Deutsche Bank and Epstein: the compliance exception

In April 2013, a memorandum prepared for Deutsche Bank’s wealth-management leadership placed two facts on the same page. One was Jeffrey Epstein’s criminal history, prison sentence and the public allegations surrounding his relationships with young women. The other was a commercial forecast: $100 million to $300 million of flows and $2 million to $4 million of annual revenue over time. The risk was not hidden. It was already part of the client-acquisition file.

That juxtaposition, documented in the New York financial regulator’s consent order, does not prove that expected revenue bought a compliance decision. It establishes something narrower: the bank knew the criminal record and reputational risk before opening the first accounts while also quantifying the relationship’s economic appeal.

Deutsche Bank has since acknowledged that onboarding Epstein in 2013 was an error, regretted its historical association with him and pointed to its investment in stronger controls. The NYDFS, for its part, called the handling of the accounts a major compliance failure while crediting the bank’s cooperation and remediation. Both elements belong in the record. Deutsche Bank statement, updated in 2026 · NYDFS, paragraphs 55 to 59 and 109 to 117

The issue is therefore not to invent a hidden motive for individual bankers. It is to understand an institutional mechanism: how a client correctly labelled high-risk could become, transaction after transaction, the internal benchmark for his own normality.

The comparison across several institutions appears in our investigation into what the banks saw. The analysis here focuses on Deutsche Bank: its decision chain, the gap between an announced exit and its implementation, and the exact limits of the public penalties and civil litigation.

The risk was in the file

The relationship originated with a relationship manager who moved from a competitor to Deutsche Bank in November 2012. According to the NYDFS, he soon presented Epstein to senior management as a potential source of millions of dollars in revenue and introductions to other wealthy clients. A coordinator prepared the April 2013 memorandum summarising the criminal record and civil settlements already in the public domain. NYDFS, paragraphs 16 to 21

The 5 May approval did not result from a formal meeting of the regional reputational-risk committee. An executive wrote that he had consulted the legal and anti-money-laundering heads orally. The regulator said the bank could find no other record of that conversation and that the committee did not meet for the onboarding. The emailed approval then became the basis for opening more accounts. NYDFS, paragraphs 22 to 25

The first accounts opened on 19 August 2013 for Southern Trust Company and Southern Financial LLC. Epstein, related entities and associates would eventually open and fund more than 40 accounts. The bank rated the relationship high-risk and subjected it to enhanced due diligence. The NYDFS nevertheless found that the monitoring was not tailored to the specific risks already identified. NYDFS, paragraphs 24 to 26

That distinction matters. A high KYC rating is not a safeguard by itself. It works only through the control rules it triggers, the people who receive them and the decisions made when real activity does not fit the expected profile. See KYC, AML and SAR in the glossary.

The diagram includes only the stages established by the NYDFS consent order. It describes failures of governance and transmission without assigning criminal intent to the employees involved.

In 2015, control tightened on paper

New reporting and legal developments prompted an internal escalation at the end of 2014 and the start of 2015. Two executives met Epstein at his home on 22 January 2015. The bank told the NYDFS that it did not possess a contemporaneous record of the discussion and was not aware of other steps taken at the time beyond asking the client himself about the allegations. NYDFS, paragraphs 33 to 37

On 30 January, the reputational-risk committee allowed the relationship to continue. No detailed minutes were retained, contrary to the internal policy described by the regulator. Three conditions were nevertheless imposed: identify unusual or suspicious activity, monitor new reputational developments and review transactions unusual in size or structure. NYDFS, paragraphs 37 to 40

The system then broke in two places. The conditions were not communicated to every member of the relationship team. Nor did they properly reach the transaction-monitoring team. The NYDFS finally describes an inverted test: instead of comparing a transaction with Epstein’s specific risk profile, the team compared it with this client’s own historical activity. In March 2017, an alert involving payments to a Russian model and publicity agent was closed because that type of activity was deemed “normal for this client”. NYDFS, paragraphs 38 to 42

That sentence does not establish an illicit purpose for the payment. It establishes a weak benchmark. If atypical behaviour repeats for long enough, the client’s past becomes the standard of normality. Monitoring turns circular: what looks like the same client’s previous behaviour is treated as ordinary.

