Tag: OFAC

Categories
Blog

BOA Part 3: The Failure to Connect the Dots: Sanctions, AML, and Effective Remediation

A payment-routing problem, a stale watchlist, an incorrectly prioritized alert, and an employee processing error may initially appear to be separate operational incidents. OFAC’s Enforcement Release asks compliance leaders to examine the broader pattern. Its compliance considerations emphasize management oversight that identifies potentially systemic problems, implements durable solutions, and prevents errors from recurring across the enterprise.

Today, in Part 3 we focus on that connection. Fixing the first visible error is necessary. Establishing whether the same weakness exists elsewhere is the next responsibility.

A Separate Action with Familiar Governance Problems

According to the Enforcement Release, Bank of America agreed to pay $11,662,930 to resolve potential civil liability for 475 apparent violations involving approximately $14.8 million in transactions. The conduct involved sanctions programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism. OFAC classified the matter as non-egregious but largely not voluntarily self-disclosed. These are separate findings from FinCEN’s anti-money laundering case. They should not be treated as findings about identical transactions merely because they reveal related governance concerns. Those concerns include control design, alert handling, staffing, technical changes, investigation scope, and the response to known weaknesses.

Payment Routing: A Control Must Work Across the Process

Bank of America used a third-party routing directory to help determine intermediary banks for certain cross-border payments. Some routing was automated; some could be entered manually. Once payment details were generated, the bank screened them for sanctions compliance.

In March 2022, the bank became aware that the directory included blocked banks and that some payments were still being processed to or through them. OFAC identified several causes: screening updates had not yet reflected new designations, analysts incorrectly dismissed alerts, or suppression rules automatically released payments based on earlier false-positive decisions.

OFAC ultimately identified 403 transactions totaling approximately $14.34 million routed through 35 blocked banks between February 2022 and March 2025. The bank implemented an automated directory solution in January 2023, but the release describes a broader set of payment-processing failures extending beyond that implementation.

The compliance lesson is to test the complete process. A current directory does not establish that manual entry works correctly. A screening alert does not establish that the alert is properly resolved. A prior false-positive decision does not establish that the same disposition remains appropriate after a sanctions designation.

Alert Prioritization: Strong Information Must Produce an Appropriate Response

OFAC describes a design flaw that assigned low or medium priority to customers whose names and dates of birth both exactly matched those of blocked persons.

Because those alerts were not classified as high priority, review was delayed. Three designated individuals conducted 31 transactions using bank or credit card accounts. The bank fully implemented the relevant correction in February 2024, six months after initially identifying the issue. This is a control-design issue with an operational consequence.

The existence of a queue does not establish effective prioritization. Compliance leaders should be able to explain which information triggers immediate attention, which activity may continue while an alert awaits review, and what interim protection applies when the prioritization logic is known to be deficient.

Watchlist Updates: Vendor Performance and Internal Processing Both Matter

Between May 24 and June 28, 2023, a third-party vendor error prevented the watchlist file used by Bank of America from reflecting changes to OFAC’s sanctions list. The bank did not identify the error until July, approximately a month after another U.S. bank blocked one of the affected payments downstream.

A separate failure in February 2025 involved technical problems in the bank’s own systems. The bank failed to implement a vendor update reflecting the previous day’s designations and processed transactions for a designated ship management company. The relevant updates were fully activated several days later; the bank subsequently conducted a lookback and self-disclosed those transactions.

The two events should not be collapsed into a single vendor failure. One originated with the vendor. The other involved the bank’s processing of an update. Together, they illustrate why oversight should verify the entire update process: issuance, receipt, loading, activation, and operation. A delivery confirmation is not proof that screening uses the new information.

Employee Errors and Technology Changes Need a Control Response

The Enforcement Release also describes a business account that remained unrestricted after an analyst dismissed an alert involving its blocked beneficial owner. A subsequent rescreening during a platform migration generated another alert, but the bank did not review it promptly. OFAC attributed the delay to the volume of alerts generated by the migration and inadequate preparation for that workload.

In another incident, personnel moved $189,869 from restricted business accounts into a new unrestricted account after misunderstanding how to handle accounts with a blocked authorized signer. Sanctions personnel identified the error and blocked the new accounts before the customer conducted further transactions involving the funds.

The second intervention mattered. It prevented further activity. It did not eliminate the need to examine why the transfer had been authorized. Calling an event human error should begin the root-cause inquiry, not end it. Was the instruction clear? Did the employee have access to appropriate guidance? Were approval rights properly defined? Should another control have prevented the action?

What the Penalty Says About Disclosure and Cooperation

OFAC determined that 413 apparent violations were not voluntarily self-disclosed and 62 were. Its base penalty calculation already reflected that distinction: the applicable scheduled amounts for the former and one-half of transaction value for the latter. The settlement equaled the resulting base penalty. Consequently, saying that the bank received no recognition whatsoever for voluntary disclosure would be inaccurate.

The more precise lesson is that OFAC granted no additional reduction from the base penalty. The release expressly states that there was no mitigation for remedial measures or cooperation. OFAC also identified a tolling agreement as a mitigating factor but concluded that the circumstances did not justify a net reduction.

OFAC described piecemeal or incomplete submissions and delayed responses that slowed its investigation. It also criticized the bank’s initially narrow lookback into blocked-bank payments, with the full scope identified only after further OFAC direction.  For compliance leaders, the lesson is to organize the response early. Investigation scope, document preservation, factual development, disclosure decisions, remediation, and regulatory responses should be coordinated rather than handled as disconnected tasks.

