Insights/Weekly Enforcement Digest
Weekly Enforcement Action Digest
Week Ending: September 21, 2026 · Across Regulatory Intelligence
Regulators covered: OFAC, FTC, DOJ, Federal Reserve, OCC, SEC, FinCEN
10
New Actions
3
Fintech / Payments / Digital Asset Impact
1
BSA/AML & Sanctions
8
Governance & Risk Management
Executive Summary — Key Takeaways This Week
- 10 material new enforcement actions were identified for the September 15-21 review period, counting individual bank-employee prohibition orders separately and coordinated matters once.
- The most relevant fintech and payments developments were OFAC's designation of Iranian digital asset exchange BitBank, the FTC's $100 million FleetCor/Corpay fuel-card settlement, and DOJ charges against two Robinhood employees involving crypto-linked perpetual futures.
- Major risk themes were sanctions and digital assets, payment-product fee transparency, insider/employee misconduct, customer-funds misuse, fraud, and governance.
- No material new action directly targeted a sponsor-bank oversight program or BaaS arrangement during the review period.
- FinCEN also held a September 16 public-private exchange with global financial institutions focused on Iranian revenue streams and procurement networks; this is treated as a supervisory/AML update rather than an enforcement action.
Priority Watchlist
| Institution | Regulator | Date | Action | Severity |
|---|---|---|---|---|
| BitBank, Pishtaz Simorgh & associates | OFAC | Sep 17 | Sanctions designations tied to Iranian digital-asset infrastructure | High |
| FleetCor / Corpay and Ronald Clarke | FTC | Sep 17 | $100M proposed settlement over fuel-card fee practices | High |
| Hefu Chai & Huaisong Xiang (Robinhood employees) | DOJ | Sep 15 | Criminal charges over misuse of confidential crypto-listing information | High |
| Three former bank / AmEx employees | Federal Reserve | Sep 18 | Consent prohibition orders for funds misuse, conflicts, and check fraud | High |
| Zena Montejano & Jorge Troncoso | OCC | Sep 17 | Prohibition orders for embezzlement and unauthorized customer debits | High |
| Ellen Polcari | SEC | Sep 18 | Civil fraud complaint over alleged investor-fund misappropriation | Medium |
| Jon P. Kipp | SEC | Sep 15 | Settled insider-trading action | Medium |
New Enforcement Actions This Week
01 — Sanctions / Digital Assets
BitBank, Pishtaz Simorgh Electronic Trade Company, and Associates
Date: September 17, 2026Regulator: OFACType: Sanctions Designations
Key Findings
- OFAC designated BitBank, its developer Pishtaz Simorgh Electronic Trade Company, and three associates of OFAC-designated Iranian financier Babak Zanjani.
- Treasury described the targets as key components of Iranian digital-asset sanctions-evasion infrastructure, part of Operation Economic Outcast.
- Recommended controls: refresh sanctions lists, aliases, ownership links, and wallet intelligence; review crypto transaction monitoring for exposure to Iranian digital-asset infrastructure; escalate indirect exposure through exchanges, payment intermediaries, and third-country counterparties.
Why It Matters
This is directly relevant to digital-asset firms, banks, and fintechs facilitating crypto-to-fiat activity, and to sanctions-screening programs.
Fintech Monitoring RelevanceHigh
02 — Consumer Compliance / Payment Products
FleetCor Technologies / Corpay and Ronald Clarke
Date: September 17, 2026Regulator: FTCType: Proposed Administrative Settlement
Key Findings
- FleetCor, now Corpay, and its CEO agreed to pay $100 million to resolve an FTC administrative action.
- The FTC alleged undisclosed and unauthorized fees connected with fuel cards, and misrepresentations regarding savings, fraud controls, and fees. The proposed settlement follows prior federal-court findings and would provide redress to affected business customers.
- Recommended controls: review fee authorization, disclosure, billing, and change-management controls for commercial payment products; validate that fraud-control and savings claims are supportable; ensure product, legal, compliance, billing, and customer-service processes identify and remediate unauthorized charges.
Why It Matters
The action is relevant to fintech payment products because it connects product representations, fee governance, billing controls, and customer consent to material enforcement exposure.
Fintech Monitoring RelevanceHigh
03 — Digital Assets / Employee Misconduct
Hefu Chai and Huaisong Xiang — Robinhood Employees
Date: September 15, 2026Regulator: DOJType: Criminal Charges
Key Findings
- DOJ charged two Robinhood engineers with commodities fraud and wire fraud.
- The government alleges they misappropriated confidential business information about forthcoming Robinhood Crypto token listings and traded perpetual futures on Hyperliquid before public announcements; each allegedly earned more than $50,000. The charges are accusations and the defendants are presumed innocent.
- Recommended controls: review employee access to listing, launch, pricing, and other market-sensitive information; apply surveillance and conflict-of-interest controls to employee trading where crypto or derivatives activity may create misuse risk; maintain access logging, segregation of duties, confidentiality controls, and investigation procedures for material nonpublic information.
