FinCrime Intelligence Weekly
Bank of America pays $1.2 billion over a monitoring threshold, SEB's Baltic alerts went silent, OFAC hits Iran's shadow banks, and the UK plans whistleblower rewards.
Marco’s Take
Marco Beranzoni
Two of this week’s enforcement actions describe the same failure from opposite ends.
At Bank of America, the problem was the design. A case reached an investigator only when a customer’s alerts added up to 20 points within 13 months, a threshold FinCEN says was “initially set by stakeholder judgment.” At SEB’s Estonian subsidiary, the system stopped. For five weeks in 2017 it created no new alerts at all. Neither failure announced itself.
The sanctions side of both cases matches. OFAC found a Bank of America rule that automatically released some payments involving blocked banks because a similar alert had been cleared before. NYDFS found SEB processed payments without sanctions screening whenever its screening tool was down.
When systems miss things, people inside the firm often know. FinCEN notes that for multiple years more than one third of Bank of America’s investigations started from referrals, subpoenas, and requests rather than its own automated alerts. The UK’s new whistleblowing consultation proposes paying people who take what they know to the Serious Fraud Office.
Here is the uncomfortable task for this week. Ask your monitoring team for the lowest daily alert count each scenario produced in the last twelve months, and the reason for it. If nobody can answer, you do not know whether your system has ever gone silent.
See you next Monday.
Marco
FinCEN says the bank's own scoring system sent a case to investigators only at 20 points within 13 months, leaving over $5 billion of suspicious activity unreported or late.
Treasury designated Iraq's International Development Bank, two Iranian offshore banks, and four exchange houses, while the State Department listed Cuba's BICSA.
NYDFS found SEB's Estonian monitoring created no new alerts from 6 July to 10 August 2017, and payments went unscreened whenever its sanctions tool was down.
A consultation open until 8 January 2027 would fund SFO rewards from corporate penalties and asks whether employers should be legally required to run whistleblowing procedures.
In a preliminary ruling, Mr Justice Turner held that victims claiming under the Proceeds of Crime Act must show ownership under Chinese law, not English law.
What changed this week, why it matters, and what to do about it.
| Region | Update | Why it matters | Action |
|---|---|---|---|
| US | On 13 October 2026, the US Office of Foreign Assets Control (OFAC) sanctioned four individuals and 11 entities connected to Cartel del Noreste (CDN), a US-designated Foreign Terrorist Organization. They include Club La Molienda, a racetrack in Nuevo Laredo, a quarter horse racing barn, construction and fuel companies, and a trucking company. Treasury calls it OFAC's fourth and largest action against CDN networks under the current administration. | Treasury says CDN launders proceeds through the horse racing sector and that one designated construction firm corruptly obtained government contracts and funnelled money to election campaigns. One designated businessman races horses at tracks in California and New Mexico, so the exposure is not confined to Mexico. | Rescreen customers and counterparties against the new entries, and review accounts linked to racehorse sales, race winnings, and fuel, construction, or trucking payments with a Nuevo Laredo connection. |
| EU | On 12 October 2026, the European Banking Authority (EBA) released the final technical package for phase 1 of its 4.4 reporting framework. It includes eligibility templates and the revised templates supporting the 2027 risk assessment data collection for the EU Anti-Money Laundering Authority (AMLA). | The AMLA templates arrive in the same package as IFRS 18 and Pillar 3 changes, so the AML team may not be the first to see them. The EBA says a second phase is expected in early 2027. | Confirm that whoever owns your AMLA data submission has the revised 2027 templates and has compared them with the version used before. |
| UK | On 13 October 2026, the UK Financial Conduct Authority (FCA) and the National Crime Agency (NCA) arrested three people in an operation against a suspected organised criminal group engaged in insider dealing and money laundering. More than 100 FCA and NCA staff searched five residential premises in London and Manchester and seized more than 30 phones, laptops, and tablets. | The FCA describes the target as an organised crime group engaged in market abuse and money laundering together. It says it secured four insider dealing convictions in 2025/26. | Check that market abuse surveillance and AML monitoring share alerts on the same clients, so suspicious trading and suspicious funding are reviewed together. |
On 13 October 2026, the US Office of Foreign Assets Control (OFAC) sanctioned four individuals and 11 entities connected to Cartel del Noreste (CDN), a US-designated Foreign Terrorist Organization. They include Club La Molienda, a racetrack in Nuevo Laredo, a quarter horse racing barn, construction and fuel companies, and a trucking company. Treasury calls it OFAC's fourth and largest action against CDN networks under the current administration.
Why it matters:Treasury says CDN launders proceeds through the horse racing sector and that one designated construction firm corruptly obtained government contracts and funnelled money to election campaigns. One designated businessman races horses at tracks in California and New Mexico, so the exposure is not confined to Mexico.
Action:Rescreen customers and counterparties against the new entries, and review accounts linked to racehorse sales, race winnings, and fuel, construction, or trucking payments with a Nuevo Laredo connection.
On 12 October 2026, the European Banking Authority (EBA) released the final technical package for phase 1 of its 4.4 reporting framework. It includes eligibility templates and the revised templates supporting the 2027 risk assessment data collection for the EU Anti-Money Laundering Authority (AMLA).
Why it matters:The AMLA templates arrive in the same package as IFRS 18 and Pillar 3 changes, so the AML team may not be the first to see them. The EBA says a second phase is expected in early 2027.
