1MDB is the region's reference case for how a politically exposed person, a web of shell companies and a bank's own control functions can fail at once. US prosecutors alleged that more than US$2.7 billion was diverted from bond proceeds and laundered through the international financial system. The US outcomes are now largely final.
This guide covers the concluded US proceedings and the control lessons drawn from them. The main Malaysian trial verdict of December 2025 is under appeal, so it is described as a conviction under appeal and not as a final outcome. Figures come from US Department of Justice releases and court reporting; confirm them against the primary documents before quoting.
It is written for CCOs, AMLCOs and monitoring leads. The case is one an examiner, a board and a new analyst all recognise, and the aim is a practical read of what it changes in a lean team's controls.
What was 1MDB, and why is it an AML case study?
It was a Malaysian state investment fund whose bond proceeds were diverted. It is a case study because every classic laundering stage and every classic control gap appears in one fact pattern.
Three bond offerings raised billions for the fund between 2012 and 2013. The US Department of Justice alleged in its 2018 indictment that more than US$2.7 billion was misappropriated. The defendants were alleged to have conspired to launder it through the US financial system. The 1MDB scandal matters to a compliance officer for a different reason than it matters to a historian. It shows placement, layering and integration in sequence. A politically exposed person sits at the top of the chain, and the financial institutions in the middle either caught the pattern or did not.
How did the money move?
Through the accounts of shell companies, then onward to officials, intermediaries and finally to assets.
According to the indictment, diverted proceeds were wired to accounts of shell companies beneficially owned or controlled by the individuals charged. They then moved through further shell-company accounts, including accounts held by officials. The integration stage was visible and expensive. The DOJ alleged that funds helped buy a New York condominium and about US$137 million of artwork, and financed a feature film. None of those uses needed a sophisticated technique. They needed a customer record that said the money was legitimate, and an institution willing to accept it. The pattern is familiar from any transaction monitoring guide. Large inbound credits arrive with no stated economic rationale, move on quickly, and involve counterparties that share owners.
Senior official with authority over the fund
Three offerings, 2012 to 2013
Owned or controlled by the individuals charged
Accounts held by officials; relatives benefited
New York condominium, about US$137 million of artwork, a feature film
Where did PEP risk show up?
At the top of the chain and in the relatives around it. A screening list that stops at the named official will miss exactly that.
The indictment described a senior government official with authority over decisions at the fund, and alleged that close relatives benefited. Officials at the fund and at a foreign guarantor were also alleged to have received bribes or kickbacks. The lesson is that politically exposed person risk is a network, not a name. Enhanced due diligence has to reach relatives and close associates. The source of wealth behind a corporate customer has to be tested against the beneficial owner's role. Our PEP screening guide sets out how domestic and foreign PEPs differ in practice. Our name screening note covers finding connected parties when the spelling varies.
What did the institutions' controls miss?
Red flags that were raised and then set aside, and a control function that could be overridden by the people it was meant to check.
In its October 2020 resolution, the Department of Justice recorded that a global investment bank's control-function employees knew a transaction party posed a significant risk. They did not take reasonable steps to confirm he was not involved. It also recorded that significant red flags raised during due diligence were ignored or addressed only nominally. The bank's Malaysian subsidiary pleaded guilty to conspiracy, and the parent entered a deferred prosecution agreement with penalties and disgorgement above US$2.9 billion. This is a market fact about an adjudicated resolution, and it is useful because it shows the failure was procedural. The questions had been asked. The answers were not enforced, and the record did not show who had overruled whom.
What were the final outcomes?
The principal US cases have concluded, while the main Malaysian case is still on appeal.
Tim Leissner, the bank's former Southeast Asia chairman, pleaded guilty in 2018 and was sentenced to two years in May 2025. His former colleague Roger Ng was convicted by a Brooklyn jury in April 2022 and sentenced to ten years in March 2023. The institutional resolution is the October 2020 one described above. In Malaysia, the High Court convicted the former prime minister on all 25 charges in the main case on 26 December 2025. An appeal was filed three days later, so that verdict is not treated here as final.
What does 1MDB change for a lean AML team today?
It turns five familiar controls from policy statements into things an examiner can test.
First, apply enhanced due diligence to the relatives and close associates of a PEP-linked principal. Test the source of wealth, not only the source of funds. Second, treat introducers and intermediaries as a risk in their own right, because the person who brings the customer often decides what the institution sees. Third, monitor for flows through newly formed or thinly capitalised companies that move large sums with no stated economic rationale and then disperse them. Fourth, make escalation independent. A concern raised by one function should not be closable by the business line that profits from the relationship. Fifth, keep a record that shows who decided what and on what basis, so that an override is visible. The customer risk rating review and the independent testing guide describe how an examiner tests the second half of that list.
How does Fyscal ARCX support these controls?
Fyscal ARCX puts the screening, monitoring and decision record in one place, so a concern raised against a customer is visible and cannot quietly disappear. Named parties on a customer record are screened against sanctions, PEP and watchlists. A compliance team defines its own monitoring scenarios, including those for rapid pass-through and unrelated counterparties, and tests them against historical data before activation. Case Management holds one case per customer with a timestamped trail of who reviewed, who approved and on what basis. That is the evidence an examiner asks for when a decision is challenged. Our guide to case management and the audit trail shows what that record looks like.