Weekly Enforcement Action Digest
Executive Summary — Key Takeaways This Week
- 9 new material enforcement actions were identified in the reviewed weekly period, together with additional policy and enforcement-status updates.
- The highest fintech and sponsor-bank relevance arose from the FTC's $2.1 million Doxo bill-payment settlement, DOJ's bank-fraud case involving fake companies used to obtain merchant/payment-processing access, and the Federal Reserve/Alabama written agreement with SouthPoint Bancshares.
- Major risk areas included payment and billing deception, merchant onboarding circumvention, bank fraud, insider misappropriation, ATM malware, cybersecurity, capital adequacy, liquidity/cash-flow governance, and consumer fee practices.
- No new enforcement action directly targeted a sponsor-bank oversight program or BaaS arrangement. Doxo and the DOJ payment-processing case directly involved payments/financial technology activity.
- Additional material updates included the FTC's proposed personalized-pricing enforcement policy statement and OCC/Federal Reserve termination actions.
| Institution | Regulator | Date | Action | Severity |
|---|---|---|---|---|
| Doxo, Inc. and two co-founders | FTC | Aug 17 | $2.1M settlement — deceptive bill-payment advertising and fees | High |
| SouthPoint Bancshares, Inc. | Federal Reserve / Alabama State Banking Department | Aug 20 | Written Agreement — capital, governance, safety & soundness | High |
| Thomas Emil Eide / CB Surety LLC | DOJ | Aug 21 | Guilty plea — bank fraud conspiracy, merchant onboarding | High |
| Juan Manuel Gouveia-Aguilera | DOJ | Aug 21 | 96-month sentence — ATM jackpotting / bank fraud / cyber | High |
| Kendrick Lamont Fugett | DOJ | Aug 20 | Federal criminal complaint — Treasury check fraud / identity theft | High |
| Mabna Institute defendants (17 Iranian nationals) | DOJ | Aug 18 | Superseding indictment — cyber intrusion / IRGC-linked activity | High |
Doxo, Inc. and Co-Founders Steve Shivers and Roger Parks
- Doxo agreed to pay $2.1 million to settle FTC allegations involving misleading search advertising and representations that allegedly caused consumers to believe Doxo was an official bill-payment channel.
- The FTC alleged that Doxo added delivery fees that were not clearly disclosed and deceptively enrolled consumers in a recurring subscription program.
- The action directly concerns a third-party online bill-payment platform used for utility, auto-loan, and other consumer payments.
This action is directly relevant to payment fintechs, merchant/payment intermediaries, and financial institutions that support bill-payment platforms. Controls should address advertising transparency, billing disclosures, recurring enrollment, complaint patterns, and clarity regarding whether a fintech is acting as an official or third-party payment channel.
Manchester City Nissan and Related Respondents
- The FTC and Connecticut secured a $4 million settlement resolving allegations that the dealership systematically deceived consumers regarding certified used-car prices, add-ons, and government fees.
- The allegations included unwanted or unauthorized add-on charges and other deceptive pricing practices.
- The settlement is relevant to financing and payment programs that support auto dealers and other high-risk merchants with material consumer-fee exposure.
Banks and fintechs supporting dealer financing, payments, or merchant acquiring should monitor complaint, refund, pricing, and add-on practices where deceptive merchant conduct could create regulatory or reputational exposure.
SouthPoint Bancshares, Inc.
- The Federal Reserve and Alabama State Banking Department entered into a Written Agreement with SouthPoint Bancshares after an offsite review identified deficiencies at the holding company.
- The agreement requires SouthPoint to serve as a source of financial and managerial strength to SouthPoint Bank, submit a capital plan and cash-flow projections, and maintain capital contingency planning.
- SouthPoint is restricted from dividends, share repurchases, other capital distributions, and additional debt without prior supervisory approval.
The action underscores holding-company responsibility for subsidiary-bank condition, capital planning, liquidity and cash-flow governance, and remediation of existing bank-level supervisory actions. Sponsor-bank programs should consider whether fintech-related growth or operational exposures are reflected in capital and contingency planning.
Stephanie R. Kilbert, Former Regions Bank Employee
- The Federal Reserve issued a consent prohibition against a former Regions Bank relationship banker.