The limited reach of account signals

The Butterfly Trust illustrates the problem. Deutsche Bank opened checking and money-market accounts for it in January 2014. The NYDFS later counted more than 120 wires totalling $2.65 million to trust beneficiaries, with stated purposes including hotels, tuition and rent. The regulator also cited more than $7 million in apparent settlement payments through law firms and more than $6 million in apparent legal expenses. NYDFS, paragraphs 28 to 32

Those categories are not convictions. Rent, tuition, a civil settlement or legal fees can be legitimate. The order says something else: given the known profile, the payments required questions better tailored to the risk, stronger documentation and escalation where appropriate.

The same safeguard applies to cash. An Epstein agent made 97 withdrawals of $7,500 at the Park Avenue branch between 2013 and 2017. The NYDFS also records $100,000 withdrawn at another nearby branch. In total, over roughly four years, the agent withdrew more than $800,000. The regulator says the bank properly filed mandatory currency transaction reports when the relevant thresholds were reached. It also found that the bank obtained no explanation beyond travel, tips and expenses, even after questions about reporting thresholds and an episode that appeared to involve structuring. NYDFS, paragraphs 48 to 52

A SAR is a signal to authorities, not proof that funds are criminal. Conversely, filing a currency transaction report correctly does not answer every question about customer knowledge or economic purpose. The obligations are complementary.

An exit decided in December, completed after the arrest

In November 2018, the Miami Herald investigation into the 2008 plea deal prompted another review. On 21 December, Deutsche Bank informed Epstein that it would no longer service his accounts. The NYDFS order treats that date as the decision to terminate the relationship. It also says that, despite the decision, a relationship manager prepared reference letters for two other financial institutions. NYDFS, paragraphs 53 and 54

DOJ records reviewed by Reuters in February 2026 provide a longer operational chronology. The exit letter gave Epstein until 28 February 2019 to transfer assets. Services continued beyond that deadline. Reuters identified at least nine accounts with combined balances of $1,776,680 on 3 May. After Epstein’s 6 July arrest, an urgent list still called for 28 accounts to be closed. Deutsche Bank told Reuters that asset transfers continued over the following months and reiterated its regret. Reuters, 11 February 2026

The December 2018 date marks the exit decision, not the instantaneous closure of every account and service. The 2019 steps come from DOJ records reviewed by Reuters, which says the documents may not be comprehensive.

The most sensitive item is the 18 March reference letter. Reuters reported that it told the receiving institution that Deutsche Bank knew of no problem with the operation or use of the accounts. The NYDFS order confirms the existence of reference letters and reproduces the same language without dating each one. The letter does not prove an intention to conceal. Public documents do not identify who approved it or what information accompanied the asset transfer. NYDFS, paragraph 54 · Reuters, 11 February 2026

Three amounts that measure different things

The public record places three eye-catching figures next to each other. Adding them or presenting them as three measures of the same harm would be wrong.

Amount	Exact category	What it does not measure
$150m	NYDFS penalty covering failures linked to Epstein, FBME Bank and Danske Bank Estonia	The order does not allocate an Epstein-only share
$75m	Civil class settlement approved in 2023	Neither a merits judgment nor an admission of liability
Over $250m	Wires the Wyden report says were reported retrospectively as suspicious	Neither proven criminal funds, bank revenue nor victim losses

The $150 million penalty appears in the NYDFS order. It resolves failures across three high-risk relationships and includes oversight by an existing independent monitor. The document does not divide the amount among Epstein, FBME and Danske Estonia. NYDFS, paragraphs 7, 114 and 117

The $75 million figure is the civil class settlement with the plaintiffs. In May 2023, a federal judge had allowed some claims to survive a motion to dismiss. At that procedural stage, the court had to assume the well-pleaded factual allegations were true to test plausibility, without deciding the bank’s liability. In October, the court approved the $75 million settlement, which expressly excluded any admission of fault or liability. SDNY, 1 May 2023 decision · SDNY, 20 October 2023 final judgment

Finally, the Senate Finance Committee staff report published on 4 August 2026 says Deutsche Bank failed to report in real time more than $250 million of suspicious wires and later filed retrospective reports. The report relies in part on confidential SARs reviewed at the Treasury. The public does not have the appendices needed to reconstruct and deduplicate every transaction. Reuters said it could not verify the report’s details. Deutsche Bank’s position cited by Reuters is that it cooperated with authorities, addressed deficiencies transparently and strengthened its controls. Reuters, 4 August 2026

The documents support only this conclusion: more than $250 million in wires were retrospectively reported as suspicious, according to the Wyden report. They do not support writing that the entire amount was criminal, financed particular offences or represented Deutsche Bank revenue.

