--- title: Weekly Enforcement Action Digest slug: weekly-enforcement-action-digest-september-21-2026 date: 2026-09-21 author: Across Regulatory Intelligence excerpt: OFAC's Iranian digital-asset sanctions on BitBank, a $100 million FTC settlement with FleetCor/Corpay, and DOJ fraud charges against two Robinhood employees headline a week dominated by digital-asset enforcement and bank-employee misconduct actions. regulators: OFAC, FTC, DOJ, Federal Reserve, OCC, SEC, FinCEN tags: - Enforcement - Sanctions - Digital Assets - BSA/AML - Governance metrics: - label: New Actions value: "10" - label: Fintech / Payments / Digital Asset Impact value: "3" - label: BSA/AML & Sanctions value: "1" - label: Governance & Risk Management value: "8" --- ## Executive Summary **Key Takeaways This Week** - 10 material new enforcement actions were identified for the September 15-21 review period, counting individual bank-employee prohibition orders separately and coordinated matters once. - The most relevant fintech and payments developments were OFAC's designation of Iranian digital asset exchange BitBank, the FTC's $100 million FleetCor/Corpay fuel-card settlement, and DOJ charges against two Robinhood employees involving crypto-linked perpetual futures. - Major risk themes were sanctions and digital assets, payment-product fee transparency, insider/employee misconduct, customer-funds misuse, fraud, and governance. - No material new action directly targeted a sponsor-bank oversight program or BaaS arrangement during the review period. - FinCEN also held a September 16 public-private exchange with global financial institutions focused on Iranian revenue streams and procurement networks; this is treated as a supervisory/AML update rather than an enforcement action. ## Priority Watchlist | Institution | Regulator | Date | Action | Severity | | --- | --- | --- | --- | --- | | BitBank, Pishtaz Simorgh & associates | OFAC | Sep 17 | Sanctions designations tied to Iranian digital-asset infrastructure | High | | FleetCor / Corpay and Ronald Clarke | FTC | Sep 17 | $100M proposed settlement over fuel-card fee practices | High | | Hefu Chai & Huaisong Xiang (Robinhood employees) | DOJ | Sep 15 | Criminal charges over misuse of confidential crypto-listing information | High | | Three former bank / AmEx employees | Federal Reserve | Sep 18 | Consent prohibition orders for funds misuse, conflicts, and check fraud | High | | Zena Montejano & Jorge Troncoso | OCC | Sep 17 | Prohibition orders for embezzlement and unauthorized customer debits | High | | Ellen Polcari | SEC | Sep 18 | Civil fraud complaint over alleged investor-fund misappropriation | Medium | | Jon P. Kipp | SEC | Sep 15 | Settled insider-trading action | Medium | ## New Enforcement Actions This Week ### 01 — Sanctions / Digital Assets #### BitBank, Pishtaz Simorgh Electronic Trade Company, and Associates **Date:** September 17, 2026 · **Regulator:** OFAC · **Type:** Sanctions Designations **Key Findings** - OFAC designated BitBank, its developer Pishtaz Simorgh Electronic Trade Company, and three associates of OFAC-designated Iranian financier Babak Zanjani. - Treasury described the targets as key components of Iranian digital-asset sanctions-evasion infrastructure, part of Operation Economic Outcast. - Recommended controls: refresh sanctions lists, aliases, ownership links, and wallet intelligence; review crypto transaction monitoring for exposure to Iranian digital-asset infrastructure; escalate indirect exposure through exchanges, payment intermediaries, and third-country counterparties. **Why It Matters** This is directly relevant to digital-asset firms, banks, and fintechs facilitating crypto-to-fiat activity, and to sanctions-screening programs. **Fintech Monitoring Relevance:** High ### 02 — Consumer Compliance / Payment Products #### FleetCor Technologies / Corpay and Ronald Clarke **Date:** September 17, 2026 · **Regulator:** FTC · **Type:** Proposed Administrative Settlement **Key Findings** - FleetCor, now Corpay, and its CEO agreed to pay $100 million to resolve an FTC administrative action. - The FTC alleged undisclosed and unauthorized fees connected with fuel cards, and misrepresentations regarding savings, fraud controls, and fees. The proposed settlement follows prior federal-court findings and would provide redress to affected business customers. - Recommended controls: review fee authorization, disclosure, billing, and change-management controls for commercial payment products; validate that fraud-control and savings claims are supportable; ensure product, legal, compliance, billing, and customer-service processes identify