Compliance Brief - October 21, 2026 - Global RADAR
Subscribe

Compliance Brief – October 21, 2026

  • Home
  • Compliance Brief – October 21, 2026
Edition 21 · Wednesday, October 21, 2026

What’s new in compliance. Why it matters. What it means for your operations.

In This Edition

Bank of America Pays Over $1.2 Billion Across FinCEN, OCC and OFAC Actions

From the Founder
Bank of America tested a better alert threshold in 2022 and kept the old one to protect case volume. FinCEN priced that as willful. Compliance officers, ask your COO and audit committee when your thresholds were last tested against what they miss, before an examiner runs the test for you.
Dominic Suszek · Founder and CEO, Global RADAR
30-Second Read
  • FinCEN, OCC and OFAC hit Bank of America for over $1.2 billion on October 13
  • Over $5 billion in suspicious activity went unreported or late, from 2018 to 2025
  • FATF plenary runs October 28 to 30; OFAC’s IDB wind-down ends October 30

1. Top story of the week

Bank of America pays over $1.2 billion across FinCEN, OCC and OFAC actions. On October 13, FinCEN found willful Bank Secrecy Act violations from January 2018 to July 2025, including over $5 billion in suspicious activity reported late or not at all. The OCC’s $750 million penalty is credited against FinCEN’s $1.2 billion, leaving $450 million payable. A separate OFAC settlement adds $11.66 million. Four independent reviews will run for years.

Why This Matters

FinCEN’s willfulness finding rests on documented knowledge: internal tests and escalations that went unaddressed. A gap your own team has flagged and you have not fixed is what turns a deficiency into a penalty of this size.

Operational Implications

Three steps by November 6:

  1. Pull your alert thresholds and rescoring rules, and have model validation document when each was last tested against missed activity.
  2. List every compliance recommendation a business line overruled in the past year, and brief your audit committee on the results.
  3. Rank exact-match sanctions hits first in your screening queue; no alert design should score them low.

2. Enforcement and penalties

  • FinCEN, October 13: $1.2 billion penalty; the OCC’s $750 million is credited, leaving $450 million payable. Over $5 billion in suspicious activity was late or unreported.
  • OCC, October 13: $750 million civil money penalty and consent order, following a December 2024 cease-and-desist order.
  • OFAC, October 13: $11,662,930 settlement for 475 apparent violations, including 403 transactions routed through 35 blocked banks.
  • State and OFAC, October 19: Sanctioned five China entities, including MiraclePlus, under PAIPA over stolen AI trade secrets.
Why This Matters

Three agencies found three failures: late SARs, weak monitoring design and slow sanctions list updates. Penalties scale with duration, and this case spans seven and a half years.

Operational Implications

Three steps by November 13:

  1. Sample alerts scoring just below your case-opening threshold and report the SAR yield to your compliance committee.
  2. Request watchlist update timestamps from your screening vendor for last quarter; delays like OFAC’s ship manager case start there.
  3. Document an owner for every alert suppression rule; unowned rules are the finding I expect examiners to repeat.

3. New guidance and rulemaking

  • Within 30 to 150 days: FinCEN’s order requires four independent reviews: monitoring, SAR lookback, customer and correspondent due diligence, and data governance.
  • October 15: FinCEN alert asks institutions to report Iranian regime abuse of religious charity networks, including diverted khums tithes.
  • Effective October 16: Executive order implements the Sanctioning Russia and Iran Act of 2026 while waiving specified provisions on national-interest grounds.
  • October 5: FinCEN withdrew proposed rules on convertible virtual currency transactions and CVC mixing.
Why This Matters

The order works as a template of examiner expectations: independent testing of monitoring, plus a SAR lookback prioritizing Chinese money laundering networks, Iran, Russia and southwest border risks.

Operational Implications

Three steps by November 13:

  1. Map your program to the four ordered reviews and document gaps for your board risk committee.
  2. Add the named typologies to your next risk assessment; FinCEN has told you where it is looking.
  3. Add FinCEN’s Iran charity red flags to your nonprofit monitoring scenarios; waiting for an exam finding is the expensive route.
Theme of the Week
Bank of America’s penalty traces to thresholds nobody re-tested: a 20-point alert trigger set by stakeholder judgment, with more than a third of investigations starting from outside referrals. A monitoring system that depends on external triggers to find cases is structurally behind.

4. Global watch

  • EU, October 15: Listed 12 circumvention targets in Türkiye, UAE, India and Seychelles.
  • UK, October 15: Global Human Rights sanctions regulations took effect, adding designation by description.
  • AUSTRAC, October 6: Infringement notices of $21,840 began for businesses that failed to enrol.
  • UN, October 14: Security Council Resolution 2831 renewed Haiti sanctions, 14 to 0.

5. Coming up in the next 30 days

Date Event or deadline
October 22, 2026 UK Iran Interim Basic Necessities General Licence expires; OFSI will not renew it.
October 23, 2026 American Express board must appoint a compliance committee under the OCC order.
October 25, 2026 EU 21st package wind-down ends for pre-existing contracts on newly restricted goods.
October 28 to 30, 2026 FATF plenary under UK presidency; watch grey list outcomes.
October 30, 2026 OFAC General License FF wind-down for Iraq-based IDB ends at 12:01 a.m. EDT.
About November 12, 2026 Bank of America’s 30-day deadline to propose its monitoring consultant to FinCEN.
November 14, 2026 Wind-down activity for Cuba’s BICSA ends under OFAC FAQ 1276.
November 15, 2026 Comments due on China’s proposed export restrictions on 40 technologies.

Next Wednesday

Next Wednesday: the FATF plenary opens that day, and Bank of America’s consultant deadline nears; what each means for your program.

Want a 30-minute review of the Bank of America findings against your current transaction monitoring and sanctions screening? Book a call with a Global RADAR compliance specialist.

Forwarded this from a colleague? Subscribe at globalradar.com/subscribe.

Best regards,
Dominic Suszek
Founder and CEO, Global RADAR
globalradar.com