New York imposed a penalty, Germany has not publicly closed the subject

The most detailed public action came from New York, which supervised the local branch and US trust company. The consent order binds the NYDFS and Deutsche Bank as to the settlement it describes. It does not bind US federal agencies, other states or criminal authorities. NYDFS, paragraphs 120 to 122

In Germany, a federal-government response published in July 2026 said that the government then had no information establishing criminally relevant links to Germany in the matters reviewed. It also said BaFin had made two information or document requests following concrete triggers and that no further supervisory action was considered necessary at that stage. The Bundestag summary does not identify the institutions concerned or the content of the responses, while the authorities said they continued to examine possible German links.

That document does not support saying that BaFin cleared Deutsche Bank. It describes the public state of German work at a particular date. No new public penalty is not proof that confidential checks did not occur, just as an information request is not proof of an offence.

Six questions remain open

The public record stops short in several places. Those gaps prove neither additional wrongdoing nor concealment. They do, however, support six specific questions.

On what date was each account closed, and which services remained available until then? Deutsche Bank might be able to publish a redacted account-by-account chronology. The NYDFS and the independent monitor named in its order might be able to clarify whether this closure period was reviewed, subject to banking secrecy and their confidentiality duties. NYDFS, paragraphs 53, 54 and 117 · Reuters, 11 February 2026
Who authorised the services maintained after 28 February 2019, and under what rules? Deutsche Bank might be able to clarify the rules applied during that period. Further DOJ records or court documents could also provide evidence if they become public. Reuters, 11 February 2026
Who approved the reference letters, and what information was sent to the receiving banks? Deutsche Bank and the institutions that received the letters might be able to describe what was communicated without disclosing personal or protected information. The public NYDFS order does not name the receiving institutions. NYDFS, paragraph 54
How was the figure above $250 million calculated and deduplicated? Senate Finance Committee staff might be able to publish a redacted methodology. FinCEN, the US Treasury and Deutsche Bank might be able to clarify the number and timing of the reports, within the legal confidentiality limits governing SARs. Senate Finance Committee staff report, 4 August 2026 · Reuters, 4 August 2026
How much revenue did the relationship actually generate each year compared with the 2013 forecasts? Deutsche Bank is best placed to publish redacted, aggregate figures. The public documents reviewed quantify the initial commercial target, not the revenue ultimately realised. NYDFS, paragraphs 16 to 21
Did the two information requests cited by the German government concern Deutsche Bank? BaFin and the federal government might be able to clarify their scope. The response published in July 2026 does not name the institutions and therefore cannot settle the question. German federal government, response 21/7048 · Bundestag summary

Naming these actors does not mean that all of them hold the answer, can lawfully publish it or are required to do so. Any silence would not confirm a hypothesis.

The exception changes the definition of abnormal

The Deutsche Bank record is not a story of compliance being entirely absent. It is a story of compliance appearing at almost every stage but being weakened by governance.

The risk is written down before onboarding. The client is rated high-risk. The relationship is reviewed. Conditions are imposed. Alerts are generated. Currency reports are filed. An exit is decided. Every one of those actions exists in the record.

The problem lies between them: approval without a formal meeting, a visit without a written record, a committee without compliant minutes, conditions not transmitted, monitoring that compares the client with himself, and a closure spread over months.

The lesson is less comfortable than a simple blind spot. Controls can know the risk, label it and still learn to live with it. When a commercial exception becomes durable, it does more than evade the rule. It moves the internal boundary between ordinary and abnormal.

Read the French version.

Sources

Limitations

The NYDFS findings come from a consent order resolving an administrative action. They are not a criminal judgment and do not bind other authorities.
The DOJ records reviewed by Reuters may not be comprehensive. This article republishes no personal data, account number or detail capable of identifying a victim.
SARs are confidential. The figure above $250 million remains a conclusion attributed to the Wyden report, not a total that can be verified transaction by transaction from the public record.
The May 2023 court decision concerns the sufficiency of civil claims. The later settlement ended the litigation without a merits judgment or admission of liability.
The German response is current only to the public documents reviewed through 9 August 2026. No publication cannot establish that no confidential investigation or supervisory work exists.