Lying about where your goods come from is now one of the most expensive mistakes in trade compliance. DOJ stood up a dedicated trade fraud task force in August of last year, and it moved fast. Its first settlement came three months later. This May, it announced the largest customs-related False Claims Act recovery ever, roughly $550 million from aluminum companies and affiliated warehouses accused...
Across corporate America, a quiet retrenchment is under way. Compliance budgets are being flattened or trimmed, headcount is being “optimized,” chief compliance officers are being moved further from the executive suite, and programs built over a decade are being described as overhead to be right-sized. The justification is usually the same: the enforcement climate has changed, so the risk has changed. The Bank of America...
You don’t need a data breach to commit False Claims Act fraud. You just need a cybersecurity certification that isn’t true. Honeywell Aerospace just paid more than $2 million to resolve allegations that, from April 2020 through December 2023, it billed on a Defense Department contract while failing to meet the cybersecurity standard known as NIST SP 800-171, the standard for protecting controlled unclassified information....
The first four posts in this series described what went wrong. This one asks what Bank of America is required to do now, how its cooperation and remediation were treated, and what a compliance officer at any institution should do on Monday morning. What the Bank Must Do Under the FinCEN consent order, the bank must work with a third party to complete a lookback...
On the same day that FinCEN and the OCC announced their penalties, OFAC announced its own: $11,662,930 for 475 apparent violations arising from sanctions screening failures between September 18, 2021 and April 24, 2025. The total value of the apparent violations was approximately $14.8 million. For a bank of this size, the dollar amount is modest. What makes the case important is the base penalty...
Lying about where your goods come from is now one of the most expensive mistakes in trade compliance. DOJ stood up a dedicated trade fraud task force in August of last year, and it moved fast. Its first settlement came three months later. This May, it announced the largest customs-related False Claims Act recovery ever, roughly $550 million from aluminum companies and affiliated warehouses accused...
Across corporate America, a quiet retrenchment is under way. Compliance budgets are being flattened or trimmed, headcount is being “optimized,” chief compliance officers are being moved further from the executive suite, and programs built over a decade are being described as overhead to be right-sized. The justification is usually the same: the enforcement climate has changed, so the risk has changed. The Bank of America...
You don’t need a data breach to commit False Claims Act fraud. You just need a cybersecurity certification that isn’t true. Honeywell Aerospace just paid more than $2 million to resolve allegations that, from April 2020 through December 2023, it billed on a Defense Department contract while failing to meet the cybersecurity standard known as NIST SP 800-171, the standard for protecting controlled unclassified information....
The first four posts in this series described what went wrong. This one asks what Bank of America is required to do now, how its cooperation and remediation were treated, and what a compliance officer at any institution should do on Monday morning. What the Bank Must Do Under the FinCEN consent order, the bank must work with a third party to complete a lookback...
On the same day that FinCEN and the OCC announced their penalties, OFAC announced its own: $11,662,930 for 475 apparent violations arising from sanctions screening failures between September 18, 2021 and April 24, 2025. The total value of the apparent violations was approximately $14.8 million. For a bank of this size, the dollar amount is modest. What makes the case important is the base penalty...
In this episode of Corruption, Crime and Compliance, Michael Volkov interviews Ryan R. Martin about how third-party risk management has evolved from its early focus on foreign bribery into a discipline now dominated by cybersecurity and artificial intelligence. Martin describes building a vendor risk management system from scratch, draws lessons from the Target data breach about how a vendor’s weakness can become a company’s crisis,...
In this episode of Corruption, Crime and Compliance, Michael Volkov examines OFAC’s $11,662,930 settlement with Bank of America for 475 apparent sanctions violations, together with what the full Treasury package shows about remediation and cooperation. He walks through four failure modes: payments through 35 blocked banks, exact name and date of birth matches ranked as low priority, stale watchlists caused by vendor and internal errors,...
The most uncomfortable part of FinCEN’s consent order is not the technology. It is the story of what happened when the bank’s own compliance staff concluded that two high-revenue customers were too risky, and the business pushed back. FinCEN uses this history to support its findings on customer due diligence, to establish that management knew of the problem, and to explain why it weighted financial...
The core of FinCEN’s case against Bank of America is a single system. The bank’s proprietary transaction monitoring platform, called Event Processor (EP), was its primary control for identifying and reporting suspicious activity. FinCEN’s consent order describes, in unusual detail, how that system was built, what the bank’s own testing said about it, and why the problems persisted for years. For compliance officers, it is...
On October 13, 2026, the Treasury Department announced what it called the third-largest penalty in its history. Three bureaus, FinCEN, the OCC, and OFAC, resolved overlapping investigations of Bank of America, N.A., the second-largest bank in the United States, in a single coordinated announcement. The headline number is more than $1.21 billion. The structure behind that number, and the admissions attached to it, matter at...