Action:Confirm that whoever owns your AMLA data submission has the revised 2027 templates and has compared them with the version used before.
On 13 October 2026, the UK Financial Conduct Authority (FCA) and the National Crime Agency (NCA) arrested three people in an operation against a suspected organised criminal group engaged in insider dealing and money laundering. More than 100 FCA and NCA staff searched five residential premises in London and Manchester and seized more than 30 phones, laptops, and tablets.
Why it matters:The FCA describes the target as an organised crime group engaged in market abuse and money laundering together. It says it secured four insider dealing convictions in 2025/26.
Action:Check that market abuse surveillance and AML monitoring share alerts on the same clients, so suspicious trading and suspicious funding are reviewed together.
Typology of the week
FinCEN's alert of 15 October 2026 (FIN-2026-Alert008) describes how the Iranian regime co-opts khums, the practice of donating a fifth of one's surplus annual income to religious institutions, from the global Shi'a community. In some cases, organisations that collect these payments do so on behalf of prominent Iranian ayatollahs with ties to the regime. The funds may then move to Iran or to Iran-linked actors through hawalas and cash couriers, outside the formal payment trail. Khums is a legitimate religious practice, and FinCEN stresses that legitimate charities should keep access to financial services. The risk sits in who collects the money and where it goes.
Example
The alert cites a 2024 case in which Muzzamil Zaidi and Asim Mujtaba Naqvi pleaded guilty for their roles in a scheme to collect tens of thousands of dollars, including khums payments, in the United States for transfer to Iran. According to the Department of Justice, as quoted in the alert, associates carried the cash out of the United States in amounts under $10,000 to avoid law enforcement scrutiny. One transfer involved a group of 25 travellers on a religious pilgrimage in Iraq who then hand-carried the US dollars to Iran.
Recent actions and the control lessons behind them.
Bank of America, N.A.
Control failure:OFAC's enforcement release of 13 October 2026 describes failures between September 2021 and April 2025. A design flaw classified alerts on customers whose name and date of birth exactly matched a blocked person as low or medium priority, and three designated individuals made 31 transactions totalling $56,258. A vendor's human error left the watchlist file without updates from 24 May to 28 June 2023. A technical failure on 7 February 2025 meant the previous day's designations did not load, and 26 transactions totalling $146,543 went through for a designated ship management company. Branch staff also moved $189,869 from restricted accounts into a new unrestricted account at the request of a blocked person's adult child, before sanctions staff caught the error. OFAC also cites piecemeal and incomplete disclosures that slowed its investigation.
Lesson:Treat an exact name and date of birth match as a top priority alert, without exception. Reconcile your screening list against OFAC's published updates every business day, so a vendor or load failure shows up within hours rather than weeks. Train branch and operations staff that a blocked person's authority over an account blocks the funds, whoever asks to move them. Answer the regulator fully the first time: the settlement gave no mitigation for remediation or cooperation.
Quanzhou Intermediate People's Court, Fujian province
Control failure:Al Jazeera reported on 13 October 2026, citing the court's statement, that the gang's crimes included telecommunications fraud, illegal casino operations, drug trafficking, organised prostitution, and the murder of at least two Chinese nationals, and that its operations netted more than $1.8bn. Chinese state broadcaster CCTV described 14 large-scale compounds and said the gang lured thousands of Chinese nationals to Myanmar with promises of high wages.
Lesson:Banks meet scam compounds at two points: the victims sending money and the accounts that receive it. Prioritise detection of payee accounts that receive many first-time payments from unrelated customers, and treat job offers promising high wages abroad as a trafficking indicator worth escalating when they surface in customer contact.
FinCEN's Bank of America order says the bank added rules to "rescore" or "suppress" monitoring activity without sufficient governance and oversight. OFAC separately found a screening rule that automatically released alerts matching ones previously closed as false positives. Any rule that removes an alert from human review deserves the same treatment as a scoring model: a documented rationale, a named owner, regular below-the-line sampling, and a log of what it suppressed. The same applies to every automated close in a machine learning tuning project.
Al Jazeera's report on the Wei family sentences cites a July warning from the International Organization for Migration that scam centres may employ up to 300,000 workers and target people in the West, many of them elderly. At that scale, the same scripts and the same payee accounts hit many customers at once. Shared intelligence on receiving accounts and coordinated approaches, across your own customer base and through information sharing with peers, catches more than any single investigation.
Career & Skills Corner
FinCEN's Bank of America order quotes the bank's own records: its main case-creation threshold was "initially set by stakeholder judgment" and stayed in place until December 2023. Analysts who can explain where their institution's thresholds came from are rare, which makes them valuable. Pick one scenario you work alerts from. Find out who set its threshold, when, and on what evidence. Ask whether anyone has tested activity just below the line, and what that testing found. Then write one page: the scenario, the threshold, the evidence, and the gaps. You will learn more about your monitoring system from that page than from months of clearing alerts, and you will have something concrete to take to your tuning or model governance team. It is also a question to expect from an examiner.
Before the next issue I'm rereading the Bank of America consent order with one question in mind: which findings would apply to a bank a tenth of its size. I'm also preparing for the FATF plenary in Paris, which FATF's calendar lists for 26 to 30 October, and the updated statements on monitored jurisdictions that come at the end of it.
Turn this weekly intelligence into a career. Marco’s AML & Financial Crime course takes you from curious to hireable.
AML & Financial Crime course →