HSBC and Scotia will pay $15 million and $7.5 million and acknowledge their supervision failures violated record-keeping rules, while the SEC said the case was a reminder for firms to self-report disclosure lapses.