<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>Across — Weekly Enforcement &amp; Compliance Insight Digest</title>
    <link>https://acrossoversight.com/insights</link>
    <atom:link href="https://acrossoversight.com/insights/rss.xml" rel="self" type="application/rss+xml" />
    <description>Stay informed on the latest regulatory enforcement actions affecting banks and credit unions, with key compliance insights and takeaways from Across Oversight-AI.</description>
    <language>en-us</language>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending October 12, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-october-12-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-october-12-2026</guid>
      <pubDate>Mon, 12 Oct 2026 00:00:00 GMT</pubDate>
      <description>American Express's $350 million BSA/AML penalty anchors a 13-action week that also covers Iran-related sanctions, a Uranium Finance hacking conviction, and SEC fraud charges against Linqto executives.</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- 13 qualifying enforcement, criminal or new judicial actions were identified in the review. The OCC and Federal Reserve actions against American Express are counted as one coordinated matter; the SEC SQN case is counted only for the October 8 judgments, not its earlier complaint.
- The most consequential banking finding was the $350 million American Express penalty, tied to deficient BSA/AML coverage and approximately $13 billion in suspected trade-based money laundering activity not timely or sufficiently reported.
- Direct fintech/digital-asset developments included the Uranium Finance crypto-exchange hacking conviction and SEC charges involving the Linqto online pre-IPO investment platform. OFAC announced sanctions affecting international trade and financial screening.
- No new enforcement action specifically against a sponsor-bank/BaaS arrangement was identified. Fintech and sponsor-bank monitoring implications are nevertheless material for card-product AML, sanctions, insider fraud, digital-asset controls and third-party oversight.

## Priority Watchlist

| Institution | Regulator | Date | Action | Severity |
| --- | --- | --- | --- | --- |
| American Express National Bank / American Express Company | OCC + Federal Reserve | Oct. 8, 2026 | Cease-and-desist orders; $350 million OCC CMP | High |
| Iranian shadow-fleet shipping and support network | OFAC / Treasury | Oct. 8, 2026 | Sanctions designations | High |
| Jonathan Spalletta / Uranium Finance | DOJ | Oct. 7, 2026 | Criminal conviction | High |
| William Sarris and Joseph Endoso / Linqto platform | SEC | Oct. 9, 2026 | Civil fraud charges | High |
| Gerardo Aquino / former TD Bank employee | DOJ | Oct. 6, 2026 | Guilty plea | High |
| Juan Francisco Ramirez / Nodus International Bank | DOJ | Oct. 7, 2026 | Criminal sentencing | High |
| Oleg Korniev / Your Mule Cashout network | DOJ | Oct. 8, 2026 | Guilty plea | High |
| Michael Edwards / stolen-check network | DOJ | Oct. 7, 2026 | Criminal sentencing | High |
| Pegasus Worldwide Logistics | OFAC | Oct. 9, 2026 | Sanctions settlement; $175,015 | Medium |
| Jefferies LLC | SEC | Oct. 9, 2026 | Cease-and-desist; censure; $650,000 penalty | Medium |
| SQN Capital Management / Jeremiah Silkowski | SEC | Oct. 8, 2026 | Court consent judgments; receiver appointment | Medium |
| Zohar Pinhasi / MonsterCloud | DOJ | Oct. 7, 2026 | Criminal indictment / arraignment | Medium |
| Greenway Auto Group | FTC | Oct. 8, 2026 | Proposed stipulated settlement | Medium |

## New Enforcement Actions This Week

### 01 — BSA/AML; Transaction Monitoring
#### American Express National Bank / American Express Company
**Date:** October 8, 2026 · **Regulator:** OCC + Federal Reserve · **Type:** Cease-and-desist orders; $350 million OCC CMP

**Key Findings**

- OCC imposed a $350 million civil money penalty and cease-and-desist order against American Express National Bank; the Federal Reserve issued a coordinated order at the holding-company level. These are treated as one coordinated matter for this digest.
- OCC found the bank failed to maintain a BSA/AML program aligned with its business and gave insufficient attention to risks in its dominant credit and charge card products.
- OCC cited staffing and expertise gaps, weak independent testing and training, customer due diligence weaknesses, and failure to timely identify, evaluate, and sufficiently report approximately $13 billion in suspected trade-based money laundering activity over a decade.

**Why It Matters**

A direct warning that enterprise AML controls and transaction monitoring must reflect the actual risk profile of high-volume payment products, with credible management oversight.

**Fintech Monitoring Relevance:** High

### 02 — Sanctions; Trade Finance
#### Iranian shadow-fleet shipping and support network
**Date:** October 8, 2026 · **Regulator:** OFAC / Treasury · **Type:** Sanctions designations

**Key Findings**

- Treasury announced sanctions targeting 17 vessels transporting Iranian petroleum or petrochemicals and associated shipping and management companies.
- The designations were made under Executive Order 13902 and included companies registered in multiple jurisdictions; Treasury also removed two vessels following changed circumstances.
- Treasury described front-company structures and cross-border shipping arrangements used to obscure prohibited Iranian petroleum transactions.

**Why It Matters**

Cross-border payments and correspondent banking can be exposed through trade-related counterparties and layered ownership even when the immediate customer is not directly designated.

**Fintech Monitoring Relevance:** High

### 03 — Digital-Asset Cyber Fraud
#### Jonathan Spalletta / Uranium Finance
**Date:** October 7, 2026 · **Regulator:** DOJ · **Type:** Criminal conviction

**Key Findings**

- A jury convicted Spalletta of computer fraud and money laundering involving two attacks on decentralized cryptocurrency exchange Uranium Finance.
- DOJ said the first exploit extracted about $1.4 million and the second approximately $53.3 million, causing the platform to shut down.
- The proceeds were laundered through cryptocurrency transactions, including the Tornado Cash mixer; approximately $31 million in cryptocurrency was seized in 2025.

**Why It Matters**

Connects digital-asset technology vulnerabilities to loss of customer funds and laundering typologies that may reach banks and payment firms.

**Fintech Monitoring Relevance:** High

### 04 — Digital Investment Platform; Investor Protection
#### William Sarris and Joseph Endoso / Linqto platform
**Date:** October 9, 2026 · **Regulator:** SEC · **Type:** Civil fraud charges

**Key Findings**

- SEC charged two former Linqto executives with allegedly misleading retail investors using an online platform to buy interests in pre-IPO companies.
- SEC alleged a subsidiary sold more than $430 million of special-purpose-vehicle interests and that platform pricing, scarcity, algorithmic pricing and legal-compliance representations were misleading.
- SEC also alleged unregistered investment-company activity and unregistered securities sales; allegations have not been adjudicated.

**Why It Matters**

Shows how digital distribution and platform design can create investor-protection exposure when pricing and eligibility disclosures do not match actual operations.

**Fintech Monitoring Relevance:** High

### 05 — Bank Insider Fraud; AML
#### Gerardo Aquino / former TD Bank employee
**Date:** October 6, 2026 · **Regulator:** DOJ · **Type:** Guilty plea

**Key Findings**

- Former TD Bank employee pleaded guilty to taking bribes and helping launder more than $4.8 million to Colombia.
- According to DOJ, he opened fraudulent accounts, issued hundreds of debit cards and unblocked cards restricted for suspected fraud.
- DOJ said 86 accounts shared one Miami commercial address and moved over $3 million; bribes included payments via a peer-to-peer digital payment network.

**Why It Matters**

Provides concrete monitoring indicators for account onboarding, debit-card fraud overrides, and insider facilitation of laundering.

**Fintech Monitoring Relevance:** Medium

### 06 — Bank Governance; Insider Lending Fraud
#### Juan Francisco Ramirez / Nodus International Bank
**Date:** October 7, 2026 · **Regulator:** DOJ · **Type:** Criminal sentencing

**Key Findings**

- Former chairman and co-owner of Nodus International Bank was sentenced to 62 months in prison and ordered to forfeit about $13.6 million.
- DOJ said he led a scheme that caused at least $23.6 million in losses by concealing insider-benefit loans and investments from directors and the Puerto Rico regulator.
- The conduct included sham investments and a transfer of a roughly $26 million nonperforming loan portfolio shortly before liquidation.

**Why It Matters**

Illustrates how insider transactions and governance failures can affect bank financial condition and depositor outcomes.

**Fintech Monitoring Relevance:** Medium

### 07 — Cybercrime Proceeds Laundering
#### Oleg Korniev / Your Mule Cashout network
**Date:** October 8, 2026 · **Regulator:** DOJ · **Type:** Guilty plea

**Key Findings**

- Korniev pleaded guilty to running an international laundering service that recruited more than 15,000 U.S.-based money mules.
- DOJ said the network helped launder at least $10 million stolen from more than 750 U.S. bank accounts; the defendant admitted to at least $7 million actually laundered.
- Mules were recruited through sham employment arrangements and directed to receive funds and wire them abroad.

**Why It Matters**

Demonstrates the value of joining fraud, account-takeover and AML analytics across the transaction lifecycle.

**Fintech Monitoring Relevance:** Medium

### 08 — Check Fraud; Mule Accounts
#### Michael Edwards / stolen-check network
**Date:** October 7, 2026 · **Regulator:** DOJ · **Type:** Criminal sentencing

**Key Findings**

- Edwards was sentenced to eight years in prison for a stolen-check and check-alteration scheme.
- DOJ said the scheme involved more than 2,600 stolen checks and over $55 million in intended losses, with more than $18 million deposited into co-conspirator accounts.
- Stolen checks were altered, deposited, or offered for sale through a Telegram channel.

**Why It Matters**

Directly relevant to check fraud, deposit risk, and downstream money-mule monitoring at banks and credit unions.

**Fintech Monitoring Relevance:** Medium

### 09 — Sanctions Screening; Blocked Property
#### Pegasus Worldwide Logistics
**Date:** October 9, 2026 · **Regulator:** OFAC · **Type:** Sanctions settlement; $175,015

**Key Findings**

- OFAC announced a $175,015 settlement covering four apparent sanctions violations and six apparent procedural/reporting violations.
- The freight-forwarding firm allegedly facilitated importation of a machine supplied by a blocked company and failed to respond fully to an OFAC subpoena for six months.
- OFAC characterized the conduct as non-egregious and not voluntarily disclosed.

**Why It Matters**

Highlights third-party and trade-related sanctions exposure outside conventional bank-to-bank transfers.

**Fintech Monitoring Relevance:** Medium

### 10 — Regulatory Reporting Integrity
#### Jefferies LLC
**Date:** October 9, 2026 · **Regulator:** SEC · **Type:** Cease-and-desist; censure; $650,000 penalty

**Key Findings**

- SEC found at least 7,700 deficient electronic blue-sheet submissions during 2018-2024, affecting data for at least 1.2 million transactions.
- Errors arose from manual mistakes, coding and programming problems, including issues involving vendor-assisted reporting.
- Jefferies accepted censure, cease-and-desist relief and a $650,000 penalty; SEC noted remediation and self-reporting of several errors.

**Why It Matters**

Shows that data integrity and vendor-dependent regulatory reporting can create material supervisory exposure even without alleged customer fraud.

**Fintech Monitoring Relevance:** Medium

### 11 — Investment-Adviser Governance
#### SQN Capital Management / Jeremiah Silkowski
**Date:** October 8, 2026 · **Regulator:** SEC · **Type:** Court consent judgments; receiver appointment

**Key Findings**

- Court entered consent judgments and appointed a receiver on October 8; SEC first filed the underlying charges on September 18, so this digest counts the new judgment, not a new filing.
- SEC alleged inflated asset values, deficient audits and misleading disclosures concerning fund liquidation.
- Judgments included a $200,000 civil penalty against Silkowski and permanent industry restrictions; defendants did not admit the allegations.

**Why It Matters**

A governance and investor-funds case illustrating risks in weak valuation, custody and audit practices.

**Fintech Monitoring Relevance:** Low

### 12 — Cyber Incident-Response Vendor Fraud
#### Zohar Pinhasi / MonsterCloud
**Date:** October 7, 2026 · **Regulator:** DOJ · **Type:** Criminal indictment / arraignment

**Key Findings**

- DOJ charged the owner of a ransomware remediation company with alleged wire fraud and conspiracy.
- The indictment alleges he represented that his firm could decrypt without paying attackers, while secretly making more than $8 million in ransom payments and charging clients more than $19 million.
- The allegations have not been proven; DOJ noted that ransom payment does not guarantee data recovery or removal of compromise.

**Why It Matters**

Shows the operational and third-party risk of relying on an incident-response provider without verification of methods and outcomes.

**Fintech Monitoring Relevance:** Medium

### 13 — Consumer Price Transparency
#### Greenway Auto Group
**Date:** October 8, 2026 · **Regulator:** FTC · **Type:** Proposed stipulated settlement

**Key Findings**

- FTC announced a proposed settlement of allegations that vehicle prices were advertised below the actual price customers paid.
- FTC alleged that more than 92% of transactions included additional charges averaging more than $3,350 over advertised prices.
- The proposed order addresses mandatory fees, conditional discounts, financing representations and deceptive promotional mailers; it requires court approval.

**Why It Matters**

An indirect but practical reminder of consumer fee transparency and advertising controls.

**Fintech Monitoring Relevance:** Low

## Material Supervisory, Rulemaking and Follow-up Updates

- Oct. 8 — FTC: Cleo AI refunds. FTC announced distribution of more than $15.8 million in refunds to users of the cash-advance app Cleo AI, arising from an earlier case. This is a redress milestone, not a new enforcement action.
- Oct. 9 — SEC: registered-fund cross trading. SEC proposed amendments to Rule 17a-7 to broaden permitted cross trades, with enhanced pricing, oversight and aggregate reporting. This is proposed rulemaking, not an enforcement action.
- Oct. 5 — CFTC: crypto asset markets. CFTC issued an advance notice seeking input on regulation of retail crypto asset transactions and crypto asset markets. Included because of direct digital-asset relevance.
- Oct. 7 — Treasury: outbound investment penalty announcement. Treasury announced a $200,000 penalty involving Amidi LLC and an outbound investment notification. Treasury states the penalty was issued in July 2026; accordingly it is not counted as a new October enforcement action.
- Oct. 5 — OFAC: sanctions list maintenance. OFAC removed 125 entries and updated 22 entries as part of sanctions-list modernization. This is a screening data update rather than a new adverse enforcement action.
- Oct. 11 — DOJ: Alvaro Pulido Vargas. DOJ announced an arrest in connection with older 2019 and 2021 indictments alleging over $2 billion in money laundering and bribery-related schemes. The arrest is a material case development but not a newly filed indictment.

## Enforcement Actions by Risk Category

**BSA/AML & Sanctions:** A01 American Express National Bank / American Express Company; A02 Iranian shadow-fleet shipping and support network; A03 Jonathan Spalletta / Uranium Finance; A05 Gerardo Aquino / former TD Bank employee; A07 Oleg Korniev / Your Mule Cashout network; A09 Pegasus Worldwide Logistics.

**Consumer Compliance:** A04 William Sarris and Joseph Endoso / Linqto platform; A13 Greenway Auto Group.

**Operational Risk & Fraud:** A01, A03, A04, A05, A06, A07, A08, A10, A11, A12, A13.

**Information Security & Cybersecurity:** A03 Jonathan Spalletta / Uranium Finance; A07 Oleg Korniev / Your Mule Cashout network; A12 Zohar Pinhasi / MonsterCloud.

**Third-Party Risk / Fintech Partnerships:** No enforcement actions directly targeting fintech partnerships, sponsor-bank programs, BaaS arrangements, payment processors, or embedded finance providers were identified this week. Relevant third-party implications arise from A04, A09 and A12.

**Governance & Risk Management:** A01, A04, A05, A06, A09, A10, A11.

**Financial / Capital / Liquidity Risk:** A06 Juan Francisco Ramirez / Nodus International Bank.

## Key Regulatory Themes

1. **Product-aligned AML and SAR governance.** The coordinated American Express orders highlight the need to assess AML risk across dominant payment products, maintain competent staffing and testing, and demonstrate effective monitoring and reporting.
2. **Insider and mule-enabled financial crime.** The TD Bank employee plea, the Korniev mule network and the Nodus Bank case show how privileged access, fraudulent onboarding and weak escalation can facilitate illicit transfers or conceal insider benefits.
3. **Digital platforms, cyber exploitation and investor protection.** Uranium Finance and Linqto highlight distinct risks in crypto smart contracts, platform controls, investment disclosures and downstream movement of funds.
4. **Sanctions and third-party data integrity.** OFAC shipping designations and the Pegasus settlement emphasize beneficial-ownership and intermediary screening; Jefferies shows that reporting data quality also requires sustained validation.

## Implications for Sponsor Banks and Fintech Programs

**Immediate Monitoring Actions**

- Backtest card and charge-product transaction-monitoring coverage, including trade-based laundering typologies and SAR escalation timeliness.
- Refresh sanctions screening for new OFAC vessels, maritime entities, beneficial owners and logistics intermediaries; verify updates and false-positive handling.
- Review employee override, debit-card unblock and repeated shared-address account-opening patterns.
- Review digital-asset partner cyber controls, mixer exposure, on/off-ramp monitoring and suspicious wallet behavior.
- Review consumer-facing investment and cash-advance marketing claims, price/fee disclosures and contractual consistency.

**Control Areas to Review**

- C1/C2 product-specific BSA/AML risk assessment and monitoring effectiveness.
- Independent AML testing, staffing, governance and SAR-quality assurance.
- Fraud-block overrides, shared-address accounts, mule behavior and cross-border wires.
- Sanctions screening, vessel/beneficial-ownership data and OFAC inquiry handling.
- Smart-contract risk, cyber response providers and incident-response transparency.
- Regulatory data reconciliation, vendor reporting and audit trails.
- Investment-platform disclosure, pricing, conflicts and custody/valuation controls.

## No Material Actions Identified

The following regulator news/enforcement sources were checked, and no additional qualifying material new enforcement action was identified in the accessible releases for the review period: FDIC, CFPB, FinCEN, NCUA, NYDFS, California DFPI and relevant state banking department releases. This is a source-based finding, not a certification that no unpublished actions occurred. FDIC and DFPI site access was partially restricted during the review; results for those sources should be treated as qualified.

## Appendix: Sources Reviewed

Action identifiers map to their primary regulator source below. Supervisory/follow-up items (S01–S06) are included for reference.

- A01 — OCC + Federal Reserve (American Express National Bank / American Express Company)
- A02 — OFAC / Treasury (Iranian shadow-fleet shipping and support network)
- A03 — DOJ (Jonathan Spalletta / Uranium Finance)
- A04 — SEC (William Sarris and Joseph Endoso / Linqto platform)
- A05 — DOJ (Gerardo Aquino / former TD Bank employee)
- A06 — DOJ (Juan Francisco Ramirez / Nodus International Bank)
- A07 — DOJ (Oleg Korniev / Your Mule Cashout network)
- A08 — DOJ (Michael Edwards / stolen-check network)
- A09 — OFAC (Pegasus Worldwide Logistics)
- A10 — SEC (Jefferies LLC)
- A11 — SEC (SQN Capital Management / Jeremiah Silkowski)
- A12 — DOJ (Zohar Pinhasi / MonsterCloud)
- A13 — FTC (Greenway Auto Group)
- S01 — FTC (Cleo AI consumer refund distribution, Oct. 8)
- S02 — SEC (proposed registered-fund cross-trading amendments, Oct. 9)
- S03 — CFTC (crypto asset markets advance notice, Oct. 5)
- S04 — Treasury (outbound investment penalty announcement, Oct. 7; penalty issued July)
- S05 — OFAC (sanctions list removals and updates, Oct. 5)
- S06 — DOJ (arrest in older Venezuelan laundering indictments, Oct. 11)

Method: public announcements and orders dated October 5–11, 2026; counts are unique cases, not regulator notices. Allegations are identified as such. The October 12 week-ending date reflects the scheduled Monday review; the U.S. review period closes October 11.]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending October 5, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-october-5-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-october-5-2026</guid>
      <pubDate>Mon, 05 Oct 2026 00:00:00 GMT</pubDate>
      <description>Ten new enforcement actions this week, led by coordinated sanctions against the A7 shadow-banking network and a Tren de Aragua ATM-jackpotting laundering operation, with no action targeting sponsor-bank or BaaS programs directly.</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- 10 material new enforcement actions were identified. The count includes formal sanctions, a Federal Reserve written agreement, criminal pleas/sentencings/convictions, and SEC enforcement actions.
- Major risk areas were sanctions and illicit finance, ATM malware/jackpotting, cryptocurrency laundering, bank and credit-union fraud, investment fraud, conflicts of interest, and governance/risk management.
- Direct fintech/payments/digital-asset impact was material. OFAC and FinCEN acted against the A7 shadow-banking network and its ruble-backed A7A5 token; OFAC also targeted a Tren de Aragua network that laundered ATM-jackpotting proceeds using cryptocurrency; the SEC sanctioned operators of online white-label brokerage platforms.
- No enforcement action directly targeting a sponsor-bank oversight program or BaaS arrangement was identified. However, this week's sanctions, payment-channel, digital-asset, cyber-enabled fraud, and third-party platform matters are relevant to sponsor-bank monitoring.

