Fraud and AML in banking

Bank of America must pay more than $1.21 billion in penalties for violating anti-money laundering and sanctions laws, the Treasury Department announced in October.

Within that amount, a $1.2 billion fine levied by the Financial Crimes Enforcement Network is the third-largest in Treasury history. The Office of the Comptroller of the Currency concurrently assessed a $750 million civil monetary penalty – the largest in its 163-year history – over a “deficient and ineffective” compliance program.

The Office of Foreign Assets Control also announced an $11.6 million settlement with Bank of America over sanctions violations tied to Iran, Russia, global terrorism and narcotics.

The Treasury credited the OCC’s penalty toward its $1.2 billion fine. No asset cap was imposed.

Charlotte, North Carolina-based Bank of America admitted to willful violations of the Bank Secrecy Act, FinCEN said. The bank said it failed to implement and maintain an AML program that satisfied the BSA and FinCEN’s implementing regulations, and that it failed to conduct due diligence for correspondent accounts for foreign financial institutions.

The bank also failed to file suspicious activity reports for $5 billion in transactions, FinCEN found.

Bank of America failed to properly monitor trillions of dollars in transactions, and “knew for years that it was failing to escalate potentially suspicious activities to investigators for review,” the OCC said.

Additionally, the bank’s BSA officer and staff “lacked sufficient skills and expertise” to effectively manage the bank’s BSA/AML program, according to the regulator.

“Financial institutions are on the front lines of protecting our economic and national security,” Treasury Secretary Scott Bessent said in a prepared statement. “When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire U.S. financial system to significant illicit finance risks.”

Bank of America agreed to a cease-and-desist order in 2024 related to BSA/AML deficiencies. But the lender failed to complete steps needed to establish an effective BSA/AML compliance program after the order, and its program continues to have significant issues, the OCC said.

More than a year after the initial order, Bank of America didn’t escalate potentially suspicious activity for review, and it processed potential trade-based money laundering transactions because of a flaw in its transaction monitoring program, the OCC said.

“Almost two years ago, the bank signed an order with the OCC and committed to fixing its longstanding BSA deficiencies,” Comptroller of the Currency Jonathan Gould said in a statement. “Despite its obligation to the American people as a national-chartered, global systemically important bank, the bank’s BSA/AML compliance program continues to reflect widespread breakdowns in internal controls, which threatens U.S. national and economic security.”

“The bank’s poor response to its BSA deficiencies is unacceptable,” Gould said. “The second largest bank’s egregious and continued BSA violations warrant the OCC imposing its largest (civil money penalty) ever assessed against a bank. The OCC expects all banks to have an effective BSA/AML compliance program. Those that do not can expect swift and significant action.”

Bank of America is confident “we’re on the course,” CEO Brian Moynihan said during the bank’s third-quarter earnings call a day after the penalty was announced.

“At the end of the day, I think we have agreed to call this a settlement and move forward,” the CEO said. “We’ll complete it and it is the focus of management to get it cleaned up.”

He indicated the bank sought to understand what Trump-era regulators expected, as they’ve pursued an overhaul of anti-money laundering rules. 

“The key was to get agreement to what the resolution was,” he said. “We went back and forth on that a little bit earlier in the year, and now (there’s) clarity as to exactly what the metrics, etc., they want to see. We file a lot of SARs, etc. and we just had to be clear about what the metrics they were looking for under a new regime that modified the programs, and we’re all set.”

The bank is taking its non-tax-deductible $1.2 billion charge in the third quarter. Despite the charge, Bank of America reported $11.6 billion in revenue for the third quarter and $6.9 billion in profit. The penalty shaved roughly 17 cents per share off the latter figure, the bank said.

Bank of America shares on Oct. 14 began trading 7.7% lower than they had before the penalty was announced, according to Yahoo Finance. By Bloomberg’s calculation, the penalty cost the bank $22 billion in stock value in the short term.

BofA ‘committed to completing’ work

A Bank of America spokesperson cited billions of dollars the company has invested in technology and personnel to thwart financial crime.

