Michael Lundberg

Axiom Bank hit with unsafe or unsound banking practices with respect to the Bank’s Bank Secrecy Act/ Anti-Money Laundering. Highlights of the corrective action plan agreed to between Axiom and the OCC include: ➡️ 𝐁𝐨𝐚𝐫𝐝 𝐀𝐩𝐩𝐨𝐢𝐧𝐭𝐞𝐝 𝐂𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 𝐂𝐨𝐦𝐦𝐢𝐭𝐭𝐞𝐞: The  Committee will be comprised of at least 3 non-executive directors to ensure accountability and regular oversight of the bank’s efforts to remediate compliance issues. Its reports to the board provide transparency and focus on regulatory expectations. ➡️ 𝐁𝐒𝐀/𝐀𝐌𝐋 𝐀𝐜𝐭𝐢𝐨𝐧 𝐏𝐥𝐚𝐧: This plan is central to addressing deficiencies. It requires clearly defined corrective actions, timelines, and responsible parties. The Board shall review the effectiveness of the BSA/AML Action Plan at least annually, and more frequently if necessary or if required by the OCC in writing. ➡️ 𝐈𝐧𝐭𝐞𝐫𝐧𝐚𝐥 𝐂𝐨𝐧𝐭𝐫𝐨𝐥𝐬 𝐚𝐧𝐝 𝐑𝐞𝐩𝐨𝐫𝐭𝐢𝐧𝐠: This requires strengthening transaction monitoring systems, developing comprehensive customer due diligence (CDD) protocols, and ensuring that controls are adaptive to evolving risks. Banks should evaluate current gaps in their reporting systems and improve the accuracy and timeliness of SAR and CTR filings. ➡️ 𝐒𝐀𝐑 𝐋𝐨𝐨𝐤-𝐁𝐚𝐜𝐤 𝐑𝐞𝐯𝐢𝐞𝐰𝐬: The Board shall adopt a written suspicious activity monitoring and reporting program to ensure the timely and appropriate identification, review, and disposition unusual activity, and the filing of SARs. The Bank will also conduct a SAR look back review to determine whether SARs should be filed for any previously unreported suspicious activity, including cases in which the BSA Officer or staff identified suspicious activity but failed to adequately support a decision not to file a SAR. The SAR Look-Back shall include activity from January 1, 2023 to June 30, 2024. ➡️ 𝐒𝐭𝐚𝐟𝐟𝐢𝐧𝐠 𝐚𝐧𝐝 𝐓𝐫𝐚𝐢𝐧𝐢𝐧𝐠: BSA/AML compliance is resource-intensive, and the order emphasizes the need for sufficient, well-trained staff. Bank should assess current staffing levels, ensuring that personnel are not only sufficient in number but also well-versed in the latest regulatory developments, typologies of money laundering, and suspicious activity detection. ➡️ 𝐓𝐡𝐢𝐫𝐝 𝐏𝐚𝐫𝐭𝐲 𝐑𝐢𝐬𝐤 𝐌𝐚𝐧𝐚𝐠𝐞𝐦𝐞𝐧𝐭:  The Bank will submit a written program to effectively assess and manage the risks posed by third-party relationships - includes the Bank’s merchant processing partnerships and prepaid card partnerships. https://lnkd.in/gCW29v3a

6

🚨 The Office of the Comptroller of the Currency has issued an enforcement action against Wells Fargo after finding “deficiencies” in its AML protections. Specifically, in the bank’s customer due diligence, customer identification & beneficial ownership programs. This is a MAJOR setback for Wells Fargo, financially + reputationally. Not only did their stock drop 4%, but it’s a dark cloud that will take a while to clear. The last time they got an AML consent order in 2015, they were only released from it 5 years later. The takeaway: adequate compliance is never just a tick-box exercise. Back-to-back negative regulatory action erodes the trust regulators and customers have in you. Investing in compliance and AML with the aim to EXCEED at it is a strategic business move. If you want to do this quickly without assembling a large team of analysts/BPOs, we can support you at Accend (YC S23). Feel free to DM me! Could other banks be at risk of a similar OCC order? 👀

8

I'm thrilled to share this article written by our very own Andrew Gazdak. He discusses the incredible impact of Banking as a Service (BaaS) and third-party AML/BSA firms on how financial institutions combat money laundering and financial crimes! #AMLRightSource #BaaS #Banking #Regulations #Finance #AML #BSA