## Priority Watchlist

| Institution | Regulator | Date | Action | Severity |
| --- | --- | --- | --- | --- |
| A7 Network | FinCEN / OFAC | Oct 1 | Proposed special measure + sanctions | High |
| Tren de Aragua financial network | OFAC | Sep 30 | 10 targets designated | High |
| Hamas financing network | OFAC / DOJ | Oct 2 | Sanctions + criminal charges | High |
| Ontario Bancorporation, Inc. | Federal Reserve | Oct 2 | Written Agreement | High |
| Pacific Private Money executives | DOJ | Sep 30 | Guilty pleas; ≥$71M restitution | High |
| White-label CFD platform operators | SEC | Sep 30 | 7 settled orders | Medium |
| Hugo Villanueva | DOJ | Sep 29 | Extradition / arraignment on charges | High |
| Meyer Global Management / CEO | SEC | Sep 30 | Fraud charges | Medium |
| Athuman Farid Omar | DOJ | Oct 1 | 40-month sentence; $2.33M restitution | High |
| CityVest / CV Manager / Donenfeld | SEC | Oct 2 | Settled cease-and-desist; penalties | Medium |

## New Enforcement Actions This Week

### 01 — Illicit Finance / Sanctions Evasion
#### A7 Network
**Date:** October 1, 2026 · **Regulator:** FinCEN / OFAC · **Type:** Proposed Special Measure / Sanctions

**Key Findings**

- FinCEN proposed a rule that would prohibit certain transmittals of funds involving A7 Network sub-agents and issued an alert to financial institutions.
- OFAC sanctioned the A7 Network as a significant transnational criminal organization.
- Treasury described A7 as a Russia-linked shadow-banking network used by Iran to evade sanctions; the network is linked to the ruble-backed A7A5 token and to digital-asset activity.
- Recommended controls: screen counterparties, payment chains, wallet exposure, and trade-linked entities for A7-related identifiers and sub-agent relationships; incorporate FinCEN alert indicators into transaction monitoring and sanctions escalation; review controls for nested payment relationships, disguised trade transactions, VPN-enabled account access, and stablecoin/token settlement.

**Why It Matters**

This coordinated action directly affects sanctions screening, transaction monitoring, correspondent/payment controls, and digital-asset risk. It is particularly relevant where fintechs or financial institutions support cross-border payments or virtual-asset flows.

**Fintech Monitoring Relevance:** High

### 02 — ATM Fraud / Money Laundering
#### Tren de Aragua Financial Network
**Date:** September 30, 2026 · **Regulator:** OFAC · **Type:** Sanctions Designations

**Key Findings**

- OFAC designated 10 targets involved in a Tren de Aragua fraud scheme.
- Treasury stated that ATM jackpotting attacks used malware to force ATMs/ITMs to dispense cash and that proceeds were laundered and transferred internationally.
- Treasury stated that the designated network used cryptocurrency transactions to launder jackpotting proceeds; reported U.S. jackpotting losses totaled $40.73 million across more than 1,500 attacks as of August 2025.
- Recommended controls: review ATM/ITM cyber controls, physical access controls, malware detection, and cash-dispense anomaly monitoring; link fraud investigations to AML and sanctions workflows when proceeds move through crypto or cross-border channels; screen newly designated parties and associated wallet/address information as published by OFAC.

**Why It Matters**

The action connects cyber-enabled ATM compromise, bank losses, sanctions, money laundering, and cryptocurrency. Banks and fintech partners should ensure fraud, cyber, AML, and sanctions teams can share signals across these domains.

**Fintech Monitoring Relevance:** High

### 03 — Terrorist Financing
#### Hamas Financing Network
**Date:** October 2, 2026 · **Regulator:** OFAC / DOJ · **Type:** Sanctions / Criminal Charges

**Key Findings**

- OFAC designated individuals and entities tied to a financing architecture that Treasury said moved more than $2 million to Hamas through deceptive charitable fronts and cryptocurrency channels.
- DOJ announced coordinated arrests and charges involving alleged solicitation, collection, and transfer of funds for Hamas, including almost $50,000 allegedly provided by a Tampa-area resident.
- The actions were coordinated across U.S. and international authorities.
- Recommended controls: review charitable-payment and nonprofit-related customer activity for sanctions and terrorist-financing exposure; ensure virtual-asset screening can identify sanctioned counterparties and related wallet activity; escalate donation/payment patterns involving high-risk jurisdictions, opaque intermediaries, or inconsistent charitable purposes.

**Why It Matters**

The matter highlights the use of charitable fronts and cryptocurrency in terrorist-financing networks and reinforces the need to connect sanctions, KYC, transaction monitoring, and digital-asset controls.

**Fintech Monitoring Relevance:** High

### 04 — Governance / Risk Management
#### Ontario Bancorporation, Inc.
**Date:** October 2, 2026 · **Regulator:** Federal Reserve · **Type:** Written Agreement

**Key Findings**

- The Federal Reserve announced a written agreement with Ontario Bancorporation, Inc., dated September 24, 2026.
- The public announcement identifies the action as a formal enforcement action; detailed obligations are contained in the written agreement.
- Recommended controls: review the underlying written agreement when assessing the institution or comparable bank counterparties; track formal bank enforcement actions as triggers for enhanced due diligence and partner-risk reassessment; ensure sponsor-bank monitoring incorporates regulatory-order status and remediation milestones.

**Why It Matters**

Formal bank enforcement actions can affect counterparty risk, governance expectations, and the suitability of institutions supporting fintech programs.

**Fintech Monitoring Relevance:** Medium

### 05 — Investment Fraud / Money Laundering
#### Pacific Private Money — Mark Hanf and Nam Phan
**Date:** September 30, 2026 · **Regulator:** DOJ · **Type:** Guilty Pleas

**Key Findings**

- CEO Mark Hanf pleaded guilty to wire-fraud conspiracy and money laundering; COO Nam Phan had pleaded guilty to wire-fraud conspiracy.
- The defendants admitted misleading investors about negative financial conditions, use of new investor funds to pay earlier redemptions, and the safety of investments.
- Their plea agreements state responsibility for at least $71 million in restitution.
- Recommended controls: validate representations and financial condition of investment-related fintech counterparties; review segregation and permitted use of investor/customer funds; escalate liquidity stress, redemption funding from new inflows, and inconsistent investor disclosures.

**Why It Matters**

The case illustrates how weak fund-use governance and misleading liquidity representations can produce large investor losses and laundering exposure.

**Fintech Monitoring Relevance:** Medium

### 06 — Unregistered Brokerage / Online Platforms
#### White-Label CFD Platform Operators
**Date:** September 30, 2026 · **Regulator:** SEC · **Type:** Settled Administrative Orders

**Key Findings**

- The SEC settled charges against seven individuals who operated and marketed online brokerage platforms facilitating security-based swaps to U.S. retail investors.
- The SEC found that the operators acted as unregistered brokers and were not associated with registered broker-dealers.
- The respondents accepted cease-and-desist orders, two-year association bars with a right to reapply, and civil penalties ranging from $60,000 to $125,000.
- Recommended controls: perform licensing and regulatory-status checks on white-label financial platforms and their operators; map responsibility across platform providers, brokers, introducers, and third-party product issuers; review product-governance controls for derivatives and other regulated products offered through embedded or white-label channels.

**Why It Matters**

This action is directly relevant to fintech platform governance and third-party risk because technology distribution models do not remove registration and product-compliance obligations.

**Fintech Monitoring Relevance:** High

### 07 — Bank Fraud / Money Laundering
#### Hugo Villanueva
**Date:** September 29, 2026 · **Regulator:** DOJ · **Type:** Extradition / Criminal Charges

**Key Findings**

- Villanueva was extradited from Peru and appeared in federal court to face charges involving an alleged multiyear bank-fraud and money-laundering scheme.
- The indictment alleges dozens of fraudulent bank loans totaling at least $40 million supported by false invoices, tax returns, and bank statements.
- The charges are allegations and have not been adjudicated.
- Recommended controls: strengthen verification of borrower financial statements, invoices, tax information, and collateral documentation; use cross-loan analytics to detect repeated documentation patterns and related-party borrower networks; escalate suspected loan fraud to AML investigations where proceeds are transferred or layered.

**Why It Matters**

The matter reinforces the intersection of commercial-loan fraud, document verification, and AML controls.

**Fintech Monitoring Relevance:** Medium

### 08 — Private Fund Fraud
#### Meyer Global Management LLC / Owen E.H. Meyer
**Date:** September 30, 2026 · **Regulator:** SEC · **Type:** Civil Fraud Charges

**Key Findings**

- The SEC charged the private fund adviser and its CEO with allegedly defrauding investors and managed funds in connection with pre-IPO investments.
- The complaint alleges misuse of client fund assets and false statements to investors, including alleged use of fund assets for personal expenses.
- Recommended controls: review custody, segregation, related-party payments, and expense-allocation controls for investment counterparties; validate claims regarding access to pre-IPO assets and underlying investment ownership; monitor transfers from customer/investor funds to principals or affiliated entities.

**Why It Matters**

The case is relevant to due diligence on investment fintechs and alternative-asset platforms that custody or direct client funds.

**Fintech Monitoring Relevance:** Low

### 09 — Credit Union Fraud
#### Athuman Farid Omar
**Date:** October 1, 2026 · **Regulator:** DOJ · **Type:** Criminal Sentencing

**Key Findings**

- Omar was sentenced to 40 months in federal prison for conspiring to defraud a Dallas-based credit union.
- DOJ stated that the scheme caused more than $2.3 million in actual losses; restitution of $2,332,491.91 was ordered.
- Recommended controls: review relationship-based overrides and exceptions in lending and account servicing; monitor employee/customer relationships that can bypass standard controls; use independent verification for high-value or unusual transactions involving trusted insiders or long-standing relationships.

**Why It Matters**

The case reinforces the need for controls that remain effective even where fraud exploits trusted relationships with financial-institution personnel.

**Fintech Monitoring Relevance:** Medium

### 10 — Conflicts of Interest / Fiduciary Duty
#### CityVest Capital / CV Manager / Alan P. Donenfeld
**Date:** October 2, 2026 · **Regulator:** SEC · **Type:** Settled Cease-and-Desist Orders

**Key Findings**

- The SEC found that the advisers and principal failed to disclose conflicts arising from $425,000 in loans from three advised funds to CityVest.
- The loans were ultimately repaid with interest, but the conflicts were not fully and fairly disclosed or approved.
- CityVest and Donenfeld each agreed to a $10,000 civil penalty, along with censures and cease-and-desist relief.
- Recommended controls: require disclosure and approval controls for related-party borrowing and intercompany transactions; review fund-to-manager transfers and operating-expense funding arrangements; maintain conflict registers and independent approval for transactions involving principals or affiliates.

**Why It Matters**

The action illustrates governance risks where a manager uses client or fund assets to finance its own operations.

**Fintech Monitoring Relevance:** Low

## Enforcement Actions by Risk Category

**BSA/AML & Sanctions**

- Oct. 1 — FinCEN/OFAC: coordinated action against the A7 shadow-banking network, including a proposed special measure, alert, and sanctions.
- Sep. 30 — OFAC: Tren de Aragua network designated after ATM jackpotting and laundering activity, including cryptocurrency transfers.
- Oct. 2 — OFAC/DOJ: coordinated Hamas financing actions involving charitable fronts and cryptocurrency.
- Sep. 30 — DOJ: Pacific Private Money CEO guilty plea included money laundering.
- Sep. 29 — DOJ: $40 million alleged bank-fraud and money-laundering scheme following extradition.

**Consumer Compliance**

No material actions identified this week.

**Operational Risk & Fraud**

- Sep. 30 — OFAC: ATM jackpotting network targeted after theft of millions from U.S. financial institutions.
- Sep. 30 — DOJ: Pacific Private Money executives admitted investor-fraud conduct; at least $71 million restitution responsibility.
- Sep. 29 — DOJ: alleged $40 million fraudulent bank-loan scheme.
- Sep. 30 — SEC: Meyer Global Management and CEO charged with private-fund fraud.
- Oct. 1 — DOJ: credit-union fraud sentence with $2.33 million restitution.

**Information Security & Cybersecurity**

- Sep. 30 — OFAC: Tren de Aragua sanctions action described malware-enabled ATM/ITM jackpotting, creating a direct cyber-fraud and financial-institution control nexus.

**Third-Party Risk / Fintech Partnerships**

- Sep. 30 — SEC: seven white-label online brokerage platform operators settled charges for facilitating security-based swaps without broker registration.

No enforcement action directly targeting a sponsor-bank program or BaaS arrangement was identified this week.

**Governance & Risk Management**

- Oct. 2 — Federal Reserve: formal written agreement with Ontario Bancorporation, Inc.
- Sep. 30 — DOJ: Pacific Private Money investor-fund governance failures.
- Sep. 30 — SEC: Meyer Global Management alleged misuse of client fund assets.
- Oct. 2 — SEC: CityVest conflict-of-interest action involving loans from advised funds.

**Financial / Capital / Liquidity Risk**

- Sep. 30 — DOJ: Pacific Private Money defendants admitted misrepresenting negative financial conditions and using new investor funds to pay earlier redemptions; the matter is relevant to liquidity and fund-use controls.

## Key Regulatory Themes

**1. Sanctions enforcement is converging with digital-asset monitoring**

A7, Tren de Aragua, and Hamas-related actions all involve modern payment channels, cryptocurrency, or shadow-finance structures. Screening must extend beyond names to counterparties, wallets, transaction paths, and facilitators.

**2. Cyber-enabled fraud requires cross-functional controls**

The ATM jackpotting action links malware, physical ATM access, bank losses, laundering, sanctions, and cryptocurrency. Fraud, cyber, AML, and sanctions monitoring should share indicators.

**3. White-label financial platforms remain accountable to regulatory perimeter rules**

The SEC's CFD-platform orders show that online distribution and white-label arrangements require clear licensing, product, and third-party responsibility mapping.

**4. Governance failures continue to drive material losses**

The Federal Reserve written agreement and DOJ/SEC matters involving fund misuse, conflicts, and fraud reinforce independent oversight, segregation of funds, exception controls, and remediation tracking.

## Implications for Sponsor Banks and Fintech Programs

**Immediate Monitoring Actions**

- Update sanctions screening and transaction-monitoring scenarios for A7 Network, Tren de Aragua, and Hamas-related identifiers and typologies.
- Review ATM/ITM cyber-fraud controls and escalation into AML/sanctions investigations where proceeds move cross-border or through crypto.
- Reassess licensing and regulatory-status controls for white-label trading, brokerage, and other embedded financial-product partners.
- Add formal bank enforcement actions and material regulatory orders as triggers in ongoing third-party and sponsor-bank counterparty reviews.

**Control Areas to Review**

- Sanctions screening and wallet/blockchain exposure
- Transaction monitoring for shadow banking and nested payment flows
- ATM/ITM cybersecurity and fraud monitoring
- White-label platform licensing and product governance
- Customer/investor fund segregation
- Related-party and conflict-of-interest controls
- Regulatory-order monitoring and remediation governance

## No Material Actions Identified

The following regulators were reviewed and no material new enforcement action meeting the digest criteria was identified for the September 29 – October 5 review period: OCC, FDIC, CFPB, NCUA, NYDFS, California DFPI, other relevant U.S. State Banking Departments, and FTC (no financial-sector action meeting the digest criteria).

## Appendix: Sources Reviewed

| Regulator | Official source / item reviewed |
| --- | --- |
| FinCEN / OFAC | Operation Economic Outcast — A7 Network, Oct. 1, 2026 — home.treasury.gov/news/press-releases/sb0644/ |
| OFAC | Tren de Aragua financial network, Sep. 30, 2026 — home.treasury.gov/news/press-releases/sb0640/ |
| OFAC / DOJ | Hamas financing network, Oct. 2, 2026 — home.treasury.gov/news/press-releases/sb0647 and justice.gov/usao-mdfl/ |
| Federal Reserve | Ontario Bancorporation written agreement announcement, Oct. 2, 2026 — federalreserve.gov/newsevents/pressreleases/enforcement20261002a.htm |
| DOJ | Pacific Private Money pleas, Sep. 30, 2026 — justice.gov/usao-ndca/ |
| DOJ | Hugo Villanueva extradition / $40M alleged bank fraud, Sep. 29, 2026 — justice.gov/usao-sdtx/ |
| DOJ | Athuman Farid Omar credit-union fraud sentencing, Oct. 1, 2026 — justice.gov/usao-ndtx/ |
| SEC | Seven white-label CFD operators, Sep. 30, 2026 — sec.gov/enforcement-litigation/administrative-proceedings/34-106538-s |
| SEC | Meyer Global Management / Owen Meyer, Sep. 30, 2026 — sec.gov/enforcement-litigation/litigation-releases/lr-26659 |
| SEC | CityVest / CV Manager / Donenfeld, Oct. 2, 2026 — sec.gov/enforcement-litigation/administrative-proceedings/ia-7021-s |
| OCC | Official news/enforcement sources reviewed; no qualifying new material action identified. |
| FDIC | Official press release/enforcement sources reviewed; no qualifying new material action identified. |
| CFPB | Official newsroom/enforcement sources reviewed; no qualifying new material action identified. |
| NCUA | Official newsroom/enforcement sources reviewed; no qualifying new material action identified. |
| FTC | Official press-release sources reviewed; no financial-sector action meeting digest criteria identified. |
| NYDFS | Official press release/enforcement sources reviewed; no qualifying new material action identified. |
| California DFPI | Official press release/enforcement sources reviewed; no qualifying new material action identified. |
| State Banking Departments | Relevant official state regulator sources reviewed; no additional qualifying new material action identified. |

*Methodology: Official regulator and Department of Justice sources were prioritized. Items are included based on public release/action dates within September 29 through October 5, 2026. Allegations are identified as allegations unless resolved by plea, judgment, sentence, settlement, or administrative order. Coordinated matters are deduplicated where appropriate.*
]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending September 28, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-september-28-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-september-28-2026</guid>
      <pubDate>Mon, 28 Sep 2026 00:00:00 GMT</pubDate>
      <description>DOJ cryptocurrency money-laundering and bank-fraud charges, an SEC $575,000 penalty against OTC Link for Regulation SCI cybersecurity failures, and the Federal Reserve's proposed GENIUS Act stablecoin framework headline a lighter week of six enforcement actions dominated by insider fraud, management-override, and technology-governance failures.</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- 6 material new enforcement or criminal actions were identified for the September 22-28 review period.
- Major risk areas were cryptocurrency fraud and money laundering, bank and credit-union fraud, insider embezzlement, management override and failed-bank governance, investment fraud, and technology/cybersecurity control deficiencies.
- Two matters directly affected digital-asset or fintech-adjacent monitoring: DOJ's cryptocurrency scam case and the SEC's OTC Link systems-control action. No new action directly targeted a sponsor-bank oversight program, BaaS arrangement, MSB/remittance provider, or embedded-finance program.
- The Federal Reserve proposed a GENIUS Act framework for Board-supervised payment stablecoin issuers, including reserve assets, capital, risk management, safekeeping, and application requirements.
- The OCC updated its Cybersecurity Supervision Work Program; the OCC stated that it changed structure and references but did not add or change examination procedures.

## Priority Watchlist

| Institution | Regulator | Date | Action | Severity |
| --- | --- | --- | --- | --- |
| Trung Nguyen Van | DOJ | Sep 25 | Money-laundering charges tied to a cryptocurrency "pig-butchering" scam | High |
| Four Massachusetts defendants | DOJ | Sep 24 | Bank fraud & money-laundering charges over stolen Treasury checks | High |
| OTC Link LLC | SEC | Sep 22 | Censure, cease-and-desist, and $575K penalty for Regulation SCI deficiencies | High |
| Renee Nicole Brown / Sandy Spring Bank | Federal Reserve | Sep 24 | Consent prohibition order for employee embezzlement | High |
| Shaun U. Christian / First National Bank of Lindsay | DOJ | Sep 25 | Guilty plea to bank fraud and money laundering | High |
| Michael D. Williams / CMI Capital | SEC | Sep 23 | Fraud charges and proposed settlement | Medium |

## New Enforcement Actions This Week

### 01 — Cryptocurrency Fraud / Money Laundering
#### Trung Nguyen Van
**Date:** September 25, 2026 · **Regulator:** DOJ · **Type:** Criminal Charges

**Key Findings**

- DOJ charged a Vietnamese national with money laundering in connection with an alleged cryptocurrency "pig-butchering" scam.
- The complaint alleges one victim transferred approximately $16 million in cryptocurrency to a fraudulent investment platform, with approximately $569,000 directly traceable to Van's wallet; DOJ stated his wallets received approximately $53.3 million in cryptocurrency from wire-fraud schemes targeting U.S. citizens between 2018 and 2024. The charges are allegations.
- Recommended controls: review crypto transaction-monitoring scenarios for scam proceeds, rapid wallet movement, and transfers to private/unhosted wallets; strengthen investigations of fraud-linked wallet exposure and source-of-funds inconsistencies; use blockchain analytics and escalation procedures where activity exhibits investment-scam typologies.

**Why It Matters**

The case is directly relevant to digital-asset firms, banks, and fintechs supporting crypto flows because it links victim fraud, wallet tracing, and money laundering.

**Fintech Monitoring Relevance:** High

### 02 — Bank Fraud / Money Laundering
#### Four Massachusetts Defendants
**Date:** September 24, 2026 · **Regulator:** DOJ · **Type:** Criminal Indictments

**Key Findings**

- Four individuals were charged with bank-fraud conspiracy and money-laundering conspiracy.
- DOJ alleges more than $12.2 million in stolen U.S. Treasury checks and more than $1 million in other frauds targeting federally insured banks, credit unions, and customers, including fraudulent deposits and withdrawals; the charges remain allegations.
- Recommended controls: review Treasury-check authentication, deposit holds, and exception processes; monitor rapid movement of proceeds following high-value check deposits; coordinate fraud and AML investigations when proceeds move into high-value goods, real estate, or other layering channels.