FinCEN’s Undertakings Show What Verification Requires

The FinCEN Consent Order requires independent work addressing historical suspicious activity, transaction monitoring effectiveness, customer and foreign correspondent due diligence, and data governance. Its lookback begins in January 2022 and extends through completion of relevant monitoring remediation, subject to the Consent Order’s scope provisions.

Two aspects are particularly instructive. First, the Consent Order addresses interim controls while remediation remains underway. A future system improvement is not treated as an answer to present exposure. Recommended interim measures may include manual processes, periodic reviews, and product-focused analyses. Second, the end-state review includes subsequent testing to validate whether enhancements meaningfully mitigate the relevant risks. Implementation and effectiveness are separate questions.

That distinction should shape remediation reporting. The board needs to know both whether the change was completed and whether testing demonstrates that it works.

Three Key Takeaways

First, investigate recurring themes across incidents. Similar errors may reveal shared weaknesses in data, approvals, staffing, training, or change management.

Second, treat disclosure and cooperation as disciplined processes. Determine the scope, preserve the record, develop the facts, and respond completely and promptly.

Third, distinguish implementation from effectiveness. Maintain interim safeguards and require independent evidence before declaring a material issue resolved.

The board question: Are we receiving evidence that remediation has reduced the risk, or only reports that remediation activities have been completed?

Summary

In Part 3, we examined how BOA’s sanctions failures exposed weaknesses across payment routing, alert prioritization, watchlist updates, and employee execution. The central lesson is that seemingly separate incidents should prompt an examination of shared weaknesses in oversight, resources, and operational processes, rather than a series of isolated fixes. We also considered vendor accountability, controlled technology changes, appropriately scoped investigations, and coordinated disclosure and cooperation.

FinCEN’s requirements for interim safeguards and subsequent effectiveness testing illustrate why implementing corrective measures and proving that they work are separate responsibilities. For CCOs, this means identifying underlying causes, protecting against continuing exposure, and independently validating the response. For boards, it means demanding evidence of reduced risk rather than accepting reports of completed activities. The measure of remediation is whether the underlying control weakness has been effectively addressed.

Join Us Tomorrow

Tomorrow in Part 4, we turn from Bank of America’s enforcement record to the decisions facing compliance professionals outside banking. In it we translate BOA’s documented failures into 20 practical lessons covering governance, continuing due diligence, technology and data, vendor oversight, employee execution, investigations, and remediation. The objective is not to apply bank-specific obligations to every company, but to examine how comparable weaknesses could arise in customer relationships, distributor networks, procurement processes, payment controls, and automated compliance systems.

Each lesson connects a finding to a practical action, giving CCOs a framework for reviewing their own programs. The series concludes with an assignment: select three areas of greatest exposure, identify accountable owners, examine the evidence that existing controls work, and address what remains unresolved. The final question is where your organization has accepted a plan to address a material risk without verifying that the plan actually worked.

Categories
Blog

BOA Part 2: The $5 Billion Blind Spot About Compliance Technology

An automated compliance system can operate exactly as configured and still fail to perform the function the organization needs.

That distinction is central to FinCEN’s findings concerning Bank of America’s proprietary transaction monitoring system, Event Processor. The FinCEN Consent Order attributes missed and delayed reporting of more than $5 billion in suspicious activity to deficiencies in internal controls and other parts of the bank’s anti-money laundering program. That figure reflects suspicious activity that was not reported on time, not a determination that every dollar represented criminal proceeds.

In Part 1, we examined management decisions about known risks. This installment examines how those decisions were embedded in technology, testing, and investigative processes. In Part 2, we review the natural follow-up to that statement: the lesson is not that automation is inherently unreliable. Automating a decision does not remove the obligation to establish that the decision is supportable.

Inside Event Processor

Bank of America developed Event Processor to manage transaction monitoring alerts. The bank’s records describe an interconnected model system intended to support identifying, investigating, and reporting suspicious activity. Its development also addressed a practical problem: there were not enough investigators to review all the alerts being generated.

The diagram on page 10 of the Consent Order illustrates the basic process. Individual alerts received weighted risk scores and were generally consolidated into customer-level Event Groups. Unless an automatic promotion applied, the group ordinarily did not become an investigative case until its combined score reached 20 points. Stakeholders initially set that threshold, and it remained in place until December 2023.

The timing rules were equally important. An Event Group generally needed to reach the threshold within 13 months of its oldest active alert. Older alerts could remain in the group but no longer contribute to its score. Consequently, retirement of an alert did not establish that the underlying concern had been investigated or resolved. For compliance leaders, the distinction is consequential. A system that generates an alert does not necessarily ensure meaningful review.

The Testing Challenged the Design

The Consent Order describes repeated evidence that the system’s risk weights did not adequately reflect the risks being identified. One internal report found that an ATM large-cash-deposit risk factor carried only one point in Event Processor even though the bank’s testing associated it with a SAR yield of 56.75%. FinCEN also notes that SAR yield can be useful but is not the only metric for evaluating a control. The issue was the bank’s failure to respond appropriately to evidence that its design was not addressing its risks.

