Weekly Enforcement Action Digest
Executive Summary — Key Takeaways This Week
- 8 material new enforcement or formal legal actions were identified during the September 8-14 review period, together with four material FinCEN supervisory/BSA updates.
- The most direct payments-sector action was the FTC's Humboldt Merchant Services settlement: $12 million and a permanent ban on processing for merchants with heightened fraud risk after allegations involving more than 1,000 sham merchant entities.
- Digital asset, sanctions, and cyber-enabled fraud remained prominent. Treasury and DOJ jointly acted against Xinbi Guarantee, while DOJ restrained approximately $52 million in cryptocurrency linked to scam laundering and OFAC sanctioned Xinbi and two operational enablers.
- Iran-related sanctions activity accelerated through OFAC's September 8 aviation-sector action, September 10 proxy-network designations, and a separate $1.427 million OFAC settlement for 39 apparent Iran-sanctions violations.
- No material new enforcement action directly targeted a sponsor-bank oversight program or BaaS arrangement this week. However, payment processor due diligence, merchant monitoring, sanctions screening, digital-asset tracing, fraud controls, and CIP processes remain directly relevant.
| Institution | Regulator | Date | Action | Severity |
|---|---|---|---|---|
| Humboldt Merchant Services | FTC | Sep 8 | $12M settlement; high-risk merchant processing ban | High |
| Xinbi Guarantee and enablers | OFAC / DOJ | Sep 9 | Sanctions; platform seizure; ~$52M crypto restrained | High |
| Iran aviation-sector network | OFAC / FinCEN | Sep 8 | 36 sanctions targets; FinCEN alert | High |
| Iran proxy-support networks | OFAC | Sep 10 | Designations supporting KH and Hizballah | High |
| Former Linqto executives | DOJ | Sep 8 | Charges in alleged $450M fraud scheme | High |
| U.S. Person-1 | OFAC | Sep 10 | $1.427M Iran-sanctions settlement | Medium |
| Sergei Filimonov | DOJ | Sep 8 | Extradition and arraignment | Medium |
| Paul W. Jorgensen | SEC | Sep 10 | Final consent judgment for insider trading | Medium |
Humboldt Merchant Services
- Humboldt Merchant Services agreed to pay $12 million and accepted permanent restrictions on processing for merchants with heightened fraud risk.
- The FTC alleged that Humboldt processed payments for more than 1,000 merchant entities that were shell or pass-through companies used by fraudulent businesses, including unauthorized billing operations.
- The matter directly addresses processor responsibility for merchant underwriting, monitoring, and continued processing where merchant structure or activity indicates fraud risk.
This is the week's clearest payment-sector enforcement signal. It reinforces that payment processors and their banking partners can face material exposure when merchant due diligence and ongoing monitoring fail to identify or stop sham merchants.
Xinbi Guarantee and Operational Enablers
- OFAC sanctioned Xinbi Guarantee, a Chinese-language illicit marketplace supporting cyber scams, fraud, money laundering, and related criminal activity, plus two entities supporting its operations.
- Treasury stated that Xinbi's marketplace processed more than $24 billion in digital assets and fiat currency since approximately 2022.
- In a coordinated action, DOJ seized Xinbi infrastructure and restrained approximately $52 million in cryptocurrency linked to scam money laundering; DOJ said the Scam Center Strike Force had restrained approximately $938 million in total.
The coordinated action links sanctions screening, fraud detection, cyber risk, and digital-asset AML. Banks and fintechs supporting fiat-crypto flows should treat scam-center infrastructure and associated wallets as an elevated transaction-monitoring risk.
Iran Aviation-Sector Network
- OFAC sanctioned 36 entities and individuals supporting Iran's aviation sector, including remaining active Iranian airlines and third-country facilitators.
- Treasury stated the targeted networks supported movement of weapons, personnel, illicit cargo, and procurement of U.S.-origin aircraft and sensitive technology.
- FinCEN simultaneously issued an alert to help financial institutions identify and report procurement networks supporting Iran's aviation industry.
The action broadens Iran-related sanctions exposure into aviation, logistics, procurement, and intermediary payment networks. Financial institutions should assess indirect exposure through third parties and cross-border payment chains.
