You don’t need a data breach to commit False Claims Act fraud. You just need a cybersecurity certification that isn’t true. Honeywell Aerospace just paid more than $2 million to resolve allegations that, from April 2020 through December 2023, it billed on a Defense Department contract while failing to meet the cybersecurity standard known as NIST SP 800-171, the standard for protecting controlled unclassified information....
The first four posts in this series described what went wrong. This one asks what Bank of America is required to do now, how its cooperation and remediation were treated, and what a compliance officer at any institution should do on Monday morning. What the Bank Must Do Under the FinCEN consent order, the bank must work with a third party to complete a lookback...
On the same day that FinCEN and the OCC announced their penalties, OFAC announced its own: $11,662,930 for 475 apparent violations arising from sanctions screening failures between September 18, 2021 and April 24, 2025. The total value of the apparent violations was approximately $14.8 million. For a bank of this size, the dollar amount is modest. What makes the case important is the base penalty...
In this episode of Corruption, Crime and Compliance, Michael Volkov interviews Ryan R. Martin about how third-party risk management has evolved from its early focus on foreign bribery into a discipline now dominated by cybersecurity and artificial intelligence. Martin describes building a vendor risk management system from scratch, draws lessons from the Target data breach about how a vendor’s weakness can become a company’s crisis,...
In this episode of Corruption, Crime and Compliance, Michael Volkov examines OFAC’s $11,662,930 settlement with Bank of America for 475 apparent sanctions violations, together with what the full Treasury package shows about remediation and cooperation. He walks through four failure modes: payments through 35 blocked banks, exact name and date of birth matches ranked as low priority, stale watchlists caused by vendor and internal errors,...
You don’t need a data breach to commit False Claims Act fraud. You just need a cybersecurity certification that isn’t true. Honeywell Aerospace just paid more than $2 million to resolve allegations that, from April 2020 through December 2023, it billed on a Defense Department contract while failing to meet the cybersecurity standard known as NIST SP 800-171, the standard for protecting controlled unclassified information....
The first four posts in this series described what went wrong. This one asks what Bank of America is required to do now, how its cooperation and remediation were treated, and what a compliance officer at any institution should do on Monday morning. What the Bank Must Do Under the FinCEN consent order, the bank must work with a third party to complete a lookback...
On the same day that FinCEN and the OCC announced their penalties, OFAC announced its own: $11,662,930 for 475 apparent violations arising from sanctions screening failures between September 18, 2021 and April 24, 2025. The total value of the apparent violations was approximately $14.8 million. For a bank of this size, the dollar amount is modest. What makes the case important is the base penalty...
In this episode of Corruption, Crime and Compliance, Michael Volkov interviews Ryan R. Martin about how third-party risk management has evolved from its early focus on foreign bribery into a discipline now dominated by cybersecurity and artificial intelligence. Martin describes building a vendor risk management system from scratch, draws lessons from the Target data breach about how a vendor’s weakness can become a company’s crisis,...
In this episode of Corruption, Crime and Compliance, Michael Volkov examines OFAC’s $11,662,930 settlement with Bank of America for 475 apparent sanctions violations, together with what the full Treasury package shows about remediation and cooperation. He walks through four failure modes: payments through 35 blocked banks, exact name and date of birth matches ranked as low priority, stale watchlists caused by vendor and internal errors,...
The most uncomfortable part of FinCEN’s consent order is not the technology. It is the story of what happened when the bank’s own compliance staff concluded that two high-revenue customers were too risky, and the business pushed back. FinCEN uses this history to support its findings on customer due diligence, to establish that management knew of the problem, and to explain why it weighted financial...
The core of FinCEN’s case against Bank of America is a single system. The bank’s proprietary transaction monitoring platform, called Event Processor (EP), was its primary control for identifying and reporting suspicious activity. FinCEN’s consent order describes, in unusual detail, how that system was built, what the bank’s own testing said about it, and why the problems persisted for years. For compliance officers, it is...
On October 13, 2026, the Treasury Department announced what it called the third-largest penalty in its history. Three bureaus, FinCEN, the OCC, and OFAC, resolved overlapping investigations of Bank of America, N.A., the second-largest bank in the United States, in a single coordinated announcement. The headline number is more than $1.21 billion. The structure behind that number, and the admissions attached to it, matter at...
If your sanctions program is still the 2019 version, it’s missing the last seven years of enforcement. OFAC’s 2019 framework is still your foundation: management commitment, risk assessment, internal controls, testing, and training. But DOJ, Commerce, and Treasury have layered new expectations on top of that through joint Tri-Seal Notes. Four of them should be on your list today. One, U.S. nexus now reaches foreign...
The Adani prosecution has become one of the most closely watched corruption cases in the country, and not because of the facts alleged in the indictment. It is now a contest over a narrower and more consequential question: when the Justice Department decides it no longer wants to pursue a criminal case, how much of an explanation does a federal court get to demand? On...
