National Australia Bank's former chief risk officer David Gall warned the group's directors in October last year that the company's anti-money laundering procedures remained "weak" even after at least A$300 million was spent upgrading the dismal systems.
In a 26 page report on the condition of the bank's risk management, Gall also alerted the NAB board to Austrac stepping up its interactions with the bank - a development he indicated carried "significant regulatory risk".
Gall, who is now a senior executive in NAB's institutional bank, told the board that some AML issues were "pervasive across the group including product, distribution and operations".
His descriptions of the group's breaches and ineffective compliance confirm that NAB is unlikely to avoid sanctions after Austrac's vigorous pursuit of CBA and Westpac.
Gall's report to the board last year also raises questions about the bank's willingness to improve disclosure to shareholders about its AML compliance woes.
The board's description of the AML situation at NAB in its latest annual report is almost a carbon copy of its 2018 disclosure even though directors are now aware of more details such as the annual cost of the remediation program and the identity of business units that have broken Australian laws.
NAB first revealed a contingent liability for issues linked to AML non-compliance two years ago (in the 2017annual report), but the board managed to mask the breadth and detail of the problems in an intricately-worded disclosure buried in the notes of the 2017 financial accounts.
The Age's Adele Ferguson began lifting the lid on the bank's errant compliance systems in August this year when a whistle-blower leaked an Ernst & Young report that documented Know Your Customer and AML reporting breaches at the Bank of New Zealand and MLC subsidiaries.
However, previously unreported NAB board documents that were furnished to the Hayne Royal Commission last year show that breaches of Australian and international anti-money laundering laws have been a recurring feature across the group's operations for many years.
According to the redacted board documents available on the royal commission's website, breaches were occurring within other NAB business units such as JB Were, NAB Asset Servicing and the Singapore banking operation.
While Gall told the board in October last year that some of the AML issues had been remediated, he wrote in his report that their identification had highlighted "historical weaknesses" in the bank's implementation of anti-money laundering and counter-terrorism funding programs.
"AML/CTF issues remediated during 2018 financial year identified historical weaknesses in the execution and oversight of NAB's AML/CTF Program, including: transaction monitoring, investigations, data, reporting, internal controls (and) oversight of the AML/CTF Program by Risk," he told the board.
"The control environment remains weak due to heavy reliance on manual and detective controls across complex processes."
According to assessments contained in the report, five former executives of the bank were judged to have "high individual accountability for issues". The names of the former executives were redacted.
Five other executives were named as having "moderate collective accountability for issues".
Gall's report recommended that the board consider adjusting incentive payments to some executives "given the scale of the remediation underway".
"Consistent with the 2017 financial year, consideration should also be given to any impacts on the group's incentive pool given a number of the AML/CTF issues were pervasive across the group including product, distribution and operations," the report said.
Gall first raised the bank's AML/CTF compliance problems as a "material issue" in the middle of 2016 when he warned the group's regulatory risk outlook could deteriorate.
"Deterioration of the outlook is driven by an expectation that new conduct events and investigations may develop into 'material conduct investigations' and the inclusion of Austrac within this particular risk setting," he told the board.
Other board documents show that a month after Gall's 2016 warning Austrac conducted an on-site inspection and requested the bank take action in relation to its correspondent banking business and report back to the regulator by the end of February 2017.
Throughout 2017 NAB was identifying a myriad of AML/CTF issues that risk officers assessed as "red" matters requiring urgent attention.
These included a review by the Monetary Authority of Singapore of NAB's transaction monitoring capability in its Singapore operations. The MAS later reprimanded the bank for non-compliance and ordered it to implement a remediation program.
There was also a raft of Austrac-related issues that were flashing "red" in October 2017. These included the bank's failure to lodge transaction threshold reports (TTR)with Austrac for money transfers exceeding $10,000.
Gall's redacted presentation to the NAB board in October 2018 did not give an estimate of the number of transactions the bank failed to report to Austrac.
However, he told the board that the TTR remediation had been completed by August last year, along with the program to address weaknesses in NAB's transaction monitoring processes.
Information tables contained in Gall's 2018 report refer to transaction threshold reports as "missing".
NAB's program to remediate breaches of Austrac's Know Your Customer requirements has taken the bank longer to complete - an indication that the level of non-compliance could be high.
"Remediation of customers with KYC validation issues is continuing," Gall advised in the 2018 report.
"Time to complete has been extended by six months to early 2019 as additional time is required to engage customers and source documentation.
"Austrac and the board have been kept fully informed of issues and progress throughout 2018."
Gall noted in tables presented to the board that the JB Were subsidiary failed to report international fund transfer instructions to Austrac for money flowing through its cash trust product.
JB Were also breached anti-money laundering laws in its dealings with charities.
While the level of detail contained in Gall's reports means that few investors should be surprised if NAB is the next bank to cop a beating from Austrac, many are likely to question why the bank's new chair, Phil Chronican, elected not to update the AML contingency in the 2019 annual report.
Perhaps the ASX might consider asking the bank to explain why its disclosure remains opaque and inept.
Click here if you wish to download a copy of the Risk management report presented to the NAB board in October 2018.