5

Sarah Beth Felix asks the same question I have ... On July 16, 2024 FinCEN, OFAC, and the FBI issued a joint notice titled “Timeshare Fraud Associated with Mexican-based Transnational Criminal Organizations” - https://lnkd.in/ePaZK3Ga The Notice included this: “Given the transnational nature of illicit activity related to timeshare fraud in Mexico, FinCEN also encourages U.S. financial institutions to continue to use, and potentially expand, their existing processes to collect and share information with foreign financial institutions in furtherance of investigations that involve cross-border activity.” That excerpt included a citation, Footnote 40: See, e.g., FinCEN, “Prepared Remarks of FinCEN Director Andrea Gacki During the SIFMA AML Conference” (May 6, 2024) at https://lnkd.in/gYAk7EYk I am not aware of any authority – law or regulation – that allows US-based and regulated financial institutions to share information with foreign financial institutions in furtherance of investigations that involve cross-border activity. And I’ve read Director Gacki’s May 6, 2024 speech: there is nothing in it that refers to US-based and regulated financial institutions being allowed to share information with foreign financial institutions in furtherance of investigations that involve cross-border activity.

54

7 Comments

Still getting through FinCEN's proposed rule to Strengthen & Modernize Financial Institutions' AML/CFT Programs (it is 178 pages). Of note, the requirement for institutions to ensure that their program is not only risk-based and reasonably designed, but also effective and in-line with national AML/CFT priorities will be new for some. The word "effective*" is used 181 times in the document. And for innovative software providers like us and those looking to adopt/pilot new approaches, "innovation" is used 34 times (and is strongly supported throughout!). Also, performing risk assessments becomes a strict regulatory requirement (though you should already be doing it); with the requirement as part of your risk assessments to consider FinCEN's national priorities and to apply resources accordingly. And in their own words: "FinCEN, in consultation with the appropriate Federal functional regulators, intends for these updates to: (1) reinforce the risk-based approach for AML/CFT programs; (2) make AML/CFT programs more dynamic and responsive to evolving ML/TF risks; (3) ultimately render AML/CFT programs more effective in achieving the purposes of the BSA; and (4) reinforce the focus of AML/CFT programs toward a more risk-based, innovative, and outcomes-oriented approach to combating illicit finance activity risks and safeguarding national security, as opposed to public perceptions that such programs are focused on mere technical compliance with the requirements of the BSA." https://lnkd.in/eab-3PqY

2

New York State Department of Financial Services issues major guidance to Part 500 in new Industry Letter on securing AI systems https://lnkd.in/eQ2uRa_K. "This Guidance does not impose any new requirements beyond obligations that are in DFS’s cybersecurity regulation codified at 23 NYCRR Part 500...rather, the Guidance is meant to explain how Covered Entities should use the framework set forth in Part 500 to assess and address the cybersecurity risks arising from AI." [1] Risk Assessments and Risk-Based Programs, Policies, Procedures, and Plans "Covered Entities should address AI-related risks in the following areas: the organization’s own use of AI, the AI technologies utilized by [Third Party Service Providers] TPSPs and vendors, and any potential vulnerabilities stemming from AI applications that could pose a risk to the confidentiality, integrity, and availability of the Covered Entity’s Information Systems or NPI." [2] Third-Party Service Provider and Vendor Management "DFS strongly recommends Covered Entities consider...the threats facing TPSPs from the use of AI and AI-enabled products and services; how those threats, if exploited, could impact the Covered Entity; and how the TPSPs protect themselves from such exploitation." [3] Access Controls "Covered Entities should consider using authentication factors that can withstand AI-manipulated deepfakes and other AI-enhanced attacks by avoiding authentication via SMS text, voice, or video, and using forms of authentication that AI deepfakes cannot impersonate, such as digital-based certificates and physical security keys." "Similarly, instead of using a traditional fingerprint or other biometric authentication system, Covered Entities should consider using an authentication factor that employs technology with liveness detection or texture analysis to verify that a print or other biometric factor comes from a live person." [4] Training "Covered Entities must now provide at least annual cybersecurity awareness training that includes social engineering.Training on social engineering, including on deepfake attacks, can be effectively delivered through simulated phishing,and voice and video impersonation exercises." [5] Monitoring "Covered Entities that use AI-enabled products or services, or allow personnel to use AI applications such as ChatGPT, should also consider monitoring for unusual query behaviors that might indicate an attempt to extract NPI and blocking queries from personnel that might expose NPI to a public AI product or system." [6] Data Management "Entities should maintain and update data inventories as they are crucial for assessing potential risks and ensuring compliance with data protection regulations. Data inventories further help entities track NPI so that if there is a breach, they know what NPI may have been exposed and what systems were impacted."