and remediate unauthorized charges. **Why It Matters** The action is relevant to fintech payment products because it connects product representations, fee governance, billing controls, and customer consent to material enforcement exposure. **Fintech Monitoring Relevance:** High ### 03 — Digital Assets / Employee Misconduct #### Hefu Chai and Huaisong Xiang — Robinhood Employees **Date:** September 15, 2026 · **Regulator:** DOJ · **Type:** Criminal Charges **Key Findings** - DOJ charged two Robinhood engineers with commodities fraud and wire fraud. - The government alleges they misappropriated confidential business information about forthcoming Robinhood Crypto token listings and traded perpetual futures on Hyperliquid before public announcements; each allegedly earned more than $50,000. The charges are accusations and the defendants are presumed innocent. - Recommended controls: review employee access to listing, launch, pricing, and other market-sensitive information; apply surveillance and conflict-of-interest controls to employee trading where crypto or derivatives activity may create misuse risk; maintain access logging, segregation of duties, confidentiality controls, and investigation procedures for material nonpublic information. **Why It Matters** The case is directly relevant to digital-asset fintech governance and demonstrates employee-conduct risk around token listings and decentralized derivatives markets. **Fintech Monitoring Relevance:** High ### 04 — Employee Misconduct / Customer Funds #### Charles Alan Wright — Former Northstar Bank Employee **Date:** September 18, 2026 · **Regulator:** Federal Reserve · **Type:** Consent Prohibition Order **Key Findings** - The Federal Reserve announced a consent prohibition order against a former Northstar Bank employee for misappropriation of customer funds. - Recommended controls: review employee access to customer funds and exception activity; maintain transaction surveillance and escalation for employee-linked transfers; ensure investigation and disciplinary processes address insider misuse. **Why It Matters** The action reinforces insider-fraud and customer-funds controls at supervised institutions. **Fintech Monitoring Relevance:** Medium ### 05 — Employee Misconduct / Conflicts #### Stephanie K. Hudders — Former American Express Travel Related Services Employee **Date:** September 18, 2026 · **Regulator:** Federal Reserve · **Type:** Consent Prohibition Order **Key Findings** - The Federal Reserve announced a consent prohibition order for misapplication of funds and conflicts of interest. - Recommended controls: review conflict-of-interest attestations and employee transaction controls; monitor privileged access and employee-linked account activity; maintain independent escalation and investigation channels. **Why It Matters** The action is relevant to payment and financial-services firms because it combines funds misuse with conflicts-of-interest risk. **Fintech Monitoring Relevance:** Medium ### 06 — Check Fraud / Employee Misconduct #### Elvisha White — Former Regions Bank Employee **Date:** September 18, 2026 · **Regulator:** Federal Reserve · **Type:** Consent Prohibition Order **Key Findings** - The Federal Reserve announced a consent prohibition order against a former Regions Bank employee for check fraud. - Recommended controls: review teller and employee check controls; monitor override, exception, and employee-linked check activity; maintain maker-checker and fraud escalation procedures. **Why It Matters** The order highlights insider-fraud risk in routine payment operations. **Fintech Monitoring Relevance:** Medium ### 07 — Embezzlement / Employee Misconduct #### Zena Montejano — Former U.S. Bank Employee **Date:** September 17, 2026 · **Regulator:** OCC · **Type:** Order of Prohibition **Key Findings** - The OCC prohibited a former U.S. Bank contact-center personal banker after finding embezzlement of approximately $329,088 from the bank. - Recommended controls: review remote/contact-center employee access and transaction authority; monitor employee-linked adjustments, transfers, and unusual account activity; maintain periodic access reviews and strong privileged-action logging. **Why It Matters** The matter is relevant to operational controls for remote banking and customer-service functions. **Fintech Monitoring Relevance:** Medium ### 08 — Unauthorized Customer Debits #### Jorge Troncoso — Former PNC Bank Employee **Date:** September 17, 2026 · **Regulator:** OCC · **Type:** Order of Prohibition **Key Findings** - The OCC prohibited a former PNC branch banker for unauthorized debits from multiple