**Why It Matters**

The case illustrates the overlap between deposit fraud and money laundering and is directly relevant to bank and credit-union transaction monitoring.

**Fintech Monitoring Relevance:** Medium

### 03 — Systems Compliance / Cybersecurity
#### OTC Link LLC
**Date:** September 22, 2026 · **Regulator:** SEC · **Type:** Censure / Cease-and-Desist / Civil Penalty

**Key Findings**

- The SEC censured OTC Link and imposed a $575,000 civil penalty for longstanding Regulation SCI violations.
- The order identified deficiencies in written policies and procedures for system security, access control, application vulnerability management, testing, and remediation; the SEC stated examination staff repeatedly identified deficiencies and that remediation was not prompt.
- Recommended controls: maintain approved security, access-control, vulnerability-management, testing, and remediation procedures; track examination and audit findings to documented closure; ensure technology-control frameworks address capacity, integrity, resiliency, availability, and security.

**Why It Matters**

The action is relevant to fintech and market-infrastructure technology governance because repeated control and remediation deficiencies resulted in formal enforcement.

**Fintech Monitoring Relevance:** High

### 04 — Employee Embezzlement
#### Renee Nicole Brown — Former Sandy Spring Bank Employee
**Date:** September 24, 2026 · **Regulator:** Federal Reserve · **Type:** Consent Prohibition Order

**Key Findings**

- The Federal Reserve issued a consent prohibition order against a former Sandy Spring Bank employee for embezzlement by a bank employee.
- Recommended controls: review employee access to customer and bank funds; monitor employee-linked transfers, overrides, adjustments, and exception activity; maintain segregation of duties and independent investigation processes.

**Why It Matters**

The action reinforces insider-fraud monitoring and employee-access controls.

**Fintech Monitoring Relevance:** Medium

### 05 — Bank Fraud / Money Laundering
#### Shaun U. Christian — First National Bank of Lindsay Matter
**Date:** September 25, 2026 · **Regulator:** DOJ · **Type:** Guilty Plea

**Key Findings**

- Christian pleaded guilty to conspiracy to commit bank fraud and money laundering in connection with the failed First National Bank of Lindsay.
- DOJ stated that false information was submitted for multiple loans and that the bank's former president and CEO manipulated records to conceal overdrafts and past-due balances; the scheme allegedly continued until shortly before the bank failed in October 2024.
- Recommended controls: review loan approval, exception, overdraft, and past-due account controls for management override; require independent review of insider-influenced or repeatedly modified credit relationships; ensure board and audit reporting can identify concealed deterioration and unusual account manipulation.

**Why It Matters**

The plea highlights management-override and governance risks capable of undermining credit controls and broader safety-and-soundness.

**Fintech Monitoring Relevance:** Medium

### 06 — Investment Fraud
#### Michael D. Williams and CMI Capital LLC
**Date:** September 23, 2026 · **Regulator:** SEC · **Type:** Civil Fraud Charges / Proposed Settlement

**Key Findings**

- The SEC charged CMI Capital and its founder with an alleged investment scheme that raised approximately $860,000 from at least 18 investors.
- The complaint alleges false or misleading representations; the defendants agreed to a bifurcated settlement subject to court approval, and the allegations remain subject to the court process.
- Recommended controls: for investment-platform counterparties, validate licensing, performance representations, and custody or flow-of-funds controls; review segregation of customer/investor funds and employee-controlled payment destinations; escalate unusually high-return claims and inconsistencies in supporting financial information.

**Why It Matters**

The case provides a counterparty due-diligence signal where fintechs or financial institutions support investment platforms or investor-fund flows.

**Fintech Monitoring Relevance:** Low

## Material Regulatory and Supervisory Updates

**Federal Reserve — Proposed GENIUS Act Stablecoin Framework** (September 24, 2026)

The Federal Reserve requested comment on two proposals for Board-supervised payment stablecoin issuers, addressing permissible reserve assets, standardized capital requirements, risk-management standards, reserve-asset safekeeping, and a tailored application process for Board-supervised banks seeking to issue payment stablecoins. This is a rulemaking development, not an enforcement action.

**OCC — Cybersecurity Supervision Work Program** (September 21, 2026)

Although released one day before the seven-day enforcement window, this update is retained because it was the OCC's material cybersecurity supervisory development entering the review week. The OCC updated the structure and references of its Cybersecurity Supervision Work Program and stated that no new examination procedures were added and no existing procedures were changed.

**FTC — Impersonation Rule Review** (September 24, 2026)

The FTC sought comment on whether to update its Rule on Impersonation of Government and Businesses or take other action concerning online platforms' role in promoting impersonation scams. This is a policy/rulemaking development, not an enforcement action.

## Enforcement Actions by Risk Category

**BSA/AML & Sanctions**

- September 25 — DOJ: cryptocurrency money-laundering charges against Trung Nguyen Van.
- September 24 — DOJ: bank-fraud and money-laundering charges involving stolen Treasury checks (Four Massachusetts defendants).
- September 25 — DOJ: guilty plea in the First National Bank of Lindsay bank-fraud and money-laundering matter.

**Consumer Compliance**

No material actions identified this week.

**Operational Risk & Fraud**

- September 25 — DOJ: cryptocurrency scam/money-laundering case against Trung Nguyen Van.
- September 24 — DOJ: Massachusetts bank and credit-union fraud indictments.
- September 24 — Federal Reserve: Sandy Spring Bank former-employee prohibition for embezzlement.
- September 25 — DOJ: First National Bank of Lindsay-related guilty plea.
- September 23 — SEC: CMI Capital investment-fraud charges.

**Information Security & Cybersecurity**

- September 22 — SEC: OTC Link censured, ordered to cease and desist, and fined $575,000 for Regulation SCI deficiencies involving security, access control, vulnerability management, testing, and remediation.

**Third-Party Risk / Fintech Partnerships**

No enforcement actions directly targeting fintech partnerships, sponsor-bank programs, BaaS arrangements, payment processors, or embedded finance providers were identified this week. The DOJ cryptocurrency matter and SEC OTC Link action remain relevant to digital-asset and technology-risk monitoring.

**Governance & Risk Management**

Governance themes arose in the OTC Link, Sandy Spring Bank employee, First National Bank of Lindsay, and CMI Capital matters.

**Financial / Capital / Liquidity Risk**

No material new action focused primarily on capital or liquidity risk was identified this week.

## Key Regulatory Themes

1. **Stablecoin supervision is becoming operational.** The Federal Reserve's September 24 proposals translate GENIUS Act requirements into proposed reserve, capital, risk-management, safekeeping, and application standards.
2. **Crypto fraud remains an AML monitoring issue.** The DOJ case shows the use of cryptocurrency wallets and unhosted-wallet transfers in alleged investment-scam laundering.
3. **Technology remediation can become an enforcement issue.** The OTC Link order emphasizes documented cybersecurity procedures and prompt remediation of examination findings.
4. **Insider and management-override risk persists.** The Federal Reserve and DOJ matters reinforce employee-access, management-override, lending-exception, and independent-oversight controls.

## Implications for Sponsor Banks and Fintech Programs

**Immediate Monitoring Actions**

- Assess stablecoin-related partners and products against the Federal Reserve's proposed reserve, capital, risk-management, safekeeping, and application framework.
- Review cryptocurrency fraud/AML scenarios for scam proceeds, wallet tracing, rapid movement, and unhosted-wallet exposure.
- Review cybersecurity remediation governance: written procedures, vulnerability management, access control, testing, and closure of supervisory findings.
- Review insider-fraud and management-override scenarios for employee-linked transfers, loan exceptions, overdrafts, and account adjustments.

**Control Areas to Review**

- Stablecoin governance and reserve controls
- Digital-asset transaction monitoring and blockchain analytics
- Cybersecurity policies and remediation tracking
- Insider fraud and privileged-access monitoring
- Check fraud and deposit controls
- Management override and lending exceptions

## No Material Actions Identified

The following authorities were reviewed and no material new enforcement actions meeting the digest criteria were identified for the September 22-28 review period: OCC, FDIC, CFPB, FinCEN, NCUA, FTC, NYDFS, California DFPI, OFAC, and other relevant U.S. state banking departments.

## Sources

| Regulator | Official source reviewed |
| --- | --- |
| OCC | Cybersecurity Supervision Work Program, Sept. 21, 2026 — OCC Bulletin 2026-48. |
| Federal Reserve | Stablecoin regulatory framework proposals, Sept. 24, 2026; Renee Nicole Brown prohibition, Sept. 24, 2026. |
| DOJ | Trung Nguyen Van crypto scam case, Sept. 25; Massachusetts bank/CU fraud case, Sept. 24; First National Bank of Lindsay matter, updated Sept. 25. |
| SEC | OTC Link LLC Regulation SCI action, Sept. 22; Michael D. Williams / CMI Capital, Sept. 23. |
| FTC | Impersonation Rule review and Rules of Practice releases, Sept. 24; enforcement index reviewed. |
| FDIC | Official press release and enforcement sources reviewed; no qualifying material new action identified. |
| CFPB | Official newsroom/enforcement sources reviewed; no qualifying material new action identified. |
| FinCEN | Official news and enforcement sources reviewed; no qualifying material new action identified. |
| NCUA | Official press release and administrative-order sources reviewed; no qualifying material new action identified. |
| NYDFS | Official press release/enforcement sources reviewed; no qualifying material new action identified. |
| California DFPI | Official press release/enforcement sources reviewed; no qualifying material new action identified. |
| OFAC | Official Treasury/OFAC releases reviewed; no qualifying material new action identified. |
| State Banking Departments | Relevant official state regulator sources reviewed; no additional qualifying material new action identified. |

Review period: September 22-28, 2026. The OCC September 21 cybersecurity supervisory update is included separately because it remained the OCC's material cybersecurity supervision development entering the review week. Rulemaking and supervisory updates are excluded from the enforcement-action count.
]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending September 21, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-september-21-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-september-21-2026</guid>
      <pubDate>Mon, 21 Sep 2026 00:00:00 GMT</pubDate>
      <description>OFAC's Iranian digital-asset sanctions on BitBank, a $100 million FTC settlement with FleetCor/Corpay, and DOJ fraud charges against two Robinhood employees headline a week dominated by digital-asset enforcement and bank-employee misconduct actions.</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- 10 material new enforcement actions were identified for the September 15-21 review period, counting individual bank-employee prohibition orders separately and coordinated matters once.
- The most relevant fintech and payments developments were OFAC's designation of Iranian digital asset exchange BitBank, the FTC's $100 million FleetCor/Corpay fuel-card settlement, and DOJ charges against two Robinhood employees involving crypto-linked perpetual futures.
- Major risk themes were sanctions and digital assets, payment-product fee transparency, insider/employee misconduct, customer-funds misuse, fraud, and governance.
- No material new action directly targeted a sponsor-bank oversight program or BaaS arrangement during the review period.
- FinCEN also held a September 16 public-private exchange with global financial institutions focused on Iranian revenue streams and procurement networks; this is treated as a supervisory/AML update rather than an enforcement action.

## Priority Watchlist

| Institution | Regulator | Date | Action | Severity |
| --- | --- | --- | --- | --- |
| BitBank, Pishtaz Simorgh & associates | OFAC | Sep 17 | Sanctions designations tied to Iranian digital-asset infrastructure | High |
| FleetCor / Corpay and Ronald Clarke | FTC | Sep 17 | $100M proposed settlement over fuel-card fee practices | High |
| Hefu Chai & Huaisong Xiang (Robinhood employees) | DOJ | Sep 15 | Criminal charges over misuse of confidential crypto-listing information | High |
| Three former bank / AmEx employees | Federal Reserve | Sep 18 | Consent prohibition orders for funds misuse, conflicts, and check fraud | High |
| Zena Montejano & Jorge Troncoso | OCC | Sep 17 | Prohibition orders for embezzlement and unauthorized customer debits | High |
| Ellen Polcari | SEC | Sep 18 | Civil fraud complaint over alleged investor-fund misappropriation | Medium |
| Jon P. Kipp | SEC | Sep 15 | Settled insider-trading action | Medium |

## New Enforcement Actions This Week

### 01 — Sanctions / Digital Assets
#### BitBank, Pishtaz Simorgh Electronic Trade Company, and Associates
**Date:** September 17, 2026 · **Regulator:** OFAC · **Type:** Sanctions Designations

**Key Findings**

- OFAC designated BitBank, its developer Pishtaz Simorgh Electronic Trade Company, and three associates of OFAC-designated Iranian financier Babak Zanjani.
- Treasury described the targets as key components of Iranian digital-asset sanctions-evasion infrastructure, part of Operation Economic Outcast.
- Recommended controls: refresh sanctions lists, aliases, ownership links, and wallet intelligence; review crypto transaction monitoring for exposure to Iranian digital-asset infrastructure; escalate indirect exposure through exchanges, payment intermediaries, and third-country counterparties.

**Why It Matters**

This is directly relevant to digital-asset firms, banks, and fintechs facilitating crypto-to-fiat activity, and to sanctions-screening programs.

**Fintech Monitoring Relevance:** High

### 02 — Consumer Compliance / Payment Products
#### FleetCor Technologies / Corpay and Ronald Clarke
**Date:** September 17, 2026 · **Regulator:** FTC · **Type:** Proposed Administrative Settlement

**Key Findings**

- FleetCor, now Corpay, and its CEO agreed to pay $100 million to resolve an FTC administrative action.
- The FTC alleged undisclosed and unauthorized fees connected with fuel cards, and misrepresentations regarding savings, fraud controls, and fees. The proposed settlement follows prior federal-court findings and would provide redress to affected business customers.
- Recommended controls: review fee authorization, disclosure, billing, and change-management controls for commercial payment products; validate that fraud-control and savings claims are supportable; ensure product, legal, compliance, billing, and customer-service processes identify and remediate unauthorized charges.

**Why It Matters**

The action is relevant to fintech payment products because it connects product representations, fee governance, billing controls, and customer consent to material enforcement exposure.

**Fintech Monitoring Relevance:** High

### 03 — Digital Assets / Employee Misconduct
#### Hefu Chai and Huaisong Xiang — Robinhood Employees
**Date:** September 15, 2026 · **Regulator:** DOJ · **Type:** Criminal Charges

**Key Findings**

- DOJ charged two Robinhood engineers with commodities fraud and wire fraud.
- The government alleges they misappropriated confidential business information about forthcoming Robinhood Crypto token listings and traded perpetual futures on Hyperliquid before public announcements; each allegedly earned more than $50,000. The charges are accusations and the defendants are presumed innocent.
- Recommended controls: review employee access to listing, launch, pricing, and other market-sensitive information; apply surveillance and conflict-of-interest controls to employee trading where crypto or derivatives activity may create misuse risk; maintain access logging, segregation of duties, confidentiality controls, and investigation procedures for material nonpublic information.

**Why It Matters**

The case is directly relevant to digital-asset fintech governance and demonstrates employee-conduct risk around token listings and decentralized derivatives markets.

**Fintech Monitoring Relevance:** High

### 04 — Employee Misconduct / Customer Funds
#### Charles Alan Wright — Former Northstar Bank Employee
**Date:** September 18, 2026 · **Regulator:** Federal Reserve · **Type:** Consent Prohibition Order

**Key Findings**

- The Federal Reserve announced a consent prohibition order against a former Northstar Bank employee for misappropriation of customer funds.
- Recommended controls: review employee access to customer funds and exception activity; maintain transaction surveillance and escalation for employee-linked transfers; ensure investigation and disciplinary processes address insider misuse.

**Why It Matters**

The action reinforces insider-fraud and customer-funds controls at supervised institutions.

**Fintech Monitoring Relevance:** Medium

### 05 — Employee Misconduct / Conflicts
#### Stephanie K. Hudders — Former American Express Travel Related Services Employee
**Date:** September 18, 2026 · **Regulator:** Federal Reserve · **Type:** Consent Prohibition Order

**Key Findings**

- The Federal Reserve announced a consent prohibition order for misapplication of funds and conflicts of interest.
- Recommended controls: review conflict-of-interest attestations and employee transaction controls; monitor privileged access and employee-linked account activity; maintain independent escalation and investigation channels.

**Why It Matters**

The action is relevant to payment and financial-services firms because it combines funds misuse with conflicts-of-interest risk.

**Fintech Monitoring Relevance:** Medium

### 06 — Check Fraud / Employee Misconduct
#### Elvisha White — Former Regions Bank Employee
**Date:** September 18, 2026 · **Regulator:** Federal Reserve · **Type:** Consent Prohibition Order

**Key Findings**

- The Federal Reserve announced a consent prohibition order against a former Regions Bank employee for check fraud.
- Recommended controls: review teller and employee check controls; monitor override, exception, and employee-linked check activity; maintain maker-checker and fraud escalation procedures.

**Why It Matters**

The order highlights insider-fraud risk in routine payment operations.

**Fintech Monitoring Relevance:** Medium

### 07 — Embezzlement / Employee Misconduct
#### Zena Montejano — Former U.S. Bank Employee
**Date:** September 17, 2026 · **Regulator:** OCC · **Type:** Order of Prohibition

**Key Findings**

- The OCC prohibited a former U.S. Bank contact-center personal banker after finding embezzlement of approximately $329,088 from the bank.
- Recommended controls: review remote/contact-center employee access and transaction authority; monitor employee-linked adjustments, transfers, and unusual account activity; maintain periodic access reviews and strong privileged-action logging.

**Why It Matters**

The matter is relevant to operational controls for remote banking and customer-service functions.

**Fintech Monitoring Relevance:** Medium

### 08 — Unauthorized Customer Debits
#### Jorge Troncoso — Former PNC Bank Employee
**Date:** September 17, 2026 · **Regulator:** OCC · **Type:** Order of Prohibition

**Key Findings**

- The OCC prohibited a former PNC branch banker for unauthorized debits from multiple customer accounts; the bank suffered a loss of at least $74,550.
- Recommended controls: review branch employee transaction authority and customer-debit controls; monitor unauthorized debit patterns and employee-linked activity; ensure customer complaint and restitution processes trigger internal fraud review.

**Why It Matters**

The action reinforces controls around employee-initiated customer-account activity.

**Fintech Monitoring Relevance:** Medium

### 09 — Investor Funds / Fraud
#### Ellen Polcari
**Date:** September 18, 2026 · **Regulator:** SEC · **Type:** Civil Complaint

**Key Findings**

- The SEC charged a former employee of two venture-capital firms with allegedly misappropriating investor money.
- The SEC alleges approximately $1.28 million was misappropriated from funds that had collectively raised approximately $28.67 million from at least 85 investors; investors were allegedly directed to wire funds to bank accounts controlled by Polcari. The allegations remain unproven.
- Recommended controls: for investment-platform counterparties, review controls over subscription instructions and destination accounts; verify segregation and reconciliation of investor funds; escalate changes to payment instructions and employee-controlled accounts.

**Why It Matters**

The case provides a useful counterparty-control signal for fintechs and financial institutions supporting private-fund or investment-platform payment flows.

**Fintech Monitoring Relevance:** Low

### 10 — Insider Trading / Governance
#### Jon P. Kipp
**Date:** September 15, 2026 · **Regulator:** SEC · **Type:** Settled Civil Action

**Key Findings**

- The SEC filed a settled insider-trading action alleging Kipp sold Funko shares after receiving confidential information from the company's then-CEO.
- The SEC alleged approximately $483,746 in avoided losses; Kipp consented, without admitting the allegations, to proposed monetary remedies totaling approximately $1.073 million, subject to court approval.
- Recommended controls: for public-company fintech counterparties, assess material-nonpublic-information policies where relevant; review insider-trading controls, restricted lists, and executive information handling; maintain training and escalation for personal relationships that may create information leakage.

**Why It Matters**

Direct sponsor-bank relevance is limited, but the action remains relevant to governance reviews of public fintech and technology counterparties.

**Fintech Monitoring Relevance:** Low

## Material Regulatory and Supervisory Updates

**FinCEN — Operation Economic Outcast Public-Private Exchange** (September 16, 2026)

FinCEN led an exchange with global financial institutions focused on identifying and disrupting revenue streams and procurement networks tied to Iran. The item is treated as a supervisory/BSA update rather than an enforcement action.

**Federal Reserve — Termination of SNB Bancshares / Bank of Eufaula Written Agreement** (September 18, 2026)

The Federal Reserve announced termination of a written agreement originally dated August 7, 2024, effective September 3, 2026. Because this is a termination rather than a new adverse action, it is not included in the enforcement count.

## Enforcement Actions by Risk Category

**BSA/AML & Sanctions**

- September 17 — OFAC: BitBank and related developer/associates designated as components of Iranian digital-asset sanctions-evasion infrastructure.

**Consumer Compliance**

- September 17 — FTC: FleetCor/Corpay and its CEO agreed to a proposed $100 million settlement concerning unauthorized or undisclosed fuel-card fees and alleged misrepresentations.

**Operational Risk & Fraud**

- September 18 — Federal Reserve: three consent prohibition orders involving customer-funds misappropriation, conflicts/misapplication of funds, and check fraud.
- September 17 — OCC: two prohibition orders involving embezzlement and unauthorized customer debits.
- September 18 — SEC: Ellen Polcari charged with alleged misappropriation of approximately $1.28 million of investor funds.
- September 15 — DOJ: two Robinhood employees charged over alleged misuse of confidential crypto-listing information.
- September 15 — SEC: settled insider-trading action against Jon P. Kipp.