“Financial crime compliance is serious, and we are responsible for getting it right,” the spokesperson said in an email to Banking Dive. “[O]ur team is far along with and committed to completing the work required to address the issues raised by our regulators.”

BofA CFO Alastair Borthwick, during a media call to discuss earnings results, said the bank has added thousands of people in BSA/AML roles and trained them as the lender has worked through its issues in recent years.

“We feel like we're meeting all of the obligations in that consent order at this point,” he said. “We don't need, necessarily, to add any more people, and if we decided we did, we have lots of different positions that we can move people within the company.”

As for the timing of the announcement, Borthwick pointed to the bank’s 2024 order and said it “takes some period of time for the OCC to conclude their work before they establish a report and before they figure out what is the appropriate result of that report.”  

The CFO declined to speculate when the order might be lifted or identify the share of the work that’s been completed, but said “we feel like a substantial amount” is done.

“We've moved quickly to address everything we need to do,” Borthwick said. We've completed a lot of the work required in that consent order, and we've made substantial investments in our program, as in people and in technology.” 

‘Significant problems’

The fact that regulators did not impose an asset cap on BofA drew the ire of Sen. Elizabeth Warren, D-MA. 

“Slap-on-the-wrist fines have become the cost of doing business on Wall Street and are no deterrent,” she said in a statement. “Big banks should be subject to structural punishments, and their executives should be held personally accountable when they break the law.”

FinCEN’s investigation revealed deficiencies related to the bank’s suspicious transaction identification and reporting and customer due diligence processes. As issues arose, Bank of America “prioritized its revenues and minimized the impact on its required compliance resources,” the Treasury Department said.

The bank’s resulting reliance on law enforcement inquiries and requests by other banks instead of its own internal controls to flag suspicious activity meant BofA “effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations,” Treasury said.

Bank of America also let suspicious activity accumulate uninvestigated for extended periods, which led to late reporting to law enforcement, regulators said.

The bank maintained that approach even as testing highlighted “significant problems,” the Treasury Department said. The bank didn’t quickly respond to “mounting red flags” involving payments from unknown third parties – including potential ties to narcotics trafficking proceeds – even when compliance employees escalated their concerns.

FinCEN’s consent order requires the bank to employ a third party to conduct a review to flag suspicious transactions that went undetected. The bank must undergo an independent review to determine the effectiveness of its suspicious activity monitoring, customer due diligence and foreign correspondent account due diligence programs, and its data governance framework related to information used in its AML program.

The bank’s settlement with OFAC relates to 475 apparent violations of sanctions programs, Treasury said. 

Bank of America “channeled correspondent banking payments through blocked banks due to technical and human error, allowed designated individuals to make payments and withdraw funds due to poor sanctions alert calibration, failed to promptly update watchlists following OFAC designations, and mishandled business accounts associated with blocked persons due to human error.”   

The bank has made “significant compliance commitments” involving training, testing and audit, and future communication and cooperation with OFAC, as part of the settlement, the Treasury release said.

Talking people out of giving their money away to scammers is a regular part of the job for JPMorgan Chase’s front-line bank employees, and the victims aren’t always who some would expect.

“It’s everybody,” said Darius Kingsley, Chase’s head of consumer fraud and scam prevention.

“We always talk about older people, and when they do fall victim to a scam, they lose a lot of money,” Kingsley said. “But it's equal, if not actually a higher number, as a percentage, of younger people these days.”

Dissuading customers from funding scammers is an everyday occurrence at JPMorgan’s branches, and the bank is leaning into education as a tool to fight back.

JPMorgan Chase livestreamed a fraud-focused panel in October to roughly 700 branches, during which the bank’s information security chief, Pat Opet; Washington Post columnist Michelle Singletary; and Brett Leatherman, the assistant director of the FBI’s cyber division, discussed how artificial intelligence-enabled impersonation and money movement scams can be spotted, as well as how individuals can strengthen their cyber defenses and protect personal and financial information when using AI tools.

“The problem is the scammers and the scams are getting more and more sophisticated,” Kingsley said in an interview ahead of the event. 

