The most uncomfortable part of FinCEN’s consent order is not the technology. It is the story of what happened when the bank’s own compliance staff concluded that two high-revenue customers were too risky, and the business pushed back. FinCEN uses this history to support its findings on customer due diligence, to establish that management knew of the problem, and to explain why it weighted financial gain so heavily in setting the penalty. It is a case study in how a compliance function can be right and still lose.

The Customers

FinCEN does not name the customers. Customer A and Customer B each operate online marketplaces connecting sellers of salvaged vehicles in the United States with domestic and international buyers. The bank had banked Customer A since 1995 and Customer B since 1996. Customer A generated several million dollars of annual revenue and the bank served as lead agent on a $200 million refinancing within a facility worth over $1 billion. Customer B generated over $25 million of revenue for the bank during the period. Customer C, a vehicle export business tied to both, was classified as a small-to-medium business with expected annual sales of $1 million to $4 million while receiving hundreds of millions of dollars in cross-border wires from Eastern Europe, principally Georgia.

Used vehicle exports are a well-documented trade-based money laundering typology, and the bank’s own investigators knew it. Both customers relied heavily on third-party payments, including international buyers, wires, and money orders from unknown purchasers.

What Compliance Saw, and When

As early as 2016, bank personnel flagged Customer A for wires from high-risk jurisdictions and limited visibility into the source of funds. From 2019 on, the bank’s own monitoring repeatedly surfaced cash structuring, wires involving high-risk jurisdictions, and unusual volumes for these customers. By early 2020, Customer B had accumulated years of investigations, alerts, and law enforcement inquiries, yet its risk rating stayed at “Standard” until a grand jury subpoena arrived in February 2020. FinCEN found that the customer’s risk ratings moved with the bank’s receipt of subpoenas, not with its own assessment.

A June 2020 case note on Customer A reads, in part, that although the customer was considered a suspect, the account would not be closed, and that closure was not supported after escalation to the client team. Through 2020 and 2021 investigators tied the accounts to business email compromise, romance scams, elder fraud, and stolen check rings. Case notes said activity was “so vast” that the investigative system could not download the transactions.

In mid-2022, compliance personnel recommended closure. Their reasoning: more than 100 AML cases from 2020 to August 2022, about 90 percent fraud related, and “no visibility or understanding of source of funds.” One employee wrote that there was “too much risk and no evident way to control/mitigate it.” Later materials counted over 250 referrals and over 125 investigations since 2020 and 290 incoming wires from Belarus in August 2022 alone, totaling $3.5 million. Compliance staff expected pushback because Customer A was a longstanding client with significant credit exposure.

The Business Response

The relationship manager’s memo described Customer A as a large and valued client, generating about $6 million in annual revenue, and said the line of business was very supportive. After a December 2022 meeting between the then-BSA Officer and the head of the line of business, the relationship team continued to argue for keeping the customer, writing that “a closure here would be detrimental given the impact of this relationship.”

In March 2023, more than six months after the closure recommendation, a mitigation plan replaced it. It asked Customer A to accept payments only from registered dealers, take its account number off its website, use a new account number, and adopt a “one strike” policy for false fraud claims. Compliance withdrew the closure recommendation on the basis of those measures, while reserving the right to revisit.

FinCEN’s finding is that the measures did not address the central concern. Customer A kept processing third-party payments through June 2025, kept accepting money orders until about July 2025, and the bank did not update its risk profile, periodic reviews, or monitoring to match. Compliance staff themselves noted in late 2023 that the same typologies were still present. Customer B stopped accepting money orders only by the end of 2024.

Warning Signs That Never Reached the Risk Rating

FinCEN lists several. A September 2021 request from a money services business flagged possible structured money order purchases deposited into Customer B’s account. The bank responded that it saw no unusual pattern and did not change the customer’s profile. A July 2022 request from another institution flagged Customer A’s transactions with a Georgia nexus. In the fourth quarter of 2022, Customer B received about $1.1 billion in wires from a UAE affiliate, up more than 200 percent, and the quarterly review did not mention it. In January 2023, compliance recorded a law enforcement view that activity through these auction companies was considered money laundering. In November 2023 one of the customers publicly disclosed a DOJ money laundering investigation, and the bank made no corresponding change. Customer C was exited in December 2023, but the bank did not reassess Customers A and B, which kept publicly disclosed commercial relationships with it. A comparative review of all auto auction customers that compliance said it would conduct in 2022 was not done until 2024, after FinCEN’s investigation was well underway.

The quarterly “Client Activity Monitoring” reviews for high-risk customers were repetitive, ignored total activity value and geography, and omitted negotiable instruments altogether, even though tens of billions of dollars were deposited.

Correspondent Account Due Diligence

Separate from the customer cases, FinCEN found the bank failed to maintain a compliant due diligence program for correspondent accounts it holds for its own foreign branches and affiliates. Until late 2024, a “simplified” policy imposed reduced requirements. Reviewing twelve branches and affiliates, FinCEN found files lacking information about anticipated activity and purpose, containing general statements such as “treasury services” or “cash management,” giving only the name of the local regulator, and including irrelevant material such as a graph of the parent company’s stock price. The point is that affiliate status is not an exemption. Rules covering correspondent accounts for foreign financial institutions apply to the bank’s own branches and affiliates too.

How FinCEN Used This in the Penalty Analysis

Several of FinCEN’s penalty factors draw directly on this story. On pervasiveness and management knowledge, FinCEN says that management focused on the effect on resourcing rather than remediation, the head of financial crimes ordered a test to be repeated, compliance’s third-party-payment concerns were overridden in favor of revenue, and by 2023 the BSA Officer and the head of the business line had been briefed on risks that then persisted without commensurate controls. On financial gain, FinCEN says the bank likely saved hundreds of millions of dollars in compliance spending, and it retained high-risk, high-value customers over compliance’s recommendation. It gave greater weight to this factor because of the duration and extent of the benefit.

FinCEN is careful on one point that compliance officers should note. Account closure is not the only appropriate response to high risk. A bank may mitigate through enhanced monitoring, product restrictions, or other risk-based controls. What it cannot do is acknowledge the risk and then leave the profile, monitoring, and reviews untouched.

Lessons

Escalation needs an owner with authority. When compliance recommends offboarding and the business disagrees, there should be a defined decision path, a documented rationale, and a requirement that any decision to retain be matched with specific, tested controls and a review date.

Risk ratings should respond to the bank’s own information first. A rating that changes when a subpoena arrives is a rating driven by external events. Alerts, case volume, adverse media, and public disclosures like a customer’s announcement of a DOJ inquiry should move the rating too.

Mitigation plans need metrics. If the central risk is third-party payments, the plan must measure third-party payments and have consequences if they continue.

Revenue should be visible in the room. The documents here show revenue figures in the same discussions as compliance concerns. Boards and BSA Officers should expect to see those trade-offs presented explicitly.

And follow through on your own promises. A review of an entire industry segment that compliance says it will do in 2022 and does in 2024 is the kind of delay a regulator will cite.