· Weekly Digest

Financial Crime Weekly Digest — 13 – 19 October 2026

Global enforcement actions, regulatory moves & intelligence from the world of AML & financial crime.

Illustration for “Financial Crime Weekly Digest — 13 – 19 October 2026”

Download the full digest (PDF) · 7 pages

13 – 19 October 2026

In this issue

  • STORY OF THE WEEK — Detection, outsourced: Treasury’s three actions against Bank of America, led by a $1.2 billion FinCEN penalty
  • ENFORCEMENT — Iran’s shadow banking, with a Dubai-based oil intermediary · a DIFC formation agent fined for working without DNFBP registration · a cartel’s racetrack
  • REGULATORY — FinCEN’s red flags for abuse of religious charities · the SFO opens a direct line before a self-report · OFAC reissues its Lukoil licences
$1.2B
FINCEN PENALTY ON BANK OF AMERICA
FinCEN · 13 Oct · credits the OCC’s $750 million		$5B+
SUSPICIOUS TRANSACTIONS NOT TIMELY REPORTED
US Treasury · 13 Oct · as found by FinCEN		475
APPARENT SANCTIONS VIOLATIONS SETTLED
OFAC · 13 Oct · $11,662,930 settlement		71
CLIENTS SERVED BY AN UNREGISTERED DIFC CSP
DFSA · 15 Oct · USD 454,367.05 penalty

STORY OF THE WEEK · UNITED STATES

Detection, Outsourced. Three Actions Against Bank of America

$1.2 billion — civil money penalty assessed by FinCEN on Bank of America, N.A., which credits the OCC’s $750 million penalty, per FinCEN’s consent order

On 13 October the US Treasury announced penalties of more than $1.21 billion on Bank of America, N.A. for violations of anti-money laundering and sanctions laws. FinCEN assessed $1.2 billion; the OCC assessed $750 million, the largest in its history; and OFAC announced an $11,662,930 settlement. FinCEN’s consent order credits the $750 million paid to the OCC, so under it the bank pays a further $450 million to the Treasury. The bank admits it willfully violated the Bank Secrecy Act, failing to maintain a compliant AML programme, to conduct due diligence on foreign correspondent accounts, and to file SARs. Treasury says it failed to timely report over $5 billion in suspicious transactions, over $1 billion of it implicating priority risks including Chinese Money Laundering Networks.

The finding that stands out is Treasury’s: by relying on law enforcement inquiries and other banks’ requests over its own controls, the bank effectively outsourced to third parties a substantial portion of its proactive detection and reporting. OFAC’s release covers 475 apparent violations from September 2021 to April 2025: payments through blocked banks listed in a vendor’s routing directory, some released by an “alert suppression rule”; exact name-and-date-of-birth matches to blocked persons classed as low or medium priority; and a watchlist file that, through a vendor’s error, was not updated between 24 May and 28 June 2023.

  • FinCEN consent order No. 2026-03 · the bank admits the Statement of Facts and Violations
  • FinCEN requires a third-party SAR lookback and independent reviews of monitoring, CDD, correspondent due diligence and data governance
  • OCC: the bank is also subject to a December 2024 cease-and-desist order
  • OFAC: non-egregious, largely not voluntarily self-disclosed · no reduction to the base penalty, including no mitigation for remedial measures or cooperation

Why it matters for compliance teams Treasury states the lesson itself: institutions cannot rely on law enforcement inquiries, referrals from other financial institutions or other external sources “as substitutes for their own effective internal monitoring and controls”. OFAC adds that each organisation remains responsible for its own compliance regardless of whether it relies upon third-party providers. Three questions follow for any firm, in any jurisdiction. What share of your SARs began with an external request rather than your own alert? Who approves your alert suppression rules, and when were they last tested? And if your vendor’s list file failed to update tomorrow, how soon would you know?

ENFORCEMENT ACTIONS

Law Enforcement Strikes This Week

Iran’s Shadow Banking: an Iraqi Bank, Offshore Banks and a Dubai-Based Oil Intermediary

SHADOW BANKING · US TREASURY / OFAC · UNITED STATES / IRAN / IRAQ / UAE

On 15 October, under Operation Economic Outcast, Treasury designated Iraq-based International Development Bank for Investment and Finance, which it says provides US dollar access for Iran, and the Iranian “offshore” banks Jazireh International Bank Company and Chabahar International Bank Overseas Company. It also designated Sayyed Ruhollah Razavi, who Treasury says lives in Dubai as one of Iran’s top oil intermediaries, and Iran-based exchange houses. The State Department designated Cuba’s BICSA, which has served Iran’s Karafarin Bank since at least 2022. General License FF authorises the wind down of transactions involving the Iraqi bank through 12:01 a.m. EDT on 30 October 2026.

