Weekly Enforcement Action Digest
Executive Summary — Key Takeaways This Week
- OFAC sanctions exposed two different financial-crime channels: DPRK-linked fraudulent remote IT work and a Rwandan financial institution allegedly supporting an armed group.
- SEC actions alleged $200 million and $130 million investment schemes involving crypto-related claims, token economics and false regulatory filings; allegations are not findings of guilt.
- DOJ highlighted identity theft, benefit-disbursement fraud and money-mule networks with a cryptocurrency seizure, raising direct transaction-monitoring questions.
- FinCEN issued new cross-border MSB and nonprofit-related fraud guidance, while OFAC clarified blocked/rejected transaction reporting and FinCEN published updated FATF jurisdiction lists.
| Institution | Regulator | Date | Action | Severity |
|---|---|---|---|---|
| OFAC sanctions DPRK IT-worker fraud facilitators | OFAC | Oct 28 | Sanctions designations; identity fraud, cybersecurity | High |
| OFAC sanctions Zigama Credit and Savings Society and Rwandan Ministry of Defence | OFAC | Oct 28 | Sanctions designations; correspondent banking, conflict financing | High |
| SEC alleges $200 million DEBT Box crypto-asset offering fraud | SEC | Oct 28 (release Oct 29) | Civil complaint; proposed settlements; digital assets, investor fraud | High |
| SEC charges BG Wealth Sharing and DSJ Exchange over $130 million scheme | SEC | Oct 29 (release Oct 30) | Civil complaint; digital assets, consumer/investor fraud, false filings | High |
| OFAC settles with Extreme Networks for $1.53 million | OFAC | Oct 27 | Civil settlement; sanctions, export controls, third-party risk | High |
| DOJ announces nationwide ghost-student fraud indictments | DOJ | Oct 29 | Criminal indictments and seizure; identity theft, payment fraud, money mules | High |
| NCUA issues two conviction-based prohibitions | NCUA | Oct 30 | Prohibition notices; insider fraud, governance, operational risk | High |
| DOJ sentences HELOC loan-application fraud organizer | DOJ/EDNY | Oct 29 | Criminal sentencing; lending fraud, document integrity, third-party risk | Medium |
| SEC settled charges against Transparent Equity Entrepreneurs | SEC | Oct 29 (release Oct 30) | Settled civil charges; investor protection, governance, misrepresentation | Medium |
OFAC Sanctions DPRK IT-Worker Fraud Facilitators
- Treasury designated ten individuals and one entity for involvement in DPRK government-run IT-worker schemes targeting legitimate businesses, including U.S. employers.
- Treasury described the use of stolen identities, fabricated personas and fraudulent documents to obtain remote technology work and generate revenue for DPRK weapons programs.
- The announcement also described the risk that operatives exploit sensitive business data and seek extortion payments; the designation is a sanctions action, not a finding against affected employers.
- Control impact: rescreen personnel, contractors, payment beneficiaries and associated entities against current OFAC lists; review ownership and alias matching; examine identity verification, device access, payroll routing and subcontractor transparency for technology vendors and outsourced developers; test escalation of potential sanctions matches and suspicious payments, including payment changes after onboarding.
This is directly relevant to fintech software vendors, outsourced development teams and banks with technology supply chains. Sanctions exposure may arise through employment, procurement and payment channels rather than conventional customer onboarding.
OFAC Sanctions Zigama Credit and Savings Society and Rwandan Ministry of Defence
- OFAC designated the Rwandan Ministry of Defence and Zigama Credit and Savings Society for providing support connected to M23 and associated actors in eastern Democratic Republic of Congo.
- Treasury stated that Zigama facilitated military-related payments, including to counterparties in China and elsewhere, and transactions supporting M23 and its political wing.
- Treasury described tens of millions of dollars in transactions and links to movement of gold sourced from M23-controlled areas; these are Treasury allegations and designation findings.
- Control impact: update sanctions screening and examine direct or indirect correspondent, remittance and trade-finance exposure to newly designated parties; review beneficial ownership, intermediary banks, payment narratives and geographic risk for transactions involving eastern DRC and Rwanda; ensure procedures distinguish blocked property from rejected transactions and provide timely reporting to OFAC.
A designated financial institution presents direct exposure to banks, payment firms and MSBs through correspondent and intermediary channels. Geographic screening alone may miss transactions routed through third-country intermediaries.
