This week evidence emerged that HSBC abetted massive money laundering by Iran, terrorist organisations, drug cartels and organised criminals. By this point, should this surprise us? Selling defective mortgage securities during the housing bubble; creating and selling securities to bet on their failure; bringing the world to the brink of collapse; colluding to manipulate interest rates; hyping your failing company while secretly selling your own stock; cooking the books; assisting Bernard Madoff. For many people in banking, it would seem, securities fraud, accounting fraud, perjury and conspiracy are just another day at the office. And yet, when I first encountered the world of money laundering while conducting research for my film Inside Job, I was still surprised.

First, there's the scale of it. HSBC transferred $19bn (£12bn) for Iran, $7bn in physical cash for Mexico. Second, it was universal – as Barclays is to Libor price fixing, HSBC is to money laundering – meaning that HSBC is just the first to be found out for something that everyone was doing. For at least four years, federal investigations have been examining more than a dozen major global banks. Credit Suisse, Lloyds and Barclays (yep, them again) have already settled, paying fines totalling $1.2bn for failures in money laundering controls. In a separate case, Wachovia, a large US bank later acquired by Wells Fargo, paid fines for having transferred, over the course of a decade, $370bn (yes, $370bn) between the US and Latin America, most of it in cash, without flagging a single suspicious transaction to the authorities. Other major cases resulting in settlements and fines involved, American Express and Riggs Bank.

Third, no customer was beyond the pale. Several banks aided Iran not just in evading general sanctions, but in concealing payments directly involving its nuclear and ballistic missile programmes. Evidence suggests that HSBC and other global banks also performed similar services for various combinations (depending on the bank) of Hamas, North Korea, Sudan, Gaddafi's Libya, Hezbollah, African warlords, ex-dictators, drug cartels, and banks linked to al-Qaida, among other distinguished clients. The amounts processed totalled hundreds of billions of dollars. Riggs Bank provided accounts and money laundering for the highly corrupt dictator of Equatorial Guinea, the secret cash accumulated by Augusto Pinochet and Saudi Arabian diplomats. Most of the banks also allowed huge transfers of physical cash and travellers' cheques used by Latin American drug cartels and Russian organised criminals. HSBC's Japanese subsidiary unquestioningly processed $290m in travellers' cheques for visiting Russians who said they were in the used-car business.

My fourth surprise was how utterly naked it was. Credit Suisse effectively created a special handbook on money laundering, which it distributed to clients, entitled How to Transfer US Dollar Payments.

When a former Scotland Yard officer working in Wachovia's compliance unit noticed supposedly independent transfers using sequentially numbered travellers' cheques, totalling huge sums and originating from Mexican border areas, he was told to shut up, then marginalised, and forced out. He sued and settled.

A recent Reuters investigation has found similar behaviour, until very recently, in HSBC's compliance operations in Delaware; for example, one compliance officer who questioned transactions that he suspected were linked to Hamas was berated and overruled. For a decade, HSBC ordered its payments operations to treat all of its foreign subsidiaries – including, for example, Mexico – as low-risk areas not requiring detailed examination.

Finally, we come to the regulators and the governments. They did virtually nothing for many years, but have finally been forced into action – or at least the appearance of action – by a combination of public scorn, media coverage, and the actions of a few remaining ethical politicians. Senator Carl Levin, chairman of the Senate permanent subcommittee on investigations, is a remarkable man, and he cannot be very popular with either his party or the Republicans right now.

What should be done? First, the obvious: prosecute and imprison those involved, as high up in the organisations as necessary. Second, force chief and other senior executives to resign. Third, impose serious fines, billions or tens of billions of dollars, particularly for the worst violations, such as aiding Iran's nuclear programme. Finally, tighten oversight. But, above all, we need to recognise that over the past 30 years, banking has become criminalised in a way that threatens global stability. The time has come to use the same law enforcement tools that are used in fighting large-scale, organised crime.

Politically, this will be very difficult. US politics has become a bizarre and, for its participants, undoubtedly tension-filled, balancing act between the money and the voters. On the one hand, both parties court and need the campaign contributions, revolving-door hiring, and lobbying budgets that fuel US politics. On the other hand, America is still a democracy in some important ways, this is a presidential election year, and the public's tolerance of bankster behaviour seems to be reaching its limits. So my bet is that a few heads will roll – mid-level people from foreign banks, such as the HSBC compliance manager who just "resigned". But a true house-cleaning seems beyond the capacity of America's politicians just now. In a way, the US political system has become the biggest money laundering operation of all.

Charles Ferguson is the director of the 2010 film Inside Job