A DIFC Formation Agent Fined for Working Without DNFBP Registration

USD 454,367 · DUBAI FINANCIAL SERVICES AUTHORITY · UAE / DIFC

On 15 October the DFSA imposed a penalty of USD 454,367.05 on Hayman-Woodward Global Mobility Services (DIFC) Ltd. for providing company service provider services in or from the DIFC without being registered as a DNFBP, in breach of Article 71A(1) of the Regulatory Law 2004. Between August 2018 and February 2025 it provided CSP services, such as acting as a formation agent and providing registered office addresses, to 71 clients. The firm settled, so the DFSA reduced the fine component by 30%. The DFSA says such services “can present elevated financial crime risks”.

A Cartel’s Racetrack: OFAC Targets Cartel del Noreste’s Horse Racing Enterprise

4 + 11 · US TREASURY / OFAC · UNITED STATES / MEXICO

On 13 October OFAC sanctioned four individuals and 11 entities connected to Cartel del Noreste, a designated Foreign Terrorist Organization, across quarter horse racing, construction, trucking and oil and gas. They include Club La Molienda, a racetrack, restaurant and bar near Nuevo Laredo that Treasury says CDN controls, and a construction company Treasury says was used to funnel money to election campaigns of CDN’s preferred candidates. OFAC coordinated the action with Mexico’s financial intelligence unit, the UIF.

Bulk Cash, Couriers and WhatsApp: a $30 Million Laundering Network

12 YEARS · US DEPARTMENT OF JUSTICE · UNITED STATES / BRAZIL

On 16 October Ygor Fokin Saviolli, a Brazilian national, was sentenced to 12 years in prison as a manager and supervisor of a money laundering organisation that laundered more than $30 million, including drug trafficking proceeds. According to court documents, US-based couriers collected bulk cash and deposited it at banks across the country to conceal and return the profits to, among others, sources of drug supply outside the United States. Pickups were coordinated through WhatsApp message chains. Five co-defendants were sentenced on 24 September.

REGULATORY DEVELOPMENTS

Regulatory Moves Reshaping the Compliance Landscape

FinCEN Issues Red Flags for Iranian Abuse of Religious Charity Networks

UNITED STATES / IRAN

On 15 October FinCEN issued Alert FIN-2026-Alert008, asking financial institutions to report potential Iranian regime abuse of religious charity networks, including diversion of religious tithes, or khums. Treasury says organisations that collect these payments may use informal channels such as hawalas and cash couriers to remit funds to Iran or Iran-linked actors. Among the red flags: a charity or NPO solicits donations but does not appear to provide any charitable services; it receives large donations from an unknown source over a short period, then sends significant wires or checks to other charities; or a customer receives transfers from a charity with no clear business relationship and withdraws the funds in cash or remits them onward. SARs should carry the key term “FIN-2026-IRANCHARITYABUSE” in field 2 and the narrative. FinCEN adds that legitimate charities should have access to financial services, and reminds banks to apply a risk-based approach.

The SFO Opens a Direct Line to Its General Counsel Before a Corporate Self-Report

UNITED KINGDOM

On 13 October the Serious Fraud Office strengthened its guidance for corporates on self-reporting suspected fraud, bribery and corruption. A corporate’s legal representatives can now discuss a potential self-report directly with its Director of Legal Services, through a dedicated email address, before committing to a formal report. The guidance, first launched in April 2025, commits that corporates who report promptly and cooperate fully will, barring exceptional circumstances, be invited to negotiate a Deferred Prosecution Agreement. The SFO will make contact within 48 business hours of a self-report and decide whether to open an investigation within six months. The update also says corporates are expected to take a proportionate, risk-based approach to identifying the full extent of any offending, and that the six-month period for concluding DPA negotiations runs from acceptance of an invitation to negotiate.