- The order states that she misappropriated $23,902 from a customer's account in a series of transactions during 2024.
- The conduct was characterized as violations of law or regulation, unsafe or unsound banking practices, or breaches of fiduciary duty involving personal dishonesty or disregard for safety and soundness.
The action reinforces employee-fraud controls, customer-account monitoring, segregation of duties, transaction review, and escalation of unusual employee activity.
Crystal A. Wykle, Former United Community Bank Employee
- The Federal Reserve issued a consent prohibition against a former United Community Bank teller.
- The order states that she misappropriated $26,917 from a customer's business accounts by skimming cash from bulk deposits and placing funds in her own savings account.
- The order notes that she was convicted of larceny in July 2025 in connection with the conduct.
The matter is relevant to teller controls, cash-deposit reconciliation, employee account surveillance, and insider-fraud monitoring.
Mabna Institute — 17 Iranian Defendants
- DOJ unsealed a superseding indictment charging 17 members of the Iran-based Mabna Institute in connection with a large-scale cyber intrusion campaign.
- DOJ alleged targeting of universities, private-sector companies, government agencies, and NGOs, with theft of more than 31 terabytes of academic data and intellectual property.
- DOJ stated that portions of the activity were conducted for the benefit of the Iranian government and IRGC; charges include computer intrusion and wire-fraud-related offenses.
The action highlights state-linked phishing, password spraying, credential compromise, data exfiltration, and cyber-enabled fraud. Banks and fintechs should maintain controls for phishing-resistant authentication, privileged access, credential monitoring, and incident response.
Thomas Emil Eide / CB Surety LLC
- Eide pleaded guilty to bank fraud conspiracy involving fake companies used to defraud banks and enable merchant clients to obtain and use accounts they otherwise could not open.
- DOJ stated that straw owners were recruited to open accounts for fake companies and that fake websites and contact information were used to deceive banks.
- The scheme allowed merchant clients to gain access to payment-processing capabilities through accounts opened under false business identities.
This case is directly relevant to sponsor banks, merchant acquirers, payment processors, and fintech onboarding. Controls should validate business identity, beneficial ownership, websites, contact data, expected activity, and post-onboarding changes in account use.
Juan Manuel Gouveia-Aguilera
- A Venezuelan national was sentenced to 96 months in prison for his role in ATM "jackpotting."
- The court attributed more than $3.5 million in losses to the defendant's conduct.
- The convictions included conspiracy to commit bank fraud, bank burglary, and computer fraud involving malware used to cause ATMs to dispense cash.
The case highlights endpoint and ATM security, malware detection, cash-out monitoring, physical/logical access controls, and rapid fraud response for banks and payment networks.
Kendrick Lamont Fugett
- DOJ announced the arrest of a defendant charged with bank fraud and aggravated identity theft.
- The complaint alleges use of stolen identities and fake identification to deposit more than $15 million in U.S. Treasury checks intended for businesses.
- The alleged scheme involved impersonating corporate officers, fabricating documents, and manipulating banks to obtain Treasury funds.
The matter is relevant to business-account authentication, check fraud, corporate identity verification, large-item review, Treasury-check controls, and cross-institution fraud detection.
Key Regulatory Themes
-
Payments and Merchant Transparency — The Doxo settlement and Eide bank-fraud case emphasize transparency in payment channels and the need to prevent merchants from obtaining financial access through misleading identities or representations.
-
Capital and Holding-Company Governance — The SouthPoint action emphasizes source-of-strength obligations, capital adequacy, cash-flow planning, distribution restrictions, and supervisory remediation.
-
Fraud and Insider-Control Effectiveness — Federal Reserve prohibition orders and DOJ fraud cases highlight employee misconduct, stolen identities, fake businesses, Treasury checks, and large-value fraudulent transactions.
-
Cyber-Enabled Financial and Operational Risk — DOJ actions involving the Mabna Institute and ATM jackpotting reinforce phishing, credential theft, malware, endpoint security, and cyber-enabled financial loss risks.
Implications for Sponsor Banks and Fintech Programs
Immediate Monitoring Considerations
- Review payment and merchant onboarding controls for fake companies, straw owners, misleading websites, false contact information, and merchants previously unable to obtain accounts.