The chart on page 21 makes the threshold problem particularly clear. In tested samples, Event Groups scoring 19 points, just below the investigative threshold, had SAR yields of 45.49% in the first quarter of 2022 and 45.03% in the second quarter. Earlier testing of groups scoring 20 to 24 points, which qualified for investigation, had produced yields of approximately 34%. FINCEN consent order

These results did not establish the precise performance of every unreviewed transaction. However, they challenged the justification for leaving the threshold unchanged. Management should have asked, “What does this evidence tell us about the activity we are not investigating?”

When Efficiency Becomes the Wrong Objective

FinCEN found that the bank’s testing often focused on whether yields above and below the threshold differed statistically, without adequately considering the implications of missed suspicious activity. The bank also lacked an objective benchmark to assess whether the threshold was appropriate.

In another example, a calibration model reduced the number of cases requiring investigation by more than 8,200. An accompanying report described the associated loss of SARs as permissible without explaining how that conclusion had been reached.

This distinction matters for any automated compliance process. Reducing unnecessary reviews can legitimately improve a process. Reducing reviews is not, by itself, evidence of improvement. Consider an expense-monitoring tool. Eliminating repetitive, demonstrably irrelevant alerts may improve performance. Raising thresholds until the review team can handle the remaining volume does not establish that the excluded transactions present acceptable risk.

That is an application of the case, not a finding about an expense system at Bank of America. The transferable principle is that the performance objective must remain tied to the compliance purpose.

Exceptions Can Defeat the Primary Control

The Event Processor also used rules that rescored certain risk factors to zero. The Consent Order describes those rules as developed through an ad hoc and subjective process without adequate testing. When the bank discontinued the logic in December 2023, approximately 150,000 active Event Groups had triggered one or more aspects of it.

One particularly useful example involved customers exempted from certain currency transaction reporting requirements. Event Processor used that status to suppress some alerts, even though the applicable exemption did not remove the obligation to report suspicious activity. The broader control lesson is to examine the legal and factual basis for every exception.

An exception for one purpose should not silently become an exemption from a different control. A previously approved customer should not automatically become exempt from future review. A false-positive determination based on yesterday’s information should not permanently determine tomorrow’s result.

Data Gaps Limit What Technology Can Detect

FinCEN found that the bank’s systems did not adequately distinguish among types of negotiable instruments, such as checks and money orders, which limited targeted monitoring. The Consent Order also describes insufficient monitoring and data quality issues involving credit card activity. The lesson for compliance technology governance begins before model selection.

What information does the control need? Is that information captured consistently? Does it reach the monitoring system? Can investigators retrieve and use it? Who is responsible when a required field is incomplete or a relevant product lacks coverage? A sophisticated analytical tool cannot compensate for an unidentified gap in the information supplied to it.

Recalibration Revealed the Scale of the Problem

Following regulatory engagement, Bank of America lowered the investigative threshold in December 2023 to 10 or 12 points, depending on the Event Group. A limited lookback identified nearly 8,900 SARs involving approximately $4 billion in activity that the bank had failed to identify and report under the prior parameters.

The bank estimated that the revised thresholds would double ongoing monthly investigative volume and require about 750 additional personnel, plus another 800 consultants for the one-time lookback. These were the bank’s staffing estimates, not evidence that every position had already been filled. For a CCO, those numbers make the resource question concrete. Technology configuration and staffing cannot be governed as unrelated decisions when one determines the other’s workload.

The Application to AI Governance

The Consent Order describes Event Processor as a proprietary interconnected model system. It does not establish that it was a generative AI system. Nevertheless, its governance failures provide useful comparison points for organizations deploying AI in compliance. FINCEN consent order

NIST’s AI Risk Management Framework organizes risk management around Govern, Map, Measure, and Manage. Applied here as an analytical framework, those functions suggest a practical sequence: assign accountable ownership, define the intended use and relevant risks, test actual performance, and act when the evidence identifies deficiencies.

ISO/IEC 42001 provides a complementary management-system approach for establishing, maintaining, and continually improving AI governance. Neither framework is presented here as a standard that FinCEN found Bank of America had violated. The objective is not to prohibit innovation. It is to ensure that innovation remains explainable, testable, and subject to effective challenge.

Three Key Takeaways

First, validate the decision rules, not merely system availability. Establish why thresholds, weights, prioritization rules, and exceptions address the intended risk.

Second, test what the control misses. Include below-threshold activity, incomplete product coverage, data gaps, and delayed escalation.

Third, connect technology governance to resources and remediation. A finding that requires additional review must lead to a supportable operational response.

The CCO question: Can you demonstrate that your compliance technology addresses the intended risk, or only that it operates according to its configuration?

In Part 2, we examined how BOA’s Event Processor transaction monitoring system failed to translate automated alerts into effective detection and investigation. FinCEN identified unsupported design choices, inadequately calibrated risk weights, poorly governed suppression rules, and monitoring gaps that persisted despite testing that challenged the system’s effectiveness.

After the bank lowered its investigative thresholds, a limited lookback identified nearly $4 billion in suspicious activity that it had failed to identify and report under the previous parameters. The central lesson for CCOs is that reducing alert volumes or investigative workloads does not, by itself, demonstrate improved compliance. Effective technology governance requires reliable data, supportable decision rules, independent testing, attention to missed activity, and resources sufficient to address the findings. These principles also provide practical guidance for AI oversight. An automated control is measured by whether it addresses the intended risk, not simply whether it operates as configured.