Open-source AI models make sham texts and emails much more convincing than the Nigerian prince scams of yesteryear, he said.

“What AI allows you to do is really personalize your messages,” he said. “It’s really, really tough to counter.”

Older Americans are more often targets of romance scams or “pig-butchering” investment scams, while younger Americans tend to fall victim to apartment or employment scams. 

In one common scheme, fraudsters will offer a fake product review gig with the caveat that the reviewer – the unknowing victim – buy a $600 Chromebook with a check provided by them.

“They send you a check, except it's not $600,” Kingsley said. “It's $2,600, and they immediately send you an email saying, ‘Oh my God, we made a mistake. We misprinted your check. Please, the moment you get it, deposit that check and wire us back $2,000, and then keep the $600 [to] go buy your laptop.’”

But when the victim deposits the check, he said, it bounces; meanwhile, the victim has already wired the $2,000.

“Now there's no job, and you're out the $2,000, and maybe your credit score got dinged, which, when you're young and you're about to go try to rent an apartment, is not a great thing,” Kingsley said.

Impostor scams cost reported victims $3.5 billion in 2025, the Federal Trade Commission said in June. That’s three times more than in 2020. 

Gallup put the number much higher: $68 billion in 2025. Most scam victims lost less than $500, but 5% lost over $10,001, the polling firm reported.

Fraud, Kingsley noted, doesn’t start at the bank. It starts upstream, with a spoof phone call or a fake social media ad. What’s really needed, he said, is for “all the industries to come together to work together to help stop this.”

Lawmakers are trying. Politicians on both sides of the aisle sponsored legislation in February meant to crack down on fraudulent and deceptive advertisements on social media and online platforms. The bill remains pending in committee.

In June, a coalition of government agencies known as the Elder Justice Coordinating Council launched The Never Ever campaign, meant to raise awareness around impostor scams. Partners in the effort include the American Bankers Association, USTelecom, Google and Microsoft. 

JPMorgan, like other banks, fights scams using the same AI models scammers do.

Banks are using AI models to map customer payment behavior patterns, and to get “smarter and faster about saying, ‘We really don't want you to send that out,’ or ‘Are you sure?’” Kingsley said.

The “vast majority of all payments are good, and people actually want to make them. So you're looking all the time for a needle in a haystack,” he said. “AI will help us do that.”

The threat, he said, is countered by an equal-opposite effort on the bank’s end. Part of the battle is fought with AI, and part with community events.

“Honestly, there's nothing else like just trying to really get out there and educate people,” Kingsley said.

Sponsored content

By ACAMS

Picture a fraud ring that builds one piece of software: An artificial intelligence (AI) agent that can browse a lender’s website, fill out a personal loan application, upload the supporting documents and hit submit with no human ever touching a keyboard. Now point that same agent at 12 different lenders in one afternoon, each time wearing a different synthetic identity. If each of those loans clears for even a modest amount, that is a six-figure exposure, and not one of the 12 lenders will see it coming.

To each of those 12 lenders, the application looks like that of an independent human applicant. No device fingerprint ties them together because the agent rotates execution environments between runs. No velocity alert fires because each application lands at a different institution. Identity verification passes because the underlying documents were built to pass it. The one thread that connects all 12 applications, the software that submitted them, is invisible to every control any of those lenders has in place.

This will not stay hypothetical for long. It is the direction agentic commerce is already heading, and it exposes a gap in fraud strategy that most lenders have not yet named, let alone closed.

The blind spot in “know your customer (KYC)”

Consumer lending fraud programs were built on a single assumption: The applicant is a person sitting at a keyboard. Identity verification, credit bureau consistency checks, device reputation, behavioral biometrics—every layer in the stack is designed to answer questions about a human being.

AI agents that shop for and apply to financial products on a person’s behalf break that assumption. When an agent submits an application, our controls still evaluate the identity data it presents. They have nothing to say about the agent itself. Who built it? What is it authorized to do? Is it acting for the person it claims to represent or for someone else entirely?

