FATF, FinCEN, AI Risk Management, and a Major Bank Enforcement Case

This week on This Week in AML, John Byrne and Elliot Berman examine several significant developments shaping the financial crime compliance landscape.

The episode highlights FATF's upcoming consultation on information sharing, a topic with major implications for public-private partnerships, cross-border collaboration, and the future effectiveness of AML programs. The hosts also discuss reports of a proposed U.S.-Russia diesel fuel arrangement, new concerns involving Iran, and the broader sanctions implications for compliance professionals.

Additional topics include the FCA's estimate that fraud in the UK exceeded £220 billion, forthcoming crypto registration requirements, new AI risk management guidance from the Monetary Authority of Singapore, and congressional questions surrounding FinCEN's AML/CFT priorities and the Corporate Transparency Act rollback. The episode concludes with breaking news: a record enforcement action against Bank of America, including a reported $1.21 billion penalty involving BSA/AML, sanctions, and suspicious activity reporting failures.

FATF, FinCEN, AI Risk Management, and a Major Bank Enforcement Case - Transcript

Elliot Berman: Hi, John. How are you today?

John Byrne: Good, Elliot. I'm actually down in Hilton Head, South Carolina for a couple days. Nice weather. Most important thing going on is that your Brewers are up two games to none-

Elliot Berman: They are ...

John Byrne: in the championship before they get to the World Series, which would be really cool.

Elliot Berman: That would be cool. The last time they went was 1982.

John Byrne: Yes. And I always tell people this, you know this, of course, that people in Milwaukee were so great that when they lost the World Series, they had a parade for them anyway- Yes ... which I think is, it's so cool, so there. This were to happen again, I don't need to tell you what it'd be like, so-

Elliot Berman: Yeah

John Byrne: So a bunch of things, we are recording this earlier in the week. We just learned today, no surprise to some of us, although you never know with this administration when they're gonna react to actually firing people. But the Greek ambassador, Kimberly Guilfoyle, who has been in the news quite a bit. Wall Street Journal's done some great stories about a couple of things that she's been accused of.

One was asking a donor for him, before she went to her Senate confirmation hearing, to pay $100,000 American Express bill that she had, and if he would do that, she would help him with his tax problems.

Now, she denies all of this. It finally got to be too much for the administration, and she has resigned, effective today. I would also mention what's interesting, and people probably don't know this, there's 196 US ambassadors around the world. There are 96 vacancies. So just-

...

John Byrne: A little fun fact I thought I would add there. In any event, since we do talk about corruption and, certainly, attempted corruption, I thought that was a relevant update to give people.

Elliot Berman: And one more totally irrelevant fun fact, at one time, quite a few years ago, she was married to Gavin Newsom.

John Byrne: Yes. Yes. That is both a fun fact and you hit your head with your palm of your hand. But yes, that's right. So you have a few other things that you've identified that we talked about pre-recording. One is that we know FATF has their October plenary at the end of the month, but FATF's president has announced a couple of projects that he's interested in, and I know you've looked at a couple of those.

Elliot Berman: Yeah, one of them is that they're going to do a consultation, and remember, for those of you in the US, you'd be more familiar with this as a notice of proposed rulemaking, but a consultation on information sharing. And this is something that has been a topic that you and I have talked about for many years, going all the way back even before the Patriot Act.

But in the last few years, I think information sharing coupled with public-private partnerships has been a conversation that has continued. Because in my view, there's a recognition that when you've got more eyes on a problem, you have a better chance of solving it. And if somebody's got one piece of the puzzle, and you've got another piece of the puzzle, figuring out how to get those together is a good thing.

So that's something to watch for. I would expect that it's likely that we'll see that consultation published in early November, coming out of the October plenary, which is right at the end of the month. That was the one that I thought was the most interesting.

John Byrne: So a couple of other things. The Washington Post is reporting that a UK intelligence chief has warned that Iran is shifting toward harder targets citing specifically a suspected plot against airbases used by US bombers. That was just announced earlier today. The reason I'm, referencing something that's certainly tangential to the financial crime field, but also because Trump has offered what he's called a deal with Russia so that Russia can provide diesel fuel to help with the cost of diesel fuel.

I'll say a couple things. Neither you nor I are experts in this space, but no economist or businessperson that I've seen the past two days has said that this is gonna have any sort of major effect on the cost of diesel to begin with. And number two, from a broader perspective let's remember Russia is helping Iran, number one. Number two, the US Senate has and the Congress in general has passed the Countering American Adversaries Through Sanctions Act back in 2017, and that was to force President Trump in his first term to be tougher on Russia.