Why It Matters
The case is directly relevant to digital-asset fintech governance and demonstrates employee-conduct risk around token listings and decentralized derivatives markets.
Fintech Monitoring RelevanceHigh
04 — Employee Misconduct / Customer Funds
Charles Alan Wright — Former Northstar Bank Employee
Date: September 18, 2026Regulator: Federal ReserveType: Consent Prohibition Order
Key Findings
- The Federal Reserve announced a consent prohibition order against a former Northstar Bank employee for misappropriation of customer funds.
- Recommended controls: review employee access to customer funds and exception activity; maintain transaction surveillance and escalation for employee-linked transfers; ensure investigation and disciplinary processes address insider misuse.
Why It Matters
The action reinforces insider-fraud and customer-funds controls at supervised institutions.
Fintech Monitoring RelevanceMedium
05 — Employee Misconduct / Conflicts
Stephanie K. Hudders — Former American Express Travel Related Services Employee
Date: September 18, 2026Regulator: Federal ReserveType: Consent Prohibition Order
Key Findings
- The Federal Reserve announced a consent prohibition order for misapplication of funds and conflicts of interest.
- Recommended controls: review conflict-of-interest attestations and employee transaction controls; monitor privileged access and employee-linked account activity; maintain independent escalation and investigation channels.
Why It Matters
The action is relevant to payment and financial-services firms because it combines funds misuse with conflicts-of-interest risk.
Fintech Monitoring RelevanceMedium
06 — Check Fraud / Employee Misconduct
Elvisha White — Former Regions Bank Employee
Date: September 18, 2026Regulator: Federal ReserveType: Consent Prohibition Order
Key Findings
- The Federal Reserve announced a consent prohibition order against a former Regions Bank employee for check fraud.
- Recommended controls: review teller and employee check controls; monitor override, exception, and employee-linked check activity; maintain maker-checker and fraud escalation procedures.
Why It Matters
The order highlights insider-fraud risk in routine payment operations.
Fintech Monitoring RelevanceMedium
07 — Embezzlement / Employee Misconduct
Zena Montejano — Former U.S. Bank Employee
Date: September 17, 2026Regulator: OCCType: Order of Prohibition
Key Findings
- The OCC prohibited a former U.S. Bank contact-center personal banker after finding embezzlement of approximately $329,088 from the bank.
- Recommended controls: review remote/contact-center employee access and transaction authority; monitor employee-linked adjustments, transfers, and unusual account activity; maintain periodic access reviews and strong privileged-action logging.
Why It Matters
The matter is relevant to operational controls for remote banking and customer-service functions.
Fintech Monitoring RelevanceMedium
08 — Unauthorized Customer Debits
Jorge Troncoso — Former PNC Bank Employee
Date: September 17, 2026Regulator: OCCType: Order of Prohibition
Key Findings
- The OCC prohibited a former PNC branch banker for unauthorized debits from multiple customer accounts; the bank suffered a loss of at least $74,550.
- Recommended controls: review branch employee transaction authority and customer-debit controls; monitor unauthorized debit patterns and employee-linked activity; ensure customer complaint and restitution processes trigger internal fraud review.
Why It Matters
The action reinforces controls around employee-initiated customer-account activity.
Fintech Monitoring RelevanceMedium
09 — Investor Funds / Fraud
Ellen Polcari
Date: September 18, 2026Regulator: SECType: Civil Complaint
Key Findings
- The SEC charged a former employee of two venture-capital firms with allegedly misappropriating investor money.
- The SEC alleges approximately $1.28 million was misappropriated from funds that had collectively raised approximately $28.67 million from at least 85 investors; investors were allegedly directed to wire funds to bank accounts controlled by Polcari. The allegations remain unproven.
- Recommended controls: for investment-platform counterparties, review controls over subscription instructions and destination accounts; verify segregation and reconciliation of investor funds; escalate changes to payment instructions and employee-controlled accounts.
Why It Matters
The case provides a useful counterparty-control signal for fintechs and financial institutions supporting private-fund or investment-platform payment flows.
Fintech Monitoring RelevanceLow
10 — Insider Trading / Governance
Jon P. Kipp
Date: September 15, 2026Regulator: SECType: Settled Civil Action
Key Findings
- The SEC filed a settled insider-trading action alleging Kipp sold Funko shares after receiving confidential information from the company's then-CEO.
- The SEC alleged approximately $483,746 in avoided losses; Kipp consented, without admitting the allegations, to proposed monetary remedies totaling approximately $1.073 million, subject to court approval.
- Recommended controls: for public-company fintech counterparties, assess material-nonpublic-information policies where relevant; review insider-trading controls, restricted lists, and executive information handling; maintain training and escalation for personal relationships that may create information leakage.
Why It Matters
Direct sponsor-bank relevance is limited, but the action remains relevant to governance reviews of public fintech and technology counterparties.
