The Compliance Current — October 2026

FinCEN assessed a $1.2 billion penalty against Bank of America for willful failures in its AML program, foreign correspondent-account due diligence and suspicious-activity reporting. The findings included:

1. Inadequately supported monitoring risk weights, investigation thresholds and alert suppression rules;
2. Gaps in negotiable-instrument and credit-card monitoring, including potential trade-based money laundering and Chinese money-laundering-network activity;
3. Ineffective testing and inadequate responses to evidence of missed suspicious activity;
4. Investigative workload and capacity constraints that influenced monitoring decisions;
5. Customer reviews and risk profiles that omitted material activity or failed to translate identified concerns into effective controls; and
6. Insufficient understanding of the purpose, expected activity and risks of correspondent accounts for foreign branches and affiliates.

These weaknesses contributed to more than $5 billion in suspicious activity being unreported or reported late. Banks with complex monitoring systems, high-risk customers and foreign correspondent accounts should assess comparable weaknesses. FinCEN credits the OCC’s coordinated $750 million penalty against its $1.2 billion assessment.

The OCC identified systemic weaknesses across Bank of America’s BSA/AML program, resulting in a $750 million penalty. Major deficiencies included:

• Ineffective transaction monitoring: Gaps in detection models, risk scoring and investigation thresholds left substantial activity inadequately monitored, including potential trade-based money laundering.
• Failed escalation and SAR reporting: Potentially suspicious activity did not consistently reach investigators, producing missed, late, inaccurate and incomplete SARs.
• Insufficient investigative capacity: Staffing, expertise and training were inadequate; the investigation backlog approached 200,000 cases in 2024.
• Weak independent testing: Corporate Audit failed to identify significant deficiencies and adequately assess critical controls.
• Inadequate correspondent due diligence: Simplified reviews of foreign branches and affiliates failed to capture required information and differing risks.
• Inaccurate wire-transfer information: Approximately 33,300 outgoing wires totaling $1 billion contained inaccurate sender information.
• Poor management response: Known weaknesses persisted despite the December 2024 order; management insufficiently prioritized remediation and minimized deficiencies.

The central issue was failure to convert known problems into effective, sustained remediation, allowing weaknesses in monitoring, investigation and reporting to continue.

FinCEN announced a proposed rule concerning fund transmittals involving A7 Network sub-agents and an alert on associated suspicious activity. Treasury also announced an OFAC designation. The proposal and the separate sanctions action should not be treated as the same legal instrument.

FinCEN withdrew proposals concerning certain convertible-virtual-currency transactions involving unhosted wallets and a special measure concerning virtual-currency mixing. The release does not announce a general exemption from existing AML duties.

FinCEN issued an alert asking financial institutions to report potential Iranian-regime abuse of religious charity networks, including diversion of religious tithes. The source links to the alert’s indicators and reporting information.

OFAC announced a $175,015 settlement with Pegasus Worldwide Logistics over apparent blocked-property and reporting violations. The same notice separately designated the International Criminal Court and issued four related general licences.

OFAC announced an approximately $11.66 million settlement for 475 apparent sanctions violations. The notice describes payments involving blocked banks, poorly prioritized exact-match alerts, delayed watchlist updates and human error affecting blocked-person accounts. OFAC noted numerous aggregating factors includine: reckless control failures, harm to sanctions objectives, institutional sophistication, and prior warnings.

OFAC announced Iran-related and Cuba actions, Russia-related licences 128D and 130B, and Iran-related licence FF. The notice links to authorizations concerning certain Lukoil activities and wind-down transactions involving International Development Bank for Investment and Finance.

OFAC issued Venezuela-related General License 60A for transactions related to earthquake relief and amended FAQ 1263.

OFAC added entities to its Non-SDN Menu-Based Sanctions List under PAIPA and issued related General Licenses 1 and 2. Individual entries specify applicable restrictions.

OFAC announced Iranian shadow-fleet-related listings, certain delistings, Iran licences GG and HH, Russia licence 131K and amended FAQs. The licences concern specified wind-down, safety, cargo and Lukoil-related activities.