SEC Alleges $200 Million DEBT Box Crypto-Asset Offering Fraud
- The SEC charged Blox Lending, Jason Anderson, Digital Licensing and two principals over an alleged offering fraud that raised at least $200 million from more than 100,000 investors worldwide.
- The SEC alleged that DEBT Box tokens were marketed as linked to real-world revenue-generating projects, with buy-and-burn mechanisms said to support token values.
- According to the complaint, more than $101 million of investor funds was used to buy or burn tokens instead of genuine project revenues, creating alleged Ponzi-like payments.
- Some defendants consented to proposed judgments without admitting the allegations; court approval and unresolved claims should not be described as final findings.
- Control impact: for digital-asset customers, test source-of-funds claims, reserve or revenue representations, and the consistency of wallet flows with the stated business model; examine concentration of payments to affiliates and whether investor proceeds are used to sustain purported returns; ensure onboarding evidence independently verifies underlying commercial projects and associated third parties.
The case illustrates how token economics and claims about real-world assets can obscure circular use of investor funds. Sponsor banks serving crypto-related firms should distinguish independent economic activity from issuer-controlled liquidity support.
SEC Charges BG Wealth Sharing and DSJ Exchange Over $130 Million Scheme
- The SEC alleged that BG Wealth Sharing and DSJ Exchange raised more than $130 million from tens of thousands of retail investors across over 40 U.S. states and territories.
- The entities allegedly promoted risk-free, extraordinary returns from purported AI-generated signals for crypto trading and falsely described their registration and licensing status.
- The complaint says false Form ADV and Form D submissions were publicly visible and shown to investors as supposed proof of SEC approval; the SEC said neither entity was registered.
- The SEC seeks injunctions, disgorgement and civil penalties; the allegations have not been adjudicated.
- Control impact: verify regulatory registrations against authoritative databases and do not treat a filing alone as proof of authorization or regulatory approval; for merchants and fintech clients marketing investments, assess claims of guaranteed returns, use of AI, trading execution and custody arrangements; monitor customer complaints, payment concentration, rapid inbound funding and cross-border transfers linked to retail-investment schemes.
The case is relevant to payment processors, banks and crypto platforms that provide access to entities presenting misleading regulatory credentials. Verification should focus on actual authorization and economic activity, not screenshots or self-reported filings.
OFAC Settles with Extreme Networks for $1.53 Million
- OFAC announced a $1,529,685 settlement with Extreme Networks, a U.S. cloud networking provider, concerning nine apparent exports of equipment and services to a Russian defense manufacturer.
- The recipient was described as blocked by operation of law because it was majority-owned by a designated company.
- The conduct occurred between September 2018 and March 2022; OFAC characterized the apparent violations as egregious and voluntarily self-disclosed.
- Control impact: test screening for ownership-based blocking, including the OFAC 50 Percent Rule, rather than relying exclusively on named-list matches; review distributor and end-user due diligence for hardware, software, cloud and support services delivered through intermediaries; confirm escalation, voluntary-disclosure and record-retention procedures for potential sanctions violations.
The settlement underscores that sanctions compliance extends to technology services and indirect ownership. Fintech and banking technology vendors may face similar exposure through reseller, service and cross-border delivery models.
DOJ Announces Nationwide Ghost-Student Fraud Indictments
- DOJ announced charges against five defendants in Operation Ghostbusters, involving alleged use of stolen identities to create fraudulent federal student aid accounts and enroll nonexistent students.
- The government said disbursement refunds were routed to accounts controlled by foreign actors, aided by U.S.-based money mules.
- DOJ announced seizure of more than $750,000 in cryptocurrency linked to the investigation; the FBI cited more than $32 million in losses across similar schemes.
- The defendants are presumed innocent unless proven guilty; broader loss estimates should not be presented as adjudicated losses attributable to the five defendants.
- Control impact: monitor rapid receipt and onward movement of student-aid or benefit-related funds, particularly where accounts show little other legitimate activity; test identity controls for synthetic or stolen identities and detect multiple beneficiaries sharing devices, addresses or payment endpoints; review cash-out pathways to virtual assets and cross-border counterparties, including mule-account indicators.
This matter is highly relevant to fintech account providers, BaaS banks and payment platforms supporting benefit disbursements. It illustrates the need to link identity risk with transaction behavior after account opening.
NCUA Issues Two Conviction-Based Prohibitions
- NCUA announced permanent prohibitions against Haley Snodgrass, formerly of Doches Credit Union, and Ian Moore, formerly of Heartland Credit Union.
