AML Regulatory Roundup – October

October was a busy month for regulators. There were five enforcement actions against banks, broker-dealers, and other regulated entities for compliance failures issued by the U.S. Department of the Treasury’s Office of the Comptroller of the Currency (OCC), Office of Foreign Assets Control (OFAC), and Financial Crimes Enforcement Network (FinCEN), as well as the Financial Industry Regulatory Authority (FINRA) and New York State Department of Financial Services (NYDFS). Below are the most relevant cases from October illustrating that while there has been a trend of deregulation in the past two years, there is still a focus on combating sanctions evasion and bolstering anti-money laundering (AML) programs.

1.  FINRA Fines Broker-Dealer $800,000 Over AML Program Deficiencies

On October 5, FINRA published a Letter of Acceptance, Waiver, and Consent (AWC) proposing settlement with a member broker-dealer for $800,000 for, among other Bank Secrecy Act (BSA) and securities law violations, failure to implement an adequate AML program designed to detect suspicious transactions and high-risk customers in violation of the BSA.¹ This is the second AWC issued against this member; FINRA previously issued an AWC in 2017 due to the member’s inadequate AML program and failure to implement monitoring systems designed to comply with the Penny Stock Rule.

The 2026 AWC highlighted that, for four years prior, the member firm underwrote or acted as the selling group member to dozens of small-cap initial public offerings, predominantly to issuers in China and Hong Kong. The issuers then engaged in trades that had all the characteristics of pump-and-dump market manipulation. The member firm also did not flag that many of its purportedly unrelated foreign customers listed the same residential address at onboarding, listed themselves as unemployed but with six figures of income, and subsequently engaged in identical trading patterns. The member firm did not capture any of the suspicious trading activity or client profiles, resulting in the fine and the need to retain a third-party consultant to review the firm’s compliance.

2.  FinCEN, OFAC, and the OCC Assess a Collective $1.2 Billion Penalty Against Bank of America for BSA/AML Failures

On October 13, FinCEN and the OCC imposed a $1.2 billion civil money penalty on Bank of America (BofA) for willful violations of the BSA and U.S. sanctions programs, of which $750 million will be paid to the OCC, and $11.6 million will be paid to OFAC through a separate settlement.² This is the third-largest penalty in FinCEN history and the largest in OCC history. Specifically, each regulator found the following:

• The OCC found that the bank failed to properly monitor trillions of dollars in transactions, resulting in missed, late, and incomplete suspicious activity reports (SARs). In fact, SARs were not filed for 18 percent to 44 percent of potentially suspicious activity, both because there were too few investigators to handle open cases and because automated systems did not create a case even in the case where the activity rose to the level of suspicious activity. The OCC also found that BofA’s inadequate training program and escalation procedures contributed to the monitoring and filing failures. BofA is still under an OCC consent order from 2024 for its BSA/AML compliance program and processes, which exacerbated the financial penalty.
• FinCEN found that flaws in the bank’s in-house monitoring system caused missed or late reporting of more than $5 billion in suspicious activity. About $1 billion of that activity involved national security-related violations that are currently enforcement priorities for the Department of Justice, including Chinese money laundering networks, fraud, and southwest border trade-based money laundering. FinCEN also found that the bank prioritized revenue generation over mitigation of risk from high-risk online auto-auction customers, despite escalation from compliance.
• OFAC found 475 violations of multiple sanctions programs when BofA processed payments to and from blocked accounts, failed to update OFAC watch lists in real time, and failed to identify violations even after being made aware of the sanctions violations via an OFAC subpoena. The violations totaled over $14 million going to sanctioned accounts, jurisdictions, and individuals in Russia and Iran.
  
  

3.  NYDFS Fines SEB $33 Million Over Baltic AML Failures That Impacted the New York Banking System

On October 15, the NYDFS entered into a $33 million consent order with the New York branch of Skandinaviska Enskilda Banken AB (SEB), a Swedish bank.³ This order follows similar orders issued by the Swedish and Estonian regulators of SEB, citing failures in SEB’s AML program and monitoring systems. Despite the AML program and monitoring deficiencies occurring at the Latvian and Lithuanian branches, the activity impacted the U.S. financial system through SEB’s New York branch and two U.S. clearing banks. Specifically, between 2015 and 2019, the two U.S. clearing banks processed hundreds of billions of dollars of transactions that originated from SEB’s Latvian and Lithuanian branches that raised red flags at the clearing banks, but were processed due to the correspondent banking relationships. 

Conclusion

Common themes emerge from the highlighted enforcement actions: failures in transaction monitoring systems, insufficient investigative staffing and training, and inadequate escalation procedures. In light of this recent uptick in enforcement, clients should take this opportunity to review their AML and sanctions policies and procedures to confirm that their compliance programs are appropriately tailored to their risk profiles. Proactively identifying and remediating gaps now is far preferable to having a regulator identify them during an exam or investigation.

If you have any questions about these developments or would like to discuss your existing AML or sanctions compliance program, please contact us at lsamlteam@lowenstein.com.

¹ See Letter of Acceptance, Waiver, and Consent No. 2023080788201 re: Revere Securities, LLC, Financial Industry Regulatory Authority (Oct. 2, 2026).
² See In the Matter of Bank of America, N.A., FinCEN Consent Order No. 2026-03, Financial Crimes Enforcement Network (Oct. 13, 2026); see also In the Matter of Bank of America, N.A., OCC Consent Order No. AA-ENF-2026-41, Office of the Comptroller of the Currency (Oct. 13, 2026); “Bank of America, N.A. Settles with OFAC for $11,662,930 Related to Apparent Violations of Multiple Sanctions Programs,” Office of Foreign Assets Control (Oct. 13, 2026).
³ See In the Matter of Skandinaviska Enskilda Banken AB and, Skandinaviska Enskilda Banken AB, New York Branch, N.Y.S. Dept. of Financial Services (Oct. 15, 2026).