OFAC Reissues Its Lukoil Licences, Now Running to April 2027

UNITED STATES / RUSSIA / BULGARIA

On 15 October OFAC issued Russia-related General License 128D, replacing 128C of 14 April 2026. It authorises transactions involving Lukoil International GmbH and entities it owns 50% or more that are ordinarily incident and necessary to the purchase of goods and services from, or the maintenance, operation or wind down of, retail service stations outside Russia, through 12:01 a.m. EDT on 24 April 2027. It does not authorise transactions under Directives 2 and 4, or the transfer of funds to any person or account in Russia. General License 130B, replacing 130A, authorises transactions involving four named Lukoil entities in Bulgaria, and entities they own 50% or more, through the same date.

ON OUR RADAR

Watch This Space

  • Extradited From Sweden: an Alleged Procurement Network for Russia, Run Through Hong Kong EXPORT CONTROLS · SANCTIONS · UNITED STATES / RUSSIA / HONG KONG — On 15 October Alexander Suvorov, a Russian national, was extradited from Sweden to the Northern District of New York. A criminal complaint alleges that between about March 2022 and April 2023 he led a network that unlawfully exported US dual-use electronic components to Russia, maintaining Hong Kong front companies to conceal that the end users were in Russia, and sent wires to US companies to pay for them. Count 1 alleges conspiracy to commit international promotional money laundering. A complaint is an allegation.
  • FCA and NCA Arrest Three Over a Suspected Insider Dealing Ring MARKET ABUSE · UNITED KINGDOM — On 13 October three individuals were arrested after a joint FCA and National Crime Agency operation against a suspected organised criminal group for insider dealing and money laundering. More than 100 FCA and NCA staff searched five homes in London and Manchester and seized more than 30 phones, laptops and tablets. The FCA says it cannot comment further at this time.
  • An NCA-Hosted Crackdown on West African Fraud Networks FRAUD · SCAM CENTRES · UNITED KINGDOM / GHANA / NIGERIA — Announced 13 October: almost 30 suspected scammers were arrested, primarily in Ghana and Nigeria, and 3.7 million online profiles and accounts removed in an NCA-hosted operation with overseas law enforcement and tech companies, held in London on 6 – 9 October. The NCA says private sector partners identified $11 million in potential freezable funds, and 117 people were identified as victims of trafficking.
  • Two Plead Guilty After Advisory Clients Lose £2m ADVISER FRAUD · UNITED KINGDOM — The FCA announced on 13 October that a director and the business operations manager of two FCA-authorised advice firms pleaded guilty to defrauding clients between January 2019 and January 2023 and using false documents; four clients lost £2m. The director also admitted a money laundering offence. Neither firm was permitted to hold or control client money. Sentencing is set for 10 December 2026.

This Week’s 3 Key Takeaways

  1. If Others Find It First, the Programme Has Failed — Treasury’s central criticism of Bank of America is not a single missed customer but how detection worked: relying on law enforcement inquiries and other banks’ requests over its own controls, so that detection was effectively outsourced and suspicious activity accumulated uninvestigated. Count how many of your own SARs in the last year began with a subpoena, a law enforcement request or another bank’s enquiry. A high share is the signal Treasury is describing, and it is worth knowing before an examiner does.
  2. Screening Plumbing Needs an Owner — OFAC’s findings against the bank are mostly plumbing: a vendor routing directory that still listed blocked banks, a suppression rule that released payments which had alerted, exact name-and-date-of-birth matches ranked below high priority, and a watchlist that, through a vendor’s error, was not updated for over a month. OFAC says decisions on alert parameters and rules should be risk-based, supervised, audited and tested, and that each organisation remains responsible for its own compliance whatever providers it relies on. Give each of those four a named owner and a test date.
  3. Our Six: the UAE This Week, Quiet Elsewhere — From the regulators of the six jurisdictions this digest follows, we confirmed one in-week financial crime item: the DFSA’s penalty on a DIFC company service provider that never registered as a DNFBP. The UAE also appears in OFAC’s Iran action, through a designated oil intermediary Treasury says lives in Dubai and shell companies in the UAE. We found nothing on financial crime dated 13 – 19 October from the Mauritian, Saudi, Qatari or Moroccan regulators we could reach, and the FATF’s news page listed nothing after 9 September, so we make no grey-list comment this week. Several sites block automated access, so that is what we could see, not proof that nothing was published.

Want this digest in your inbox every week?

Follow SonarPulse on LinkedIn · https://www.linkedin.com/company/sonarpulse

Sources

This article draws on the following sources. Follow the links for the original text.

Start with a compliance health check.

A working session with your compliance team, then a walkthrough against your own risk appetite: the lifecycle end to end, scoring weights set to your policy, and a review of the audit trail the system produces.

Or write to info@sonarpulse.mu