**Information Security & Cybersecurity**

No material actions identified this week.

**Third-Party Risk / Fintech Partnerships**

- September 17 — FTC: FleetCor/Corpay action is relevant to payment-product governance and customer billing controls.
- September 15 — DOJ: Robinhood employee case is relevant to digital-asset fintech governance and access to sensitive listing information.

No material new enforcement action directly targeting a sponsor-bank oversight program or BaaS arrangement was identified this week.

**Governance & Risk Management**

Employee misconduct and privileged-access risk were recurring themes across Federal Reserve, OCC, DOJ, and SEC actions.

**Financial / Capital / Liquidity Risk**

No material actions identified this week.

## Key Regulatory Themes

1. **Digital assets remain within sanctions and criminal-enforcement reach.** OFAC's BitBank designation and DOJ's Robinhood case show distinct but complementary risks: sanctions evasion through crypto infrastructure and misuse of confidential information in crypto markets.
2. **Payment-product fee governance.** The FleetCor/Corpay settlement emphasizes express customer consent, fee transparency, billing controls, and substantiation of product claims.
3. **Insider and employee misconduct.** Five banking/payment employee prohibition actions plus DOJ and SEC matters reinforce the importance of employee-access monitoring, conflicts controls, and transaction surveillance.
4. **Iran-related financial intelligence.** FinCEN's September 16 exchange indicates continued public-private focus on Iranian revenue streams and procurement networks.

## Implications for Sponsor Banks and Fintech Programs

**Immediate Monitoring Actions**

- Refresh OFAC screening and crypto wallet/counterparty monitoring for the September 17 BitBank designations and related ownership links.
- Review fee disclosure, customer consent, billing, and product-claim controls for payment and commercial card products in light of the FleetCor/Corpay action.
- Assess employee access to sensitive fintech product, token-listing, customer-funds, and transaction information; confirm logging and surveillance are operating.
- Review insider-fraud scenarios for branch, contact-center, payment, and customer-service staff, including employee-linked transfers, debits, overrides, and checks.
- Consider whether Iran-related AML investigative guidance should be refreshed following FinCEN's September 16 public-private exchange.

**Control Areas to Review**

- Sanctions screening and digital-asset counterparty controls
- Fee authorization, disclosure, billing, and product governance
- Employee access and privileged-activity monitoring
- Insider fraud and customer-funds safeguards
- Conflicts of interest and employee trading controls
- Investor/payment instruction verification and segregation of funds

## No Material Actions Identified

The following authorities were reviewed and no material new enforcement actions meeting the digest criteria were identified for the September 15-21 review period: FDIC, CFPB, NCUA, NYDFS, California DFPI, and other relevant U.S. state banking departments.

## Sources

| Regulator | Official source reviewed |
| --- | --- |
| OFAC / Treasury | [September 17 BitBank designation](https://home.treasury.gov/news/press-releases/sb0632) |
| FinCEN | [September 16 FinCEN Exchange](https://www.fincen.gov/news/news-releases/treasury-convenes-global-financial-institutions-advance-operation-economic) |
| FTC | [September 17 FleetCor/Corpay settlement](https://www.ftc.gov/news-events/news/press-releases/2026/09/fleetcor-agrees-pay-100-million-resolve-administrative-action-after-federal-court-finds-it-violated) |
| DOJ | [September 15 Robinhood employee charges](https://www.justice.gov/usao-sdny/pr/two-robinhood-employees-charged-fraud) |
| Federal Reserve | [September 18 employee enforcement actions](https://www.federalreserve.gov/newsevents/pressreleases/enforcement20260918a.htm); [September 18 termination](https://www.federalreserve.gov/newsevents/pressreleases/enforcement20260918b.htm) |
| OCC | [September 17 enforcement actions](https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-79.html) |
| SEC | [Ellen Polcari](https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26642); [Jon P. Kipp](https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26640) |
| FDIC | Official press release and enforcement sources reviewed; no qualifying new material item identified. |
| CFPB | Official newsroom/enforcement sources reviewed; no qualifying new material item identified. |
| NCUA | Official press release/administrative-order sources reviewed; no qualifying new material item identified. |
| NYDFS | Official press release/enforcement sources reviewed; no qualifying new material item identified. |
| California DFPI | Official press release/enforcement sources reviewed; no qualifying new material item identified. |

Review period: September 15-21, 2026. Coordinated or consolidated matters are counted once; individual prohibition orders are counted separately.
]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending September 14, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-september-14-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-september-14-2026</guid>
      <pubDate>Mon, 14 Sep 2026 00:00:00 GMT</pubDate>
      <description>Eight new enforcement actions this week were led by the FTC's $12 million Humboldt Merchant Services settlement and a coordinated OFAC/DOJ sanctions and seizure action against the Xinbi Guarantee crypto-laundering marketplace, alongside accelerating Iran-related sanctions activity.</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- 8 material new enforcement or formal legal actions were identified during the September 8-14 review period, together with four material FinCEN supervisory/BSA updates.
- The most direct payments-sector action was the FTC's Humboldt Merchant Services settlement: $12 million and a permanent ban on processing for merchants with heightened fraud risk after allegations involving more than 1,000 sham merchant entities.
- Digital asset, sanctions, and cyber-enabled fraud remained prominent. Treasury and DOJ jointly acted against Xinbi Guarantee, while DOJ restrained approximately $52 million in cryptocurrency linked to scam laundering and OFAC sanctioned Xinbi and two operational enablers.
- Iran-related sanctions activity accelerated through OFAC's September 8 aviation-sector action, September 10 proxy-network designations, and a separate $1.427 million OFAC settlement for 39 apparent Iran-sanctions violations.
- No material new enforcement action directly targeted a sponsor-bank oversight program or BaaS arrangement this week. However, payment processor due diligence, merchant monitoring, sanctions screening, digital-asset tracing, fraud controls, and CIP processes remain directly relevant.

## Priority Watchlist

| Institution | Regulator | Date | Action | Severity |
| --- | --- | --- | --- | --- |
| Humboldt Merchant Services | FTC | Sep 8 | $12M settlement; high-risk merchant processing ban | High |
| Xinbi Guarantee and enablers | OFAC / DOJ | Sep 9 | Sanctions; platform seizure; ~$52M crypto restrained | High |
| Iran aviation-sector network | OFAC / FinCEN | Sep 8 | 36 sanctions targets; FinCEN alert | High |
| Iran proxy-support networks | OFAC | Sep 10 | Designations supporting KH and Hizballah | High |
| Former Linqto executives | DOJ | Sep 8 | Charges in alleged $450M fraud scheme | High |
| U.S. Person-1 | OFAC | Sep 10 | $1.427M Iran-sanctions settlement | Medium |
| Sergei Filimonov | DOJ | Sep 8 | Extradition and arraignment | Medium |
| Paul W. Jorgensen | SEC | Sep 10 | Final consent judgment for insider trading | Medium |

## New Enforcement Actions This Week

### 01 — Consumer Compliance / Payment Processing / Third-Party Risk
#### Humboldt Merchant Services
**Date:** September 8, 2026; court order entered September 11, 2026 · **Regulator:** Federal Trade Commission · **Type:** Settlement / Permanent Injunction

**Key Findings**

- Humboldt Merchant Services agreed to pay $12 million and accepted permanent restrictions on processing for merchants with heightened fraud risk.
- The FTC alleged that Humboldt processed payments for more than 1,000 merchant entities that were shell or pass-through companies used by fraudulent businesses, including unauthorized billing operations.
- The matter directly addresses processor responsibility for merchant underwriting, monitoring, and continued processing where merchant structure or activity indicates fraud risk.

**Why It Matters**

This is the week's clearest payment-sector enforcement signal. It reinforces that payment processors and their banking partners can face material exposure when merchant due diligence and ongoing monitoring fail to identify or stop sham merchants.

**Fintech Monitoring Relevance:** High

### 02 — BSA/AML & Sanctions / Digital Asset Fraud / Cybercrime
#### Xinbi Guarantee and Operational Enablers
**Date:** September 9, 2026 · **Regulator:** OFAC and U.S. Department of Justice · **Type:** Sanctions / Seizure / Cryptocurrency Restraint

**Key Findings**

- OFAC sanctioned Xinbi Guarantee, a Chinese-language illicit marketplace supporting cyber scams, fraud, money laundering, and related criminal activity, plus two entities supporting its operations.
- Treasury stated that Xinbi's marketplace processed more than $24 billion in digital assets and fiat currency since approximately 2022.
- In a coordinated action, DOJ seized Xinbi infrastructure and restrained approximately $52 million in cryptocurrency linked to scam money laundering; DOJ said the Scam Center Strike Force had restrained approximately $938 million in total.

**Why It Matters**

The coordinated action links sanctions screening, fraud detection, cyber risk, and digital-asset AML. Banks and fintechs supporting fiat-crypto flows should treat scam-center infrastructure and associated wallets as an elevated transaction-monitoring risk.

**Fintech Monitoring Relevance:** High

### 03 — Sanctions / BSA/AML / Procurement Finance
#### Iran Aviation-Sector Network
**Date:** September 8, 2026 · **Regulator:** OFAC / FinCEN · **Type:** Sanctions Designations / FinCEN Alert

**Key Findings**

- OFAC sanctioned 36 entities and individuals supporting Iran's aviation sector, including remaining active Iranian airlines and third-country facilitators.
- Treasury stated the targeted networks supported movement of weapons, personnel, illicit cargo, and procurement of U.S.-origin aircraft and sensitive technology.
- FinCEN simultaneously issued an alert to help financial institutions identify and report procurement networks supporting Iran's aviation industry.

**Why It Matters**

The action broadens Iran-related sanctions exposure into aviation, logistics, procurement, and intermediary payment networks. Financial institutions should assess indirect exposure through third parties and cross-border payment chains.

**Fintech Monitoring Relevance:** Medium

### 04 — Terrorist Financing / Sanctions
#### Iran Proxy-Support Networks
**Date:** September 10, 2026 · **Regulator:** OFAC · **Type:** Sanctions Designations

**Key Findings**

- OFAC designated entities and individuals supporting Kata'ib Hizballah and Lebanese Hizballah across Iraq, Lebanon, the United Arab Emirates, and Turkiye.
- Treasury stated the targeted networks supported terrorist proxies and sanctions-evasion schemes tied to Iran.
- OFAC also updated its Iran Statement of Licensing Policy to a presumption of denial except in limited circumstances.

**Why It Matters**

The action increases sanctions and terrorist-financing risk for cross-border banking and payments involving Iran-linked networks and third-country facilitators.

**Fintech Monitoring Relevance:** Medium

### 05 — Fraud / Governance / Investment Platform
#### Former Linqto Executives
**Date:** September 8, 2026 · **Regulator:** U.S. Department of Justice · **Type:** Criminal Charges / Guilty Plea

**Key Findings**

- DOJ announced charges against William Sarris, founder of pre-IPO investment platform Linqto, and stated that Joseph Endoso pleaded guilty in connection with an alleged $450 million fraud scheme.
- The charges include securities fraud, broker-dealer fraud, wire fraud, and conspiracy-related allegations.
- The matter concerns a technology-enabled investment platform rather than a sponsor-bank or BaaS arrangement.

**Why It Matters**

The matter is relevant to fintech counterparty due diligence because it highlights governance, licensing, customer-funds, and representation risks in technology-enabled investment platforms.

**Fintech Monitoring Relevance:** Medium

### 06 — Sanctions Compliance
#### U.S. Person-1 — Iran Sanctions Settlement
**Date:** September 10, 2026 · **Regulator:** OFAC · **Type:** Civil Settlement

**Key Findings**

- A U.S. person agreed to pay $1,427,230 to settle potential civil liability for 39 apparent violations of Iran-related sanctions.
- OFAC stated the conduct included providing management consulting services to an Iranian software company, receiving Iranian-origin dividends to U.S. bank accounts, and acquiring real property in Iran.
- OFAC determined the apparent violations were egregious and not voluntarily self-disclosed.

**Why It Matters**

The settlement illustrates how indirect payment routing through third-country banks can still create U.S. sanctions exposure and reinforces source-of-funds and sanctions-investigation controls.

**Fintech Monitoring Relevance:** Medium

### 07 — Cybersecurity / Fraud / Bank Account Takeover
#### Sergei Anatolyevich Filimonov — Bank Account Takeover Scheme
**Date:** September 8, 2026 · **Regulator:** U.S. Department of Justice · **Type:** Extradition / Arraignment on Prior Indictment

**Key Findings**

- DOJ announced the extradition and arraignment of a Russian national allegedly involved in a transnational bank-account takeover scheme causing millions of dollars in losses.
- The alleged scheme used spoofed domains mimicking federally insured financial institutions and sponsored search-engine links to direct customers to credential-harvesting pages.
- The September 8 announcement concerns procedural advancement of a case previously indicted in November 2025; the allegations remain unproven.

**Why It Matters**

This case is relevant to financial institutions because it highlights the operational link between brand impersonation, credential theft, customer account takeover, and downstream payment fraud.

**Fintech Monitoring Relevance:** Medium

### 08 — Securities Compliance / Governance
#### Paul W. Jorgensen
**Date:** September 10, 2026 · **Regulator:** Securities and Exchange Commission · **Type:** Final Consent Judgment

**Key Findings**

- A federal court entered a final judgment by consent against the former Chief Revenue Officer of Doximity in an SEC insider-trading case.
- The SEC alleged trading ahead of two negative earnings announcements, with approximately $2.53 million in avoided losses and profits.
- The defendant previously pleaded guilty in a parallel criminal case and was sentenced in May 2026.

**Why It Matters**

The action has limited direct sponsor-bank relevance but is useful for governance assessments of public fintech and technology counterparties.

**Fintech Monitoring Relevance:** Low

## Material Regulatory and Supervisory Updates

**FinCEN — Verifiable Digital Credentials under CIP** (September 8, 2026)
FinCEN issued new and updated FAQs addressing state-issued mobile driver's licenses and other government-issued verifiable digital credentials under the Customer Identification Program rule. Depository institutions should review how digital identity credentials are accepted, validated, and documented in CIP procedures.

**FinCEN — Iran Aviation Procurement Alert** (September 8, 2026)
FinCEN issued FIN-2026-Alert006 to assist financial institutions in identifying and reporting procurement networks supporting Iran's aviation industry. FinCEN's SAR key-term page identifies FIN-2026-IRANAIR as the requested term for relevant filings.

**FinCEN — Health Care Fraud Financial Trend Analysis** (September 9, 2026)
FinCEN identified approximately $17.5 billion in suspicious financial activity potentially linked to health care fraud. The update is relevant to transaction monitoring, suspicious activity investigations, and financial institutions serving health care providers or payment flows.

**FinCEN — Iran-Related Whistleblower Bulletin** (September 10, 2026)
FinCEN issued a whistleblower bulletin seeking information about BSA or sanctions violations involving Iran, including activity by proxies and facilitators outside Iran. The bulletin states that qualifying information may support whistleblower awards.

## Enforcement Actions by Risk Category

**BSA/AML & Sanctions**
- September 10 — OFAC: $1.427 million settlement for 39 apparent Iran-sanctions violations involving consulting services, Iranian-origin dividends, and Iranian real estate.
- September 10 — OFAC: sanctions against networks supporting Kata'ib Hizballah and Lebanese Hizballah.
- September 9 — OFAC / DOJ: Xinbi Guarantee sanctions, infrastructure seizure, and approximately $52 million in restrained cryptocurrency.
- September 8 — OFAC / FinCEN: 36 Iran aviation-sector targets sanctioned; FinCEN issued related procurement-finance alert.

**Consumer Compliance**
- September 8 — FTC: Humboldt Merchant Services agreed to pay $12 million and accepted permanent restrictions on processing for merchants with heightened fraud risk.

**Operational Risk & Fraud**
- September 9 — DOJ / OFAC: coordinated action against Xinbi Guarantee and scam-laundering infrastructure.
- September 8 — DOJ: Linqto executives charged in an alleged $450 million fraud scheme.
- September 8 — DOJ: extradition and arraignment advanced a transnational bank account takeover case.
- September 10 — SEC: final consent judgment entered in the Jorgensen insider-trading matter.

**Information Security & Cybersecurity**
- September 9 — DOJ / OFAC: Xinbi action targeted cyber-scam infrastructure, digital wallets, and money-laundering services.
- September 8 — DOJ: bank account takeover matter involved spoofed financial-institution domains, sponsored search links, and credential harvesting.

**Third-Party Risk / Fintech Partnerships**
- September 8 — FTC: Humboldt action directly implicates payment-processor merchant onboarding, downstream merchant monitoring, and fraud-risk escalation.
- September 8 — DOJ: Linqto charges are relevant to fintech investment-platform licensing, governance, customer-funds, and representation risk.
- No material new enforcement action directly targeting a sponsor-bank oversight program or BaaS arrangement was identified this week.

**Governance & Risk Management**
- September 8 — DOJ: Linqto allegations highlight licensing, governance, and customer-funds risks for investment platforms.
- September 10 — SEC: Jorgensen judgment highlights insider-trading and material nonpublic information governance.

**Financial / Capital / Liquidity Risk**
No material actions identified this week.

## Key Regulatory Themes

1. **Payment processor accountability** — The Humboldt matter places merchant underwriting and downstream monitoring at the center of payment-processor enforcement risk.
2. **Cyber-enabled fraud and digital asset laundering** — The coordinated Xinbi action shows continued use of sanctions, seizures, blockchain tracing, and infrastructure disruption against scam-center ecosystems.
3. **Iran-related sanctions expansion** — OFAC and FinCEN activity this week expanded sanctions, alerts, enforcement, and whistleblower activity involving aviation, proxy networks, third-country facilitators, and Iranian-origin funds.
4. **Fraud and governance in technology-enabled financial platforms** — The Linqto and Jorgensen matters reinforce governance, licensing, customer representation, and executive-conduct risks relevant to financial and technology counterparties.

## Implications for Sponsor Banks and Fintech Programs

**Immediate Monitoring Actions**

- Review payment processor and payfac merchant-monitoring controls against the Humboldt allegations, especially shell merchants, pass-through structures, high fraud rates, unauthorized billing, and merchant cycling.
- Refresh OFAC screening and transaction-monitoring rules for the September 8-10 Iran-related and Xinbi designations, including associated entities, wallets, intermediaries, and third-country routing.
- Incorporate FinCEN's September 8 Iran aviation alert and September 9 health care fraud trend analysis into relevant AML investigation procedures and analyst guidance.
- Review bank and fintech brand-protection processes for spoofed domains, paid-search abuse, credential harvesting, and customer account takeover.
- For investment or marketplace fintech counterparties, reassess licensing, governance, customer-funds, financial representations, and executive conduct where applicable.

**Control Areas to Review**

- Merchant underwriting and downstream merchant monitoring
- Sanctions screening and 50-percent-rule ownership analysis
- Digital asset wallet and scam-center transaction monitoring
- Cross-border source-of-funds and third-country payment routing
- CIP procedures for verifiable digital credentials
- Phishing, brand impersonation, and account takeover controls
- Fintech licensing, governance, and customer-funds safeguards

## No Material Actions Identified

The following regulators were reviewed and no material new enforcement actions meeting the digest criteria were identified during the September 8-14 review period: OCC, FDIC, Federal Reserve, CFPB, NCUA, NYDFS, California DFPI, and other relevant U.S. State Banking Departments.

## Appendix: Sources Reviewed

| Regulator | Official source / item reviewed |
| --- | --- |
| FTC | Humboldt Merchant Services case and September 8 press release; case updated September 11. |
| OFAC / Treasury | Xinbi Guarantee sanctions — September 9. |
| DOJ | Scam Center Strike Force / Xinbi seizures — September 9. |
| OFAC / Treasury | Iran aviation-sector sanctions — September 8. |
| OFAC / Treasury | Operation Economic Outcast proxy-network sanctions — September 10. |
| OFAC | Iran-related civil settlement — September 10. |
| FinCEN | Iran aviation procurement alert — September 8. |
| FinCEN | Health care fraud FTA — September 9. |
| FinCEN | Iran-related whistleblower bulletin — September 10. |
| FinCEN | September 8 CIP / verifiable digital credentials guidance. |
| DOJ | Bank account takeover extradition — September 8. |
| DOJ | Linqto alleged $450M fraud charges — September 8. |
| SEC | Paul W. Jorgensen final consent judgment — September 10. |
| OCC | Official OCC news and enforcement sources reviewed; no qualifying new material action identified. |
| FDIC | Official FDIC news and administrative enforcement sources reviewed; no qualifying new material action identified. |
| Federal Reserve | Official Federal Reserve enforcement sources reviewed; no qualifying new material action identified. |
| CFPB | Official CFPB newsroom and enforcement sources reviewed; no qualifying new material action identified. |
| NCUA | Official NCUA newsroom and administrative order sources reviewed; no qualifying new material action identified. |
| NYDFS | Official NYDFS press release and enforcement sources reviewed; no qualifying new material action identified. |
| California DFPI | Official DFPI press release and enforcement sources reviewed; no qualifying new material action identified. |
| Relevant U.S. State Banking Departments | Official state regulator sources reviewed where relevant; no additional qualifying material action identified. |

Review period: September 8 through September 14, 2026. Public release/action dates are used for weekly inclusion. Coordinated OFAC/DOJ Xinbi actions are deduplicated as one matter for the enforcement count.