12

2 Comments

🚨 Time’s Up! The deadline to respond to the FATF’s consultation on updates to Recommendation 16 passed last Friday, May 3rd. Although these revisions will be considered separately for crypto, we took the opportunity to share our views on their impact for the sector. Here are the key highlights from our submission: 🏡 𝐆𝐞𝐨𝐠𝐫𝐚𝐩𝐡𝐢𝐜 𝐀𝐝𝐝𝐫𝐞𝐬𝐬𝐞𝐬 𝐚𝐬 𝐈𝐝𝐞𝐧𝐭𝐢𝐟𝐢𝐞𝐫𝐬: — Geographic address might become a mandatory identifier for originator and beneficiary customers. — We argue that requiring geographic addresses for both originator and beneficiary customers isn’t just unhelpful for sanction controls but also raises significant privacy concerns. 🤷‍♂️ 𝐄𝐱𝐭𝐞𝐧𝐝𝐞𝐝 𝐈𝐧𝐟𝐨𝐫𝐦𝐚𝐭𝐢𝐨𝐧 𝐨𝐧 𝐁𝐞𝐧𝐞𝐟𝐢𝐜𝐢𝐚𝐫𝐢𝐞𝐬: — The FATF is debating whether to (i) require beneficiary geographic addresses, along with names and account numbers, or (ii) standardize the information scope for both originators and beneficiaries. — We advocate that FIs and VASPs should be allowed to adopt a risk-based approach when deciding if and what additional information should be collected about beneficiary customers, rather than imposing rigid requirements. ✅ 𝐌𝐚𝐧𝐝𝐚𝐭𝐨𝐫𝐲 𝐕𝐞𝐫𝐢𝐟𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝐨𝐟 𝐁𝐞𝐧𝐞𝐟𝐢𝐜𝐢𝐚𝐫𝐲 𝐈𝐧𝐟𝐨𝐫𝐦𝐚𝐭𝐢𝐨𝐧: — It’s proposed that beneficiary institutions must verify received beneficiary information against their customer records. — We support this as a crucial step for enhancing sanctions controls and preventing fraud, and highlight the importance of carrying it out pre-transaction. 🔢 𝐀𝐜𝐜𝐨𝐮𝐧𝐭 𝐍𝐮𝐦𝐛𝐞𝐫𝐬 𝐚𝐫𝐞 𝐔𝐧𝐬𝐮𝐢𝐭𝐚𝐛𝐥𝐞 𝐈𝐝𝐞𝐧𝐭𝐢𝐟𝐢𝐞𝐫𝐬: — The challenge of linking account numbers to specific legal entities isn’t unique to crypto. Traditional FIs encounter similar issues with virtual IBANs. —We suggest shifting from an over-reliance on account numbers to more effective structures that ensure clear identification of all parties involved in a transaction. It’s encouraging to see the FATF address inefficiencies in the implementation of Recommendation 16. In crypto, we have the unique chance to implement it unhampered by legacy systems. Let’s lead the way for better standards in Travel Rule compliance!

16

Financial Crimes Enforcement Network, US Treasury published a notice for FIs to operationalize threats related to timeshare #fraud and Mexico-based TCOs like CJNG. This was issued jointly with #OFAC and the #FBI. I certainly didn't have a 14 page document re: timeshare fraud and Mexican drug cartels on my 2024 BINGO card, but here we are. See the third point for 6 things you can do right now to act on this Notice. Here are the highlights, more comments in the attached pdf - 1) This notice will primarily be impactful if all #banks, credit unions, #trust companies, investors, brokers, and fiduciaries provide customer education. Pgs. 3-5 offer great keywords to use in your outreach. 2) After customer education, the typologies are pretty limited in operationalability (not a word, I know). This is where I will say again - if your #AML system does not allow you to operationalize advisories and notices from FinCEN, get a new one! 3) It is time to take a temp check of your transactional threat landscape as it relates to this notice - look at the following: a) age of the customer (elderly) and repetitive wires to Mexico; b) wires to Mexico with the terms "fees" and "taxes" in description; c) wires to Mexico going to the same/similar beneficiary but from different 60+ aged customers; d) search beneficiaries of wires to Mexico with the terms "travel", "real estate", "closing", "title", "realty", and "broker" (English & Spanish); e) wires from trust or #retirement accounts to Mexico; and f) internal transfers from trust/retirement accounts to checking then wires to Mexico. 4) Once that exercise is done, you will know how much exposure you have. 5) If there are any positive matches to # 3 above, do additional research on the businesses to see if they are newly formed. 6) Remember to use 314b info sharing with other US FIs! 7) If your #communitybank or CU is based in a large retirement community, you have a duty to at least brief your customers on this risk. Some things I'm confused by - pg. 9 states "U.S. financial institutions to continue to use, and potentially expand, their existing processes to collect and share information with foreign financial institutions in furtherance of investigations that involve cross-border activity"... what?? The reference is a footnote from Gacki's speech in May. But I am not aware of any legal mechanism by which US FIs (not the Tier1s) can share with info with a non-US FI? Please someone tell me I'm wrong. #ifollowdirtymoney

