Morgan Stanley discovered last year that a yearslong brokerage customer had been convicted in 2005 in a U.S. court—for lying about terrorism investigations—and had links to al Qaeda bombings of U.S. embassies.

The bank informed law enforcement and shut down the accounts. By then, at least tens of thousands of dollars had been withdrawn from ATMs in Pakistan.