Fintech Monitoring RelevanceLow
Material Regulatory and Supervisory Updates
FinCEN — Operation Economic Outcast Public-Private Exchange (September 16, 2026)
FinCEN led an exchange with global financial institutions focused on identifying and disrupting revenue streams and procurement networks tied to Iran. The item is treated as a supervisory/BSA update rather than an enforcement action.
Federal Reserve — Termination of SNB Bancshares / Bank of Eufaula Written Agreement (September 18, 2026)
The Federal Reserve announced termination of a written agreement originally dated August 7, 2024, effective September 3, 2026. Because this is a termination rather than a new adverse action, it is not included in the enforcement count.
Key Regulatory Themes
- Digital assets remain within sanctions and criminal-enforcement reach. OFAC's BitBank designation and DOJ's Robinhood case show distinct but complementary risks: sanctions evasion through crypto infrastructure and misuse of confidential information in crypto markets.
- Payment-product fee governance. The FleetCor/Corpay settlement emphasizes express customer consent, fee transparency, billing controls, and substantiation of product claims.
- Insider and employee misconduct. Five banking/payment employee prohibition actions plus DOJ and SEC matters reinforce the importance of employee-access monitoring, conflicts controls, and transaction surveillance.
- Iran-related financial intelligence. FinCEN's September 16 exchange indicates continued public-private focus on Iranian revenue streams and procurement networks.
Implications for Sponsor Banks and Fintech Programs
Immediate Monitoring Actions
- Refresh OFAC screening and crypto wallet/counterparty monitoring for the September 17 BitBank designations and related ownership links.
- Review fee disclosure, customer consent, billing, and product-claim controls for payment and commercial card products in light of the FleetCor/Corpay action.
- Assess employee access to sensitive fintech product, token-listing, customer-funds, and transaction information; confirm logging and surveillance are operating.
- Review insider-fraud scenarios for branch, contact-center, payment, and customer-service staff, including employee-linked transfers, debits, overrides, and checks.
- Consider whether Iran-related AML investigative guidance should be refreshed following FinCEN's September 16 public-private exchange.
Control Areas to Review
- Sanctions screening and digital-asset counterparty controls
- Fee authorization, disclosure, billing, and product governance
- Employee access and privileged-activity monitoring
- Insider fraud and customer-funds safeguards
- Conflicts of interest and employee trading controls
- Investor/payment instruction verification and segregation of funds
No Material Actions Identified
The following authorities were reviewed and no material new enforcement actions meeting the digest criteria were identified for the September 15-21 review period: FDIC, CFPB, NCUA, NYDFS, California DFPI, and other relevant U.S. state banking departments.
Sources
| Regulator | Official source reviewed |
|---|---|
| OFAC / Treasury | September 17 BitBank designation |
| FinCEN | September 16 FinCEN Exchange |
| FTC | September 17 FleetCor/Corpay settlement |
| DOJ | September 15 Robinhood employee charges |
| Federal Reserve | September 18 employee enforcement actions; September 18 termination |
| OCC | September 17 enforcement actions |
| SEC | Ellen Polcari; Jon P. Kipp |
| FDIC | Official press release and enforcement sources reviewed; no qualifying new material item identified. |
| CFPB | Official newsroom/enforcement sources reviewed; no qualifying new material item identified. |
| NCUA | Official press release/administrative-order sources reviewed; no qualifying new material item identified. |
| NYDFS | Official press release/enforcement sources reviewed; no qualifying new material item identified. |
| California DFPI | Official press release/enforcement sources reviewed; no qualifying new material item identified. |
Review period: September 15-21, 2026. Coordinated or consolidated matters are counted once; individual prohibition orders are counted separately.
Older Digests
Week Ending September 14, 2026Eight new enforcement actions this week were led by the FTC's $12 million Humboldt Merchant Services settlement and a coordinated OFAC/DOJ sanctions and seizure action against the Xinbi Guarantee crypto-laundering marketplace, alongside accelerating Iran-related sanctions activity.Read >>
Week Ending September 7, 2026Six new enforcement actions this week were led by the FTC's $4.85M Nuvei settlement, OFAC's Golden Global Bank sanctions, and FinCEN's Southwest Border MSB GTO and digital asset scam alert.Read >>
Week Ending August 31, 2026FinCEN moves to cut off Banque Misr UAE's correspondent access over Iran-linked shadow banking as DOJ brings cartel money-laundering, stolen-check, and software supply-chain cyber cases across a 10-action week.Read >>
Week Ending August 24, 2026Nine new enforcement actions this week, headlined by the FTC's $2.1M Doxo settlement, a DOJ bank-fraud scheme tied to merchant onboarding, and a Federal Reserve/Alabama written agreement with SouthPoint Bancshares.Read >>
Week Ending August 17, 2026FTC halts alleged $200M credit-repair scheme; no fintech, sponsor-bank, or BaaS-specific enforcement actions identified this week.Read >>