Block sets aside $764 million for a DOJ deal over its anti-money laundering programme

What happened

In its quarterly report dated 3 November 2026, Block, Inc., the owner of Cash App, disclosed an agreement in principle with the US Department of Justice (DOJ), reached in October. Under a deferred prosecution agreement (DPA), the DOJ will defer for three years a charge that the company failed to maintain an effective anti-money laundering (AML) programme in violation of the Bank Secrecy Act.

The filing says the DPA is expected to set a gross monetary component of approximately $964 million and to require a net payment of approximately $764 million, based on credit for prior regulatory resolutions. Block accrued $764 million for the matter as of 30 September 2026. If it fully complies during the three-year term, the DOJ will move to dismiss the deferred charges with prejudice.

None of this is final. The resolution remains subject to a final agreement satisfactory to all parties and to court approval. Block says it cannot provide any assurance that a final agreement will be reached. It also says the final terms could result in losses above the amount accrued.

The filing gives the background. Block received inquiries from the Securities and Exchange Commission (SEC) and the DOJ shortly after a short seller report published in March 2023. Those inquiries primarily relate to the report’s allegations, the company’s compliance and risk practices, and related disclosures. In March 2026, SEC staff told Block they had concluded their investigation and did not intend to recommend enforcement action. The DOJ presented potential terms the same month.

Why it matters

The filing does not describe the alleged deficiencies. Until a statement of facts is published, nobody outside the case can say which controls failed, and firms should be careful about drawing conclusions from the headline figure alone.

The sum still sets a reference point for payments and fintech boards. An inquiry that began after a public allegation in 2023 has reached a nine-figure accrual and a three-year period in which any breach could bring prosecution on the deferred charge.

A separate risk factor deserves attention from compliance leaders. Block warns that workforce reductions, together with “potential increased reliance on automation and AI tools to support certain legal, regulatory compliance and risk management functions,” may limit its capacity and introduce additional oversight risks. A listed company under a pending DPA has put that sentence in front of its investors. Other firms making the same trade would be wise to examine it.

The $200 million gap between gross and net figures also shows that earlier regulatory settlements can count in a later negotiation.

Practitioner angle

• Read the statement of facts when the DPA is published, and map each described failure to your own programme.
• If you run AML at a payments or fintech firm, test whether onboarding, monitoring, and investigation capacity have kept pace with customer growth.
• Where compliance roles are being replaced by automation, document who reviews the tool’s output and how you know capacity is still adequate.
• Treat a credible public allegation, from a short seller or the press, as a trigger for a documented internal review.
• Keep a single record of past settlements, remediation commitments, and evidence of completion, so that legal and compliance can use it in any future discussion.