customer accounts; the bank suffered a loss of at least $74,550. - Recommended controls: review branch employee transaction authority and customer-debit controls; monitor unauthorized debit patterns and employee-linked activity; ensure customer complaint and restitution processes trigger internal fraud review. **Why It Matters** The action reinforces controls around employee-initiated customer-account activity. **Fintech Monitoring Relevance:** Medium ### 09 — Investor Funds / Fraud #### Ellen Polcari **Date:** September 18, 2026 · **Regulator:** SEC · **Type:** Civil Complaint **Key Findings** - The SEC charged a former employee of two venture-capital firms with allegedly misappropriating investor money. - The SEC alleges approximately $1.28 million was misappropriated from funds that had collectively raised approximately $28.67 million from at least 85 investors; investors were allegedly directed to wire funds to bank accounts controlled by Polcari. The allegations remain unproven. - Recommended controls: for investment-platform counterparties, review controls over subscription instructions and destination accounts; verify segregation and reconciliation of investor funds; escalate changes to payment instructions and employee-controlled accounts. **Why It Matters** The case provides a useful counterparty-control signal for fintechs and financial institutions supporting private-fund or investment-platform payment flows. **Fintech Monitoring Relevance:** Low ### 10 — Insider Trading / Governance #### Jon P. Kipp **Date:** September 15, 2026 · **Regulator:** SEC · **Type:** Settled Civil Action **Key Findings** - The SEC filed a settled insider-trading action alleging Kipp sold Funko shares after receiving confidential information from the company's then-CEO. - The SEC alleged approximately $483,746 in avoided losses; Kipp consented, without admitting the allegations, to proposed monetary remedies totaling approximately $1.073 million, subject to court approval. - Recommended controls: for public-company fintech counterparties, assess material-nonpublic-information policies where relevant; review insider-trading controls, restricted lists, and executive information handling; maintain training and escalation for personal relationships that may create information leakage. **Why It Matters** Direct sponsor-bank relevance is limited, but the action remains relevant to governance reviews of public fintech and technology counterparties. **Fintech Monitoring Relevance:** Low ## Material Regulatory and Supervisory Updates **FinCEN — Operation Economic Outcast Public-Private Exchange** (September 16, 2026) FinCEN led an exchange with global financial institutions focused on identifying and disrupting revenue streams and procurement networks tied to Iran. The item is treated as a supervisory/BSA update rather than an enforcement action. **Federal Reserve — Termination of SNB Bancshares / Bank of Eufaula Written Agreement** (September 18, 2026) The Federal Reserve announced termination of a written agreement originally dated August 7, 2024, effective September 3, 2026. Because this is a termination rather than a new adverse action, it is not included in the enforcement count. ## Enforcement Actions by Risk Category **BSA/AML & Sanctions** - September 17 — OFAC: BitBank and related developer/associates designated as components of Iranian digital-asset sanctions-evasion infrastructure. **Consumer Compliance** - September 17 — FTC: FleetCor/Corpay and its CEO agreed to a proposed $100 million settlement concerning unauthorized or undisclosed fuel-card fees and alleged misrepresentations. **Operational Risk & Fraud** - September 18 — Federal Reserve: three consent prohibition orders involving customer-funds misappropriation, conflicts/misapplication of funds, and check fraud. - September 17 — OCC: two prohibition orders involving embezzlement and unauthorized customer debits. - September 18 — SEC: Ellen Polcari charged with alleged misappropriation of approximately $1.28 million of investor funds. - September 15 — DOJ: two Robinhood employees charged over alleged misuse of confidential crypto-listing information. - September 15 — SEC: settled insider-trading action against Jon P. Kipp. **Information Security & Cybersecurity** No material actions identified this week. **Third-Party Risk / Fintech Partnerships** - September 17 — FTC: FleetCor/Corpay action is relevant to payment-product governance and customer billing controls. - September 15 — DOJ: Robinhood employee case is relevant to digital-asset fintech governance and access to sensitive listing information. No material new enforcement action directly targeting a sponsor-bank oversight program or BaaS arrangement was identified this week. **Governance & Risk Management** Employee misconduct and privileged-access risk were recurring themes across Federal Reserve, OCC, DOJ, and SEC actions. **Financial / Capital / Liquidity Risk** No material actions identified this week. ## Key Regulatory Themes 1. **Digital assets remain within sanctions and criminal-enforcement reach.