- NCUA identified prior federal convictions and sentences involving credit-union theft, embezzlement or misapplication; the Moore matter also involved bank fraud.
- The prohibitions bar the individuals from participating in the affairs of federally insured depository institutions.
- Control impact: review employee background checks and applicable prohibition screening for institution-affiliated roles; test segregation of duties, privileged transaction access and independent reconciliation of staff-initiated adjustments; evaluate how employee misconduct is escalated to risk management, internal audit and board oversight.
Although the notices are institution-specific, they reinforce the value of insider-fraud controls in banks, credit unions and fintech operations with access to customer funds.
DOJ Sentences HELOC Loan-Application Fraud Organizer
- Seung Y. Lee was sentenced to 33 months in prison after pleading guilty to conspiracy to commit wire fraud and bank fraud.
- DOJ said his business submitted or caused the submission of hundreds of fraudulent home-equity line-of-credit applications over seven years.
- The court ordered forfeiture of $841,549.50 in criminal profits.
- Control impact: validate income, property and borrower information independently of loan brokers and other introducers; use anomaly detection for repeated brokers, similar supporting documents and unusual application clusters; review compensation incentives and quality assurance for third-party origination channels.
The sentencing highlights fraud exposure from intermediary-originated applications. Bank and fintech lenders should not rely solely on attestations from high-volume third-party originators.
SEC Settled Charges Against Transparent Equity Entrepreneurs
- The SEC filed settled charges against Bran Crudden and Transparent Equity Entrepreneurs over an alleged investment scheme involving a day-trading fund and pre-IPO investments.
- The complaint described more than $645,000 raised from approximately 23 retail investors between March 2021 and at least March 2026.
- The defendants consented to judgments that would impose approximately $910,577 in monetary relief; distinguish proposed relief from amounts actually paid.
- Control impact: for customers raising investor funds, validate business purpose, marketing claims and the destination of subscriptions; escalate activity inconsistent with disclosed investment strategy or investor-protection controls.
This narrower case reinforces diligence around investment intermediaries and the risks of treating small investor pools as low-risk without examining the underlying activity.
Separate Regulatory, Supervisory and Policy Developments (Not Counted as Enforcement)
October 30 — FinCEN: FATF jurisdiction update. FinCEN reported that FATF removed Bulgaria, Côte d'Ivoire, the Democratic Republic of Congo and Monaco from increased monitoring. Iran, DPRK and Burma remained subject to calls for action; Iran and DPRK remain subject to countermeasures and Burma to enhanced due diligence. Institutions should review jurisdiction-risk matrices and correspondent/MSB-agent risk controls, while recognizing that delisting does not automatically eliminate customer-level risk.
October 30 — FinCEN: foreign-agent-directed MSB transactions and nonprofit misuse. FinCEN issued an alert concerning suspicious cross-border payments involving U.S. MSBs and a notice addressing abuse of charities and nonprofits. This is a new detection/reporting reference, not a new enforcement penalty. Review transaction-monitoring scenarios for high-risk foreign agents, anomalous charity disbursements and links among common beneficiaries or intermediaries.
October 26 — OFAC: updated blocking, rejecting and reporting FAQs. OFAC amended FAQs on blocking, rejecting, customer inquiries and filing reports. Updated guidance describes reporting blocked property and rejected transactions through ORS within ten business days and distinguishes a payment instruction from a general customer inquiry. Confirm workflow decision trees, escalation, evidence capture and reporting timeliness; do not confuse a rejected payment with blocked property.
October 29 — OFAC: amended Iran-related general license. OFAC posted an amended Iran-related general license. Before changing controls, compliance teams should examine the specific authorization, covered activities and conditions rather than assuming a broad sanctions relaxation.
October 27 — NCUA: 2027–2028 proposed budget. NCUA released its proposed budget and announced a November 17 public hearing. This is an agency operations development rather than a change to institution-specific compliance obligations.
Four Key Regulatory Themes
- Sanctions risks now span employment, outsourcing, technology exports, ownership-based blocking and correspondent payment chains.
- Fraudulent regulatory credentials and claims about crypto-linked investment returns remain material onboarding and transaction-monitoring red flags.
- Identity theft and mule accounts can convert public benefit payments into cross-border or virtual-asset transfers after apparently routine onboarding.