So that law still exists. Some have opined that what he's doing now could be a violation of an act of Congress if he directs the Treasury to issue a general license granting him an avenue to buy Russian oil. This is obviously a major turn from where we were, and I'm just baffled by this.

Again, from an economic standpoint, experts say it's really not gonna have any sort of major effect on the cost of diesel to begin with, and number two, this certainly goes against US policy toward Russia. I don't know what your thoughts are.

Elliot Berman: I'm just scratching my head. I've heard the same things that you just referred to in terms of business folks and economists opining about the impact of a deal like this on the current price of diesel, which I think is in the six and a half dollars a gallon range, but also, I can't figure out how this puzzle piece fits into our foreign policy.

So let's go to something I do understand a little bit. The FCA has announced that after looking at prior year activity that fraud in the UK last year likely totaled more than two hundred and twenty billion British pounds, which is a big number. You and I have been talking regularly over the last several years about the continuing explosion in the amount of fraud globally. Putting a number to it was breathtaking.

FCA also reminded everybody that their new crypto regime is kicking off the twenty-fifth of October a year from now, so in twenty twenty-seven. But reminding people who are not currently registered, that they're gonna have a registration obligation ahead of that date. Even if they are registered now for other activities, if they're involved in running a crypto exchange and providing crypto-related services, they will need to have another registration.

So if you are connected to one of those organizations or you're a vendor to one of those organizations you should continue to pay attention to this so that you know that you either are compliant or you're dealing with a compliant counterparty

John Byrne: Referencing again the sanctions space, another dramatic thing that occurred in the past week is the US has imposed sanctions, believe it or not, on the International Criminal Court as an institution. This is, according to the ICC unprecedented, follows a series of other designations against 13 independent judges and prosecutors. The measure targets an independent judicial institution, which the ICC is, that was created by 125 states with investigating and prosecuting genocide, crimes against humanity, war crimes, and crimes of aggression.

According to the statement from the ICC, it is an attempt to obstruct the course of justice and prevent the court from doing what it was created to do. Our friends at the Charity and Security Network have also highlighted this action with a statement earlier this week or over the weekend.

They said that imposing organization-wide sanctions on the ICC again, reading from the press statement, "The Trump administration has shamelessly discarded the rights of victims of atrocities and those that support their pursuit of justice. Instead, the administration has sided with authoritarians that fear accountability and desire impunity."

You can read more about Charity and Security Network's comments on this, and this isn't the first time they've commented on actions toward the ICC. But again, sanctions is a big part of our world, a big part of our community, and to say that the sanctions utilized by the US are counterintuitive in a number of areas is an understatement.

So regardless of where you sit on certain specific issues, it bears paying attention to because as sanctions experts that follow our conversation, you have obligations, legal compliance and going forward, maybe there'll be moral and ethical obligations. We'll see how this turns out.

Elliot Berman: Yes. You want to talk about the Amex fines?

John Byrne: Joe and I spent some time talking about that last week. So people should, as we said last week go through that. It's interesting. There are interesting takeaways.

I know we'll mention this toward the end of our conversation today, but I sat down with Sarah Beth Felix late last week, and that conversation will get posted before you hear this on Friday. And we talked about that as well with Sarah. So again good information. Bottom line was 11 years of issues.

So I think you can figure out why there were penalties there.

Elliot Berman: Yeah. The other thing to think about when you read those things is the OCC related to the national bank that is part of the Amex complex, but the Fed came out with a parallel set of determinations, and that related to the non-bank businesses.

And so many of the financial institutions in the United States are part of a bank holding company, and that's why you can have both regulators in there. And there was concern identified related to the travel-related businesses as well as the banking business by the OCC.

John Byrne: Also our colleague Sabrina Chen, who's in the FCA practice, posted an insightful piece on LinkedIn. So you should follow Sabrina if you don't already. Sabrina Chen. And she posted this a couple of days ago. The Monetary Authority of Singapore has newly published guidelines on artificial intelligence risk management.

And Sabrina, in her analysis calls out a couple of things. She said third-party AI is explicitly in scope, but accountability stays with the bank. Vendor self-attestation may not be enough. MAS recognizes independent external assessments as a potential source to address transparency limitations with third-party AI.

