AML Enforcement Tracker

Gambling Commission

QuinnBet agreed to pay 609,104 pounds, including 193,118 pounds of disgorgement, after the Gambling Commission found its anti-money laundering and customer interaction controls were not effective in practice for 29 months. A platform migration had switched off working limits.

Takeaway: A migration that silently drops a control is a control failure from the day it ships.

OFAC

OFAC settled eight apparent violations covering roughly 121,527 dollars of goods, after the company’s Italian subsidiary shipped to Iran through a distributor in the United Arab Emirates.

Takeaway: Sanctions rules bind entities that US persons own or control almost as tightly as the parent itself.

FinCEN

FinCEN imposed a 125 million dollar penalty, its largest ever on a broker-dealer, after more than 61,500 foreign currency wires worth over 10.5 billion dollars went unmonitored between January 2019 and June 2023. The firm admitted it never closed the gaps a 2018 consent order required it to fix.

Takeaway: An unremediated consent order compounds: the second penalty prices in the first.

OCC

The OCC denied Wise a national trust bank charter, ruling it could not confirm an effective anti-money laundering programme while a 2025 multistate order over late suspicious activity reports and transaction monitoring data integrity remained unresolved.

Takeaway: An open AML order is a licensing blocker, not just a remediation project.

BaFin

BaFin ordered Helaba to remedy customer due diligence failures spanning customer identification, verification, updating of customer data, risk analysis and transaction monitoring. It is the second BaFin money laundering measure against the bank in seven months.

Takeaway: A remediation order with no fine still creates a supervisory record that the next measure builds on.

NYDFS

New York’s Department of Financial Services secured a 50 million dollar penalty from Swedbank and its New York branch for withholding information about its Baltic subsidiaries’ links to the Panama Papers, across responses spanning 2016 to 2019.

Takeaway: The concealment was punished on its own, separately from the underlying money laundering.

DNB

De Nederlandsche Bank fined the payment institution 2,656,250 euros after roughly 4,200 merchants sat outside its transaction monitoring system for 23 months, with alerts closed in bulk and no recorded justification. The penalty was raised because CCV had breached the same rule before.

Takeaway: Coverage gaps outrank tuning: a merchant outside the system generates no alerts to calibrate.

—

The Atlanta auto insurer disclosed a breach affecting 6,998,886 people, exposing names, contact details and driver’s license numbers after an employee’s credentials were compromised.

Takeaway: Driver’s license numbers retained after a verification check are a standing liability, not a record.

DNB

De Nederlandsche Bank fined ABN AMRO 8.5 million euros for inadequate due diligence on high-risk customers, finding monitoring insufficiently critical and customer explanations accepted without verification. It follows a 480 million euro criminal settlement five years earlier.

Takeaway: Accepting a customer explanation without verifying it is not ongoing monitoring.

OFAC

OFAC blocked a network that moved more than 30 million dollars of US drug proceeds through cryptocurrency for Brazil’s PCC, designating two Brazilian nationals and four companies. Brazil then froze roughly 2 billion dollars in related assets.

Takeaway: Crypto rails do not remove the sanctions nexus; they only change which intermediary sees the transaction.

DOJ

EagleBank agreed to pay 9,057,821 dollars in fines plus 736,515 dollars in forfeiture under a non-prosecution agreement, admitting it wilfully failed to run an anti-money laundering programme from 2010 to 2021 while executives overrode compliance staff.

Takeaway: Where senior management overrides compliance, the programme on paper counts for nothing.

SEC

The SEC fined Merrill 7.5 million dollars because its transaction monitoring system only investigated alerts scoring 20 or higher, after Merrill’s own analysis showed lower-scoring events would have produced suspicious activity reports. It took about three years to fix.

Takeaway: A monitoring threshold you know is miscalibrated is a documented failure, not a tuning decision.

FCA

The FCA publicly censured CACEIS UK for weak financial crime controls that let the collapsed wealth manager WealthTek hold client assets it was never permitted to hold. It avoided a 33 million pound fine and agreed a voluntary payment of 31,714,068 pounds to affected clients.

