On the same day that FinCEN and the OCC announced their penalties, OFAC announced its own: $11,662,930 for 475 apparent violations arising from sanctions screening failures between September 18, 2021 and April 24, 2025. The total value of the apparent violations was approximately $14.8 million. For a bank of this size, the dollar amount is modest. What makes the case important is the base penalty with no reduction, and the pattern OFAC saw in four separate failure modes.

Failure One: Payments Through Blocked Banks (403 Transactions, $14.3 Million)

In May 2021 the bank automated how it routed cross-border payments through correspondent banks, using a routing directory supplied by a third-party vendor. After Russia’s February 2022 invasion of Ukraine, the bank learned that the directory listed banks that OFAC had blocked. Payments were still being screened, but some went through anyway for three reasons. A bank had been blocked and the screening filter had not yet been updated. Analysts mistakenly cleared alerts as false positives. Or an “alert suppression rule” automatically suppressed an alert because it matched the criteria of one an analyst had previously cleared as a false positive.

The bank implemented several fixes over the following months, and in January 2023 it deployed an automated technical solution removing blocked banks from the directory its payment engine used. Even so, from February 2022 through March 2025 it processed 403 transactions totaling $14,340,100 through 35 blocked banks: 32 under the Russian Harmful Foreign Activities Sanctions Regulations, two under the Belarus regulations, and one under an Iran sector order.

OFAC’s more serious criticism is about what happened after the bank knew. Despite awareness since March 2022 and despite telling OFAC more than once that it was investigating, the bank initially performed only a single, narrowly tailored lookback. It did not identify the full scope until OFAC issued an administrative subpoena in January 2025 asking for information about its recent lookbacks.

Failure Two: Exact Matches Treated as Low Priority (31 Transactions, $56,258)

A design flaw in the bank’s alert prioritization logic classified alerts on individual customers whose name and date of birth exactly matched a blocked person as low or medium priority. Review was delayed, and three individuals designated under the Burma, Russia, and Foreign Narcotics Kingpin programs conducted 31 transactions using their bank or credit card accounts between September 2021 and February 2024. The flaw was identified and corrected only after about six months once discovered, in February 2024. An exact name-and-birthdate match to an SDN is about as high-confidence as a screening hit gets; the failure here is in how the system ranked it.

Failure Three: Watchlist Updates That Did Not Happen

Between May 24 and June 28, 2023, a vendor error left the bank’s screening watchlist file out of date, and six transactions totaling $100,828 involving entities designated under the Burma, Somalia, and Illicit Drug Trade programs went through. The bank did not identify the vendor’s error until July 2023, about a month after another U.S. bank blocked one of the payments downstream. Then on February 7, 2025, the watchlist failed to take the previous day’s designations because of technical problems within the bank’s own systems, and 26 transactions totaling $146,543 for a ship management company designated under the global terrorism program were processed. The updates were fully active on February 12, almost a week later. The bank did a lookback and self-disclosed that one.

Failure Four: Human Error on Two Business Accounts

In May 2023 an analyst wrongly dismissed an alert on an individual recently designated under the Russia program who was the beneficial owner of a business. The business’s account remained unrestricted. The bank rescreened in September 2023 during a platform transition but did not review the alert or identify the blocked interest until July 2024, 14 months after designation, because the rescreening of all customers generated a volume of alerts for which it was insufficiently prepared. Internal communications noted a need for more formalized processes, resources, and governance around self-disclosures. In April 2025, after the bank restricted two business accounts whose authorized signer had just been designated, AML operations staff approved the owner’s request to close the accounts and branch staff transferred $189,869 into a new unrestricted account because of a misunderstanding about accounts with blocked signers. Sanctions compliance caught the error and blocked the new accounts before any transaction, and the bank reported and self-disclosed it.

The Penalty

OFAC found the case non-egregious. It found 413 apparent violations were not voluntarily self-disclosed and 62 were. The base penalty is the sum of the schedule amount for each non-disclosed violation and one-half of the transaction value for each disclosed one, which comes to $11,662,930. The settlement equals the base penalty. In OFAC’s words, no reduction was applied, including for remedial measures or cooperation.

Aggravating factors were: reckless failure to promptly implement screening enhancements, update the watchlist for over a month, prioritize exact matches, and ensure analysts were trained and following procedures; harm to sanctions program objectives, particularly the more than $14 million processed to or through blocked banks after the Russian invasion, most of which was not stopped by other banks; the bank’s size and sophistication; and multiple prior cautionary letters from OFAC about substantially similar conduct. The only mitigating factor was a tolling agreement on the narcotics-designation violations, and OFAC found that, given the totality of circumstances, no net reduction was warranted.

The Cooperation Finding

OFAC separately faulted the bank’s cooperation. For many of the violations it submitted piecemeal or incomplete disclosures or responses, sometimes over an extended period, and it did not promptly answer all requests for information. OFAC says this slowed its investigation and prolonged resolution. Combined with the lack of any mitigation credit, this is a clear warning: cooperation credit is earned by completeness and timeliness, not by the fact of responding.

Treasury’s Compliance Considerations

OFAC draws several lessons. A sanctions program needs detail-oriented management oversight that proactively identifies risks across the enterprise, connects the dots to locate systemic problems, and promptly implements durable solutions. The recurrence of thematically similar violations raises doubt about overall program effectiveness. Screening alert parameters and rules should be risk-based, supervised, and subject to audit and testing so errors do not compound. An institution is responsible for its own compliance regardless of reliance on third-party providers. Technical transitions should be controlled to avoid gaps and backlogs. Training must reach front-line and customer-facing staff, backed by testing and auditing. And firms should investigate promptly, identify all root causes, remediate, self-disclose, and cooperate fully.

Connecting It to the FinCEN Case

The themes overlap with the FinCEN order: a suppression rule that auto-cleared alerts; priority logic that did not match risk; human error in dispositioning; reliance on a vendor; a system transition without adequate capacity; and a narrow lookback when a broader one was needed. It is no accident that Treasury released these actions together and said AML and sanctions efforts must be integrated and mutually reinforcing. If your monitoring and screening teams use separate tuning processes, separate governance, and separate testing, this case suggests regulators will view the whole as only as strong as its weakest part.

Practical Takeaways

Test your suppression and auto-disposition rules against known true positives, including exact matches. Verify, daily, that your watchlist is current, and alert on failures to load. Treat exact matches as the highest priority. Make sure when you find one failure, you ask what else the same cause touched, and scope the lookback to answer that question. And if you are going to cooperate with OFAC, do it completely the first time.