What else with Sabrina's analysis did you see?

Elliot Berman: She talked about that validation under the new guidelines is going to have to be use case specific, not generic. And not just testing the underlying models. And she had some comments about the guidelines as they relate to agentic AI.

And some good insights into the monetary authority's approach to risk proportionality. A good post. And for those of you who are operating in that part of the world that guidance is worth looking at. We'll have to see as guidance comes out from some of the other big regulators around the world how aligned they all turn out to be.

Great call out.

John Byrne: There was a hearing last month where at the time the director of FinCEN was Andrea Gacki, who has left FinCEN, and the ranking minority leader of the committee, Maxine Waters, sent in a series of questions as you do with hearings to the witnesses, and those responses come back in writing.

I just wanted to reference one that struck me by what it didn't say. I'm going to reference part of it. The question was about corruption and financial crime. Representative Waters wanted to know about the inclusion of corruption in the impending revision of the national priorities from 2021 that we're all well aware of.

She was concerned that the hesitation in responding to whether or not there is any in there could leave the impression that the administration will no longer prioritize fighting corruption. So they wanted an opportunity for FinCEN to set the record straight. Will it be included or not included in the revised list of priorities?

I'm reading the exact answer. Quote, "As FinCEN is engaged in an open rulemaking, the agency cannot provide any specifics regarding Treasury's consideration of the comments received during this process. As the director noted in the hearing, once the rule is finalized, then FinCEN will update the AML/CFT priorities." Close quote. You can take from that what you will. What else did you see with the Q&As with the witness?

Elliot Berman: It was interesting. There were a number of questions that talked about the impact on the ability to manage risk and to fight financial crime given the rollback of the Corporate Transparency Act rule and the closing of the registry.

And in each response, the essence of it was "We're sensitive to all of that, but we believe that the risk is from foreign bad actors." What I thought of when I read those responses was, I think if you go in the other room and look at the SARs, there are plenty of SARs that would speak to the fact that there appears to be a shell company, it appears to be domestic, and we don't know who to tell you to chase. So interesting.

John Byrne: Elliot, breaking news. My daughter, Rachel, who works at PNC, just texted me. There's a major new enforcement action just announced, so I'm reading this from the press release. I have no more information. Treasury announced record enforcement action against Bank of America, largest in OCC history.

A $1.2 billion penalty against B of A including, let's see FinCEN assesses for their failure to mitigate and report priority national security risks, including Chinese money laundering networks and illicit finance along the southwest border. The OCC assessed a $750 million civil penalty for the bank's deficient and ineffective BSA compliance program, and OFAC announced an $11.6 million settlement with the bank over apparent violations of numerous sanctions programs, including Iran, Russia, narcotics, and global terrorism.

The quote from Treasury Secretary Bessent, I'm reading the quote, "When a bank of this size fails to meet its AML and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire US financial system, to significant illicit finance risks." As part of its resolution, BofA admits it willfully violated the BSA and failed to implement and maintain a program with the minimum requirements to conduct due diligence for correspondent accounts and file SARs.

Fascinating. The consent order requires BofA to work with a third party to complete a look-back to identify and report to FinCEN suspicious transactions that went undetected to the failures noted above

Elliot Berman: There had been some rumors about investigations going on at B of A, but I didn't see anything prior to what you just read that indicated the magnitude. That is a big deal kind of in every which way you look at it. So besides breaking news, anything else to add before we wind up?

John Byrne: Two things. The webinar that we will be posting on the 22nd of October will be on banking high-risk customers, and so our panel will talk about the challenges there, and some recommendations, some best practices. I already mentioned the conversation with Sarah Beth Felix.

The only other thing I'd mention, as an aside, but going back to issues with Russia and Ukraine, saw something today that President Zelenskyy of Ukraine posted that they had blown up a data center in Russia just the other day, and based on that happening, a lot of bots that were sending false information to Europe and the US disappeared.

So that was an interesting I leave it to others that are experts whether that is possible or not that a data center would do that, but, seems logical to me that could be a possible action.

Elliot Berman: You mentioned next week's webinar. There's still time to get a seat. It'll live stream next Thursday, the 22nd, at 1:00 PM Eastern Time, and you can go to our website and register. John, I will talk to you next week. You enjoy the rest of your time in Hilton Head and drive home carefully.

John Byrne: Go Brewers. Take care.

Elliot Berman: You too. Bye bye.