The honest answer at most lenders is: We do not know and we have no way to find out. Synthetic identity fraud is already the fastest-growing form of financial crime in the U.S.,¹ expanding at roughly 16% a year, precisely because building a convincing fake identity used to be slow, manual work.² Agents remove that constraint. They can maintain the digital footprint of a synthetic persona, cultivate a credit history and file applications at a pace and scale no fraud ring’s back office ever could.

Borrowing a century-old idea

The fix does not require inventing a new concept from scratch, it requires applying an old one to a new kind of bearer.

A passport works because it concentrates on a set of trust decisions into a single portable, tamper-evident document: Who you are, who vouches for you, where are you from, what are you permitted to do? A border agent does not investigate every traveler from first principles; they trust the passport authority that issued the document. The logic has not needed to change since, only the bearer has.

An AI agent passport applies that same structure to software instead of people: a signed, persistent credential that travels with an agent and answers five questions before the agent ever gets near an applicant’s data.

Who is this agent? A unique, persistent digital identifier lets a lender recognize the same piece of software the next time it shows up, at this institution or another one.

Who built and deployed it, and did that party pass KYC? This is the field that matters most. It forces whoever puts an agent into a lending channel to stake a verified identity on that deployment.

What is it built on? Which AI model, which orchestration software and hosted where? A lender can finally apply policy to infrastructure it can see, instead of infrastructure it must have on faith.

What is it allowed to do? A hard ceiling on loan amount, a cap on applications per day and a defined window of validity. These limits can be narrowed but never expanded once set, so a hijacked or repurposed agent cannot simply grant itself more authority.

What has it attested to? Signed confirmations that the deployment meets data protection, fair lending and audit logging obligations, with a freshness window so stale attestations lose credibility over time.

Put a valid passport requirement at the front door and a lender can reject an agent it does not recognize, trace anything that goes wrong back to an accountable human or institution and stop an agent from quietly doing more than it was ever authorized to do.

Five doors this closes on fraud rings

None of the five fields above are arbitrary, each one exists to shut down a specific pattern that current controls cannot see.

Synthetic identity fraud: The synthetic personas an agent presents can all look different, but the agent’s infrastructure behind them is persistent and can be fingerprinted across lenders. More importantly, the creator-identity requirement forces a fraud ring to either compromise a real KYC provider, which is expensive and traceable, or simply fail the check everywhere it tries.

First-party bust-out: Bust-out schemes depend on drawing down as much credit as possible before lenders compare notes, and an agent is very good at pacing that below any single institution’s velocity threshold. A hard cap on daily applications and loan amount removes the room to run that play, no matter how well the agent optimizes its timing.

Application misrepresentation: Document fabrication (plausible pay stubs, employment letters, bank statements) is an area where agents are genuinely dangerous, and today’s defenses catch it only after submission. An agent whose passport lacks a data-integrity attestation gets routed to enhanced document verification before it ever reaches underwriting.

Unauthorized delegation: This is the scenario that should worry examiners most from a victim-harm angle: a real consumer’s genuine information, lifted from a data breach, handed to an agent that consumer has never heard of. Because the underlying data is real, KYC passes cleanly. A mismatch between who built the agent and who the applicant claims to be is the strongest available signal that something is wrong.

That said, this signal must be built carefully, or it backfires. Banks, credit unions, registered advisers and fintech platforms all legitimately run agents on a customer’s behalf as a normal part of doing business: a bank’s own loan-shopping assistant, an adviser’s comparison tool acting under a client agreement. If the “creator does not match the applicant” this is treated as fraud full stop, every one of those legitimate channels gets flagged, and the false-positive volume will kill adoption in exactly the institutions that most need to be part of this system. The workable version of this control distinguishes an unexplained mismatch from one backed by verifiable authorization (an account relationship, a power of attorney, a platform agreement) and escalates only the former.

Fleet attacks: A fraud ring that stands up many agents sharing common infrastructure or provenance is running the AI-agent equivalent of a mule network. Correlating that provenance across institutions, without centrally tracking any consumer’s behavior, surfaces coordinated activity that no single lender could see on its own.

