselves. Nothing in the individual transaction record pointed to a problem.

The problem was visible only at the relationship level. The same securities moving between counterparties with undisclosed connections, in a pattern that served no apparent investment rationale, across two desks in two jurisdictions. Seeing it required looking across the Moscow and London books simultaneously and asking why the same client network kept appearing on both sides of the same trades. That question wasn't part of the transaction monitoring architecture.

The NYDFS and FCA findings document this failure consistently: Deutsche Bank's AML controls failed to detect or escalate the mirror trading activity. Beneficial ownership verification on the offshore entities was inadequate. SARs that should have been filed weren't. The monitoring program reviewed individual transactions without the framework to identify what the aggregate pattern across desks and jurisdictions represented.

What internal compliance did flag

Compliance staff in Moscow identified the mirror trading program as high-risk. Those concerns were escalated internally. The NYDFS consent order documents that Deutsche Bank was aware of compliance concerns associated with the program. The program continued.

That sequence (identification, escalation, continuation) is what makes enforcement actions expensive rather than uncomfortable. It's the same pattern in the TD Bank culture emails, the Binance CCO's internal message, and the Capital One risk assessments on the check-cashing business. The detection worked. The escalation reached someone with authority to act. The business ran anyway.

Deutsche Bank wasn't a bank that didn't know it had risk in its Russian equity business. It was a bank that knew, flagged it, and didn't change the outcome. The NYDFS found that management-level awareness of the compliance concerns, combined with the program's continuation, contributed to the severity of the regulatory response. The FCA reached a similar conclusion. Both regulators issued their findings on January 30, 2017.

Who the clients were

The enforcement record is careful with specific names, but the pattern is documented. The NYDFS consent order notes Deutsche Bank's failure to conduct adequate due diligence on the beneficial owners of the entities involved in the scheme. Clients identified in the enforcement record included politically exposed persons, individuals connected to sanctioned networks, and parties with links to Russian organized crime. The offshore entities on the London side had adequate corporate documentation. What they lacked was a verified beneficial owner. Deutsche Bank accepted the entity without identifying the person behind it.

The mirror trade structure then moved value across jurisdictions for people the bank couldn't name. That's a UBO verification failure in its most consequential form: not a documentation error on a known customer, but a sustained failure to identify who the customer actually was.

What the red flags looked like

The practitioner question

The mirror trading structure works because it's invisible at the transaction level and visible only at the relationship level. Most compliance programs monitor transactions. Few have the cross-product, cross-geography analytical capacity to identify relationship-level patterns before they accumulate to $10 billion.

That's not primarily a technology problem. It's an access and authority problem. Someone needs to be able to look across the Moscow and London equity books simultaneously and ask why the same client network is consistently on both sides of the same trades. At Deutsche Bank, compliance had enough access to identify the risk and ask the question. It didn't have enough authority to change the answer.

A compliance program that can detect a problem it can't stop is better than one that can't detect it at all. But the gap between detection and action is where $10 billion moves.

Sources: New York Department of Financial Services Consent Order, Deutsche Bank AG, January 30, 2017 | Financial Conduct Authority Final Notice, Deutsche Bank AG, January 30, 2017 | NYDFS Press Release, "DFS Announces Deutsche Bank to Pay $425 Million Penalty for Mirror Trading Scheme," January 30, 2017

INTELLIGENCE BRIEFING

FinCEN — FinCEN has issued a final rule postponing the effective date of its AML/CFT program and SAR filing requirements for registered investment advisers and exempt reporting advisers to no earlier than January 1, 2028. The rule was originally set to take effect January 1, 2026, was delayed via exemptive relief order in August 2025, and is now formally pushed again with a new NPRM expected before the revised compliance date. For institutions with investment adviser affiliates or subsidiaries, the practical implication is that FinCEN's requirements around AML programs, customer due diligence, and SAR obligations for that segment are still coming; the delay extends the runway but doesn't eliminate the obligation. Source: FinCEN press release, "FinCEN Issues Final Rule to Postpone Effective Date of Investment Adviser Rule to 2028."

OFAC — On June 25, OFAC designated a Rwandan gold refinery and an associated network for enabling the illicit smuggling of conflict minerals from eastern Democratic Republic of the Congo. M23 forces, operating with direct Rwandan military support, control substantial mineral-producing territory in North and South Kivu and generate revenue through mineral extraction and export. The designated network moves those minerals through Rwanda to major processing countries including China, with trade documentation obscuring the origin of the goods. For institutions with exposure to African commodity trade corridors or precious metals clients, the June 25 SDN updates are live and screening queues should reflect the new entries. Source: Treasury press release, "Treasury Sanctions Rwandan Gold Refinery and Network Enabling Illicit Conflict Minerals Trade," June 25, 2026.

DOJ — On June 10, a former retail banker at TD Bank was sentenced to two years in prison for accepting bribes and laundering approximately $5.5 million to Colombia. Over roughly five months in 2023, the defendant opened fraudulent accounts, issued more than 150 debit cards to shell companies, and unblocked debit cards that TD Bank's systems had already flagged and restricted for suspicious activity, manually bypassing the bank's controls from the inside. The accounts and cards facilitated more than 12,000 ATM withdrawals in Colombia. The bribe total: approximately $6,000. It's a useful data point on the economics of insider corruption, $6,000 to move $5.5 million, at an institution already under federal scrutiny for its AML program. Source: DOJ press release, "TD Bank Insider Sentenced to Prison for Accepting Bribes, Laundering Millions to Colombia," June 10, 2026.

FROM THE SOURCE

Sixteen pages into the NYDFS consent order, the finding is stated plainly. The program existed. The monitoring ran. The trades settled. The oversight architecture reviewed each transaction independently and never asked what the relationship between the buyer and the seller actually was. By the time anyone did ask, $10 billion had moved and the answer was in a regulators' report rather than a SAR.

The UBO verification failure here isn't a paperwork error. It's a design decision. The program was built to review counterparties at the entity level and stopped there. The person behind the entity, the beneficial owner whose identity determines whether the account should exist, wasn't systematically verified. That gap is what the Corporate Transparency Act's beneficial ownership registry is intended to close on the corporate formation side. Whether it closes it in practice for existing accounts at major financial institutions is a different question.

Source: NYDFS Consent Order, Deutsche Bank AG, January 30, 2017SECTION 5: CTA Block

If someone forwarded this to you, welcome.

The AML Brief goes out every Tuesday. Subscribe for free and get the Top 10 AML Red Flags cheat sheet as a thank-you:

[BUTTON: Subscribe → theamlbrief.com]

Already subscribed? Forward this to one colleague who works in financial crimes. That's how we grow.

The AML Brief | theamlbrief.com

Disclaimer: The AML Brief is an independent financial crimes intelligence publication. All content is sourced from publicly available regulatory documents, enforcement actions, and published research. Nothing published here constitutes legal, compliance, or regulatory advice. The AML Brief is not affiliated with any financial institution, regulator, law firm, or employer. For advice specific to your situation, consult a qualified attorney or compliance professional.