** OFAC's BitBank designation and DOJ's Robinhood case show distinct but complementary risks: sanctions evasion through crypto infrastructure and misuse of confidential information in crypto markets. 2. **Payment-product fee governance.** The FleetCor/Corpay settlement emphasizes express customer consent, fee transparency, billing controls, and substantiation of product claims. 3. **Insider and employee misconduct.** Five banking/payment employee prohibition actions plus DOJ and SEC matters reinforce the importance of employee-access monitoring, conflicts controls, and transaction surveillance. 4. **Iran-related financial intelligence.** FinCEN's September 16 exchange indicates continued public-private focus on Iranian revenue streams and procurement networks. ## Implications for Sponsor Banks and Fintech Programs **Immediate Monitoring Actions** - Refresh OFAC screening and crypto wallet/counterparty monitoring for the September 17 BitBank designations and related ownership links. - Review fee disclosure, customer consent, billing, and product-claim controls for payment and commercial card products in light of the FleetCor/Corpay action. - Assess employee access to sensitive fintech product, token-listing, customer-funds, and transaction information; confirm logging and surveillance are operating. - Review insider-fraud scenarios for branch, contact-center, payment, and customer-service staff, including employee-linked transfers, debits, overrides, and checks. - Consider whether Iran-related AML investigative guidance should be refreshed following FinCEN's September 16 public-private exchange. **Control Areas to Review** - Sanctions screening and digital-asset counterparty controls - Fee authorization, disclosure, billing, and product governance - Employee access and privileged-activity monitoring - Insider fraud and customer-funds safeguards - Conflicts of interest and employee trading controls - Investor/payment instruction verification and segregation of funds ## No Material Actions Identified The following authorities were reviewed and no material new enforcement actions meeting the digest criteria were identified for the September 15-21 review period: FDIC, CFPB, NCUA, NYDFS, California DFPI, and other relevant U.S. state banking departments. ## Sources | Regulator | Official source reviewed | | --- | --- | | OFAC / Treasury | [September 17 BitBank designation](https://home.treasury.gov/news/press-releases/sb0632) | | FinCEN | [September 16 FinCEN Exchange](https://www.fincen.gov/news/news-releases/treasury-convenes-global-financial-institutions-advance-operation-economic) | | FTC | [September 17 FleetCor/Corpay settlement](https://www.ftc.gov/news-events/news/press-releases/2026/09/fleetcor-agrees-pay-100-million-resolve-administrative-action-after-federal-court-finds-it-violated) | | DOJ | [September 15 Robinhood employee charges](https://www.justice.gov/usao-sdny/pr/two-robinhood-employees-charged-fraud) | | Federal Reserve | [September 18 employee enforcement actions](https://www.federalreserve.gov/newsevents/pressreleases/enforcement20260918a.htm); [September 18 termination](https://www.federalreserve.gov/newsevents/pressreleases/enforcement20260918b.htm) | | OCC | [September 17 enforcement actions](https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-79.html) | | SEC | [Ellen Polcari](https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26642); [Jon P. Kipp](https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26640) | | FDIC | Official press release and enforcement sources reviewed; no qualifying new material item identified. | | CFPB | Official newsroom/enforcement sources reviewed; no qualifying new material item identified. | | NCUA | Official press release/administrative-order sources reviewed; no qualifying new material item identified. | | NYDFS | Official press release/enforcement sources reviewed; no qualifying new material item identified. | | California DFPI | Official press release/enforcement sources reviewed; no qualifying new material item identified. | Review period: September 15-21, 2026. Coordinated or consolidated matters are counted once; individual prohibition orders are counted separately.