Join us Tomorrow

Tomorrow, Part 3 broadens the analysis from transaction monitoring to sanctions compliance, examining OFAC’s findings on blocked-bank payment routing, improperly prioritized alerts, delayed watchlist updates, and mishandled accounts associated with blocked persons. These incidents raise a broader management question: when several controls fail in different ways, does the organization investigate each error separately, or does it examine whether they reveal shared weaknesses in oversight, resources, and operational execution?

We will explore the importance of vendor oversight, controlled technology changes, appropriately scoped investigations, and coordinated disclosure and cooperation. We will also examine the difference between completing a corrective action and proving it works, including the role of interim safeguards and independent validation. Boards and compliance leaders must ask whether management has corrected individual incidents or verified that the underlying controls work across the enterprise.

Categories
Blog

BOA Part 1: $1.2 Billion Compliance Failure: When Red Flags Meet Revenue

A compliance program is tested when someone identifies a risk that the business would prefer not to address. The question is not whether compliance can produce a memorandum. The question is whether the organization makes a timely, supportable decision and implements controls that address the concern.

The Bank of America enforcement record provides a detailed examination of that problem. FinCEN (Consent Order) describes repeated internal warnings, testing that identified weaknesses, and customer relationships that continued without controls commensurate with the risks. Its findings place management decisions about revenue and resources at the center of the compliance failure.

For chief compliance officers, the central lesson is straightforward: Identifying a material risk is the beginning of compliance work, not its completion. Over this four-part blog series, we will review the FinCEN Consent Order, OFAC’s Enforcement Release, and the Department of the Treasury’s Press Release to mine each for how this was allowed to occur, how it continued, the governance failures, the marginalization of compliance, and the penalties assessed. Today in Part 1, we examine the governance failure at the heart of the Bank of America enforcement actions: compliance personnel identified significant risks, but management did not ensure those concerns led to timely, effective corrective action.

Understanding the Enforcement Actions

On October 13, 2026, the Department of the Treasury announced enforcement actions involving FinCEN, the Office of the Comptroller of the Currency, and the Office of Foreign Assets Control. Treasury described combined penalties exceeding $1.21 billion for anti-money laundering and sanctions failures.

The penalty structure matters. FinCEN assessed $1.2 billion but credited the bank’s $750 million OCC payment, leaving $450 million payable under the FinCEN Consent Order. OFAC’s separate Enforcement Release states a settlement of $11,662,930. Adding the full FinCEN and OCC assessments together would therefore overstate the combined financial penalty.

The legal posture also matters. Bank of America admitted the facts and violations in the FinCEN Consent Order. It expressly limited its admission of willfulness to the civil Bank Secrecy Act enforcement standard. By contrast, OFAC resolved potential civil liability for apparent violations. These documents should not be characterized as a criminal guilty plea.

The Warnings Were Already Inside the Organization

Consider the relationship identified in the FinCEN Consent Order as Customer A, an online marketplace connecting sellers of salvaged vehicles with domestic and international buyers. The bank had maintained accounts for this customer since 1995. By 2022, compliance personnel had identified concerns involving third-party payments, limited visibility into the source of funds, and repeated fraud-related investigations. In July, compliance recommended that the customer’s accounts be considered for closure. Subsequent internal analysis identified more than 100 customer-related cases between 2020 and August 2022.

This was not simply a disagreement about a customer’s reputation. Compliance was identifying a weakness in the bank’s ability to understand the funds moving through the relationship. An important distinction must remain clear. The Consent Order records that no evidence shows Customer A orchestrated the underlying fraud. The concern was that its accounts appeared to have received and moved fraud proceeds, creating risks the bank needed to address. Suspicion concerning transactions is not proof that the customer knowingly participated in the underlying misconduct.

That distinction makes the compliance lesson more useful. An organization does not need to prove a business partner is a criminal before deciding the relationship requires stronger controls.

When Commercial Importance Becomes the Answer to a Different Question

Following an internal meeting in September 2022, the relationship manager prepared a memorandum describing Customer A as a “large and valued client” generating approximately $6 million in annual revenue. The memorandum emphasized the broader commercial relationship and the business line’s support for retaining it. Compliance personnel continued asking how the underlying risks were being mitigated. FINCEN consent order

Here is the governance problem: commercial value and risk mitigation answer different questions. Revenue explains why the business wants to retain a relationship. It does not establish that the relationship can be maintained within an effective control environment.

Nor does compliance independence require that every recommendation to terminate a relationship prevail. FinCEN expressly states that account closure is not the only appropriate response to heightened financial crime risk. Enhanced monitoring, restrictions on products or services, and other risk-based controls may be appropriate. The real question is whether the alternative works.

A defensible decision to retain a high-risk customer should explain what will change, who will implement it, what evidence will show it works, and what happens if the customer does not meet the agreed conditions. Without those elements, an alternative mitigation plan can become a way to defer the original decision.

A Mitigation Plan Is Not the Same as Mitigation

In March 2023, more than six months after compliance recommended closure, the relationship manager summarized proposed measures, including limiting payments to registered buyers or dealers. Compliance withdrew its closure recommendation based on the communication and implementation of those measures, while reserving the possibility of revisiting the decision.

However, Customer A continued processing third-party payments through its Bank of America account until June 2025. The bank did not adequately update the customer’s risk profile, ongoing monitoring, or other due diligence measures to address the continuing practice. Some other changes were implemented, but the central payment risk persisted.