Methodology: Official regulator and U.S. government sources were prioritized. Allegations are described as allegations unless a plea, judgment, settlement, or sentence occurred. Regulatory guidance and trend analyses are presented separately from the enforcement-action count.
]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending September 7, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-september-7-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-september-7-2026</guid>
      <pubDate>Mon, 07 Sep 2026 00:00:00 GMT</pubDate>
      <description>Six new enforcement actions this week were led by the FTC's $4.85M Nuvei settlement, OFAC's Golden Global Bank sanctions, and FinCEN's Southwest Border MSB GTO and digital asset scam alert.</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- 6 new material enforcement actions were identified, plus four significant supervisory, BSA/AML, and policy updates.
- The highest fintech and sponsor-bank relevance arose from the FTC's $4.85 million settlement with global payment processor Nuvei, FinCEN's Southwest Border GTO for MSBs, and DOJ's money-laundering/BSA case involving a Detroit money remitter.
- OFAC designated Türkiye-based Golden Global Bank and two subsidiaries for Iran-related financial-sector activity and correspondent-banking support, creating direct sanctions and correspondent-banking implications.
- FinCEN issued a digital asset scam alert based on 33,904 BSA reports involving approximately $12.7 billion in suspected activity and encouraged Section 314(b) information sharing.
- No new enforcement action directly targeted a sponsor-bank oversight program or BaaS arrangement; however, Nuvei directly targeted a payment processor and several actions directly involved digital assets, MSBs, correspondent banking, and payment fraud.

## Priority Watchlist

| Institution | Regulator | Date | Action | Severity |
| --- | --- | --- | --- | --- |
| Nuvei Corporation and subsidiaries | FTC | Sep 4 | $4.85M settlement; merchant-screening requirements | High |
| Golden Global Bank and two subsidiaries | OFAC | Sep 4 | Sanctions designations | High |
| La Posada / Juan Romo-Padilla | DOJ | Sep 4 | Money laundering and BSA charges | High |
| Certain Southwest Border MSBs | FinCEN | Sep 2 | Reissued Geographic Targeting Order | High |
| Digital asset scam-center activity | FinCEN | Sep 3 | Alert and financial trend analysis | High |
| Hamas fundraising infrastructure | DOJ | Sep 1 | Crypto and infrastructure seizures | High |
| Pacific Private Money Group executives | SEC | Sep 1 | Fraud charges | High |

## New Enforcement Actions This Week

### 01 — Consumer Compliance / Payment Processing
#### Nuvei Corporation and Subsidiaries
**Date:** September 4, 2026 · **Regulator:** FTC · **Type:** Settlement

**Key Findings**

- Nuvei agreed to pay $4.85 million to settle FTC charges that it opened and maintained payment-processing accounts for merchants it knew or should have known were engaged in deception.
- The FTC alleged that Nuvei processed more than $30 million in consumer payments for Reimage, an offshore tech-support scheme, and also maintained accounts for other high-risk or previously terminated merchants.
- The proposed order requires enhanced merchant screening and monitoring, investigation of elevated chargebacks, restrictions on high-risk tech-support merchants, and prohibits tactics intended to evade bank or card-network fraud controls.

**Why It Matters**

The action is directly relevant to sponsor banks, merchant acquirers, payment processors, payfacs, and fintechs. It reinforces expectations for merchant due diligence, ongoing monitoring, chargeback surveillance, high-risk merchant controls, and escalation when merchants have been terminated elsewhere.

**Fintech Monitoring Relevance:** High

### 02 — BSA/AML & Sanctions / Correspondent Banking
#### Golden Global Bank and Subsidiaries
**Date:** September 4, 2026 · **Regulator:** OFAC · **Type:** Sanctions Designations

**Key Findings**

- OFAC designated Türkiye-based Golden Global Bank and two controlled subsidiaries under E.O. 13902 for Iran-related financial-sector activity.
- Treasury stated that the bank facilitated tens of millions of dollars in transactions for the IRGC-QF and provided correspondent-banking access that enabled international movement of Iranian funds.
- Treasury stated that Golden Global Bank knowingly offered correspondent banking services to Iranian financial institutions and supported transactions through accounts controlled by the IRGC-QF and proxies.

**Why It Matters**

The action creates direct sanctions-screening and correspondent-banking implications for banks, fintechs, payment firms, and financial institutions with cross-border exposures. Institutions should assess direct and indirect exposure to the designated bank, subsidiaries, related counterparties, and shadow-banking networks.

**Fintech Monitoring Relevance:** High

### 03 — BSA/AML / MSB / International Money Laundering
#### La Posada / Juan Romo-Padilla
**Date:** September 4, 2026 · **Regulator:** DOJ · **Type:** Criminal Charges / Arrest

**Key Findings**

- DOJ announced the arrest of the owner of La Posada, a Detroit restaurant, convenience store, and money-remitter business.
- The defendant faces charges including conspiracy to launder monetary instruments, international money laundering, laundering of represented drug proceeds, and Bank Secrecy Act violations.
- The complaint alleges structured cash transfers of drug proceeds to Mexico through the money-remitter business.

**Why It Matters**

This matter is directly relevant to MSBs, remittance platforms, correspondent partners, sponsor banks, and transaction-monitoring programs. It highlights structuring, cross-border remittance, drug-proceeds laundering, and BSA compliance risks.

**Fintech Monitoring Relevance:** High

### 04 — Terrorist Financing / Digital Assets / Cyber
#### Hamas Cryptocurrency Fundraising Infrastructure
**Date:** September 1, 2026 · **Regulator:** DOJ · **Type:** Seizure / Disruption

**Key Findings**

- DOJ announced court-authorized seizures of more than $560,000 in cryptocurrency intended for Hamas and the disruption of associated fundraising and recruitment domains and servers.
- The fundraising network used rotating cryptocurrency addresses and online infrastructure to solicit and receive donations.
- DOJ stated that the seized infrastructure enabled investigators to intercept funds and identify individuals attempting to donate using cryptocurrency and other methods.

**Why It Matters**

The action is relevant to banks, digital asset exchanges, wallet providers, payment processors, and fintechs supporting fiat-to-crypto activity. Monitoring should address terrorist-financing indicators, wallet screening, rapid tracing, and escalation of suspicious digital asset flows.

**Fintech Monitoring Relevance:** High

### 05 — Money Laundering / Digital Assets / Drug Proceeds
#### Carlos Erick Vazquez Gonzalez
**Date:** September 4, 2026 · **Regulator:** DOJ · **Type:** Guilty Plea

**Key Findings**

- Vazquez Gonzalez pleaded guilty to laundering approximately $4 million in drug-trafficking proceeds.
- DOJ stated that the defendant received narcotics proceeds into a cryptocurrency wallet, rapidly moved the funds to conceal their origins, converted cryptocurrency to U.S. dollars in Mexico, and returned bulk cash to a money broker.
- The scheme involved money brokers, cryptocurrency transfers, cross-border movement, and conversion between cash and digital assets.

**Why It Matters**

The case highlights the use of digital assets to move and obfuscate illicit proceeds across borders. Banks, exchanges, fintechs, and payment providers should monitor rapid crypto movement, cash-to-crypto patterns, money-broker activity, and high-risk cross-border conversions.

**Fintech Monitoring Relevance:** High

### 06 — Investor Fraud / Governance / Financial Risk
#### Pacific Private Money Group Executives
**Date:** September 1, 2026 · **Regulator:** SEC · **Type:** Civil Enforcement Complaint

**Key Findings**

- The SEC charged former PPMG executives Mark D. Hanf and Hoai-Nam Chu Phan with an alleged offering fraud that raised more than $80 million from approximately 190 investors.
- The SEC alleged that new investor capital was used to make Ponzi-like payments to earlier investors and that more than $7 million was misappropriated for personal use.
- The SEC stated that by February 2026 the funds had almost $121 million in outstanding investments but less than $17 million in estimated recoverable assets.

**Why It Matters**

The action is most relevant to investment and private-fund due diligence rather than sponsor-bank operations, but it reinforces the need for financial-condition verification, source-and-use-of-funds review, governance controls, and fraud indicators when fintechs or financial counterparties rely on private capital.

**Fintech Monitoring Relevance:** Medium

## Enforcement Actions by Risk Category

**BSA/AML & Sanctions**

- OFAC — September 4, 2026: Golden Global Bank and two subsidiaries were designated for Iran-related financial-sector activity and correspondent-banking support.
- DOJ — September 4, 2026: La Posada's owner was charged with international money laundering, laundering represented drug proceeds, and BSA violations involving structured remittances to Mexico.
- DOJ — September 4, 2026: Carlos Erick Vazquez Gonzalez pleaded guilty to laundering approximately $4 million in drug proceeds through cryptocurrency.
- DOJ — September 1, 2026: More than $560,000 in cryptocurrency intended for Hamas was seized.
- FinCEN — September 2, 2026: FinCEN reissued a Geographic Targeting Order imposing enhanced reporting requirements on certain MSBs along the Southwest Border.
- FinCEN — September 3, 2026: FinCEN published an alert and analysis covering approximately $12.7 billion in suspected digital asset investment scam activity.

**Consumer Compliance**

- FTC — September 4, 2026: Nuvei agreed to pay $4.85 million and implement enhanced merchant screening and monitoring after FTC allegations that it facilitated deceptive merchants and tech-support scams.

**Operational Risk & Fraud**

- FTC — September 4, 2026: Merchant-risk and chargeback-monitoring deficiencies were central to the Nuvei settlement.
- SEC — September 1, 2026: PPMG executives were charged in an alleged $80 million Ponzi-like private-fund scheme.
- DOJ — September 1-4, 2026: Material cases involved crypto terrorist financing, cross-border drug-proceeds laundering, and remittance-based money laundering.

**Information Security & Cybersecurity**

- DOJ — September 1, 2026: Hamas fundraising domains, servers, and cryptocurrency infrastructure were disrupted.
- FinCEN — September 3, 2026: Digital asset scam-center alert described social engineering, fake investment websites/apps, mule networks, shell companies, and stablecoin transfers.
- DOJ — September 1, 2026: A separate multinational operation disrupted the Sality botnet and malware infrastructure; this is treated as a material cyber-risk update but not included in the enforcement-action count.

**Third-Party Risk / Fintech Partnerships**

- FTC — September 4, 2026: The Nuvei action directly targets payment processor merchant onboarding, ongoing monitoring, chargebacks, and evasion of bank or card-network fraud controls.
- FinCEN — September 2, 2026: The Southwest Border GTO directly affects certain MSBs and reinforces enhanced reporting expectations in higher-risk geographies.
- FinCEN — September 3, 2026: The digital asset scam alert highlights shell companies, money mules, professional money launderers, stablecoin transfers, and exchanges outside the United States.

No enforcement actions directly targeting sponsor-bank oversight programs or BaaS arrangements were identified this week.

**Governance & Risk Management**

- FTC — September 4, 2026: Nuvei must implement stronger screening, monitoring, investigation, and risk controls for merchants.
- FinCEN / Federal Banking Agencies — September 2, 2026: Joint guidance clarified how banks can communicate with customers about fraud, suspicious activity, or account closure without disclosing a SAR.

**Financial / Capital / Liquidity Risk**

- SEC — September 1, 2026: PPMG's alleged Ponzi-like scheme reflected severe liquidity and asset-recovery shortfalls; the SEC stated that almost $121 million in outstanding investments were backed by less than $17 million in estimated recoverable assets by February 2026.

## Key Regulatory Themes

**1. Payment Processor and Merchant Oversight**

The Nuvei settlement is a direct supervisory signal for payment processors, acquiring relationships, and sponsor banks: high-risk merchants require stronger onboarding, chargeback monitoring, and action when fraud or prior termination indicators emerge.

**2. Digital Assets as an Illicit-Finance Channel**

FinCEN, DOJ, and OFAC actions this week repeatedly involved cryptocurrency, stablecoins, wallets, cross-border transfers, terrorist financing, scam centers, and professional money-laundering networks.

**3. MSB and Cross-Border Remittance Risk**

FinCEN's GTO and DOJ's La Posada case emphasize heightened reporting, structuring detection, geographic risk, and transaction monitoring for MSBs and remittance providers.

**4. Correspondent Banking and Sanctions Exposure**

OFAC's Golden Global Bank action highlights the risk of foreign financial institutions providing correspondent banking or financial access to sanctioned Iranian actors and shadow-banking networks.

## Implications for Sponsor Banks and Fintech Programs

**Immediate Monitoring Considerations**

- Review payment-processor and payfac merchant-monitoring controls against the Nuvei order, including prior termination checks, chargeback thresholds, high-risk merchant categories, and load-balancing or monitoring-evasion indicators.
- Screen for Golden Global Bank, its designated subsidiaries, related counterparties, and indirect correspondent or nested-payment exposure.
- Update digital-asset monitoring using FinCEN's September 3 red flags, including scam-center patterns, money mules, shell companies, stablecoin transfers, and rapid movement to offshore exchanges.
- Review MSB and remittance transaction monitoring for structured cash transfers, Southwest Border geographic exposure, Mexico-bound flows, and reporting obligations under applicable GTO requirements.
- Ensure customer communications during fraud investigations and account closures do not disclose SAR existence while allowing communication about underlying transactions and account actions.

**Areas Requiring Elevated Attention**

- Merchant onboarding and payment-processor oversight
- Chargeback and fraud-rate monitoring
- High-risk and previously terminated merchants
- Digital asset scam-center exposure
- Stablecoin and offshore exchange flows
- MSB / remittance structuring and geographic risk
- Correspondent banking and Iran sanctions exposure
- SAR confidentiality and customer communications
- Terrorist-financing wallet screening

## No Material Actions Identified

The following regulators were reviewed and no material new enforcement actions meeting the digest criteria were identified: FDIC, CFPB, NCUA, NYDFS, California DFPI, and other relevant U.S. state banking departments.

The Federal Reserve announced on September 4, 2026 that it terminated prior enforcement actions involving United Texas Bank and Quontic entities. These terminations were reviewed but are not counted as new enforcement actions.

The SEC also proposed rescission of its investment-adviser political contribution rule on September 3, 2026. This is included as a material policy update but not as an enforcement action.

## Additional Material Regulatory Updates

- FinCEN / Federal Reserve / FDIC / NCUA / OCC — September 2, 2026: Joint statement clarified that SAR confidentiality does not prevent banks from discussing underlying transactions, suspected fraud, or account closures with customers, provided the existence of a SAR is not disclosed.
- FinCEN — September 2, 2026: FinCEN reissued the Southwest Border GTO for certain MSBs to support detection of cartel-related illicit finance and money laundering.
- FinCEN — September 3, 2026: FinCEN's analysis identified 33,904 BSA reports involving approximately $12.7 billion in suspected digital asset investment scam activity and encouraged voluntary Section 314(b) information sharing.
- SEC — September 3, 2026: SEC proposed rescinding the investment-adviser political contribution rule and related recordkeeping requirements. Existing antifraud, fiduciary duty, compliance, and code-of-ethics requirements would remain.
- Federal Reserve — September 4, 2026: The Board announced termination of prior enforcement actions with United Texas Bank and Quontic-related holding companies; the terminations are not counted as new enforcement actions.

Review period: September 1-7, 2026, based on official releases available by the time of this report. Public-release dates are used for weekly inclusion. Overlapping agency releases were deduplicated.

Method: Official regulator and U.S. government sources were prioritized. Criminal allegations are described as allegations unless a plea, conviction, or sentence occurred. Items were excluded where the source did not clearly support inclusion or where relevance to banking, fintech, payments, risk, or compliance was immaterial.

## Sources

| Regulator | Source |
| --- | --- |
| OCC | Sept. 2, 2026 - OCC Bulletin 2026-43, Joint Statement on SAR Confidentiality; OCC enforcement pages reviewed. |
| FDIC | Sept. 2, 2026 - Joint SAR Confidentiality Statement; official FDIC enforcement/release pages reviewed. |
| CFPB | Official CFPB Enforcement Actions / Newsroom sources reviewed; no qualifying material new weekly action identified. |
| FinCEN | Sept. 2, 2026 - Southwest Border MSB GTO; Sept. 2 - Joint SAR Confidentiality Statement; Sept. 3 - Digital Asset Investment Scam Alert and FTA. |
| OFAC | Sept. 4, 2026 - Treasury Severs Iranian Regime's Financial Lifelines in Türkiye; Golden Global Bank and subsidiaries designated. |
| Federal Reserve | Sept. 2, 2026 - SR 26-5 SAR Confidentiality; Sept. 4, 2026 - termination of United Texas Bank and Quontic enforcement actions. |
| NCUA | Sept. 2, 2026 - Joint SAR Confidentiality Statement; official administrative order sources reviewed. |
| SEC | Sept. 1, 2026 - PPMG private-fund fraud charges; Sept. 3 - proposed rescission of investment-adviser political contribution rule. |
| FTC | Sept. 4, 2026 - Nuvei $4.85 million payment-processor settlement and merchant-screening requirements. |
| DOJ | Sept. 1-4, 2026 - Hamas crypto seizure; Sality malware disruption; La Posada money-remitter case; Vazquez Gonzalez crypto laundering plea. |
| NYDFS | Official NYDFS enforcement and press release sources reviewed; no qualifying material new weekly action identified. |
| California DFPI | Official DFPI enforcement and press release sources reviewed; no qualifying material new weekly action identified. |
| Relevant U.S. State Banking Departments | Official state regulator release sources reviewed where relevant; no additional material qualifying action identified. |
]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending August 31, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-august-31-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-august-31-2026</guid>
      <pubDate>Mon, 31 Aug 2026 00:00:00 GMT</pubDate>
      <description>FinCEN moves to cut off Banque Misr UAE's correspondent access over Iran-linked shadow banking as DOJ brings cartel money-laundering, stolen-check, and software supply-chain cyber cases across a 10-action week.</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- 10 new material enforcement, sanctions, or criminal financial-risk actions were identified for August 24–31, 2026.
- The highest sponsor-bank and fintech relevance arose from FinCEN's proposed correspondent-account restriction on Banque Misr UAE, OFAC's Iran-related sanctions, DOJ's money-transmitter laundering case tied to CJNG, and DOJ's bank/check-fraud cases.
- Major risk areas were BSA/AML and sanctions, correspondent banking, money transmission, fraud, identity theft, shell-company laundering, cyber intrusion, software supply-chain security, and insider misappropriation.
- No action directly targeted a BaaS or sponsor-bank oversight program. Several actions directly implicated payment access, correspondent banking, money transmitters, digital-asset activity, or financial-institution controls.
- Key supervisory developments included the OCC/FDIC final rule on unsafe or unsound practices and Matters Requiring Attention, plus OCC revisions to enforcement and MRA procedures.

## Priority Watchlist

| Institution | Regulator | Date | Action | Severity |
| --- | --- | --- | --- | --- |
| Banque Misr UAE / Iranian financial facilitators | FinCEN / OFAC | Aug 28 | Proposed correspondent-account restriction + sanctions | High |
| Christopher A. Bravo Marin / Minnesota money transmitter | DOJ | Aug 25 | Indictment — cartel money-laundering (CJNG) | High |
| Iranian networks under Operation Economic Outcast | OFAC / Treasury | Aug 24 | Sanctions campaign / designations | High |
| Autistici Inventati, Palestine Action, Masar Badil | OFAC | Aug 26 | Counterterrorism designations | High |
| Five defendants / $24M stolen-check scheme | DOJ | Aug 25 | Indictment — bank fraud / stolen checks | High |
| PRC state-sponsored QScan/QTRouter platforms | DOJ / FBI | Aug 26 | Domain seizures — cyber / critical infrastructure | High |
| Gadiel Rosario-Alvarado / Banco Popular de Puerto Rico | Federal Reserve | Aug 27 | Prohibition order — insider fraud | Medium |

## New Enforcement Actions This Week

### 01 — BSA/AML & Sanctions / Correspondent Banking

#### Banque Misr UAE and Iranian Financial Facilitators

**Date:** August 28, 2026 · **Regulator:** FinCEN / OFAC · **Type:** Proposed Rule / Sanctions Designations

**Key Findings**

- FinCEN proposed a rule that would revoke Banque Misr UAE's correspondent banking access to U.S. financial institutions.
- Treasury stated Banque Misr UAE processed approximately $1.8 billion between January 2024 and June 2026 for 103 companies potentially tied to Iranian shadow-banking networks.
- OFAC also sanctioned Reza Mohammad Taeedi, manager of Bank Melli's Dubai branch, and Hong Kong-based Kameng Trading Limited for Iran-related financial facilitation.

**Why It Matters**

This is directly relevant to correspondent banking, nested relationships, cross-border payments, sanctions screening, and third-party due diligence. U.S. institutions should assess direct and indirect exposure to Banque Misr UAE, Bank Melli-linked facilitators, and related shadow-banking networks.

**Fintech Monitoring Relevance:** High

### 02 — Sanctions / Shadow Banking / Cyber

#### Operation Economic Outcast — Iran Networks

**Date:** August 24, 2026 · **Regulator:** OFAC / U.S. Treasury · **Type:** Sanctions Designations / Campaign Launch

**Key Findings**

- Treasury launched Operation Economic Outcast to target financial channels supporting the Iranian regime and IRGC.
- The action targeted procurement networks, a malicious cyber group linked to Iran's intelligence apparatus, and brokers, companies, and shadow-fleet vessels used to move Iranian oil and revenue.
- Treasury stated the campaign is intended to increase isolation of Iran's financial facilitators and expand sanctions risk for third-country actors.