The Federal Reserve identified significant weaknesses in American Express’s enterprise-wide financial-crime program, including failures to detect, investigate and report suspicious activity promptly. Its findings and required remediation cover these major areas:

• Transaction monitoring: Weaknesses in monitoring effectiveness, including how rules and thresholds were established, tested and documented.
• Fraud referrals and suspicious-activity reporting: Deficient referral processes and inadequate identification, evaluation and timely reporting across business lines.
• Customer due diligence: A need for controls proportionate to customers’ money-laundering and other illicit-finance risks.
• Third-party oversight: Weaknesses in assessing and managing risks involving network partners, ATM partners and compliance-support providers.
• Governance and escalation: Insufficient enterprise-wide implementation, management accountability, resources and escalation of material issues.
• Sanctions compliance at AMEX Travel Related Services (TRS): Required improvements to OFAC risk assessment, screening procedures and ongoing, role-specific training.

The order explicitly identifies transaction monitoring, fraud referrals, third-party risk assessment and financial-crime risk management as deficiencies; its corrective requirements provide further detail on the areas needing improvement.

The SEC Division of Examinations published a handbook explaining examination stages, engagement and preparation. This is broader compliance-process material, not a new AML or sanctions rule.

NYDFS announced a $33 million settlement with SEB and its New York branch. Findings included weak high-risk customer and correspondent due diligence, deficient files, risk miscalculation and monitoring backlogs in Baltic subsidiaries.

Extreme Networks agreed to a $1,529,685 settlement for nine apparent violations involving exports to Russian defense manufacturer MMZA between September 2018 and March 2022. MMZA was already blocked through its sanctioned parent’s majority ownership, before its own later designation.

Underlying deficiencies

• Acquisition diligence: Review of acquired customer contracts failed to identify MMZA’s blocked ownership, although a contract named it as end-user.
• Conflicting end-user information: Records named DEMZ, while email addresses, delivery details and direct dealings pointed to MMZA. Compliance accepted a distributor’s revised explanation and end-user statement without resolving the discrepancies.
• Foreign-affiliate oversight: Russian personnel concealed the actual recipient in customer records and instructed MMZA staff to register under DEMZ’s name.
• Access controls and follow-through: Portal access was approved despite inconsistent identifiers and, in one instance, an unanswered diligence request. Available ownership-screening resources were not used to resolve the relationship before the conduct ended. Settlement agreement.

OFAC’s aggravating factors in the egregious case

1. Reckless disregard: Insufficient diligence and failure to act on repeated warning signs identifying the true recipient.
2. Knowledge: Extreme knew it fulfilled the orders and had reason to know MMZA was the end-user.
3. Harm to sanctions objectives: The dealings benefited a blocked defense manufacturer and undermined efforts to restrict Russia’s military capabilities.

Disclosure and mitigation

OFAC classified the conduct as egregious but voluntarily self-disclosed. Disclosure placed the base penalty at half the statutory maximum: $1,699,650. OFAC separately credited the absence of enforcement actions during the relevant preceding five years and substantial remediation, including improved ownership and end-user checks, acquisition diligence, staffing and training. The settlement was 10% below the base penalty. OFAC enforcement release.

FINTRAC described modernization of supervision, increased analytical capability and a focus on demonstrable connections between identified risk and programme measures. The speech discusses enrolment and enforcement changes but is not itself implementing legislation.

OSFI endorsed FSB sound practices for responsible AI adoption, emphasizing accountability, human oversight, data governance and proportionate controls throughout the AI lifecycle. This is a cross-cutting statement, not an AML-specific rule.

The FCA described building AI tools for planned oversight of approximately 60,000 AML firms entering its remit in 2028. The speech also emphasizes accountability and planning for failures as AI use evolves. It does not create a new AML rule.

OFSI’s dated update log records the addition of FAQ 205 on what happens to specific licences when a designated person is delisted. This entry refers to the October 9 update rather than the original 2024 publication date.

AMLA announced its contribution to the MiCA review, addressing staking/lending, DeFi control, unauthorized stablecoins, certain token issuers and cross-border supervision. The underlying response is dated September 30; the publication announcement is October 7. These are recommendations, not adopted amendments.