This is where compliance activity and compliance effectiveness separate. A meeting is an activity. A mitigation plan is an activity. A customer assurance is information. None, standing alone, establishes that the risk has been reduced. For the CCO, the missing discipline is verification. When the organization decides to continue a relationship subject to conditions, those conditions need an owner, an implementation date, evidence requirements, and consequences for nonperformance.

Resources Are Also a Governance Decision

FinCEN found that management’s approach to transaction monitoring was influenced by the resources required to investigate additional cases. When remediation began, the bank estimated that investigative volumes would double and that approximately 750 additional personnel would be needed. FinCEN concluded that the bank had likely avoided hundreds of millions of dollars in compliance-related expenditures during the relevant period. That was FinCEN’s assessment, not a separately calculated figure of realized profit.

The business lesson is not that every compliance function should receive every requested dollar. Resource decisions need to address the actual risk. Management should not resolve a capacity problem by treating the activity that exceeds capacity as less important without a supportable risk basis.

What the CCO and Board Should Ask

As a comparison framework, the DOJ’s Evaluation of Corporate Compliance Programs (ECCP) examines whether a program is well designed, adequately resourced and empowered, and effective in practice. It also asks whether managers tolerate greater compliance risks to pursue revenue and how the company responds when compliance raises concerns. These are useful analytical questions here, not the legal standards under which FinCEN resolved this case.

Board oversight provides another comparison. In Marchand v. Barnhill, the Delaware Supreme Court emphasized the need for a good-faith effort to establish board-level monitoring of a critical compliance risk. Caremark liability involves a demanding bad-faith standard, not automatic liability whenever a control fails. The Bank of America documents discussed here are not Caremark judgments against its directors.

The practical board questions nevertheless follow naturally. Which material compliance recommendations remain unresolved? Which business decisions depend on mitigation that has not been verified? Which deficiencies have appeared repeatedly without an effective response? Those questions move oversight beyond receiving presentations to examining whether management is controlling the risk.

Three Key Takeaways

First, require decisions, not indefinite escalation. Material concerns need accountable decision-makers, documented reasoning, deadlines, and follow-through.

Second, separate commercial justification from control effectiveness. A valuable relationship may be retained, but its revenue does not demonstrate that its risks are mitigated.

Third, verify the conditions supporting the decision. Keep an approved remediation plan open until the organization has evidence that the relevant controls work.

The CCO question: When the business rejects or modifies a compliance recommendation, can you demonstrate that the alternative actually reduced the risk?

Today we examined the governance failure at the heart of the Bank of America enforcement actions: compliance personnel identified significant risks, but management did not ensure that those concerns produced timely, effective corrective action. FinCEN’s findings describe an organization that prioritized customer revenue and resource considerations while known risks persisted without commensurate controls.

The central lesson is not that compliance must prevail in every disagreement or that every high-risk relationship must be terminated. Decisions to retain those relationships must rest on demonstrable risk mitigation, not commercial importance alone. For CCOs, this means establishing accountable decision-makers, deadlines, documented reasoning, and verification that agreed measures work. For boards, it means examining unresolved exposure rather than merely receiving reports of completed activities. A mitigation plan does not establish that a risk has been mitigated. The organization must verify the result.

Join us Tomorrow

Management decisions about compliance don’t stay confined to committee meetings and customer relationship discussions. They also shape the technology that determines which risks receive attention and which remain uninvestigated. In Part 2, we turn to Bank of America’s Event Processor transaction monitoring system and FinCEN’s findings concerning unsupported design choices, investigative thresholds, alert suppression, gaps in monitoring coverage, and inadequate responses to testing.

Our focus shifts from whether management acted on known concerns to whether its automated controls could identify and escalate the relevant activity. We will examine the difference between reducing investigative workload and improving compliance effectiveness, with practical applications for data governance, model validation, and AI oversight. Every CCO must ask whether your technology addresses the intended risk, not simply whether it operates according to its configuration.

Categories
Compliance Into the Weeds

Compliance into the Weeds: Amex AML Enforcement: Credit Card Risk, SAR Failures, and Board Accountability

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into compliance topics, literally going into the weeds. Looking for hard-hitting compliance insights? Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly discuss the recent OCC and Federal Reserve enforcement actions against American Express.

The penalties included a $350 million civil penalty, cease-and-desist orders, and extensive compliance obligations tied to weaknesses in customer due diligence, suspicious activity reporting, staffing, and risk assessment. Tom highlighted that Amex processed billions of transactions, many ordinary credit-card transactions, showing banks must know all customers, not just high-dollar activity, and noted regulators’ broader pattern of similar actions across the industry as financial innovation outpaced compliance investment.

Matt noted that regulators depend on SARs as critical inputs for broader enforcement “mosaics,” explaining why SAR failures draw intense scrutiny. The orders’ notable feature is direct board involvement, requiring a board-level compliance committee and action plan to hold management accountable, with a strong focus on end-to-end documentation and evidence trails; they see no facts suggesting the egregious, employee-involved criminality seen in TD Bank.