**Why It Matters**

Banks, fintechs, digital-asset firms, MSBs, and payment providers should review exposure to Iranian shadow-banking networks, petroleum-linked entities, cyber actors, intermediaries, and cross-border counterparties.

**Fintech Monitoring Relevance:** High

### 03 — BSA/AML & Sanctions / Terrorist Financing

#### Autistici Inventati, Palestine Action, Masar Badil and Leaders

**Date:** August 26, 2026 · **Regulator:** OFAC · **Type:** Sanctions Designations

**Key Findings**

- OFAC designated entities and individuals under counterterrorism authority E.O. 13224, as amended.
- Designated parties included Autistici Inventati, Palestine Action, Masar Badil, and two Masar Badil leaders.
- Treasury emphasized blocking obligations, the 50 Percent Rule, and possible secondary-sanctions exposure for foreign financial institutions facilitating significant transactions for designated persons.

**Why It Matters**

The action is relevant to sanctions screening, correspondent banking, payment processing, fundraising controls, and monitoring of entities that may provide technical, financial, or logistical support to designated organizations.

**Fintech Monitoring Relevance:** High

### 04 — Money Laundering / Money Transmission

#### Christopher A. Bravo Marin / Minnesota-Based Money Transmitter

**Date:** August 25, 2026 · **Regulator:** DOJ · **Type:** Indictment

**Key Findings**

- DOJ announced an indictment charging the operator of a Minnesota-based money transmitter with conspiring to launder at least $750,000 in drug proceeds for the Cártel de Jalisco Nueva Generación.
- DOJ alleged the defendant abused his position at a financial institution to facilitate laundering of cartel proceeds back to Mexico.
- The case directly involves money transmission, cross-border movement of funds, and alleged misuse of financial-institution access.

**Why It Matters**

This is highly relevant to MSB and money-transmitter onboarding, agent oversight, transaction monitoring, source-of-funds analysis, cartel typologies, cross-border remittance risk, and sponsor-bank oversight of payment partners.

**Fintech Monitoring Relevance:** High

### 05 — Bank Fraud / Check Fraud

#### Five Defendants / $24 Million Stolen-Check Scheme

**Date:** August 25, 2026 · **Regulator:** DOJ · **Type:** Indictment

**Key Findings**

- Five Houston-area defendants were indicted in a scheme involving checks stolen from U.S. mail.
- DOJ alleged postal employees were recruited to steal checks that were then sold through Telegram and distributed to buyers.
- The alleged scheme involved approximately $24 million in stolen checks.

**Why It Matters**

The case is relevant to check-fraud controls, anomalous deposit monitoring, mail-theft typologies, account takeover, mule activity, and rapid information sharing between banks and law enforcement.

**Fintech Monitoring Relevance:** High

### 06 — Digital Assets / Investment Fraud / Money Laundering

#### Brent C. Kovar / Profit Connect

**Date:** August 24, 2026 · **Regulator:** DOJ · **Type:** Criminal Conviction

**Key Findings**

- A federal jury convicted Kovar of wire fraud, mail fraud, and money laundering related to Profit Connect.
- DOJ stated that Kovar fraudulently obtained $24 million from at least 400 investors through false claims involving AI software, cryptocurrency mining, fixed returns, and purported reserves.
- DOJ stated investor funds were used to operate the scheme, purchase personal assets, and make payments to earlier investors.

**Why It Matters**

The matter is relevant to digital-asset due diligence, investment-fraud monitoring, high-yield return claims, source-of-funds review, and banking services provided to crypto-related businesses.

**Fintech Monitoring Relevance:** High

### 07 — Information Security / Cybersecurity

#### PRC State-Sponsored QScan and QTRouter Platforms

**Date:** August 26, 2026 · **Regulator:** DOJ / FBI · **Type:** Court-Authorized Domain Seizures

**Key Findings**

- DOJ and FBI seized domains used by two hacking platforms associated with a PRC state-sponsored group.
- The platforms allegedly targeted U.S. critical infrastructure and sensitive networks, including the Federal Reserve.
- The action was intended to disrupt malicious infrastructure used for reconnaissance and compromise.

**Why It Matters**

Banks and fintechs should review threat intelligence for state-sponsored scanning, credential compromise, edge-device exposure, and infrastructure used to stage attacks against financial and critical systems.

**Fintech Monitoring Relevance:** Medium

### 08 — Information Security / Cybersecurity

#### Ruben Ian Thomson / TeamPCP Software Supply-Chain Attacks

**Date:** August 27, 2026 · **Regulator:** DOJ · **Type:** Indictment

**Key Findings**

- A federal grand jury indicted Thomson for alleged computer-fraud offenses tied to TeamPCP cyberattacks.
- DOJ alleged exploitation of trusted software supply-chain security tools and injection of malicious code.
- The alleged compromise affected downstream customers that relied on the targeted software tools.

**Why It Matters**

The action highlights third-party software risk, supply-chain compromise, code-signing controls, vendor security, continuous monitoring, and incident-response dependencies across financial technology ecosystems.

**Fintech Monitoring Relevance:** High

### 09 — Money Laundering / Fraud

#### Oluwasegun Baiyewu

**Date:** August 28, 2026 · **Regulator:** DOJ · **Type:** Criminal Sentencing

**Key Findings**

- Baiyewu was sentenced to 95 months in prison for laundering more than $3.1 million in proceeds from business email compromise, romance, and unemployment-insurance fraud.
- DOJ stated the conspiracy used illicit proceeds to purchase used vehicles that were shipped to West Africa.
- The laundering involved multiple co-conspirators in the United States and Nigeria.

**Why It Matters**

The case is relevant to BEC monitoring, mule networks, cross-border laundering, unusual vehicle-related payments, rapid movement of fraud proceeds, and international beneficiary risk.

**Fintech Monitoring Relevance:** Medium

### 10 — Insider Fraud / Operational Risk

#### Gadiel Rosario-Alvarado, Former Banco Popular de Puerto Rico Employee

**Date:** August 27, 2026 · **Regulator:** Federal Reserve · **Type:** Prohibition Order

**Key Findings**

- The Federal Reserve announced a consent prohibition order against a former Banco Popular de Puerto Rico employee.
- The stated basis was misappropriation of customer funds.
- The prohibition prevents the individual from participating in the affairs of federally insured depository institutions without required regulatory approval.

**Why It Matters**

The action reinforces employee-fraud monitoring, privileged-access controls, customer-account surveillance, segregation of duties, and escalation of suspicious employee activity.

**Fintech Monitoring Relevance:** Medium

## Enforcement Actions by Risk Category

**BSA/AML & Sanctions**

- FinCEN / OFAC — August 28, 2026: Proposed correspondent-account restriction on Banque Misr UAE and sanctions against additional Iran-related financial facilitators.
- OFAC — August 24, 2026: Operation Economic Outcast launched against Iranian financial, petroleum, cyber, and shadow-banking networks.
- OFAC — August 26, 2026: Counterterrorism designations targeted entities and leaders providing financial, technological, or organizational support to designated terrorist-linked networks.
- DOJ — August 25, 2026: Money-transmitter operator charged with laundering alleged CJNG drug proceeds.

**Consumer Compliance**

- FTC — August 27, 2026: FTC finalized orders requiring Cox Media Group, MindSift, and 1010 Digital Works to pay a total of $930,000 over allegedly deceptive representations concerning an AI-powered "active listening" advertising service. The action is consumer/data-use related but not bank-specific.

**Operational Risk & Fraud**

- DOJ — August 25, 2026: Approximately $24 million stolen-check scheme allegedly involved postal employees and resale of stolen checks.
- DOJ — August 24, 2026: Crypto/AI investment-fraud conviction involved $24 million obtained from at least 400 investors.
- DOJ — August 28, 2026: Money laundering sentencing involved more than $3.1 million in fraud proceeds.
- Federal Reserve — August 27, 2026: Former Banco Popular employee prohibited after misappropriation of customer funds.

**Information Security & Cybersecurity**

- DOJ / FBI — August 26, 2026: Court-authorized seizure of infrastructure used by PRC state-sponsored hackers to target U.S. critical infrastructure and sensitive networks.
- DOJ — August 27, 2026: TeamPCP indictment alleged exploitation of trusted software supply-chain security tools and downstream customer compromise.
- Treasury — August 24, 2026: Operation Economic Outcast included action against an Iranian malicious cyber group linked to attacks on U.S. critical infrastructure and financially motivated cyber theft.

**Third-Party Risk / Fintech Partnerships**

- FinCEN / OFAC — August 28, 2026: Banque Misr UAE action is highly relevant to correspondent banking, nested relationships, and indirect exposure to shadow-banking networks.
- DOJ — August 25, 2026: Money-transmitter operator charged with laundering cartel proceeds, creating direct MSB and remittance-monitoring relevance.
- DOJ — August 27, 2026: TeamPCP software supply-chain case highlights risks created by trusted third-party technology providers.
- DOJ — August 24, 2026: Profit Connect conviction is relevant to banking services supporting crypto and AI-related investment businesses.
- No enforcement actions directly targeting sponsor-bank programs or BaaS arrangements were identified this week.

**Governance & Risk Management**

- OCC / FDIC — August 27, 2026: Joint final rule defined "unsafe or unsound practice" for Section 8 purposes and revised the framework for Matters Requiring Attention and other supervisory communications.
- OCC — August 27, 2026: OCC revised enforcement-action and MRA policies and procedures and proposed amendments to its violations framework.

**Financial / Capital / Liquidity Risk**

No material actions identified this week.

## Key Regulatory Themes

1. **Correspondent Banking and Iran-Related Shadow Finance** — The Banque Misr UAE proposal and Operation Economic Outcast materially increase focus on correspondent access, front companies, exchange houses, and third-country institutions that may facilitate Iranian financial activity.
2. **Money Transmission and Cross-Border Laundering** — DOJ's Minnesota money-transmitter case highlights the need for agent oversight, corridor risk assessment, source-of-funds controls, and transaction monitoring for cartel-related laundering.
3. **Fraud Through Checks, Digital Assets, and Mule Networks** — The week's fraud cases involved stolen checks, Treasury-related instruments, investment schemes, BEC proceeds, shell or intermediary activity, and cross-border laundering.
4. **Cyber and Third-Party Technology Risk** — State-sponsored hacking and software supply-chain attacks reinforce the need for vendor security, threat intelligence, hardened access controls, and rapid incident response.

## Implications for Sponsor Banks and Fintech Programs

**Immediate Monitoring Considerations**

- Screen direct and indirect counterparties for newly designated Iran-related entities, facilitators, and 50-percent-owned entities; assess correspondent exposure to Banque Misr UAE.
- Review MSB, money-transmitter, and remittance partners for cartel typologies, unusual cash or cross-border activity, agent anomalies, and rapid funds movement to Mexico or other high-risk destinations.
- Strengthen check-fraud monitoring for stolen-mail typologies, high-value Treasury or business checks, newly opened accounts, and rapid withdrawals or transfers after deposit.
- Review third-party software and security vendors for supply-chain compromise risk, privileged access, code integrity, and downstream dependency exposure.

**Areas Requiring Elevated Attention**

- Correspondent and nested banking relationships
- Iran and sanctioned-network exposure
- Money transmitters and agent networks
- Cross-border remittance corridors
- High-value check and mail-theft fraud
- Digital-asset and investment-fraud businesses
- Business email compromise and mule activity
- Third-party software supply-chain security
- Employee misappropriation and privileged access

## No Material Actions Identified

The following regulators were reviewed and no material new enforcement actions meeting the digest criteria were identified: FDIC (separate enforcement action; joint supervisory rule noted above), CFPB, NCUA, SEC, NYDFS, California DFPI, and relevant U.S. State Banking Departments beyond the federal/state-related items identified above.

## Sources

| Regulator | Source |
| --- | --- |
| OCC | Aug. 27, 2026 - OCC Acts to Improve Transparency and Consistency to Bank Enforcement and Supervisory Standards; Bulletin 2026-40 and related OCC materials. https://occ.gov/news-issuances/news-releases/2026/nr-occ-2026-72.html · https://occ.gov/news-issuances/bulletins/2026/bulletin-2026-40.html |
| FDIC | Official FDIC news/enforcement sources reviewed; joint Aug. 27 OCC/FDIC supervisory rule reflected through OCC's official release. |
| CFPB | Official CFPB enforcement and newsroom sources reviewed; no qualifying material new weekly action identified. |
| FinCEN | Aug. 28, 2026 - Treasury/FinCEN proposed action concerning Banque Misr UAE correspondent banking access. https://home.treasury.gov/news/press-releases/iran-s-access-uae-banks-targeted-under-operation-economic-outcast/ |
| OFAC | Aug. 24, 2026 - Operation Economic Outcast (https://home.treasury.gov/news/press-releases/sb0613); Aug. 26, 2026 - counterterrorism designations (https://home.treasury.gov/news/press-releases/sb0616/); Aug. 28, 2026 - additional Iran-related financial facilitators. |
| Federal Reserve | Aug. 27, 2026 - Enforcement action with former employee of Banco Popular de Puerto Rico. https://www.federalreserve.gov/newsevents/pressreleases/enforcement20260827a.htm |
| NCUA | Official NCUA press releases and administrative orders reviewed; no qualifying material new weekly action identified. |
| SEC | Official SEC newsroom/enforcement sources reviewed; no qualifying material new enforcement action identified in the weekly period. |
| FTC | Aug. 27, 2026 - Final orders involving Cox Media Group, MindSift, and 1010 Digital Works over alleged "active listening" AI marketing representations. https://www.ftc.gov/news-events/news/press-releases |
| DOJ | Aug. 24-28, 2026 official DOJ/U.S. Attorney releases: Profit Connect conviction (https://www.justice.gov/usao-nv/pr/jury-convicts-las-vegas-business-owner-cryptocurrency-ponzi-scheme); Minnesota money-transmitter indictment (https://www.justice.gov/opa/pr/operator-minnesota-based-money-transmitter-charged-laundering-drug-proceeds-mexican-cartel-0); $24M stolen-check indictment (https://www.justice.gov/usao-sdtx/pr/postal-employees-charged-24m-stolen-check-scheme); PRC hacking-platform seizures (https://www.justice.gov/opa/pr/justice-department-and-fbi-seize-platforms-operated-and-used-china-state-sponsored-hackers); TeamPCP supply-chain indictment (https://www.justice.gov/usao-ndca/pr/australian-man-indicted-teampcp-cyberattacks-software-supply-chain); Baiyewu money-laundering sentencing (https://www.justice.gov/opa/pr/nigerian-national-sentenced-laundering-31m-scam-proceeds). |
| NYDFS | Official NYDFS enforcement/press release sources reviewed; no qualifying material new weekly action identified. |
| California DFPI | Official DFPI enforcement/press release sources reviewed; no qualifying material new weekly action identified. |
| Relevant U.S. State Banking Departments | Official state regulator sources reviewed where relevant; no additional qualifying material action identified. |

*Review period: August 24–31, 2026. Public release dates were used for weekly inclusion. Overlapping Treasury, FinCEN, OFAC, DOJ, and underlying-order announcements were deduplicated. Criminal allegations are described as allegations unless a conviction, plea, or sentence occurred. Counts are category counts and may overlap across risk areas.*
]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending August 24, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-august-24-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-august-24-2026</guid>
      <pubDate>Mon, 24 Aug 2026 00:00:00 GMT</pubDate>
      <description>Nine new enforcement actions this week, headlined by the FTC's $2.1M Doxo settlement, a DOJ bank-fraud scheme tied to merchant onboarding, and a Federal Reserve/Alabama written agreement with SouthPoint Bancshares.</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- 9 new material enforcement actions were identified in the reviewed weekly period, together with additional policy and enforcement-status updates.
- The highest fintech and sponsor-bank relevance arose from the FTC's $2.1 million Doxo bill-payment settlement, DOJ's bank-fraud case involving fake companies used to obtain merchant/payment-processing access, and the Federal Reserve/Alabama written agreement with SouthPoint Bancshares.
- Major risk areas included payment and billing deception, merchant onboarding circumvention, bank fraud, insider misappropriation, ATM malware, cybersecurity, capital adequacy, liquidity/cash-flow governance, and consumer fee practices.
- No new enforcement action directly targeted a sponsor-bank oversight program or BaaS arrangement. Doxo and the DOJ payment-processing case directly involved payments/financial technology activity.
- Additional material updates included the FTC's proposed personalized-pricing enforcement policy statement and OCC/Federal Reserve termination actions.

## Priority Watchlist

| Institution | Regulator | Date | Action | Severity |
| --- | --- | --- | --- | --- |
| Doxo, Inc. and two co-founders | FTC | Aug 17 | $2.1M settlement — deceptive bill-payment advertising and fees | High |
| SouthPoint Bancshares, Inc. | Federal Reserve / Alabama State Banking Department | Aug 20 | Written Agreement — capital, governance, safety & soundness | High |
| Thomas Emil Eide / CB Surety LLC | DOJ | Aug 21 | Guilty plea — bank fraud conspiracy, merchant onboarding | High |
| Juan Manuel Gouveia-Aguilera | DOJ | Aug 21 | 96-month sentence — ATM jackpotting / bank fraud / cyber | High |
| Kendrick Lamont Fugett | DOJ | Aug 20 | Federal criminal complaint — Treasury check fraud / identity theft | High |
| Mabna Institute defendants (17 Iranian nationals) | DOJ | Aug 18 | Superseding indictment — cyber intrusion / IRGC-linked activity | High |

## New Enforcement Actions This Week

### 01 — Consumer Compliance / Payments
#### Doxo, Inc. and Co-Founders Steve Shivers and Roger Parks
**Date:** August 17, 2026 · **Regulator:** FTC · **Type:** Settlement

**Key Findings**

- Doxo agreed to pay $2.1 million to settle FTC allegations involving misleading search advertising and representations that allegedly caused consumers to believe Doxo was an official bill-payment channel.
- The FTC alleged that Doxo added delivery fees that were not clearly disclosed and deceptively enrolled consumers in a recurring subscription program.
- The action directly concerns a third-party online bill-payment platform used for utility, auto-loan, and other consumer payments.

**Why It Matters**

This action is directly relevant to payment fintechs, merchant/payment intermediaries, and financial institutions that support bill-payment platforms. Controls should address advertising transparency, billing disclosures, recurring enrollment, complaint patterns, and clarity regarding whether a fintech is acting as an official or third-party payment channel.

**Fintech Monitoring Relevance:** High

### 02 — Consumer Compliance / Fees
#### Manchester City Nissan and Related Respondents
**Date:** August 19, 2026 · **Regulator:** FTC / State of Connecticut · **Type:** Settlement

**Key Findings**

- The FTC and Connecticut secured a $4 million settlement resolving allegations that the dealership systematically deceived consumers regarding certified used-car prices, add-ons, and government fees.
- The allegations included unwanted or unauthorized add-on charges and other deceptive pricing practices.
- The settlement is relevant to financing and payment programs that support auto dealers and other high-risk merchants with material consumer-fee exposure.

**Why It Matters**

Banks and fintechs supporting dealer financing, payments, or merchant acquiring should monitor complaint, refund, pricing, and add-on practices where deceptive merchant conduct could create regulatory or reputational exposure.

**Fintech Monitoring Relevance:** Medium

### 03 — Governance / Capital / Safety and Soundness
#### SouthPoint Bancshares, Inc.
**Date:** August 20, 2026 release; Written Agreement dated August 14, 2026 · **Regulator:** Federal Reserve / Alabama State Banking Department · **Type:** Written Agreement

**Key Findings**

- The Federal Reserve and Alabama State Banking Department entered into a Written Agreement with SouthPoint Bancshares after an offsite review identified deficiencies at the holding company.
- The agreement requires SouthPoint to serve as a source of financial and managerial strength to SouthPoint Bank, submit a capital plan and cash-flow projections, and maintain capital contingency planning.
- SouthPoint is restricted from dividends, share repurchases, other capital distributions, and additional debt without prior supervisory approval.

**Why It Matters**

The action underscores holding-company responsibility for subsidiary-bank condition, capital planning, liquidity and cash-flow governance, and remediation of existing bank-level supervisory actions. Sponsor-bank programs should consider whether fintech-related growth or operational exposures are reflected in capital and contingency planning.

**Fintech Monitoring Relevance:** High

### 04 — Fraud / Insider Misappropriation
#### Stephanie R. Kilbert, Former Regions Bank Employee
**Date:** August 20, 2026 release; prohibition effective August 12, 2026 · **Regulator:** Federal Reserve · **Type:** Prohibition Order

**Key Findings**

- The Federal Reserve issued a consent prohibition against a former Regions Bank relationship banker.
- The order states that she misappropriated $23,902 from a customer's account in a series of transactions during 2024.
- The conduct was characterized as violations of law or regulation, unsafe or unsound banking practices, or breaches of fiduciary duty involving personal dishonesty or disregard for safety and soundness.

**Why It Matters**

The action reinforces employee-fraud controls, customer-account monitoring, segregation of duties, transaction review, and escalation of unusual employee activity.

**Fintech Monitoring Relevance:** Low

### 05 — Fraud / Insider Misappropriation
#### Crystal A. Wykle, Former United Community Bank Employee
**Date:** August 20, 2026 release; prohibition effective August 12, 2026 · **Regulator:** Federal Reserve · **Type:** Prohibition Order

**Key Findings**

- The Federal Reserve issued a consent prohibition against a former United Community Bank teller.
- The order states that she misappropriated $26,917 from a customer's business accounts by skimming cash from bulk deposits and placing funds in her own savings account.
- The order notes that she was convicted of larceny in July 2025 in connection with the conduct.