Takeaway: Redress paid to clients is not a penalty, but the permission-scope check that failed is exactly what onboarding due diligence exists to catch.

CBUAE

The Central Bank of the UAE fined a foreign bank branch 20 million dirhams for repeated anti-money laundering and sanctions control failures, and separately fined its head of compliance 300,000 dirhams.

Takeaway: Personal liability for the compliance officer is now a live tool, not a theoretical one.

OFAC, FinCEN

Treasury widened its action against the Cambodian scam conglomerate, adding 9 individuals and 26 entities, while FinCEN moved to sever the renamed Huione affiliate H-Pay from the US financial system.

Takeaway: Designated networks rename and re-form. Screening against a static entity list misses the successor.

Finansinspektionen

Sweden’s financial supervisor fined Ikano Bank 140 million kronor and issued a formal remark for failing to assess how its corporate products could be used to fund crime. No laundering case was alleged.

Takeaway: The general risk assessment is itself an enforceable obligation, independent of whether any transaction went wrong.

Garante per la protezione dei dati personali

Italy’s data protection authority fined Poste Italiane 6,624,000 euros and Postepay 5,877,000 euros for embedding device-surveillance software in banking apps and making consent to it a condition of account access.

Takeaway: A fraud-prevention purpose does not by itself satisfy the GDPR necessity test if a less intrusive control would have worked.

PRA

The PRA fined Bank of London Group £2 million for integrity failings and inadequate cooperation over misrepresenting its capital position.

Takeaway: Regulators want the data trail behind the numbers: source, calculation, sign-off, validation date.

SRA

The SRA fined Ranson Houghton LLP for AML failures, signalling AML enforcement expanding beyond banks into legal services.

Takeaway: AML obligations now bite professional-services firms, not just financial institutions.

EDPB / 25 EU DPAs

25 EU regulators launched a coordinated GDPR transparency enforcement sweep affecting how KYC flows present data processing.

Takeaway: KYC data-collection transparency is now a coordinated enforcement priority.

FinCEN

FinCEN assessed an 80 million dollar penalty, its largest ever against a broker-dealer, for years of gamed trade surveillance and at least 160 suspicious activity reports that were never filed.

Takeaway: Regulators judge an AML programme by what it catches, not by what the written policy says it should catch.

—

IDMerit left roughly one billion identity records (203M tied to US residents) in a database with no authentication, access control or encryption — downloadable by anyone with the URL.

Takeaway: Centralised identity databases are honeypots; the breach needed no sophistication.

—

A breach via a malicious attachment on a third-party support platform went undetected for 18 months (Jul 2024–Jan 2026).

Takeaway: A centralised KYC provider is only as secure as its weakest integration; 18-month dwell time is a monitoring failure.

—

A third-party customer service vendor was compromised, exposing roughly 70,000 government ID photos that the vendor held to review age-related appeals.

Takeaway: Age assurance built on stored ID images moves the honeypot to whichever vendor reviews the appeals.

—

Overseas support agents (contracted via TaskUs) were bribed to abuse privileged access, exfiltrating data on ~70,000 users (~1% of customers), including masked SSNs, government IDs and balances.

Takeaway: An insider/controls failure, not a hack. Privileged access to a central PII store is the attack surface.

DOJ, FinCEN, OCC, Federal Reserve

TD Bank pleaded guilty and paid about $3 billion for Bank Secrecy Act and money-laundering failures — the largest bank ever to plead guilty to conspiracy to commit money laundering. ~$1.8B DOJ, $1.3B FinCEN, $450M OCC, $123.5M Federal Reserve.

Takeaway: More than 90% of transaction volume was never fed into automated monitoring — a coverage gap, not a tuning problem.

DOJ, FinCEN, OFAC, CFTC

Binance agreed to pay more than $4.3 billion to US authorities; founder CZ pleaded guilty, paid a $50M personal fine and stepped down. FinCEN $3.4B civil penalty + 5-year monitorship; OFAC $968M.

Takeaway: Compliance-light by design is now treated as a federal crime, not a growth tactic.