Key highlights:

  • Industry Pattern and Root Causes
  • Innovation as Compliance Risk
  • Board Oversight Mandates
  • Why SARs Matter
  • DOJ Risk and TD Bank Comparison
  • Disjointed Compliance and Fixes

Resources:

Tom in the FCPA Compliance Report, Part 1 and Part 2

Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

A multi-award-winning podcast, Compliance into the Weeds, was recently named one of the Top 25 Regulatory Compliance Podcasts, Top 10 Business Law Podcasts, and Top 12 Risk Management Podcasts. Compliance into the Weeds has been awarded a Davey, Communicator, and W3 Award, all for podcast excellence.

Categories
Blog

Re-Calibrating Risk Assessments: Uncovering FTO and TCO Exposure in Cartel-Driven Economies

This blog continues our series focusing on the upcoming ACI Forum on Cartels, TCOs, and Compliance in Latin America and why it is so timely. It is also why compliance officers need to understand that this is not simply another enforcement trend. It is a structural change in how risk must be assessed, governed, and managed. Today, I want to explore why you need to recalibrate your risk assessment in light of the US’s shift in classifying cartels from criminal organizations to Foreign Terrorist Organizations (FTOs).

For years, many companies treated cartel risk as a regional security issue, a physical safety issue, or a narrow sanctions-screening issue. That approach is no longer sufficient. Cartel-driven economies now create enterprise risk across sales, supply chain, procurement, logistics, human resources, community relations, government affairs, security, and internal controls. The CCO must help the organization move from episodic screening to a dynamic, evidence-based risk assessment model that identifies where the business may be exposed to Foreign Terrorist Organization (FTO) and Transnational Criminal Organization (TCO) risks.

The legal and enforcement environment has shifted. Executive Order 14157 established a process for certain international cartels and other organizations to be designated as FTOs or Specially Designated Global Terrorists, and described those organizations as threats to U.S. national security, foreign policy, and the economy. OFAC later issued an alert identifying eight designated organizations and warning that companies with operations in, or exposure to, high-risk jurisdictions where designated cartels are active should assess their sanctions compliance controls. That is the compliance lesson. This is not simply a legal list update. It is a risk assessment reset.

Cartel-Driven Economies Change the Risk Ranking Model

Traditional compliance risk assessments often rank risk by country, business unit, transaction value, government touchpoints, and third-party type. Those variables still matter. But cartel-driven economies require additional factors: territorial control, coercive influence, infiltration of local business networks, labor pressure, logistics-route control, cash intensity, proximity to ports or borders, public security risks, and the likelihood that a legitimate counterparty may be owned, controlled, taxed, extorted, or otherwise influenced by criminal organizations.

The ranking model should distinguish between three types of exposure. First, direct exposure, where a company deals with a designated party or a party it owns or controls. Second, indirect exposure, where a supplier, distributor, customer, logistics provider, labor broker, or security vendor is connected to cartel-linked actors. Third, environmental exposure, where the company operates in a geography or sector where coercion, extortion, or criminal facilitation is a predictable operating condition.

The DOJ’s Evaluation of Corporate Compliance Programs (ECCP) asks whether third-party management is risk-based, integrated into vendor management, supported by business rationale, tied to appropriate contract terms, and subject to ongoing monitoring. Those questions should now be applied not only to anti-bribery risk, but also to FTO and TCO risk.

Create an Internal FTO Working Group

A company cannot manage this risk through sanctions screening alone. The CCO should establish an internal FTO working group with a clear charter, executive sponsorship, and board reporting. The group should include compliance, legal, sanctions, AML, procurement, sales, finance, logistics, security, HR, government affairs, community relations, internal audit, and enterprise risk management.

Its mandate should be practical: identify exposures, refresh risk rankings, define escalation protocols, review high-risk contracts, approve enhanced due diligence standards, monitor emerging typologies, and track remediation efforts. It should also define when the company will suspend a transaction, reject a counterparty, exit a relationship, seek external counsel, notify insurers, or brief the board. This working group should meet frequently at the outset, then move to a risk-based cadence. Its output should not be a memo that sits on a shelf. It should produce a revised heat map, a prioritized counterparty review list, an action tracker, and control enhancements that can be tested by internal audit.

Leverage Existing Risk Assessments

The most efficient approach is not to create a wholly separate FTO risk assessment. The better approach is to integrate FTO/TCO risk into existing assessments. Your FCPA risk assessment already identifies government touchpoints, customs brokers, permitting issues, gifts and entertainment, charitable donations, intermediaries, consultants, and high-risk payments. Those same data points are highly relevant to cartel exposure because criminal networks often exploit local permitting, customs clearance, transportation, public security, and procurement systems.

The business and human rights assessment also provides critical intelligence. The UN Guiding Principles on Business and Human Rights recognize a corporate responsibility to respect human rights through due diligence that avoids infringing on the rights of others and addresses adverse impacts with which the business is involved. In cartel-affected markets, human rights due diligence can reveal forced labor, threats against workers, community intimidation, unsafe security practices, land-access disputes, migrant exploitation, and labor-broker abuse.

Sanctions, AML, trade compliance, cybersecurity, and fraud risk assessments should also be mined. Look for recurring names, addresses, beneficial owners, banks, payment patterns, shell entities, shared directors, unusual routes, unexplained subcontractors, and counterparties that appear across unrelated business units.