- Regulatory updates require operational interpretation: list changes, FATF risk revisions and OFAC reporting FAQs should translate into documented procedure and rule reviews.
Implications for Sponsor Banks and Fintech Programs
Immediate Monitoring Actions
- Refresh sanctions screening with October 28 designations; document list ingestion, false-positive disposition and ownership-based match handling.
- Run targeted transaction reviews for foreign-agent-directed MSB transfers, benefit-related refunds and charity/nonprofit flows using available customer and counterparty data.
- Review high-risk crypto or investment-platform customers for unsupported registration claims, circular transfers and investor-funded token repurchases.
- Check third-party developer and vendor access for identity anomalies, unexplained subcontracting and payments to unrelated overseas beneficiaries.
Control Areas to Review
- Sanctions operations: blocked versus rejected classification, ORS reporting within ten business days, ownership aggregation and audit trails.
- BSA/AML: risk-based jurisdiction updates following FATF changes, correspondent banking due diligence and MSB agent monitoring.
- Fraud and customer onboarding: stolen/synthetic identity indicators, mule-network clustering, broker document validation and adverse event escalation.
- Third-party risk: contract developer identity checks, intermediary and distributor screening, access rights and periodic re-verification.
- Governance: policy ownership, independent quality assurance, control-test evidence and management reporting on remediation completion.
No Material Actions Identified
Within the selected official-source review for October 26–November 1, no separately verified material new actions were included from OCC, FDIC, Federal Reserve Board, CFPB, FTC, NYDFS or California DFPI. This is a qualified statement about the reviewed releases, not an exhaustive certification that these authorities took no action. NCUA and SEC actions, DOJ criminal matters, OFAC designations/settlement and FinCEN guidance are covered above.
Appendix: Sources Reviewed
- OFAC, DPRK IT worker sanctions, Oct 28 — https://home.treasury.gov/news/press-releases/sb0669
- OFAC, Zigama/Rwanda designations, Oct 28 — https://home.treasury.gov/news/press-releases/sb0668
- SEC, DEBT Box complaint, Oct 29 — https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26678
- SEC, BG Wealth/DSJ complaint, Oct 30 — https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26679
- OFAC, Extreme Networks settlement, Oct 27 — https://ofac.treasury.gov/recent-actions/20261027
- DOJ, Operation Ghostbusters, Oct 29 — https://www.justice.gov/opa/pr/justice-department-unveils-indictments-nationwide-ghost-student-fraud-scam-linked-kenyan
- NCUA, two prohibitions, Oct 30 — https://ncua.gov/newsroom/press-release/2026/ncua-prohibits-two-individuals-participating-affairs-any-federally-insured-depository-institution-october-2026
- DOJ, HELOC fraud sentencing, Oct 29 — https://www.justice.gov/usao-edny/pr/new-jersey-businessman-sentenced-33-months-prison-bank-fraud-scheme
- SEC, Transparent Equity, Oct 30 — https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26680
- FinCEN, FATF update, Oct 30 — https://www.fincen.gov/news/news-releases/financial-action-task-force-identifies-jurisdictions-anti-money-laundering-6
- FinCEN, fraud prevention alert, Oct 30 — https://www.fincen.gov/news/news-releases/fincen-issues-alert-and-notice-support-new-fraud-prevention-measures-minnesota
- OFAC, FAQ updates, Oct 26 — https://ofac.treasury.gov/faqs/updated/2026-10-26
- OFAC, recent actions index — https://ofac.treasury.gov/recent-actions
- NCUA, press releases — https://ncua.gov/news/press-releases
- OCC, news releases — https://www.occ.gov/news-events/newsroom/news-issuances/news-releases/2026/index-2026-news-releases.html
- FDIC, news releases — https://www.fdic.gov/news/press-releases
- Federal Reserve, enforcement actions — https://www.federalreserve.gov/supervisionreg/enforcementactions.htm
- CFPB, newsroom — https://www.consumerfinance.gov/about-us/newsroom/
- FTC, press releases — https://www.ftc.gov/news-events/news/press-releases
- NYDFS, press releases — https://www.dfs.ny.gov/reports_and_publications/press_releases
- California DFPI, news — https://dfpi.ca.gov/news/
Methodology: reviewed official regulator publications dated October 26–November 1, 2026; consolidated overlapping references; separated regulatory guidance from enforcement. Financial amounts are those stated by regulators and are not independently audited. This digest is for monitoring and does not constitute legal advice.