M&T Bank Corp. was on its way to acquiring Hudson City Bancorp – and making a strategic push into New Jersey – when it hit a snag.

The Buffalo-based bank put the $3.7 billion deal on hold in April while it worked with the Federal Reserve Bank of New York to strengthen its anti-money laundering and Bank Secrecy Act compliance program.

No allegations of wrongdoing were made, no fines were levied, but the directive triggered an ongoing, expensive process to build an enhanced level of security into bank operations. It’s a challenge and an expense large banks are facing after several high-profile breaches, including a $1.9 billion fine for HSBC.

The Bank of Montreal and Citigroup were cited for security shortcomings in their safeguards just this year.

Money laundering became a national security issue after 9/11, and the prominent settlement with London-based HSBC at the end of last year highlighted the threat. The regulations are designed to block terrorists, drug dealers and other criminals from moving money through U.S. banks.

For M&T, the solution has proven expensive and extensive, forcing the bank to pour millions of dollars into consulting services, new employees’ salaries, and building a better system. Meanwhile, the bank has delayed a deal that would allow M&T to expand into a coveted territory, while moving closer to the ranks of the nation’s top 10 banks.

Rene Jones, M&T’s chief financial officer, told analysts in a recent conference call that M&T increased salaries by $2 million in the third quarter from the previous quarter, partly due to hiring about 200 full-time equivalent employees to deal with anti-money laundering issues, as well as “stress testing,” to prove the bank could withstand a financial calamity. M&T also reported spending $7 million in the third quarter on “specialized consulting services” related to anti-money laundering practices and the Bank Secrecy Act.

Jones explained the lengths M&T must go by saying “it’s not like you just go fix a weakness.”

“You actually have to think about it in the way of building the state-of-the-art, best-in-the-industry practices, in part because of all the trillions of dollars of illicit activity that ends up going through the banking system, those folks are ramping up their efforts to try to figure out new ways to get around you,” Jones said.

When asked on the call about the Hudson City deal, Jones said M&T executives “haven’t spent any time thinking about Hudson City lately.” That statement surprised some observers, given a key deadline involving the two banks was only three months away when he said it.

But M&T’s message was clear: the bank would not be distracted from resolving the anti-money laundering issues.

M&T has not said exactly what regulators found lacking. Last April, M&T’s chairman and chief executive officer, Robert G. Wilmers said: “It’s a question of having a more sophisticated system than we have today. We’ve got to go into greater depth to make sure we’re reporting everything that they want.”

Knowing your customers

Bert Ely, a Virginia-based consultant for financial firms, said banks in general are under more pressure to “know your customer,” beyond completing transactions with them. Banks are expected to report suspicious activity, forcing them to make judgment calls about what constitutes suspicious. “These are not always black-and-white situations,” he said.

Banks’ remedies for gaps in their anti-money laundering practices might be better software or more employees; the solution depends on a bank’s situation, Ely said.

The Federal Reserve also has not said what prompted the closer look at M&T’s anti-money laundering practices. But analysts and other observers see a few possibilities.

Most notable is the planned Hudson City acquisition, a major deal seeking regulatory approval in the post-financial crisis banking world.

“Oftentimes, a big acquisition will trigger a closer review,” Ely said.

Another factor could simply be the tougher regulatory climate for financial services firms. The Bank Secrecy Act has been around since 1970, aimed at preventing banks from being used to facilitate criminal activity. But other standards and regulations have been added over the years to crack down on violators. And recent high-profile settlements have put some banks on the hot seat.

Standard Chartered last year agreed to pay a $340 million fine to settle allegations it broke anti-money laundering laws, stemming from transactions involving Iranian clients. And last December, HSBC agreed to a staggering $1.92 billion settlement, avoiding federal and state money laundering charges linked to its dealings with drug cartels and nations like Iran.

In the HSBC case, investigators said the bank ignored obvious warnings and “allowed hundreds of millions of dollars in drug money to pass through its unattended gates.” Prosecutors say some employees altered the details of the transactions, to hide the fact they involved parties whom were off limits.

It’s not just the big-name players feeling pressure. Last week, a New York City-based check cashing company and its owner pleaded guilty to Bank Secrecy Act-related violations, and will forfeit $3.3 million. The owner will have to pay nearly $1 million in restitution.

Others scrutinized

Ely said banks have had to accept to the expense of adding staff and systems to ward off potential problems with money laundering. “It has to become part of the woodwork, so to speak.”

Buffalo-based First Niagara Financial Group’s chief financial officer, Gregory W. Norwood, spoke in a recent conference call with analysts about the regulatory burdens created by anti-money laundering compliance, qualified mortgage rules, and capital stress tests. “While we have been ahead of the curve of (anti-money laundering), addressing these increasing demands will involve additional technology and business investments,” he said.

Another factor that might have drawn attention to M&T is its connection to Delaware-based Wilmington Trust Corp., which M&T acquired in 2011. The written agreement between M&T and the Federal Reserve – released last June - said M&T would use an independent consultant to review account and transaction activity associated with “high-risk customer accounts and transactions” connected with M&T and Wilmington Trust from July 1, 2012, through the end of 2012, to determine if “suspicious activity” was properly identified and reported.

Through the Wilmington Trust deal, M&T picked up a high-end wealth management business unit, as well as an office Wilmington Trust had in the renowned offshore tax haven of the Cayman Islands. It is not known if that had anything to do with the scrutiny, but regulators might look at overseas transactions as potentially higher risk.

One analyst who asked not to be identified noted deposits in the Cayman Islands office soared to $1 billion as of the end of 2012, compared to $356 million a year earlier. The analyst said while the increase may have been relatively small in the context of the total book of business, it is “still substantial enough for the regulator to want to keep an eye or, at the very least, make sure adequate systems are in place to monitor.” Deposits at the Cayman Islands office were $1 billion or higher in some preceding years.

While M&T works to satisfy the Federal Reserve’s concerns, a question remains: Will the Hudson City deal still be completed, and on schedule? Back in April, M&T and Hudson City said they were extending a deadline – from last Aug. 27 to Jan. 31, 2014 – after which either party could walk away if it had not been completed. Both banks’ shareholders have approved the acquisition, and neither bank has publicly suggested the deal was in jeopardy. But some observers wonder if the January deadline could be pushed back again.