**Why It Matters**

The matter is relevant to teller controls, cash-deposit reconciliation, employee account surveillance, and insider-fraud monitoring.

**Fintech Monitoring Relevance:** Low

### 06 — Information Security / Cybersecurity
#### Mabna Institute — 17 Iranian Defendants
**Date:** August 18, 2026 · **Regulator:** DOJ · **Type:** Superseding Indictment

**Key Findings**

- DOJ unsealed a superseding indictment charging 17 members of the Iran-based Mabna Institute in connection with a large-scale cyber intrusion campaign.
- DOJ alleged targeting of universities, private-sector companies, government agencies, and NGOs, with theft of more than 31 terabytes of academic data and intellectual property.
- DOJ stated that portions of the activity were conducted for the benefit of the Iranian government and IRGC; charges include computer intrusion and wire-fraud-related offenses.

**Why It Matters**

The action highlights state-linked phishing, password spraying, credential compromise, data exfiltration, and cyber-enabled fraud. Banks and fintechs should maintain controls for phishing-resistant authentication, privileged access, credential monitoring, and incident response.

**Fintech Monitoring Relevance:** Medium

### 07 — Bank Fraud / Payment Processing
#### Thomas Emil Eide / CB Surety LLC
**Date:** August 21, 2026 · **Regulator:** DOJ · **Type:** Guilty Plea

**Key Findings**

- Eide pleaded guilty to bank fraud conspiracy involving fake companies used to defraud banks and enable merchant clients to obtain and use accounts they otherwise could not open.
- DOJ stated that straw owners were recruited to open accounts for fake companies and that fake websites and contact information were used to deceive banks.
- The scheme allowed merchant clients to gain access to payment-processing capabilities through accounts opened under false business identities.

**Why It Matters**

This case is directly relevant to sponsor banks, merchant acquirers, payment processors, and fintech onboarding. Controls should validate business identity, beneficial ownership, websites, contact data, expected activity, and post-onboarding changes in account use.

**Fintech Monitoring Relevance:** High

### 08 — Cyber / ATM Fraud
#### Juan Manuel Gouveia-Aguilera
**Date:** August 21, 2026 release; sentenced August 20, 2026 · **Regulator:** DOJ · **Type:** Criminal Sentencing

**Key Findings**

- A Venezuelan national was sentenced to 96 months in prison for his role in ATM "jackpotting."
- The court attributed more than $3.5 million in losses to the defendant's conduct.
- The convictions included conspiracy to commit bank fraud, bank burglary, and computer fraud involving malware used to cause ATMs to dispense cash.

**Why It Matters**

The case highlights endpoint and ATM security, malware detection, cash-out monitoring, physical/logical access controls, and rapid fraud response for banks and payment networks.

**Fintech Monitoring Relevance:** High

### 09 — Bank Fraud / Identity Theft
#### Kendrick Lamont Fugett
**Date:** August 20, 2026 · **Regulator:** DOJ · **Type:** Criminal Complaint / Arrest

**Key Findings**

- DOJ announced the arrest of a defendant charged with bank fraud and aggravated identity theft.
- The complaint alleges use of stolen identities and fake identification to deposit more than $15 million in U.S. Treasury checks intended for businesses.
- The alleged scheme involved impersonating corporate officers, fabricating documents, and manipulating banks to obtain Treasury funds.

**Why It Matters**

The matter is relevant to business-account authentication, check fraud, corporate identity verification, large-item review, Treasury-check controls, and cross-institution fraud detection.

**Fintech Monitoring Relevance:** Medium

## Enforcement Actions by Risk Category

**BSA/AML & Sanctions** — DOJ (August 18, 2026): The Mabna Institute superseding indictment concerns IRGC-linked cyber activity and wire-fraud-related conduct. No separate new OFAC enforcement action was identified in the weekly review.

**Consumer Compliance** — FTC (August 17, 2026): Doxo agreed to a $2.1 million settlement over alleged deceptive bill-payment advertising, fee disclosures, and recurring subscription enrollment. FTC / Connecticut (August 19, 2026): Manchester City Nissan and related respondents agreed to a $4 million settlement over alleged deceptive pricing, add-ons, and fees.

**Operational Risk & Fraud** — Federal Reserve (August 20, 2026): Two former bank employees were prohibited from banking after customer-fund misappropriation findings. DOJ (August 21, 2026): Thomas Eide pleaded guilty in a fake-company scheme used to obtain bank accounts and payment-processing access. DOJ (August 21, 2026): ATM jackpotting defendant sentenced to 96 months; losses exceeded $3.5 million. DOJ (August 20, 2026): Treasury-check fraud complaint alleges more than $15 million in checks deposited using stolen identities and fabricated documents.

**Information Security & Cybersecurity** — DOJ (August 18, 2026): Superseding indictment charged 17 Mabna Institute defendants in an alleged state-linked cyber theft campaign. DOJ (August 21, 2026): ATM jackpotting sentencing involved malware used to compromise ATM systems.

**Third-Party Risk / Fintech Partnerships** — FTC (August 17, 2026): Doxo is a third-party online bill-payment platform; the settlement is directly relevant to payment fintechs and financial institutions supporting third-party payment channels. DOJ (August 21, 2026): Eide's scheme allegedly enabled merchants that could not obtain legitimate accounts to access payment-processing services through fake companies. No enforcement actions directly targeting sponsor-bank oversight programs or BaaS arrangements were identified this week.

**Governance & Risk Management** — Federal Reserve / Alabama State Banking Department (August 20, 2026): SouthPoint Bancshares is subject to a Written Agreement requiring source-of-strength support, capital planning, cash-flow projections, capital conservation, and quarterly progress reporting.

**Financial / Capital / Liquidity Risk** — Federal Reserve / Alabama State Banking Department (August 20, 2026): SouthPoint must maintain an acceptable capital plan, assess capital sources and uses, plan for additional capital, maintain capital contingencies, and obtain approval before capital distributions or new debt.

## Key Regulatory Themes

1. **Payments and Merchant Transparency** — The Doxo settlement and Eide bank-fraud case emphasize transparency in payment channels and the need to prevent merchants from obtaining financial access through misleading identities or representations.

2. **Capital and Holding-Company Governance** — The SouthPoint action emphasizes source-of-strength obligations, capital adequacy, cash-flow planning, distribution restrictions, and supervisory remediation.

3. **Fraud and Insider-Control Effectiveness** — Federal Reserve prohibition orders and DOJ fraud cases highlight employee misconduct, stolen identities, fake businesses, Treasury checks, and large-value fraudulent transactions.

4. **Cyber-Enabled Financial and Operational Risk** — DOJ actions involving the Mabna Institute and ATM jackpotting reinforce phishing, credential theft, malware, endpoint security, and cyber-enabled financial loss risks.

## Implications for Sponsor Banks and Fintech Programs

**Immediate Monitoring Considerations**

- Review payment and merchant onboarding controls for fake companies, straw owners, misleading websites, false contact information, and merchants previously unable to obtain accounts.
- Confirm payment-platform disclosures clearly identify third-party status, fees, recurring subscriptions, cancellation terms, and payment-method restrictions.
- Review sponsor-bank capital, liquidity, and operational-risk reporting to ensure material fintech exposures and growth are incorporated into board and contingency planning.
- Strengthen monitoring for employee-originated account activity, large Treasury checks, ATM anomalies, credential compromise, and malware indicators.

**Areas Requiring Elevated Attention**

Merchant and business identity verification; payment-platform advertising and fee disclosure; recurring billing and subscription consent; capital and liquidity contingency planning; employee fraud and customer-account access; Treasury check and large-item fraud; ATM and endpoint malware; credential theft and phishing.

## No Material Actions Identified

The following regulators were reviewed and no material enforcement actions meeting the digest criteria were identified: FDIC, CFPB, FinCEN, NCUA, SEC, NYDFS, California DFPI, OFAC, and other relevant U.S. State Banking Departments, except the Alabama State Banking Department action noted above.

OCC issued an August 20, 2026 enforcement release terminating a prior Formal Agreement with First National Bank of Pasco. The termination was reviewed but is not counted as a new enforcement action. The Federal Reserve also announced termination of its 2017 Deutsche Bank cease-and-desist order; that termination is likewise excluded from the new-action count.

## Additional Material Regulatory Update

**FTC (August 19, 2026)** — The FTC requested public comment on a proposed enforcement policy statement regarding personalized pricing, described as the use of personal data to set prices according to individual consumer characteristics or behavior. This is a policy-development item and is not included in the new-enforcement-action count.

**OCC (August 19, 2026)** — Comptroller Gould discussed digital-asset innovation and OCC work following the GENIUS Act. The remarks were reviewed as a policy signal but are not treated as an enforcement or supervisory action in the metrics.

## Sources

| Regulator | Source |
| --- | --- |
| OCC | Aug. 20, 2026 — OCC Announces Enforcement Actions for August 2026; official OCC enforcement pages reviewed. |
| FDIC | Official FDIC press release and administrative enforcement sources reviewed; no qualifying material new weekly action identified. |
| CFPB | Official CFPB Enforcement Actions / Newsroom sources reviewed; no qualifying material new weekly action identified. |
| FinCEN | Official FinCEN news and enforcement release sources reviewed; no qualifying material new weekly action identified. |
| OFAC | Official Treasury / OFAC press and enforcement release sources reviewed; no qualifying material new weekly action identified. |
| Federal Reserve | Aug. 20, 2026 — SouthPoint Bancshares Written Agreement; prohibition orders involving former employees of Regions Bank and United Community Bank; Deutsche Bank termination announcement. |
| NCUA | Official NCUA press release / administrative order sources reviewed; no qualifying material new weekly action identified. |
| SEC | Official SEC newsroom, enforcement and rulemaking sources reviewed; no qualifying material new weekly enforcement action identified. |
| FTC | Aug. 17, 2026 — Doxo $2.1M settlement; Aug. 19, 2026 — Manchester City Nissan $4M settlement; Aug. 19, 2026 — proposed enforcement policy statement regarding personalized pricing. |
| DOJ | Aug. 18–21, 2026 official DOJ and U.S. Attorney releases covering Mabna Institute cyber charges, Treasury-check fraud, Thomas Eide bank-fraud plea, and ATM jackpotting sentencing. |
| NYDFS | Official NYDFS press release and enforcement sources reviewed; no qualifying material new weekly action identified. |
| California DFPI | Official DFPI press release / enforcement sources reviewed; no qualifying material new weekly action identified. |
| Relevant U.S. State Banking Departments | Alabama State Banking Department was a party to the SouthPoint Bancshares Written Agreement; other official state banking regulator releases reviewed where relevant. |

## Methodology

Review period: August 17–24, 2026, based on official releases available by the time of this report. Public-release dates are used for weekly inclusion when an underlying order was executed earlier. Overlapping releases and underlying orders were deduplicated.

Official regulator and U.S. government sources were prioritized. Criminal allegations are described as allegations unless a plea, conviction, or sentence occurred. Items were excluded where the source did not clearly support inclusion or where relevance to banking, fintech, payments, risk, or compliance was immaterial.
]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending August 17, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-august-17-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-august-17-2026</guid>
      <pubDate>Mon, 17 Aug 2026 00:00:00 GMT</pubDate>
      <description>FTC halts alleged $200M credit-repair scheme; no fintech, sponsor-bank, or BaaS-specific enforcement actions identified this week.</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- 1 new material enforcement action was identified from reviewed official regulator sources for the weekly period.
- The material action was the FTC's August 10, 2026 action temporarily halting an alleged credit-repair scheme involving a network of related companies and principals.
- Major risk areas involved consumer compliance, deceptive credit-repair practices, recurring billing, advance fees, creditor/debt-collector impersonation, and identity-theft reporting misuse.
- No new enforcement actions directly targeting fintech partnerships, sponsor-bank oversight programs, BaaS arrangements, payment processors, or digital asset firms were identified.
- No material BSA/AML, sanctions, cybersecurity, bank capital, liquidity, or bank supervisory enforcement action was identified in the reviewed sources for the weekly period.

## Priority Watchlist

| Institution | Regulator | Date | Action | Severity |
| --- | --- | --- | --- | --- |
| Credit-repair scheme operators (network of 17 related companies; principals not fully identified in reviewed source excerpt) | FTC | Aug 10 | Federal court temporarily halted alleged credit-repair scheme | High |

## New Enforcement Actions This Week

### 01 — Consumer Compliance / Fraud

#### Credit-Repair Scheme Operators (Network of 17 Related Companies)

**Date:** August 10, 2026 · **Regulator:** FTC · **Type:** Other - FTC Complaint / Temporary Court Halt

**Key Findings**

- The FTC announced that, at its request, a federal court temporarily halted an alleged credit-repair scheme run by a network of 17 related companies and principals.
- The FTC stated the scheme allegedly scammed consumers out of nearly $200 million.
- Supporting details reviewed for this digest include alleged advance fees, recurring charges without proper consent, impersonation of creditors or debt collectors, and misuse of identity-theft reporting processes.

**Why It Matters**

The action matters for financial institutions and fintech programs that provide payment processing, merchant services, recurring billing, credit-related services, lead generation, or consumer-data access. Monitoring should address deceptive merchant activity, unauthorized recurring charges, chargebacks, refund complaints, identity-theft-report misuse, and high-risk credit-repair merchants.

**Fintech Monitoring Relevance:** Medium

## Enforcement Actions by Risk Category

**BSA/AML & Sanctions**

No material actions identified this week.

**Consumer Compliance**

- FTC - August 10, 2026: Federal court temporarily halted an alleged credit-repair scheme. The FTC stated the action involved a network of related companies and principals and nearly $200 million in consumer harm.

**Operational Risk & Fraud**

- FTC - August 10, 2026: The matter is relevant to recurring billing controls, refund and complaint monitoring, creditor or debt-collector impersonation risk, and misuse of identity-theft reporting processes.

**Information Security & Cybersecurity**

No material actions identified this week.

**Third-Party Risk / Fintech Partnerships**

No enforcement actions directly targeting fintech partnerships, sponsor-bank programs, BaaS arrangements, payment processors, or embedded finance providers were identified this week.

**Governance & Risk Management**

No material actions identified this week.

**Financial / Capital / Liquidity Risk**

No material actions identified this week.

## Key Regulatory Themes

1. **Deceptive Credit-Repair Practices** — The FTC action focused on alleged false or deceptive credit-repair practices affecting financially vulnerable consumers.
2. **Recurring Billing and Advance-Fee Risk** — The matter highlights the need to monitor recurring-payment authorization, advance fees, cancellations, refunds, and related complaints for high-risk consumer-service merchants.
3. **Identity-Theft Process Misuse** — Alleged misuse of identity-theft reporting processes creates fraud, consumer harm, and data-integrity concerns for institutions supporting related payment flows.
4. **Limited Bank / Fintech-Specific Enforcement Activity** — Reviewed bank, fintech, BSA/AML, sanctions, cybersecurity, capital, and liquidity enforcement sources did not identify additional material actions for the weekly period.

## Implications for Sponsor Banks and Fintech Programs

**Immediate Monitoring Considerations**

- Review merchant and fintech portfolios for credit-repair, debt-relief, credit-counseling, and similar high-risk service providers.
- Monitor recurring-payment complaints, refund patterns, chargebacks, disputed authorizations, and negative-option billing practices.
- Assess whether onboarding and ongoing monitoring detect misleading advertising, creditor impersonation, identity-theft-report misuse, and servicemember targeting where applicable.

**Areas Requiring Elevated Attention**

- Credit-repair and debt-relief merchants
- Recurring billing and negative-option enrollment
- Unauthorized charges and refund complaints
- Identity-theft-report integrity
- Advertising and marketing representations
- Merchant and lead-generation monitoring

## No Material Actions Identified

The following regulators were reviewed and no material enforcement actions meeting the digest criteria were identified: OCC, FDIC, Federal Reserve, CFPB, FinCEN, DOJ, NCUA, SEC, NYDFS, California DFPI, OFAC, and relevant U.S. State Banking Departments.

## Sources

| Regulator | Source |
| --- | --- |
| OCC | Enforcement Actions / official OCC release links reviewed; latest available enforcement release in reviewed source was outside the weekly period. |
| FDIC | Administrative Enforcement Actions / official FDIC release links reviewed; no qualifying weekly action identified. |
| CFPB | Enforcement Actions / official CFPB release links reviewed; no qualifying weekly action identified. |
| FinCEN | Enforcement Releases / official FinCEN release links reviewed; no qualifying weekly action identified. |
| OFAC | Enforcement Actions / official OFAC and Treasury release links reviewed; no qualifying weekly sanctions/enforcement action identified. |
| Federal Reserve | Enforcement Actions / official Federal Reserve release links reviewed; no qualifying weekly action identified. |
| NCUA | Administrative Orders / official NCUA release links reviewed; no qualifying weekly action identified. |
| SEC | Enforcement Actions / official SEC release links reviewed; no qualifying weekly action identified. |
| FTC | August 10, 2026 - FTC Stops Sprawling Credit Repair Scheme that Scammed Consumers Out of Nearly $200 Million. |
| NYDFS | Enforcement Actions / official NYDFS release links reviewed; no qualifying weekly action identified. |
| California DFPI | Enforcement Actions / official DFPI release links reviewed; no qualifying weekly action identified. |
| Relevant U.S. State Banking Departments | Official state regulator release links reviewed, where relevant; no additional material weekly action identified. |

*Review period: August 10–17, 2026. Official regulator sources were prioritized. Overlapping items were deduplicated. Findings are limited to details supported by reviewed sources.*
]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending July 20, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-july-20-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-july-20-2026</guid>
      <pubDate>Mon, 20 Jul 2026 00:00:00 GMT</pubDate>
      <description>TD Bank Insider Sentencings, DOJ Cybercrime Indictment &amp; OFAC Iran Procurement Network</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- Identified **6 material enforcement or criminal regulatory actions**, including two DOJ bank-insider sentencings, a major DOJ cybercrime indictment, an OFAC sanctions action, and two FTC enforcement resolutions.
- The most significant bank-specific matter involved **two former TD Bank employees** — one who facilitated large-scale money laundering activity, and another who enabled account takeover fraud and false bank records.
- OFAC targeted an international procurement and financial network supporting Iran's weapons programs, reinforcing sanctions and counterparty-screening requirements.
- No new enforcement actions directly targeted sponsor-bank oversight programs or BaaS arrangements. However, new **U.S.–UK recommendations on stablecoins and digital assets** have direct relevance to payments and digital asset firms.
- Key regulatory themes: BSA/AML controls, insider risk, cybersecurity infrastructure, sanctions, credit underwriting, consumer advertising, and digital asset regulatory coordination.

## Priority Watchlist

| Institution | Regulator | Date | Action | Severity |
| --- | --- | --- | --- | --- |
| TD Bank former employees | DOJ | Jul 15 | Criminal sentencing — insider money laundering | High |
| Media Land, ML.Cloud & associates | DOJ | Jul 14 | Criminal indictment — cybercrime hosting | High |
| Iran-linked procurement network | OFAC | Jul 15 | Sanctions — weapons proliferation finance | High |
| U.S.–UK digital asset markets | Treasury / HM Treasury | Jul 14 | Joint regulatory recommendations | Medium |
| Non-work-authorized borrowers | OCC / FDIC / NCUA | Jul 13 | Interagency guidance — credit underwriting | Medium |
| Edwards Lifesciences / Genesis MedTech | FTC | Jul 13 | $12M settlement — pre-merger reporting | Low |

## New Enforcement Actions This Week

### 01 — BSA/AML / Insider Misconduct

#### Wilfredo Aquino & Edward Low / Former TD Bank Employees

**Date:** July 15, 2026 · **Regulator:** DOJ · **Type:** Criminal Sentencing

**Key Findings**

- Aquino, a former TD Bank assistant store manager, was sentenced to 46 months for facilitating a money laundering network.
- DOJ stated the network moved approximately $474 million through TD Bank accounts; Aquino processed roughly 1,680 official bank checks totaling more than $92 million.
- Edward Low was sentenced to 24 months for account takeover fraud, misuse of confidential customer information, and false bank records.

**Why It Matters**

Reinforces the need for insider-risk monitoring, CTR quality controls, employee transaction surveillance, and privileged access controls.

**Fintech Monitoring Relevance:** High

### 02 — Cybersecurity / Money Laundering

#### Media Land, ML.Cloud & Associated Russian Nationals

**Date:** July 14, 2026 · **Regulator:** DOJ · **Type:** Criminal Indictment

**Key Findings**

- DOJ unsealed an indictment against three Russian nationals and two "bulletproof hosting" companies.
- Defendants were charged with computer fraud, wire fraud, and conspiracy to commit money laundering.
- DOJ alleged the infrastructure supported cybercrime against U.S. victims resulting in more than $62 million in losses.

**Why It Matters**

Banks and fintechs should assess exposure to cybercrime infrastructure, suspicious hosting providers, ransomware-related activity, and cryptocurrency payment flows.

**Fintech Monitoring Relevance:** High

### 03 — Sanctions / Proliferation Finance

#### Iran-Linked Global Weapons Procurement Network

**Date:** July 15, 2026 · **Regulator:** OFAC · **Type:** Sanctions Designations

**Key Findings**

- OFAC targeted an international network involved in procuring weapons and related resources for Iran's Islamic Revolutionary Guard Corps.
- Treasury identified aviation and transport firms, financial conduits, procurement agents, and travel coordinators used to obscure procurement activity.
- The action was taken under authorities targeting weapons-of-mass-destruction proliferators and their supporters.