AMLA and OLAF signed a working arrangement covering operational and strategic information exchange and cooperation relevant to money laundering, terrorist financing, fraud and corruption. It provides for OLAF expertise in relevant joint analyses with participating FIU consent.

The October 28–30 FATF plenary concluded with decisions on country monitoring, virtual assets and fraud. FATF removed Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco from increased monitoring, updated its statements on Iran and Myanmar, accelerated virtual-asset implementation reviews, and approved a scam-compound report for subsequent publication. It adopted the US and Mexico mutual evaluation reports, scheduled for publication in December. These verified outcomes supersede the earlier meeting announcement.

FinCEN confirms four increased-monitoring removals and unchanged call-for-action jurisdictions. Iran and DPRK remain subject to countermeasures; Burma remains subject to enhanced due diligence rather than countermeasures.

FinCEN issued two complementary publications on October 30 addressing cross-border payment and non-profit abuse risks.

Foreign-agent-directed transactions — FIN-2026-Alert009

The alert describes foreign agents instructing US money transmitters to pay overseas third parties, sometimes characterized as settlement. Limited information about recipients, commercial relationships and payment purpose can obscure beneficiaries and expose both principal MSBs and their banks to illicit finance. FinCEN identified more than $8 billion in reported suspicious payments during 2021–2025; that figure is not proof of criminal activity.

Indicators include:

• Payments outside agent agreements or to apparently unrelated businesses.
• Generic explanations, missing or inconsistent invoices, or reluctance to provide due-diligence evidence.
• Payment timing, volumes or destinations inconsistent with the expected business.
• Repeated round-dollar payments and rapid overseas transfers after funds arrive.

Principal MSBs remain responsible for effective agent oversight; contracts do not transfer away AML obligations. Banks should understand the activity underlying settlement payments. Relevant SARs should reference FIN2026FOREIGNAGENT in field 2 and the narrative. Read the alert.

Charities and non-profit organizations — FIN-2026-NTC2

The notice explains sham charities, NPO fraud and embezzlement, with case studies and indicators involving organizational legitimacy, funding and use of funds. Examples include fundraising with little apparent service delivery, imitation of established charities, unverifiable legal status and unexplained large donations followed by substantial transfers. It addresses diversion to terrorism, misuse of government funding and theft of donations.

Institutions should assess each organization individually: most US NPOs present low risk, and neither an indicator nor charitable status alone establishes suspicion. Relevant SARs should reference FIN2026NPO in field 2 and the narrative. Read the notice.

The SEC published its FY 2027 examination priorities, including broker-dealer anti-money laundering compliance, operational resilience and emerging technologies.

On October 1, AMLA submitted three final draft regulatory technical standards (RTS) to the European Commission, covering EU obliged entities and relevant group arrangements:

• Business relationships and occasional or linked transactions — AMLR Article 19(9): Clarifies customer-engagement classification and when transactions must be considered together for due diligence thresholds. The accompanying factsheet highlights ongoing access, expected repetition and duration. Transactions can be linked across customers acting together; their combined value matters. For remittance, currency exchange and crypto-asset exchange, it identifies three transactions in 12 months as an indicator of repetition and a one-month period for assessing linked transactions. These criteria supplement the AMLR definitions rather than replace them.
• Customer due diligence — Article 28(1): Specifies information collection and verification, proportionate lower-risk measures, remote verification, electronic identification, and screening of politically exposed persons, family members and close associates.
• Group-wide arrangements — Articles 16(4) and 17(3): Addresses governance, risk management, internal controls and secure information sharing, including legal barriers affecting branches or subsidiaries outside the EU. The third-country factsheet describes identifying restrictions on due diligence, information sharing or recordkeeping; notifying supervisors; seeking consent where legally possible; and applying additional safeguards. Examples include enhanced monitoring, independent due diligence and senior-management approval. Unmanageable risks can require restrictions or withdrawal from business.

Status: These are final drafts submitted for Commission adoption, not binding rules merely because AMLA finalized them. The release proposes application six months after entry into force following adoption and Official Journal publication, with July 10, 2029 specified for football agents and professional football clubs. Confirm the adopted text and applicable dates before setting implementation deadlines.

