Compliance Brief - September 23, 2026 - Global RADAR
Subscribe

Compliance Brief – September 23, 2026

  • Home
  • Compliance Brief – September 23, 2026
Edition 17 · Wednesday, September 23, 2026

What’s new in compliance. Why it matters. What it means for your operations.

In This Edition

FinCEN Puts $17.5 Billion of Suspected Health Care Fraud in 5,702 Bank Reports

From the Founder
Two FinCEN trend analyses in one month, $12.7 billion in scams and $17.5 billion in health care fraud, came from SAR narratives banks wrote. Fraud is now the dominant BSA typology, and examiners will grade monitoring against these reports. Audit committees should ask one question: which rule would have flagged a home health provider with no patients?
Dominic Suszek · Founder and CEO, Global RADAR
30-Second Read
  • FinCEN flags $17.5 billion in suspected health care fraud across 5,702 reports; home health leads
  • South Africa fines Capitec R28 million; OFAC settles with an individual for $1.43 million
  • US agencies propose new third-party risk guidance; UK Iran sanctions bite September 29

1. Top story of the week

FinCEN says banks flagged $17.5 billion in suspected health care fraud in twelve months. The September 9 Financial Trend Analysis covers 5,702 BSA reports filed by 471 institutions between March 2025 and February 2026, with a median of $600,000 per report. Home health providers appear most often. The pattern: shell-like providers with no medical footprint commingle Medicare, Medicaid and private insurance receipts, layer through affiliates, then cash out abroad.

Why This Matters
Fraud now rivals sanctions as the typology FinCEN writes about most. FinCEN turned bank reports into a national dataset in six months, and examiners will use it to ask why your monitoring did not. A provider with no patients is a KYC failure before it is a fraud.
Operational Implications
Three steps for this week:

  1. Pull every business customer coded to home health, hospice, DME or behavioral health by September 30 and confirm a licensed provider footprint: NPI, address, staff; a P.O. box is a red flag, not a detail.
  2. Add a rule for commingled Medicare, Medicaid and private insurer credits followed by same-week transfers to affiliates; generic structuring rules will not catch it.
  3. Brief investigators on the FTA typologies by Friday; narratives must name the program billed.

2. Enforcement and penalties

  • Prudential Authority (South Africa), September 11: Fined Capitec R28 million (about $1.7 million) for customer due diligence, ongoing monitoring and training failures; its second FIC Act penalty since 2024.
  • OFAC, September 10: A U.S. individual pays $1,427,230 for advising an Iranian software company and receiving $713,615 in Iranian dividends; 39 egregious, undisclosed violations.
  • FINTRAC, September 3: Penalized Nova Scotia Gaming (C$231,826) and New Brunswick Lotteries (C$399,712) for unfiled suspicious transaction reports; New Brunswick’s rated very serious.
Why This Matters
Three regulators, three continents, one finding: due diligence that stops after onboarding. Capitec was penalized for ongoing monitoring and screening manuals nobody approved; OFAC’s consultant paid $1.43 million personally for two years of Iranian dividends. The institutional shield is gone.
Operational Implications
Three steps for this week:

  1. Confirm by September 30 that every screening manual carries a dated management approval; Capitec’s did not.
  2. Run the inbound wire population for dividend-style credits from Türkiye, the UAE and Singapore to U.S. individuals; a $713,615 pattern hides easily.
  3. Escalate gaming and casino customers with no STR filings in twelve months to the compliance officer; FINTRAC now rates silence as very serious.

3. New guidance and rulemaking

  • Comments due November 16: OCC, Fed, FDIC and NCUA propose replacing the 2023 third-party risk guidance with a proportionality-based framework and a community bank guide.
  • Effective September 10: OFAC moves Iran-related specific license applications to a presumption of denial; only statutory or life-safety cases proceed, with written attestation.
  • Issued September 10: FinCEN whistleblower bulletin offers 10 to 30 percent of penalties above $1 million for Iran-related BSA and sanctions tips, including from non-U.S. persons.
Why This Matters
The TPRM rewrite hands banks discretion to size vendor oversight to actual risk; your AML and screening vendors move to the top of the list. Discretion cuts both ways: an examiner who disagrees with your tiering will cite your own risk assessment against you.
Operational Implications
Three steps for this week:

  1. Draft the comment letter on the TPRM proposal by October 15 and name which 2023 requirements produced paper, not risk reduction.
  2. Freeze pending Iran specific-license applications and tell the business line this month; the answer is now no.
  3. Update the whistleblower policy so internal reports of Iran exposure reach the compliance officer within 48 hours; FinCEN now pays outsiders to beat you to it.
Theme of the Week
Your SARs are now FinCEN’s research budget. Two trend analyses in one month, $12.7 billion in scam-center activity from 33,904 reports and $17.5 billion in health care fraud from 5,702, were built entirely from bank narratives. A report that names the program billed, the affiliate and the cash-out route shapes the next advisory; a vague one is noise.

4. Global watch

  • UK, September 29: Iran (Sanctions) (Amendment) Regulations 2026 take effect; energy, metals, gold, software, shipping, banking.
  • FATF, September 9: First gaming and gambling risk indicators; casinos and sports betting carry the highest exposure.
  • South Africa, September 11: Prudential Authority also sanctioned Al Baraka Bank and Ninety One Assurance under the FIC Act.

5. Coming up in the next 30 days

Date Event or deadline
September 29, 2026 UK’s expanded Iran sanctions regulations enter into force.
September 30, 2026 OFAC Annual Report of Blocked Property due for holdings as of June 30.
October 1, 2026 Comments close on FinCEN’s section 311 proposal against Banque Misr UAE.
October 19, 2026 Comments close on Treasury’s GENIUS Act stablecoin issuance, offer and sale rulemaking.
October 25, 2026 EU 21st package wind-down ends for pre-existing contracts on newly listed goods.
October 26, 2026 FATF plenary opens in Paris, first under the UK presidency, through October 30.

Next Wednesday

Next Wednesday: the Banque Misr comment window closes October 1; we will cover the responses, plus first reactions to the third-party risk proposal.

Want a 30-minute review of your health care and fraud monitoring rules against the typologies in FinCEN’s $17.5 billion trend analysis? Book a call with a Global RADAR compliance specialist.

Forwarded this from a colleague? Subscribe at globalradar.com/subscribe.

Best regards,
Dominic Suszek
Founder and CEO, Global RADAR
globalradar.com