Iran Proxy-Support Networks
- OFAC designated entities and individuals supporting Kata'ib Hizballah and Lebanese Hizballah across Iraq, Lebanon, the United Arab Emirates, and Turkiye.
- Treasury stated the targeted networks supported terrorist proxies and sanctions-evasion schemes tied to Iran.
- OFAC also updated its Iran Statement of Licensing Policy to a presumption of denial except in limited circumstances.
The action increases sanctions and terrorist-financing risk for cross-border banking and payments involving Iran-linked networks and third-country facilitators.
Former Linqto Executives
- DOJ announced charges against William Sarris, founder of pre-IPO investment platform Linqto, and stated that Joseph Endoso pleaded guilty in connection with an alleged $450 million fraud scheme.
- The charges include securities fraud, broker-dealer fraud, wire fraud, and conspiracy-related allegations.
- The matter concerns a technology-enabled investment platform rather than a sponsor-bank or BaaS arrangement.
The matter is relevant to fintech counterparty due diligence because it highlights governance, licensing, customer-funds, and representation risks in technology-enabled investment platforms.
U.S. Person-1 — Iran Sanctions Settlement
- A U.S. person agreed to pay $1,427,230 to settle potential civil liability for 39 apparent violations of Iran-related sanctions.
- OFAC stated the conduct included providing management consulting services to an Iranian software company, receiving Iranian-origin dividends to U.S. bank accounts, and acquiring real property in Iran.
- OFAC determined the apparent violations were egregious and not voluntarily self-disclosed.
The settlement illustrates how indirect payment routing through third-country banks can still create U.S. sanctions exposure and reinforces source-of-funds and sanctions-investigation controls.
Sergei Anatolyevich Filimonov — Bank Account Takeover Scheme
- DOJ announced the extradition and arraignment of a Russian national allegedly involved in a transnational bank-account takeover scheme causing millions of dollars in losses.
- The alleged scheme used spoofed domains mimicking federally insured financial institutions and sponsored search-engine links to direct customers to credential-harvesting pages.
- The September 8 announcement concerns procedural advancement of a case previously indicted in November 2025; the allegations remain unproven.
This case is relevant to financial institutions because it highlights the operational link between brand impersonation, credential theft, customer account takeover, and downstream payment fraud.
Paul W. Jorgensen
- A federal court entered a final judgment by consent against the former Chief Revenue Officer of Doximity in an SEC insider-trading case.
- The SEC alleged trading ahead of two negative earnings announcements, with approximately $2.53 million in avoided losses and profits.
- The defendant previously pleaded guilty in a parallel criminal case and was sentenced in May 2026.
The action has limited direct sponsor-bank relevance but is useful for governance assessments of public fintech and technology counterparties.
Material Regulatory and Supervisory Updates
FinCEN — Verifiable Digital Credentials under CIP (September 8, 2026) FinCEN issued new and updated FAQs addressing state-issued mobile driver's licenses and other government-issued verifiable digital credentials under the Customer Identification Program rule. Depository institutions should review how digital identity credentials are accepted, validated, and documented in CIP procedures.
FinCEN — Iran Aviation Procurement Alert (September 8, 2026) FinCEN issued FIN-2026-Alert006 to assist financial institutions in identifying and reporting procurement networks supporting Iran's aviation industry. FinCEN's SAR key-term page identifies FIN-2026-IRANAIR as the requested term for relevant filings.
FinCEN — Health Care Fraud Financial Trend Analysis (September 9, 2026) FinCEN identified approximately $17.5 billion in suspicious financial activity potentially linked to health care fraud. The update is relevant to transaction monitoring, suspicious activity investigations, and financial institutions serving health care providers or payment flows.
FinCEN — Iran-Related Whistleblower Bulletin (September 10, 2026) FinCEN issued a whistleblower bulletin seeking information about BSA or sanctions violations involving Iran, including activity by proxies and facilitators outside Iran. The bulletin states that qualifying information may support whistleblower awards.
Key Regulatory Themes
- Payment processor accountability — The Humboldt matter places merchant underwriting and downstream monitoring at the center of payment-processor enforcement risk.
- Cyber-enabled fraud and digital asset laundering — The coordinated Xinbi action shows continued use of sanctions, seizures, blockchain tracing, and infrastructure disruption against scam-center ecosystems.