96

7 Comments

Excellent, energizing and clarifying to hear state & federal government land technology leaders engaged in dialogue on foundational and fundamental questions around freedom, information, and safety.

4

The SEC and FinCEN final Investment Advisors rule comes into effect January 1, 2026. Thirteen months sounds like a long time to get ready, until you realize that the AML requirements apply to *every* LP tied to an active fund on your SEC registration. Time to start retroactive screening now. Screening is just one step to get compliant. Passthrough's Head of Financial Crime Mark Mangion is going to walk through everything you need to do to get ready for SEC/FinCEN AML audits in Q1 and Q2 2026.

8

Avoid the dark side, you must. As noted in Luis’s summary, according to the CPPA Deputy Director Macko, “[d]ark patterns aren’t about intent, they’re about effect.” This follows on increased scrutiny of dark patterns by the FTC and other authorities. #ccpa #privacylaw

27

In April 2024, the California Privacy Protection Agency ("CPPA") released an enforcement advisory titled "Implementing Data Minimization in Consumer Requests," highlighting data minimization as a cornerstone principle of the California Consumer Privacy Act ("CCPA"). The principle requires companies to collect only the minimum consumer information necessary. This is especially important when handling consumer requests, including opt-out requests for selling or sharing personal data. The advisory serves as a reminder for businesses to review their data practices to comply with the CCPA's data minimization requirements. Stay informed on #CCPA and #Privacy regulations to ensure your business is complying with the latest guidelines.

11

What I find most interesting about all of the BSA/AML monitoring consent orders is that whatever the case may be about how the varying agencies want the thing done, it is completely ineffective. In 2020, banks spent $180 billion (I bet that is an under-estimate) on AML monitoring. Meanwhile, the detection rate for money laundering crimes is estimated to be anywhere from 0.1% to 1.0%. To put it more concretely, one top 5 accounting firm's figure was that $499 of every $500 laundered is never detected. This amounts to "billions of dollars" in detected funds flows. Notice that it is always vague how much is laundered (estimates of $800bn to $2tn), how efficacious this is (see tenfold range above), and how many crimes are cleared by the labor-intensive way this is being done. At what true cost is this make-work, I would ask. You have what the banks spend on the programs. We can estimate what portion of bank exams and regulatory staff are aimed at this issue. They fine the banks probably $10 billion per year for ineffective programs, too. Add to that training expense and materials creation for the purpose. Finally, an end-around the 4th Amendment isn't something that can even be quantified. It's a cottage industry. It's a path dependency, too - we can't think outside of rulesets and bodies watching the flows. I hope for change in the future on these questions. Because this is an ugly apparatus, by most metrics.

5

🍗 🥵 For me #TRMTalks is a work in progress. As we approach year four 😮 of amazing talks with law enforcement, regulators, compliance professionals and builders we are always looking to make it more fun, more educational and more engaging. I am constantly listening to, and learning from, great interviewers. I listen to Oprah, Larry King, and Howard Stern. One of my favorites is Sean Evans from First We Feast’s Hot 🍗 Ones. Sean has eaten wings with Kevin Hart, Scarlett Johansson, Paul Rudd, Margot Robbie, Billie Eilish, Post Malone, Lizzo, Shaquille O'Neal, Joel Embiid, Stone Cold Steve Austin, Travis Kelce, Idris Elba, Steph Curry and so many others. Why is Sean a great interviewer? 🍗 Deep Research: Evans thoroughly researches his guests, often bringing up obscure or personal details that surprise them. This level of preparation creates a deeper, more engaging conversation, often leading guests to open up in unexpected ways. 🍗 Unique Format: The combination of an intense interview with the escalating challenge of eating progressively spicier hot wings creates a disarming environment. This makes the interviews more authentic, as the guests become more candid and vulnerable while handling the heat. 🍗 Genuine Curiosity and Calm Demeanor: Evans maintains a calm, composed presence throughout, showing genuine interest in his guests’ lives and stories. His non-confrontational style encourages guests to relax and share openly without feeling pressured or defensive. 🍗 Relatability and Empathy: As he participates in eating the wings alongside the guests, Evans shares in their discomfort, which fosters a sense of camaraderie. This creates a more human and relatable interaction, helping the guests feel comfortable even in the midst of a challenge. 🍗 Balanced Questioning: Evans has a knack for balancing light-hearted, fun questions with deeper, more thought-provoking ones. This range allows the interviews to be both entertaining and insightful, providing a fuller picture of the guest's personality. TRM Labs Hot 🍗 Ones anyone? Listen to our 🥵 collection of hot #TRMTalks here this weekend #cryptoverse: https://lnkd.in/eGApZ9Gv