Review Major Contracts and Customers for FTO/TCO Risk

Companies often focus due diligence on suppliers and intermediaries, while under-reviewing major customers. That is a mistake. A customer can create sanctions, money-laundering, books-and-records, reputational, and material-support risks. The company should identify major contracts in high-risk geographies and sectors, then re-rank them based on ownership transparency, payment behavior, sector exposure, government interaction, logistics routes, and local operating conditions. High-risk contracts should include enhanced representations, beneficial ownership update obligations, audit rights, sanctions, and FTO/TCO clauses, payment transparency requirements, subcontractor disclosure, termination rights, and controls over cash, commissions, rebates, donations, sponsorships, and community payments.

A contract should move into enhanced review when the business cannot explain the counterparty’s commercial rationale, when pricing is uneconomic, when payment comes from unrelated parties, when revenue spikes in cartel-affected regions, when the counterparty refuses beneficial ownership disclosure, or when local employees report pressure to use a particular vendor, union, broker, transporter, or security provider.

Detect Commingling of Legitimate and Illegal Activity

The core challenge is commingling. Cartels do not always operate through obviously illicit entities. They use logistics companies, fuel businesses, casinos, real estate, import-export companies, labor brokers, charities, community organizations, and professional service providers.

Recent enforcement actions show the point. Recently, the US Department of the Treasury announced multiple CJNG-linked fuel schemes involving cross-border smuggling, falsified customs documents, and shell companies. OFAC also described cartel-linked casino activity used to launder proceeds and integrate illicit funds into the legitimate financial system. For compliance professionals, these examples reinforce a familiar truth: a company’s legal form is not the same as its risk profile.

Detection requires data and local intelligence. Compare invoices to actual services. Review customs documentation against logistics activity. Test whether vendors have employees, assets, facilities, and capacity. Analyze payment flows for round-dollar amounts, rapid pass-through activity, third-party payments, and mismatches between business size and transaction volume. Monitor hotline reports for references to threats, forced vendors, security payments, labor pressure, and community demands.

Functions That Must Be in Scope

Supply chain must map critical suppliers, second-tier exposure, logistics corridors, warehousing, border crossings, ports, and emergency sourcing decisions. HR must assess labor brokers, recruitment channels, employee intimidation, workplace violence, the risk of retaliation, and escalation pathways for threatened employees. Community relations must review donations, sponsorships, local foundations, land-access payments, and community intermediaries. Union relations must assess whether labor organizations or labor contractors are being used as pressure points. Government affairs must evaluate permitting, customs, inspections, police interaction, and local political exposure. Security must review private security providers, public security coordination, incident response, travel protocols, and extortion procedures. The board should ask one question above all others: where could the company be doing legitimate business through a channel that criminal actors influence, control, or monetize?

Practical Takeaways

CCOs should refresh the risk assessment now, not after a transaction is called into question. Build the FTO working group, integrate existing FCPA and human rights intelligence, re-rank major contracts and customers, and test controls for commingling. The objective is not perfection. The objective is a documented, risk-based, board-visible process that shows the company understands its exposure, updates its controls, and acts when the risk profile changes.

The Cartels, TCOs & Compliance in Latin American conference will feature these topics and many more. For information and registration, click here. For a complete list of the agenda, click here. You can receive a 10% off the price by using the Discount Code D10-999-CPN26.

ACI is the sponsor of today’s blog.

Categories
Everything Compliance

Everything Compliance: The Summer Potpourri Edition

Welcome to a revamped Everything Compliance. We have a new host, Adam Turteltaub, and a new panelist, Rebecca Walker, who joins returning regulars Matt Kelly, Jonathan Armstrong, and Karen Moore for the next iteration of Everything Compliance. 

  • Matt Kelly highlights OFAC’s $1.05M settlement with FTI Consulting for indirectly providing services to sanctioned VTB Bank via a law firm payment conduit and creating a prohibited extension of debt when invoices went unpaid, emphasizing OFAC’s message that indirect dealings are treated like direct ones. 
  • Karen Moore reviews the NFL Rooney Rule’s intent and criticism; the Brian Flores discrimination lawsuit, which is moving forward in open court after the Supreme Court declined to compel arbitration; and Florida’s attorney general’s subpoena challenging the rule under state civil rights law, alongside trends in discrimination charges and potential changes to EEO-1 data reporting. 
  • Rebecca Walker shares NAVEX 2026 survey findings linking leadership “say vs. do” gaps to higher violations. 
  • Jonathan Armstrong covers an Italian Garante fine (€190,000) against ITA Airways for overly broad digital forensics and GDPR process failures, underscoring the importance of scoping, vendor management, and documentation.

 

The members of Everything Compliance are:

The award-winning Everything Compliance is a part of the Compliance Podcast Network.

Categories
Compliance Into the Weeds

Compliance into the Weeds: OFAC’s Warning Shot: FTI Consulting Fined for Indirect Dealings with Sanctioned Bank

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore it in greater depth. Looking for some hard-hitting insights on compliance? Look no further than Compliance into the Weeds! In this episode of Compliance into the Weeds, Tom Fox and Matt Kelly discuss a recent OFAC enforcement action fining FTI Consulting $1.05 million for a sanctions violation involving indirect dealings with Russia’s state-owned VTB Bank.

FTI provided economic analysis for VTB in litigation, but, knowing VTB was sanctioned, used a law firm as an intermediary to invoice and receive payment, which OFAC said does not avoid liability because prohibitions apply to indirect transactions as well as direct ones. OFAC doubled the base penalty of $525,000 explicitly to promote future compliance by similarly situated companies, signaling strong disapproval of “middleman” structures. The case also involved unpaid invoices that became an impermissible extension of credit to a sanctioned entity, highlighting the need for rigorous contract and payment-term review beyond basic sanctions screening and for dedicated sanctions expertise.