**Why It Matters**

Financial institutions, fintechs, payment companies, and cross-border programs should ensure sanctions lists are updated and assess exposure to intermediary companies, financial conduits, and complex international payment chains.

**Fintech Monitoring Relevance:** High

### 04 — Regulatory Compliance

#### Edwards Lifesciences Corp. and Genesis MedTech Group

**Date:** July 13, 2026 · **Regulator:** FTC · **Type:** Settlement / Civil Penalties

**Key Findings**

- The FTC secured $12 million in penalties over alleged violations of Hart-Scott-Rodino pre-merger reporting requirements.
- FTC alleged the parties structured a transaction to avoid mandatory federal antitrust review.
- The settlement included a $10 million penalty for Edwards-related parties, a $2 million penalty for Genesis, and additional prior-notice requirements.

**Why It Matters**

While not directly related to banking compliance, the action reinforces expectations that regulated companies should not structure transactions to circumvent regulatory reporting or approval requirements.

**Fintech Monitoring Relevance:** Low

### 05 — Consumer Compliance / Advertising

#### TruHeight / Vanilla Chip LLC and Principals

**Date:** July 15, 2026 · **Regulator:** FTC · **Type:** Final Order

**Key Findings**

- The FTC finalized an order addressing allegedly deceptive and unsupported product claims.
- The respondents must pay $750,000, with a $4 million judgment partially suspended based on ability to pay.
- The order prohibits false or unsupported claims and misrepresentations involving customer reviews, including fake or incentivized reviews.

**Why It Matters**

Reinforces regulatory expectations around substantiation of consumer-facing claims, testimonials, reviews, marketing governance, and disclosure of incentives.

**Fintech Monitoring Relevance:** Low

### 06 — Governance / Insider Risk

#### Former Federal Reserve Board Adviser

**Date:** July 15, 2026 · **Regulator:** DOJ · **Type:** Criminal Sentencing

**Key Findings**

- A former senior adviser to the Federal Reserve Board was sentenced to 38 months in federal prison.
- The matter involved misuse of sensitive information associated with the adviser's government role.
- The case highlights risks involving privileged information and trusted insiders.

**Why It Matters**

Reinforces expectations for confidential information controls, employee monitoring, privileged-access governance, and insider-risk management.

**Fintech Monitoring Relevance:** Medium
]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending July 13, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-july-13-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-july-13-2026</guid>
      <pubDate>Mon, 13 Jul 2026 00:00:00 GMT</pubDate>
      <description>Kentland Federal Savings Receivership &amp; DOJ Cybercrime Sentencings</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- 4 new enforcement or enforcement-related actions were identified: one OCC bank receivership, two DOJ cyber/cryptocurrency criminal matters, and one FTC warning-letter initiative.
- The OCC closed a critically undercapitalized federal savings association after finding substantial asset and earnings dissipation caused by unsafe and unsound practices.
- DOJ actions involved ransomware, Bitcoin ransom proceeds, cryptocurrency laundering, illicit mixing services, and attempted removal of forfeited digital assets.
- No new enforcement actions directly targeting sponsor-bank oversight programs, BaaS arrangements, payment processors, or embedded finance providers were identified.
- Key themes were capital adequacy, unsafe banking practices, ransomware controls, cryptocurrency tracing, fraud prevention, consumer advertising, and retail-investor protection.
]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending July 6, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-july-6-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-july-6-2026</guid>
      <pubDate>Mon, 06 Jul 2026 00:00:00 GMT</pubDate>
      <description>OFAC Sanctions Cartel Fuel-Smuggling &amp; Drug-Proceeds Networks</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- 6 material enforcement or sanctions actions were identified.
- 3 high-relevance BSA/AML or sanctions items were identified involving cartel fuel smuggling, terrorist financing, and drug-proceeds laundering.
- No new enforcement actions directly targeting sponsor-bank oversight, BaaS, embedded finance, payment processors, or digital asset firms were identified.
- Key themes were sanctions screening, illicit finance, consumer fee practices, misleading earnings claims, CRA transparency, and capital/remediation oversight.
]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending June 29, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-june-29-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-june-29-2026</guid>
      <pubDate>Mon, 29 Jun 2026 00:00:00 GMT</pubDate>
      <description>FinCEN Moves to Sever Huione Successor Entities from U.S. System</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- 8 material regulatory, supervisory, enforcement, or sanctions updates were identified.
- 5 new enforcement / sanctions actions were identified: 1 Federal Reserve enforcement action, 1 FDIC monthly enforcement publication, and 3 OFAC sanctions actions.
- 1 high-relevance BSA/AML action involved FinCEN's proposed rule to sever H-Pay Service PLC and Huione successor entities from the U.S. financial system.
- No new enforcement actions directly targeting sponsor-bank oversight programs, BaaS arrangements, or embedded finance providers were identified.
- Key themes were illicit finance, sanctions screening, cyber-enabled fraud, unsafe lending, regulatory data standards, complaint management, and market risk controls.
]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending June 22, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-june-22-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-june-22-2026</guid>
      <pubDate>Mon, 22 Jun 2026 00:00:00 GMT</pubDate>
      <description>GENIUS Act CIP Rule Proposed for Stablecoin Issuers</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- 6 material enforcement or supervisory updates were identified.
- 5 new enforcement / sanctions actions were identified: 2 OCC prohibition orders, 2 Federal Reserve prohibition actions, and 1 OFAC sanctions action.
- 1 action directly involved a bank insider money laundering matter.
- 1 rulemaking directly targeted permitted payment stablecoin issuers and BSA customer identification requirements.
- No new enforcement actions directly targeting sponsor-bank oversight programs, BaaS arrangements, or embedded finance providers were identified.
- Key themes were insider misconduct, BSA/AML and sanctions, stablecoin CIP obligations, governance, and operational controls.
]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending June 15, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-june-15-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-june-15-2026</guid>
      <pubDate>Mon, 15 Jun 2026 00:00:00 GMT</pubDate>
      <description>NYDFS Proposes Stablecoin Rule Aligned with GENIUS Act</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- Identified 6 material regulatory, supervisory, sanctions, or enforcement-related updates from the reviewed authorities for the week of June 8–15, 2026.
- No new OCC, FDIC, CFPB, FinCEN, or SEC enforcement actions meeting the digest criteria were identified for this week.
- Major risk areas: stablecoin supervision, sanctions screening, consumer mortgage relief fraud, regulatory data standards, payment-card fee authority, and credit union system risk.
- One item had direct fintech / digital asset relevance: NYDFS proposed stablecoin regulation issued June 9, 2026.
- One item had direct payments relevance: NCUA interim final rule on federal credit union non-interest charges and payment-card fees issued June 8, 2026.
- OFAC posted multiple sanctions list and general license updates during the week, requiring sanctions-screening list refresh and change management review.
]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending June 9, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-june-9-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-june-9-2026</guid>
      <pubDate>Tue, 09 Jun 2026 00:00:00 GMT</pubDate>
      <description>Material enforcement and supervisory items from OFAC, FinCEN, the federal banking agencies, SEC, and California DFPI for the week ending June 9, 2026 — including OFAC's designation of Iranian digital asset exchanges and a $4M DFPI penalty against Navitas Credit Corp.</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- New material enforcement or supervisory items were identified from **OFAC**, **FinCEN**, the **federal banking agencies**, **SEC**, and **California DFPI**.
- The highest fintech-relevant item was **OFAC's June 2 designation of Iranian digital asset exchanges**, including Nobitex, Wallex, Bitpin, and Ramzinex, for sanctions evasion, terror-finance, and IRGC-linked activity.
- FinCEN issued a **joint advisory** with the FDIC, OCC, NCUA, and IRS on detecting and reporting illicit activity related to non-work-authorized populations, including identity theft, payroll fraud, and misuse of the banking system.
- The OCC, FDIC, and Federal Reserve jointly removed additional references to **reputation risk** from interagency supervisory materials, reinforcing a shift toward material financial-risk-based supervision.
- California DFPI announced a **$4 million penalty against Navitas Credit Corp.** for unlicensed lending activity in California.
- No new material enforcement actions were identified this week from the CFPB, DOJ, FTC, NYDFS, or NCUA beyond participation in the FinCEN advisory.

## Weekly Metrics

| Metric | Count |
| --- | --- |
| Total New Enforcement Actions / Material Supervisory Updates | 6 |
| High Relevance to Fintech / Sponsor Banks | 3 |
| BSA/AML & Sanctions | 3 |
| Consumer Compliance | 1 |
| Governance & Risk Management | 1 |
| Fraud & Operational Risk | 2 |
| Information Security / Cybersecurity | 0 |
| Fintech / BaaS Specific Actions | 2 |

## Priority Watchlist

| Institution | Regulator | Action | Risk Area | Fintech/BaaS Relevance | Severity |
| --- | --- | --- | --- | --- | --- |
| Nobitex, Wallex, Bitpin, Ramzinex | OFAC | Sanctions designations | Sanctions, digital assets, terror finance | High: direct digital asset exchange activity | High |
| Iranian LPG / shadow banking network | OFAC | Sanctions designations | Sanctions evasion, foreign bank accounts, shell companies | Medium: sanctions-screening and correspondent-risk relevance | High |
| Financial institutions broadly | FinCEN / FDIC / OCC / NCUA / IRS | Joint advisory | Identity theft, payroll fraud, suspicious activity reporting | Medium: MSBs, banks, payroll processors, and fintech onboarding controls | Medium |
| Banks supervised by OCC, FDIC, Federal Reserve | OCC / FDIC / Federal Reserve | Supervisory guidance update | Governance, supervision, debanking, risk taxonomy | High: sponsor-bank and lawful-business access implications | Medium |
| Navitas Credit Corp. | California DFPI | $4 million penalty | Unlicensed lending, state licensing | Medium: fintech lending and state licensing controls | Medium |
| Financial institutions reporting to federal regulators | SEC and other agencies | Joint data standards final rule | Regulatory reporting, data quality | Low to Medium: future reporting-data modernization | Low |

## New Enforcement Actions This Week

### 1. Nobitex, Wallex, Bitpin, Ramzinex, and Related Individuals

**Regulator:** OFAC
**Action Type:** Sanctions Designation
**Risk Area:** Sanctions, digital assets, terror finance, ransomware-linked activity

**Key Findings**

- OFAC designated Nobitex, described by Treasury as Iran's largest digital asset exchange, along with Wallex, Bitpin, and Ramzinex.
- Treasury stated that Nobitex processed more than 50% of Iranian digital asset inflows in 2025 and facilitated activity tied to sanctions evasion, IRGC-linked transactions, and ransomware-linked actors.
- OFAC also designated Nobitex leadership and officials, including Amir Hossein Rad.

**Why It Matters**

- This is a high-priority digital asset sanctions action. Banks, sponsor banks, money transmitters, crypto firms, payment processors, and fintechs should review sanctions-screening, blockchain analytics, customer-risk-rating, and geolocation controls.

**Fintech Monitoring Relevance:** High

---

### 2. Iranian LPG Smuggling and Shadow Banking Network

**Regulator:** OFAC
**Action Type:** Sanctions Designation
**Risk Area:** Sanctions evasion, shadow banking, foreign bank accounts, front companies

**Key Findings**

- OFAC designated a network of individuals, entities, and vessels involved in shipping Iranian-origin LPG disguised as Omani LPG to South and East Asia.
- Treasury stated the network used UAE and China front companies, foreign bank accounts, and Iran's shadow fleet to move Iranian LPG while concealing its origin.
- OFAC also targeted an Iranian exchange house and leadership for moving foreign currency on behalf of sanctioned Iranian banks.

**Why It Matters**

- This action is relevant to sanctions screening, trade finance, correspondent banking, nested activity, shell-company detection, and payment-flow monitoring.

**Fintech Monitoring Relevance:** Medium

---

### 3. Joint Advisory on Illicit Activity Related to Non-Work-Authorized Populations

**Regulator:** FinCEN, with FDIC, OCC, NCUA, and IRS
**Action Type:** Advisory / Supervisory Update
**Risk Area:** BSA/AML, identity theft, payroll fraud, suspicious activity reporting

**Key Findings**

- FinCEN issued an advisory urging financial institutions to detect and report illicit activity linked to unlawful employment schemes.
- The advisory highlights identity theft, payroll fraud, misuse of Social Security numbers, and access to financial services through unlawfully obtained personal information.
- FinCEN stated that schemes can involve U.S. banks and may support transnational criminal activity, including drug trafficking and human trafficking.

**Why It Matters**

- Banks, fintechs, payroll platforms, MSBs, and sponsor-bank programs should consider whether onboarding, CIP, fraud-monitoring, payroll-processing, and SAR escalation controls identify these risk typologies.

**Fintech Monitoring Relevance:** Medium

---

### 4. Removal of Additional References to Reputation Risk

**Regulator:** OCC, FDIC, Federal Reserve
**Action Type:** Supervisory Guidance Update
**Risk Area:** Governance, supervision, risk taxonomy, debanking

**Key Findings**

- The federal banking agencies jointly updated interagency documents to remove references to reputation risk.
- The agencies stated that supervisory decisions should be based on material financial risks and that the updates are limited to removing reputation-risk references.
- The agencies stated they may continue reviewing supervisory materials for further updates.

**Why It Matters**

- Sponsor banks should ensure fintech, BaaS, payments, crypto, and higher-risk customer decisions are documented in terms of legal, compliance, credit, operational, BSA/AML, sanctions, and fraud risk rather than unsupported reputation-risk concepts.

**Fintech Monitoring Relevance:** High

---

### 5. Navitas Credit Corp.

**Regulator:** California DFPI
**Action Type:** Penalty / Enforcement Action
**Risk Area:** State licensing, consumer lending, unlicensed lending

**Key Findings**

- DFPI announced that it ordered Florida-based Navitas Credit Corp. to pay a $4 million penalty for unlicensed lending activity in California.
- The action is relevant to state licensing controls for nonbank lenders and fintech lending programs.

**Why It Matters**

- Banks and fintech lenders should review state lending-license determinations, exempt-bank partnership models, broker/lender role documentation, and state-law monitoring.

**Fintech Monitoring Relevance:** Medium

---

### 6. SEC Joint Data Standards Final Rule

**Regulator:** SEC, with other federal financial regulators
**Action Type:** Final Rule / Regulatory Update
**Risk Area:** Regulatory reporting, data standards, operational controls

**Key Findings**

- The SEC established joint data standards under the Financial Data Transparency Act of 2022.
- The standards are intended to promote interoperability of financial regulatory data across agencies using common identifiers for entities, locations, dates, products, and currencies.
- The SEC stated that the Federal Reserve, CFTC, CFPB, Treasury, FDIC, FHFA, NCUA, and OCC have established or are expected to act on the standards.

**Why It Matters**

- This is not an enforcement action, but it may affect future regulatory reporting, data lineage, system mapping, and machine-readable reporting obligations.

**Fintech Monitoring Relevance:** Low to Medium

## Enforcement Actions by Risk Category

### BSA/AML & Sanctions

- **OFAC – Iranian digital asset exchanges:** High-priority sanctions action involving digital asset exchanges, sanctions evasion, IRGC-linked activity, and ransomware-linked wallets.
- **OFAC – Iranian LPG and shadow banking network:** Sanctions action involving front companies, foreign bank accounts, and exchange-house activity on behalf of sanctioned Iranian banks.
- **FinCEN advisory:** BSA/AML advisory focused on identity theft, payroll fraud, and suspicious activity tied to unlawful employment schemes.

### Consumer Compliance

- **California DFPI – Navitas Credit Corp.:** $4 million penalty for unlicensed lending activity in California.

### Operational Risk & Fraud

- **FinCEN advisory:** Highlights identity theft, payroll fraud, tax evasion, and misuse of financial accounts.
- **DFPI – Navitas:** Indicates licensing and compliance-control failures in lending activity.

### Information Security & Cybersecurity

No material actions identified this week.

### Third-Party Risk / Fintech Partnerships

- **Federal banking agencies – reputation risk update:** Sponsor banks should ensure fintech and customer-access decisions are tied to documented material financial and compliance risks.
- **OFAC – digital asset exchanges:** Relevant to crypto partners, blockchain analytics vendors, payment partners, and sanctions-screening controls.

### Governance & Risk Management

- **OCC / FDIC / Federal Reserve:** Removal of reputation-risk references from interagency supervisory materials may affect board-level risk appetite, exit decisions, and supervisory documentation standards.
- **SEC:** Joint data standards may require stronger governance over regulatory data quality, identifiers, and reporting architecture.

### Financial / Capital / Liquidity Risk

No material actions identified this week.

## Key Regulatory Themes

1. **Sanctions Evasion Through Digital Assets** — OFAC's digital asset exchange designations reinforce expectations for sanctions screening beyond name matching, including wallet analytics, jurisdictional risk, and exposure to foreign exchanges.
2. **Shadow Banking and Front-Company Risk** — OFAC's Iran-related actions show continued focus on foreign exchange houses, shell companies, foreign bank accounts, and trade-based sanctions evasion.
3. **Identity Theft and Payroll Fraud Typologies** — FinCEN's advisory identifies identity theft and payroll fraud as key illicit-finance typologies requiring monitoring and SAR escalation.
4. **Supervisory Shift Away From Reputation Risk** — Federal banking agencies continue to remove reputation-risk references and emphasize material financial risks in supervisory decision-making.
5. **State Licensing Enforcement for Nonbank Lenders** — DFPI's Navitas action reinforces state-level scrutiny of lending authority, licensing coverage, and consumer-credit compliance.
6. **Regulatory Data Modernization** — The SEC's joint data standards final rule points toward increased use of common identifiers and machine-readable regulatory submissions.

## Implications for Sponsor Banks and Fintech Programs

### Immediate Monitoring Considerations

- Review OFAC screening for exposure to Nobitex, Wallex, Bitpin, Ramzinex, related individuals, and connected wallets or counterparties.
- Confirm crypto, MSB, money-transmission, and payment partners have controls for Iranian sanctions evasion, nested activity, and digital asset exposure.
- Evaluate whether onboarding and transaction monitoring identify payroll-fraud, identity-theft, and suspicious employment-related activity described in the FinCEN advisory.
- Update fintech and higher-risk customer exit documentation to anchor decisions in material financial, legal, compliance, operational, fraud, sanctions, or BSA/AML risks.
- Review state lending-license inventories and bank-partnership documentation for nonbank lending programs.
- Begin assessing regulatory data governance against emerging common-identifier and machine-readable reporting standards.

### Areas Requiring Elevated Attention

- Digital asset sanctions screening and blockchain analytics
- Payroll processor and employer-related fraud monitoring
- CIP / CDD controls for identity-theft indicators
- Money transmitter and MSB partner oversight
- State lending-license coverage
- Sponsor-bank customer exit and restriction documentation
- Regulatory data lineage, common identifiers, and reporting controls

## No Material Actions Identified

No material new enforcement actions or supervisory updates meeting the weekly digest criteria were identified from the following regulators during the review period:

- CFPB
- DOJ
- FTC
- NYDFS
- NCUA, other than participation in the FinCEN advisory
- OCC standalone enforcement actions
- FDIC standalone enforcement actions
- Federal Reserve standalone enforcement actions
- Relevant U.S. state banking departments other than California DFPI

## Sources

| Regulator | Source |
| --- | --- |
| OFAC / Treasury | OFAC designation of Iranian digital asset exchanges, including Nobitex, Wallex, Bitpin, and Ramzinex. |
| OFAC / Treasury | OFAC action targeting Iranian LPG smuggling and shadow banking networks. |
| FinCEN / Treasury | FinCEN advisory on detecting and reporting illicit activity related to non-work-authorized populations. |
| OCC / FDIC / Federal Reserve | Joint release removing additional references to reputation risk from interagency documents. |
| SEC | Final rule establishing joint data standards under the Financial Data Transparency Act of 2022. |
| SEC | Draft Strategic Plan, including digital asset, enforcement, and technology priorities. |
| California DFPI | Navitas Credit Corp. $4 million penalty for unlicensed lending. |
| FDIC | FDIC 2026 press release index reviewed; no standalone enforcement release identified during the review period. |]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending June 8, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-june-8-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-june-8-2026</guid>
      <pubDate>Mon, 08 Jun 2026 00:00:00 GMT</pubDate>
      <description>FDIC Publishes May Enforcement Actions; CFPB Consent Order on Overdraft Disclosures</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- The FDIC published its monthly list of May enforcement actions, and the CFPB issued a consent order addressing overdraft disclosure practices.
]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending June 1, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-june-1-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-june-1-2026</guid>
      <pubDate>Mon, 01 Jun 2026 00:00:00 GMT</pubDate>
      <description>OCC Prohibition Order Against Former Community Bank CFO</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- The OCC issued a prohibition order against a former community bank chief financial officer.
]]></content:encoded>
    </item>
    <item>
      <title>Weekly Enforcement Action Digest — Week Ending May 25, 2026</title>
      <link>https://acrossoversight.com/insights/weekly-enforcement-action-digest-may-25-2026</link>
      <guid isPermaLink="true">https://acrossoversight.com/insights/weekly-enforcement-action-digest-may-25-2026</guid>
      <pubDate>Mon, 25 May 2026 00:00:00 GMT</pubDate>
      <description>Federal Reserve Guidance on Third-Party Model Risk Management</description>
      <content:encoded><![CDATA[
## Executive Summary

**Key Takeaways This Week**

- The Federal Reserve issued guidance on third-party model risk management.
]]></content:encoded>
    </item>
  </channel>
</rss>
