HSBC Holdings could face monetary penalties of more than $1.5 billion related to a host of criminal and regulatory probes charging that its Swiss private banking arm aided customers in evading taxes in their home jurisdictions, according to the bank’s annual report, released Tuesday.

In the report, HSBC stated it is facing investigations in Argentina, Belgium, India, Spain and the United States, among others, related to tax crimes and money laundering. These disclosures come on the heels of the bank paying $370 million in November to settle similar claims in France. To read the full disclosure, click here.

The $1.5 billion figure is significantly larger than the just more than $600 million the bank had set aside at the end of the year for the various probes, but even that amount might go higher, depending on factors outside the bank’s control.

“Due to uncertainties and limitations of these estimates, the ultimate penalties could differ significantly from this amount,” according to the annual report. “In light of the media attention regarding these matters, it is possible that other tax administration, regulatory or law enforcement authorities will also initiate or enlarge similar investigations or regulatory proceedings.”

HSBC has been battling various criminal and civil probes, with some directly related the functioning of its anti-money laundering (AML) program.

The bank paid the U.S. Department of Justice $100 million tied to rate rigging in a case that convicted a former executive, a minor glimpse of a larger trend at play where top officials and compliance officers are facing greater individual liability in large bank failures and penalties.

HSBC also stated it had faced a 2014 Canadian class action suit related to its AML failings seeking monetary damages as high as $20 billion, but that its legal team was able to get the case dismissed before an Ontario Superior Court, though the other side has appealed the verdict.

Even so, HSBC admitted in the annual report that since late 2014, “five lawsuits have been filed in federal court in New York, Illinois and Texas, against various HSBC companies and others, on behalf of plaintiffs who are, or are related to, victims of terrorist attacks in Iraq and Jordan or of cartel violence in Mexico.”

And though one action was voluntarily dismissed in October 2017, the remaining actions are pending in federal court in New York and based on the facts currently known, “it is not practicable at this time for HSBC to predict the resolution of these matters, including the timing or any possible impact on HSBC, which could be significant.”

Even after DPA, more AML scrutiny

But these investigations have to be weighed against a major recent milestone for the bank and its compliance function.

At the tail end of 2017, the bank shed arguably its most high-profile action, the remaining vestiges of the $1.9 billion penalty and deferred prosecution agreement (DPA) from December 2012 for AML and sanctions failures, chiefly becoming the bank of choice for Mexican drug cartels and dealing with rogue regime, Iran.

As part of the DPA, the bank had to agree to a court-appointed monitor to review its progress on improving AML programs, with the individual delivering the fourth annual report earlier this month.

As a result, “through his country-level reviews, the monitor identified potential anti-money laundering and sanctions compliance issues that HSBC is reviewing further” with U.S. and United Kingdom investigators and regulators.

In the U.S. the Department of Justice (DOJ) “in particular…is investigating HSBC’s handling of a corporate customer’s accounts,” according to the annual report, which the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) is “investigating the collection and transmittal of third-party originator information in certain payments instructed over HSBC’s proprietary payment systems.”

The U.K.’s Financial Conduct Authority (FCA) is also “conducting an investigation into HSBC Bank plc’s compliance with UK money laundering regulations and financial crime systems and controls requirements. HSBC is cooperating with all of these investigations.”

But all of the investigations would likely be compounded in complexity if the bank had not met its obligations under the original 2012 DPA.

That milestone is even more of a major accomplishment considering that a year ago, in February 2017, in its annual report, the corporate monitor expressed “significant concerns” over HSBC’s progress in being able to comply with the DPA.

Failure to comply with the terms and timetables of the agreement could have meant the bank would be essentially “convicted” of money laundering, resulting in the bank potentially losing its charter in the United States.

Other lesser, but still very expensive, penalties were also on the table, including extending the length of the agreement and related remediation, bringing new charges against the bank or even handing down additional monetary penalties.

HSBC has “lived up to all of its commitments,” the bank said in the statement in December, adding that the next expected step is the DOJ filing a motion with the with the U.S. District Court for the Eastern District of New York seeking the dismissal of the charges laid out in the agreement.

In penalty documents and Congressional proceedings HSBC admitted that over a decade it laundered more than $1.2 billion for illicit drug trafficking groups and rogue regime Iran.

During its long commercial relationship with Mexican drug cartels, HSBC was accused of moving $7 billion in drug cash to the U.S. in 2007 and 2008, chiefly through its Mexican affiliate. No top bank executives were prosecuted or went to jail.

AML improvements include big names

A lot, however, has changed when it comes to HSBC’s AML aims.

In the last few years, HSBC has gone from compliance pariah to law enforcement partner, snapping up some of the biggest names in the fincrime space and placing them in top program positions.

That storied list includes many former top U.S. Treasury officials, including Robert Werner, Stuart Levey, and, most recently, Jennifer Shasky Calvery, a trail blazer at FinCEN.

Also factoring into the government’s analysis of compliance with the DPA was broad improvements in HSBC’s systems to analyze for both aberrant behavior and the expertise of AML analysts.

Since 2015, HSBC has “substantially improved” its IT infrastructure to better uncover and analyze financial crime, investing $1 billion in new and upgraded systems, according to its website.

As part of that initiative, the bank built a “single environment that takes all the data from our millions of customers worldwide and brings it together in an integrated way.”

On the whole, HSBC’s compliance team is five times bigger than in 2013, according to its site.

Last year, the bank created a dedicated Financial Crime Risk (FCR) to merge risk management and compliance across the spectrum of financial crime, along with strengthening public-private partnerships to better understand and react to criminal trends directly from law enforcement.