On October 23, the FCA announced restrictions on six Annex 1 lenders after identifying concerns about AML policies, controls and procedures during application assessments. Annex 1 firms register for Money Laundering Regulations supervision; this is distinct from FCA authorisation and wider regulation.

The restrictions, imposed at the firms' request, differ:

• Kingscrown Finance Ltd: Further September restrictions limit customer payments and require an orderly loan-book wind-down.
• MOMSB Ltd and Momentus Capital Ltd: October restrictions limit new customers, lending and customer payments, with limited exceptions, and require independent AML reviews.
• Grosvenor Funding Ltd and Grosvenor Funding (North West) Ltd: Similar limits on new business and payments, plus independent AML reviews.
• Abbital Ltd: Specified conditions for new customers, lending and payments, plus an independent AML review.

The FCA is also assessing information from around 900 registered Annex 1 firms. Its announcement identifies broad AML concerns, without detailing each lender's underlying control failures.

FINTRAC's 2025–26 Annual Report is accompanied by an October 29 audit-response statement confirming that its new Supervision Framework has been finalized and implemented. It affects businesses subject to the Proceeds of Crime (Money Laundering) and Terrorist Financing Act.

The statement describes strengthened risk tools, questionnaires and sector profiles to improve risk information and understanding of sector-specific threats and vulnerabilities. FINTRAC also reports expanded supervisory activity and additional supervisory resources. It does not publish the framework's detailed assessment methodology or scoring model.

FINTRAC's October 9 supervisory speech explains the broader approach:

• A dynamic risk picture: Combine examination findings, control effectiveness, reporting and data-quality concerns, enforcement history, voluntary disclosures and partner intelligence to assess sector and entity risks.
• Proportionate supervision: Use guidance, compliance promotion or monitoring where risk is lower; deepen engagement as risk increases; intervene more firmly for significant or persistent non-compliance.
• Documented decisions and results: Connect identified risks to supervisory planning, examinations, interventions and their contribution to stronger compliance.
• Professional judgment: Consider each business's circumstances rather than applying a uniform model.

The speech also discusses planned technology, analytics and enrolment improvements. These modernization plans should be distinguished from the implemented framework and checked separately for applicable legal commencement dates.

OFAC amended eleven FAQs on October 26, 2026 as part of its review of published guidance. The update covers sanctions-program scope, blocking and rejecting transactions, and reporting to OFAC.

Updated FAQs — number and title/topic

• FAQ 10 — What jurisdictions or countries are sanctioned by the United States?
• FAQ 32 — How does a financial institution block an account or a funds transfer?
• FAQ 33 — How much interest do I have to pay on the blocked funds?
• FAQ 34 — Can my financial institution deduct service charges from a blocked account?
• FAQ 35 — Do all OFAC programs involve blocking property?
• FAQ 36 — When should I reject a transaction rather than block it?
• FAQ 41 — Notifying customers that their property has been blocked and explaining the action
• FAQ 42 — Account-opening attempts by blocked persons and transactions with blocked persons
• FAQ 49 — When and how to report rejected transactions or blocked property
• FAQ 50 — Is there a required format for submitting Annual Reports of Blocked Property to OFAC?
• FAQ 53 — Distinguishing a customer inquiry from a payment instruction involving a sanctioned party or country

Longer question titles for FAQs 41, 42, 49 and 53 are shortened above for readability; each link opens the full official question and answer.

OFSI issued General Licence INT/2026/10050568 concerning specified ground rent, service charges and late-payment fees for relevant properties in England or Wales. The licence applies under the listed UK autonomous sanctions regulations.

The Council announced listings of 826 companies and 743 individuals in Russia’s military-industrial complex. Its release describes asset freezes and prohibitions on making funds or economic resources available, and links to the legal acts. The Commission also reported the same package.

FF-1 replaces the October 15 licence and authorizes specified wind-down transactions involving International Development Bank for Investment and Finance and its covered subsidiaries.

OFSI published Legal Services General Licence INT/2026/11112108 to succeed the licence expiring on October 28. It permits qualifying payments to UK legal firms or counsel under specified sanctions regimes, subject to its conditions.

AMLA announced consultation on draft standards for a central supervisory database, including information scope, reporting and material breach thresholds. The design primarily uses information supervisors already hold or collect.