Welcome to the Rundown!
Financial institutions and their ability to spot suspicious transactions came under scrutiny last week, while federal prosecutors were told to move earlier to freeze stolen funds.
The Office of the Comptroller of the Currency fined American Express National Bank $350 million over systemic monitoring failures across its credit card portfolios.
The Justice Department ordered prosecutors to seize fraudulent web domains and freeze bank accounts before indictment.
The Supreme Court declined to review a constitutional challenge to the Corporate Transparency Act, leaving commercial lenders to manage corporate ownership verification on their own.
The OCC introduced direct reporting rails for community lenders to flag suspected payments fraud.
This week, we will be tracking regional banking supervisory updates from the Federal Reserve and watching whether state commercial registries issue fresh guidance on beneficial ownership filings.
American Express fined $350 million over commercial payment monitoring
The OCC slapped American Express with a $350 million civil money penalty last week for pervasive breakdowns across its anti-money laundering program. The agency said the bank failed to maintain internal controls capable of monitoring transactions across its card portfolios. Under the settlement, the bank agreed to overhaul its compliance framework without admitting or denying the findings.
Examiners said the bank focused compliance efforts on its small portfolio of demand deposit accounts, rather than its charge and credit products which represent the bulk of its transaction volume. That led to systemic failures in suspicious activity reporting, leaving approximately $13 billion in suspected trade-based money laundering that the bank failed to identify and report fully and promptly.
The consent order requires American Express to establish a board-level compliance committee, strengthen its suspicious-activity monitoring and reporting, and run historical lookbacks.
Other large banks have faced major OCC penalties for systemic compliance breakdowns. In 2024, the agency fined TD Bank $450 million for anti-money laundering failures, JPMorgan Chase $250 million for trade-surveillance gaps, and Citibank $75 million over data-governance deficiencies.
Supreme Court declines review of Corporate Transparency Act challenge
The Supreme Court declined to review an Eleventh Circuit decision regarding congressional authority under the Corporate Transparency Act. The appeal, brought by the National Small Business Association, challenged the constitutionality of requiring domestic operating entities to report beneficial ownership information to FinCEN.
The denial leaves in place an administrative landscape shaped by executive exemptions. While the underlying statute remains in federal law, FinCEN finalized an administrative rule in August exempting domestic operating companies and U.S. persons from beneficial ownership filing requirements. In the absence of a federal reporting mandate for domestic companies, commercial lenders and counterparties continue to rely on private customer due diligence and direct collection of corporate formation records to verify ownership structures.
Justice Department orders early domain seizures and pre-indictment account freezes
The DOJ’s National Fraud Enforcement Division directed its prosecutors to seize digital infrastructure and freeze illicit financial assets before filing formal criminal charges. The new directive instructs prosecutors to make early use of civil injunctions under federal banking law and civil asset forfeiture statutes. The directive prioritizes early seizures and disruption alongside prosecution and financial recovery.
Prosecutors are directed to obtain restraining orders that freeze illicit proceeds held in commercial bank accounts and cryptocurrency exchanges shortly after funds are stolen. The policy also instructs attorneys to seek warrants seizing websites, domain names, and cellular communication terminals used to run corporate impersonation schemes and business email compromise operations. The instruction shifts federal strategy from post-conviction financial recovery toward real-time operational disruption.
Leader of 15,000-mule network pleads guilty to corporate account laundering
A man pleaded guilty last week to running a money laundering service that helped hackers cash out stolen funds from more than 750 U.S. bank accounts. Federal prosecutors said 42-year-old Oleg Korniev helped run Your Mule Cashout, a network that recruited more than 15,000 American money mules to move hacked corporate funds overseas.
The enterprise deceived people into believing they were working as remote payment processing agents for legitimate commercial enterprises. The organization directed mules to receive unauthorized transfers from compromised corporate accounts into personal deposit accounts, withdraw the funds in cash, and wire the proceeds to overseas accounts primarily in Eastern Europe.
Korniev admitted that the network was responsible for more than $14.7 million in actual and intended losses and that he personally laundered at least $7 million through domestic banks.
OCC establishes direct reporting pipeline for community bank payments fraud
Comptroller Jonathan V. Gould announced last week that the agency is establishing a specialized channel for community banks to directly report suspected payments fraud involving regulated institutions to an OCC fraud taskforce. Speaking to regional banking executives in Minneapolis, Gould announced the initiative alongside supervisory reminders encouraging lenders to share real-time fraud indicators with peer institutions under Section 314(b) of the USA PATRIOT Act.
The agency created the reporting channel to counter a surge in corporate check theft, altered vendor invoices, and business email compromise targeting small and mid-sized businesses. Gould told community bankers that non-mortgage fraud reports in Minnesota more than doubled between 2020 and 2024. He pointed to an almost 300% jump in suspicious activity reports tied to check fraud across that four-year stretch. He also cited a recent FinCEN analysis identifying more than $17 billion in suspicious activity potentially linked to healthcare fraud, ranking Minnesota first per capita.
Transatlantic regulators escalate examination of autonomous AI payment agents
Banking supervisors in the U.S. and Europe are stepping up formal inquiries into how large depository institutions govern artificial intelligence models deployed in commercial payments and automated treasury operations. Examiners from the Federal Reserve, the European Central Bank, and the Bank of England have asked financial institutions to provide comprehensive inventories of third-party software dependencies and automated decision-making workflows.
U.S. regulators are asking banks how they use AI agents in cybersecurity, what limits govern their actions and how they can be shut down. In July, the European Central Bank gave lenders until the end of October to submit plans addressing AI-enabled cyber threats, including backup and recovery measures. British supervisors are encouraging the largest banks to examine separate recovery systems that could operate if their main systems were compromised.