HSBC's controversial $1.9bn (£1.6bn) settlement deal with the US authorities over money laundering charges has stalled after a row between the justice department and the judge overseeing the case.

The deal – known as a deferred prosecution agreement (DPA) – meant HSBC was exempt from prosecution and triggered a storm of criticism. Judge John Gleeson is now believed to be considering rejecting the deal, a move that could leave HSBC facing a criminal prosecution and the threat that its charter to do business in the US could be revoked.

The bank will hold its annual meeting in London on Friday and is expected to be asked for an update on the agreement.

US authorities reached the deal with HSBC last December after uncovering evidence that the bank had illegally conducted transactions on behalf of Mexican drug lords, terrorists and customers in Cuba, Iran, Libya, Sudan and Burma – all countries that were subject to US sanctions.

Gleeson, a former assistant attorney general, made his name prosecuting drug rings and organised crime, most notably securing the conviction of John Gotti, the Gambino crime family boss. The justice department is believed to be challenging the need for Gleeson's approval after failing to get a quick signature while the judge is upholding his opinion that he must sign off on the DPA.

Court officials would not comment on the case. The judge last referred to the case on 15 February, noting solely that he had not yet approved or disapproved of the settlement. Last December Gleeson said there had been "much publicised criticism" of judges rubber-stamping DPAs.

The agreements are an increasingly common settlement which allow a company to pay a fine to stop a criminal prosecution.

John Coffee, Adolf A Berle professor of law at Columbia University, said judges were increasingly unhappy with DPAs.

"There is a serious disconnect between judges and prosecutors about whether prosecutors are doing anything meaningful," he said.

Senator Chuck Grassley lambasted the justice department over the settlement last year and said it was "inexcusable" that they had not brought a criminal prosecution against the bank. "What I have seen from the department is an inexplicable unwillingness to prosecute and convict those responsible for aiding and abetting drug lords and terrorists. I cannot help but agree with an editorial in the New York Times that 'the government has bought into the notion that too big to fail is too big to jail'," he wrote in a letter to attorney general Eric Holder.

At the time of the deal's announcement Stuart Gulliver, HSBC chief executive, said: "We accept responsibility for our past mistakes. We have said we are profoundly sorry for them, and we do so again."

HSBC has undergone a drastic management overhaul since the issues came to light and has strengthened its compliance policies and procedures. It is continuing to implement those changes as the US authorities work on a resolution to the DPA disagreement.

Stuart McWilliam, senior campaigner with lobby group Global Witness, said: "News that the DPA hasn't yet been signed off gives the justice department a clear opportunity to reconsider the penalties HSBC should face for its widespread money laundering failures.

"Given that over 35,000 people were brutally slain in Mexico at the hands of drug traffickers while HSBC laundered at least $880m of their money, it's shocking that the current system of sanctions does not include senior executives being held personally responsible for the actions of their institutions. Is HSBC too big to jail?"

Gleeson would not be the first judge to challenge a DPA in recent months. Last year Jed Rakoff refused to sign off on an agreement between Citigroup and the Securities and Exchange Commission over the sale of "toxic" mortgage bonds. In his opinion the $285m settlement was "neither reasonable, nor fair, nor adequate, nor in the public interest". That dispute is ongoing.