48

14 Comments

❗ Only a little over a week left to register for this FREE event for ACFCS Members ❗ I will be discussing Crypto vs. TradFi: Who knows their customers better? – What crypto firms can teach TradFi about KYC/CDD along side Joanna Marathakis and Brian Svoboda-Kindle. Register now to hear us talking about: ✔ The unique challenges and opportunities associated with KYC/CDD in the cryptocurrency sector ✔ The approaches taken by cryptocurrency firms to enhance customer identification and due diligence ✔ Regulatory trends and requirements shaping KYC/CDD practices in both crypto and TradFi, and their implications for businesses and customers. ✔ Strategies for fostering collaboration and knowledge sharing between crypto and TradFi firms to strengthen KYC/CDD practices and enhance financial integrity. 🔥 Definitely don't miss this one day event on June 12th! 🔥 https://lnkd.in/epVSn_Vu

21

OFAC's fourth enforcement action of 2024 makes clear that the U.S. government's current laser focus on Russia-related sanctions enforcement extends to the sectoral sanctions imposed in 2014. As stated in OFAC's web-post, "sectoral sanctions are an important element of OFAC’s foreign policy and national security goals, and OFAC is committed to enforcing against these programs. Companies that onboard or otherwise do business with nonblocked entities that are subject to sectoral sanctions, including entities owned more than 50 percent by SSI entities under E.O. 13662, must ensure that they comply with all aspects of these sanctions." https://lnkd.in/ewBu6Jmd

32

1 Comment

The Unintended Victims: How AML and Sanctions Regulations Are Strangling U.S. Small Businesses As a trade attorney who has spent years navigating the increasingly complex landscape of AML, banking, and sanctions laws, I feel compelled to sound the alarm on a growing crisis facing small businesses in the US. The very regulations designed to protect our financial system are now threatening the lifeblood of our economy: our small business owners. Recent developments, as highlighted in comments submitted to the Treasury Department by various NGOs, paint a disturbing picture of overcompliance and "derisking" in the banking sector. While these issues are causing significant hurdles for humanitarian groups trying to deliver aid abroad, they're also having a devastating impact closer to home. Every year, the list of red flags grows longer, and more small businesses find themselves caught in this expanding web. What was once a system designed to catch bad actors is now ensnaring innocent entrepreneurs whose only crime is operating outside what banks consider the "norm." As we've seen with humanitarian organizations experiencing a "sharp and sudden 300% spike" in delayed and blocked transfers, overzealous compliance can paralyze legitimate operations. Now, imagine this happening to a small business owner trying to make payroll or pay suppliers. InterAction reported that one of its members spent an additional $100,000 annually over the past three years just to manage wrongly blocked or delayed transactions. For a large NGO, this might be absorbable. For a small business? It could be the difference between growth and bankruptcy. Perhaps most troubling is the thinly veiled discrimination occurring under the banner of compliance. The National Iranian American Council's (NIAC) ongoing class action lawsuit against Bank of America highlights how these regulations are being used to justify the freezing of accounts belonging to former Iranian citizens and students, often without notice and despite confirmation of U.S. residency. Similarly, the Yemeni American Merchants Association reports its members have faced "unjust account closures, denials of financial services, and other forms of exclusion" driven by misinterpretation or overenforcement of sanctions. This is not just a humanitarian issue; it's a direct threat to the diverse fabric of American small business. Banks, fearing the hefty penalties associated with sanctions violations, are increasingly choosing to "derisk" by simply refusing to serve entire categories of customers deemed too risky. The banking industry's obsession with the "strict liability" standard in sanctions and AML regs are creating an imbalance that favors derisking over rational risk assessment. #tradelaw #compliance #AMLcompliance

3

1 Comment