The City of London watchdog has hit three HSBC firms with fines totalling £3.2m (€3.69m) after losing the details of thousands of customers in the post and putting them at risk of identity fraud.