- Confirm payment-platform disclosures clearly identify third-party status, fees, recurring subscriptions, cancellation terms, and payment-method restrictions.
- Review sponsor-bank capital, liquidity, and operational-risk reporting to ensure material fintech exposures and growth are incorporated into board and contingency planning.
- Strengthen monitoring for employee-originated account activity, large Treasury checks, ATM anomalies, credential compromise, and malware indicators.
Areas Requiring Elevated Attention
Merchant and business identity verification; payment-platform advertising and fee disclosure; recurring billing and subscription consent; capital and liquidity contingency planning; employee fraud and customer-account access; Treasury check and large-item fraud; ATM and endpoint malware; credential theft and phishing.
No Material Actions Identified
The following regulators were reviewed and no material enforcement actions meeting the digest criteria were identified: FDIC, CFPB, FinCEN, NCUA, SEC, NYDFS, California DFPI, OFAC, and other relevant U.S. State Banking Departments, except the Alabama State Banking Department action noted above.
OCC issued an August 20, 2026 enforcement release terminating a prior Formal Agreement with First National Bank of Pasco. The termination was reviewed but is not counted as a new enforcement action. The Federal Reserve also announced termination of its 2017 Deutsche Bank cease-and-desist order; that termination is likewise excluded from the new-action count.
Additional Material Regulatory Update
FTC (August 19, 2026) — The FTC requested public comment on a proposed enforcement policy statement regarding personalized pricing, described as the use of personal data to set prices according to individual consumer characteristics or behavior. This is a policy-development item and is not included in the new-enforcement-action count.
OCC (August 19, 2026) — Comptroller Gould discussed digital-asset innovation and OCC work following the GENIUS Act. The remarks were reviewed as a policy signal but are not treated as an enforcement or supervisory action in the metrics.
Sources
| Regulator | Source |
|---|---|
| OCC | Aug. 20, 2026 — OCC Announces Enforcement Actions for August 2026; official OCC enforcement pages reviewed. |
| FDIC | Official FDIC press release and administrative enforcement sources reviewed; no qualifying material new weekly action identified. |
| CFPB | Official CFPB Enforcement Actions / Newsroom sources reviewed; no qualifying material new weekly action identified. |
| FinCEN | Official FinCEN news and enforcement release sources reviewed; no qualifying material new weekly action identified. |
| OFAC | Official Treasury / OFAC press and enforcement release sources reviewed; no qualifying material new weekly action identified. |
| Federal Reserve | Aug. 20, 2026 — SouthPoint Bancshares Written Agreement; prohibition orders involving former employees of Regions Bank and United Community Bank; Deutsche Bank termination announcement. |
| NCUA | Official NCUA press release / administrative order sources reviewed; no qualifying material new weekly action identified. |
| SEC | Official SEC newsroom, enforcement and rulemaking sources reviewed; no qualifying material new weekly enforcement action identified. |
| FTC | Aug. 17, 2026 — Doxo $2.1M settlement; Aug. 19, 2026 — Manchester City Nissan $4M settlement; Aug. 19, 2026 — proposed enforcement policy statement regarding personalized pricing. |
| DOJ | Aug. 18–21, 2026 official DOJ and U.S. Attorney releases covering Mabna Institute cyber charges, Treasury-check fraud, Thomas Eide bank-fraud plea, and ATM jackpotting sentencing. |
| NYDFS | Official NYDFS press release and enforcement sources reviewed; no qualifying material new weekly action identified. |
| California DFPI | Official DFPI press release / enforcement sources reviewed; no qualifying material new weekly action identified. |
| Relevant U.S. State Banking Departments | Alabama State Banking Department was a party to the SouthPoint Bancshares Written Agreement; other official state banking regulator releases reviewed where relevant. |
Methodology
Review period: August 17–24, 2026, based on official releases available by the time of this report. Public-release dates are used for weekly inclusion when an underlying order was executed earlier. Overlapping releases and underlying orders were deduplicated.
Official regulator and U.S. government sources were prioritized. Criminal allegations are described as allegations unless a plea, conviction, or sentence occurred. Items were excluded where the source did not clearly support inclusion or where relevance to banking, fintech, payments, risk, or compliance was immaterial.