Key highlights:

  • Introducing the OFAC Case
  • Middleman Billing Scheme
  • Why Screening Misses Indirect Risk
  • Did Compliance Approve It?
  • OFAC Expectations and Capability
  • Penalty Doubled Warning Shot
  • Unpaid Invoices as Credit Extension

Resources:

Matt in Radical Compliance

Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

A multi-award-winning podcast, Compliance into the Weeds was most recently honored as one of the Top 25 Regulatory Compliance Podcasts, a Top 10 Business Law Podcast, and a Top 12 Risk Management Podcast. Compliance into the Weeds has been conferred the Davey, Communicator, and W3 Awards, all for podcast excellence.

Categories
2 Gurus Talk Compliance

2 Gurus Talk Compliance – Episode 78 – A Brave New World Edition

What happens when two top compliance commentators get together? They talk compliance, of course. Join Tom Fox and Kristy Grant-Hart in 2 Gurus Talk Compliance as they discuss the latest compliance issues in this week’s episode!

 Stories This Week Include:

  • SBF Applies for Pardon
  • Post Wells Issues for Profit Disgorgement
  • Sad Day for College Sports
  • Hungary uses AI to track Orban’s corruption
  • Meetings are Useless
  • Big Banks and New Tokenization
  • OFAC fines FTI
  • What is MNPI
  • The compliance job market
  • A Florida man writes on the whiteboard outside the house that he is not home. Arrested nonetheless

Resources:

Kristy

Kristy Grant-Hart on LinkedIn

Order Kristy’s updated, 10-year new edition of How to Be a Wildly Effective Compliance Officer by clicking here.

Tom

Check out the top compliance handbook, The Compliance Handbook, 7th edition, published by LexisNexis. Visit the LexisNexis® Store at https://lexisnexis.com/fox20

To save 20% on The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, please reference or enter promotion code: FOX20.

Offer expires December 31, 2026. Offer applies to new orders only, before shipping and taxes are calculated and shipped to a U.S. address. A discount will be applied to each applicable product after the code FOX20 is entered. Discount does not apply to current subscriptions, renewals, or updates. Certain exclusions and other restrictions may apply. Void where prohibited. View full terms here.

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
FCPA Compliance Report

FCPA Compliance Report: Venezuela Re-Entry: A Strategy of Watchful Waiting

Welcome to the award-winning FCPA Compliance Report, the longest-running podcast in compliance. In this episode, Tom welcomes Morgan Lewis partners Carl Valenstein (international corporate law, Latin America) and Katelyn Hilferty (international trade, export controls and sanctions) on whether businesses should consider returning to Venezuela after Maduro’s arrest and President Trump’s announcement. Ed. Note: this podcast was recorded in February, and since then, OFAC has issued New and amended Venezuelan-related General Licenses. The situation remains fluid.

Valenstein leads off by noting that he is counselling businesses to engage in “watchful waiting” due to continued instability, corruption, weakened institutions, security risks, uncertainty about elections, and a lack of clear U.S. incentives, such as political risk insurance. Hilferty explains that sanctions relief is narrow: two limited OFAC general licenses focused on Venezuelan-origin oil and U.S.-origin diluents, while most sanctions and broad export control restrictions remain in effect, with licenses revocable. They discuss payment and transparency concerns, large outstanding debts, and major capital and operational challenges to restore oil production. They advise companies to review licenses, establish compliance guardrails, screen counterparties, and draft contract and payment terms before pursuing opportunities.

Key highlights:

  • What Changed in Venezuela
  • Watchful Waiting Reality Check
  • License Reversals and Uncertainty
  • Compliance Starting Point Checklist
  • Cartels and Terror Designations
  • Beyond Oil and Gas Opportunities

Resources:

Morgan Lewis

Carl Valenstein

Katelyn Hilferty

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Returning to Venezuela on Amazon.com

Categories
FCPA Compliance Report

FCPA Compliance Report – Navigating Export Control and Trade Sanction Challenges in Venezuela: Insights from Brent Carlson

Welcome to the award-winning FCPA Compliance Report, the longest-running podcast in compliance. In this inaugural episode of 2026, Tom Fox welcomes back Brent Carlson, a specialist in trade and economic sanctions, focusing on compliance issues related to Venezuela.

Tom and Brent discuss the shifting political landscape, potential business opportunities in the energy sector, and the steps compliance professionals need to take to navigate new regulations and restrictions from the export control and trade sanctions perspective. Brent emphasizes the importance of a robust, business-aligned compliance strategy, a non-siloed approach involving all risk disciplines, and proactive dialogue with regulators. They also discuss the heightened enforcement landscape and the need for companies to remain vigilant and adaptable in a rapidly changing global environment.

Key highlights:

  • Focus on Venezuela: Navigating Export Controls and Sanctions
  • Business Opportunities and Risks in Venezuela
  • Importance of Understanding Business Operations
  • Board of Directors: Asking the Right Questions
  • Geopolitical Changes and Risk Management

Resources:

Brent Carlson on LinkedIn

Red Flags Rising website

Tom Fox

Five-Part Blog Post Series on Doing Business in Venezuela on the FCPA Compliance and Ethics Blog

Instagram

Facebook

YouTube

Twitter

LinkedIn