- Iran-related sanctions expansion — OFAC and FinCEN activity this week expanded sanctions, alerts, enforcement, and whistleblower activity involving aviation, proxy networks, third-country facilitators, and Iranian-origin funds.
- Fraud and governance in technology-enabled financial platforms — The Linqto and Jorgensen matters reinforce governance, licensing, customer representation, and executive-conduct risks relevant to financial and technology counterparties.
Implications for Sponsor Banks and Fintech Programs
Immediate Monitoring Actions
- Review payment processor and payfac merchant-monitoring controls against the Humboldt allegations, especially shell merchants, pass-through structures, high fraud rates, unauthorized billing, and merchant cycling.
- Refresh OFAC screening and transaction-monitoring rules for the September 8-10 Iran-related and Xinbi designations, including associated entities, wallets, intermediaries, and third-country routing.
- Incorporate FinCEN's September 8 Iran aviation alert and September 9 health care fraud trend analysis into relevant AML investigation procedures and analyst guidance.
- Review bank and fintech brand-protection processes for spoofed domains, paid-search abuse, credential harvesting, and customer account takeover.
- For investment or marketplace fintech counterparties, reassess licensing, governance, customer-funds, financial representations, and executive conduct where applicable.
Control Areas to Review
- Merchant underwriting and downstream merchant monitoring
- Sanctions screening and 50-percent-rule ownership analysis
- Digital asset wallet and scam-center transaction monitoring
- Cross-border source-of-funds and third-country payment routing
- CIP procedures for verifiable digital credentials
- Phishing, brand impersonation, and account takeover controls
- Fintech licensing, governance, and customer-funds safeguards
No Material Actions Identified
The following regulators were reviewed and no material new enforcement actions meeting the digest criteria were identified during the September 8-14 review period: OCC, FDIC, Federal Reserve, CFPB, NCUA, NYDFS, California DFPI, and other relevant U.S. State Banking Departments.
Appendix: Sources Reviewed
| Regulator | Official source / item reviewed |
|---|---|
| FTC | Humboldt Merchant Services case and September 8 press release; case updated September 11. |
| OFAC / Treasury | Xinbi Guarantee sanctions — September 9. |
| DOJ | Scam Center Strike Force / Xinbi seizures — September 9. |
| OFAC / Treasury | Iran aviation-sector sanctions — September 8. |
| OFAC / Treasury | Operation Economic Outcast proxy-network sanctions — September 10. |
| OFAC | Iran-related civil settlement — September 10. |
| FinCEN | Iran aviation procurement alert — September 8. |
| FinCEN | Health care fraud FTA — September 9. |
| FinCEN | Iran-related whistleblower bulletin — September 10. |
| FinCEN | September 8 CIP / verifiable digital credentials guidance. |
| DOJ | Bank account takeover extradition — September 8. |
| DOJ | Linqto alleged $450M fraud charges — September 8. |
| SEC | Paul W. Jorgensen final consent judgment — September 10. |
| OCC | Official OCC news and enforcement sources reviewed; no qualifying new material action identified. |
| FDIC | Official FDIC news and administrative enforcement sources reviewed; no qualifying new material action identified. |
| Federal Reserve | Official Federal Reserve enforcement sources reviewed; no qualifying new material action identified. |
| CFPB | Official CFPB newsroom and enforcement sources reviewed; no qualifying new material action identified. |
| NCUA | Official NCUA newsroom and administrative order sources reviewed; no qualifying new material action identified. |
| NYDFS | Official NYDFS press release and enforcement sources reviewed; no qualifying new material action identified. |
| California DFPI | Official DFPI press release and enforcement sources reviewed; no qualifying new material action identified. |
| Relevant U.S. State Banking Departments | Official state regulator sources reviewed where relevant; no additional qualifying material action identified. |
Review period: September 8 through September 14, 2026. Public release/action dates are used for weekly inclusion. Coordinated OFAC/DOJ Xinbi actions are deduplicated as one matter for the enforcement count.
Methodology: Official regulator and U.S. government sources were prioritized. Allegations are described as allegations unless a plea, judgment, settlement, or sentence occurred. Regulatory guidance and trend analyses are presented separately from the enforcement-action count.