Why AML and compliance teams should care just as much

This is not only a fraud detection story; it is a compliance one.

Regulators are converging agent accountability faster than most institutions are building for it. The EU AI Act treats creditworthiness assessment as high-risk,³ which pulls agent-mediated origination workflows into conformity assessment and human oversight requirements. General Data Protection Regulation Article 22⁴ and its AI Act counterpart require that automated credit decisions come with a human-interpretable explanation, which means a denial triggered by agent verification needs to say why in plain language, not just return an error code. In the U.S., Equal Credit Opportunity Act and fair lending obligations require that whatever criteria a lender uses to accept or reject agents get tested for disparate impact⁵ like any other underwriting variable. The Financial Crimes Enforcement Network (FinCEN's) 2026 proposal⁶ to reform AML program requirements explicitly encourages institutions that deploy AI-driven compliance tooling, a signal that agent-identity infrastructure is not just tolerated but increasingly expected.

The accountability trail that a passport creates (who built this agent, who authorized it, what is it allowed to do?) is exactly the kind of documentation an examiner or regulator will expect to see once agent-mediated applications become common. Institutions building that trail now, even informally, are ahead. Institutions waiting for a mandate will be building it under deadline pressure instead.

Where this stands today

To be direct about the limits, the AI agent passport and comparable proposals are largely architecture, not shipped products.⁷ KYA-OS, an open agent identity and delegation standard from Vouched and the Decentralized Identity Foundation, is the furthest along: the specification is ratified, its reference implementation is public, and Vouched has customers running it in production today,⁸ Early deployment is not a proven track record, and the two halves of this problem mature at different rates. Key possession, delegation scope, revocation, and after-the-fact reconstruction of who authorized what are already deterministic and independently verifiable. Verification performance, validated over a full fraud cycle, risk-weighting calibrated against actual fraud outcomes rather than expert judgment, and cross-institution governance across multiple lenders and agent providers are not, and still need to be built and tested. A verified agent can still be hijacked mid-session by a bad prompt; a passport limits the blast radius of that hijack but does not prevent it. None of that makes the idea premature. It is the same place where device fingerprinting and behavioral biometrics were 15 years ago: useful, imperfect, and worth building now rather than after the fraud losses force the issue.

The practical starting point for a fraud or compliance team today is not buying anything. It is three questions worth asking this quarter:

1. Does our origination flow currently distinguish a human applicant from an agent acting on that applicant’s behalf?
2. If an AI agent applied for a loan tomorrow using a real customer’s stolen data, would anything in our stack flag it before funding?
3. Who, internally, owns the answer to “who authorized this agent to act” when an examiner eventually asks for it?

KYC told us who the applicant is; it was never built to tell us what is acting on their behalf—that is the gap agentic commerce is opening, and closing it, deliberately and now, is cheaper than closing it after the first headline case.

---

References:

1. “Synthetic identity fraud,” The Federal Reserve, FedPayments Improvement, https://fedpaymentsimprovement.org/strategic-initiatives/payments-security/synthetic-identity-payments-fraud/
2. "Mitek and Datos Insights Report Finds Synthetic Identity Fraud Is Emerging as the Defining Fraud Threat of 2026" Mitek Systems, https://www.miteksystems.com/press-releases/mitek-and-datos-insights-report-finds-synthetic-identity-fraud-is-emerging-as-the-defining-fraud-threat-of-2026
3. "Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending Regulations (EC) No 300/2008, (EU) No 167/2013, (EU) No 168/2013, (EU) 2018/858, (EU) 2018/1139 and (EU) 2019/2144 and Directives 2014/90/EU, (EU) 2016/797 and (EU) 2020/1828 (Artificial Intelligence Act) (Text with EEA relevance)," EUR-Lex, https://eur-lex.europa.eu/eli/reg/2024/1689/oj
4. "Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance)," EUR-Lex, https://eur-lex.europa.eu/eli/reg/2016/679/oj
5. "12 CFR Part 1002 - Equal Credit Opportunity Act (Regulation B)," cfpb, https://www.consumerfinance.gov/rules-policy/regulations/1002/
6. "FinCEN Proposes Rule to Fundamentally Reform Financial Institution Programs Designed to Fight Illicit Finance," FinCEN, April 7, 2026, https://www.fincen.gov/news/news-releases/fincen-proposes-rule-fundamentally-reform-financial-institution-programs
7. "Open Standards for Verifiable AI Agent Identity" Passport Alliance,https://www.passportalliance.org/; "Open Agent Passport (OAP) v1.0.0: Authorization Specification for AI Agent Interoperability" zenobo, March 7, 2026 https://doi.org/10.5281/zenodo.18901596; Minghui Xu, Xiaoyu Liu, Yihao Guo, et al., “AgentDID: Trustless Identity Authentication for AI Agents," arvix, https://arxiv.org/abs/2604.25189; Takumi Otsuka, Kentaroh Toyoda and Alex Leung, "AI Identity: Standards, Gaps, and Research Directions for AI Agents," arvix, https://arxiv.org/abs/2604.23280
8. “Decentralized Identity Foundation,” GitHub,https://github.com/decentralized-identity/kya-os-mcp "AI Agents & your business. Now with identity permissions to work together," Vouched,https://www.vouched.id/know-your-agent

Financial Crimes Enforcement Network Director Andrea Gacki is leaving the federal agency to become global head of sanctions at Citi, the bank and the Treasury Department confirmed separately in July.

Gacki will start at the bank Oct. 1, joining Citi’s independent compliance risk management leadership team, according to a company memo shared with Banking Dive. She’ll report to Tom Anderson, the bank’s chief compliance officer.

“Andrea’s deep geopolitical experience coupled with her national security and policy expertise will benefit Citi as we support our clients and businesses across the globe in navigating the increasingly complex sanctions landscape,” Anderson said in the memo. 

Jenna Casanova has been appointed FinCEN’s acting director, and Gacki will remain at the agency for several weeks to support the transition, a Treasury spokesperson said. 

Gacki is equally respected across industry and government, said Brent McIntosh, Citi’s chief legal officer and corporate secretary, in a LinkedIn post. Before leading FinCEN, Gacki was the director of the Office of Foreign Assets Control for five years, and spent years at the Justice Department. 

“Few leaders can match Andrea Gacki’s depth of experience in sanctions and financial crime,” McIntosh said in the post. “I know from our shared time at the U.S. Department of the Treasury what a dynamic leader she is. Her career has been defined by tackling the toughest issues where national security and the economy intersect. Andrea’s perspective and leadership will be a tremendous asset to Citi, and I’m looking forward to working with her as we continue to advance a critical aspect of our work.” 

McIntosh worked at the Treasury Department from 2017 to 2021, serving as general counsel and undersecretary for international affairs, according to his LinkedIn profile. 

In a statement, Gene Lange, who is carrying out the duties of undersecretary for terrorism and financial intelligence, cited Gacki’s 25 years of government service, “including nearly three years leading FinCEN during a period of significant change and accomplishment for the bureau.”

“We are grateful for her dedicated service and many contributions to Treasury's national security mission, and we wish her every success in her new role,” Lange said. 

Lange noted the department’s “deep bench of career leaders,” allowing for a “seamless” transition. 

Casanova most recently served as a senior adviser to the undersecretary for terrorism and financial intelligence, leading Treasury’s work on illicit finance priorities and coordinated policy across FinCEN, OFAC, the Office of Terrorist Financing and Financial Crimes, the Office of Intelligence and Analysis and federal law enforcement partners, a Treasury spokesperson said.

Prior to that, Casanova served as a senior enforcement officer at FinCEN and as acting section chief within the enforcement division. While there, she helped lead the enforcement effort against TD that resulted in a $1.3 billion civil money penalty.

Casanova “is an outstanding public servant with a proven record of leadership in the fight against illicit finance,” Lange said. “Her experience leading Department-wide illicit finance priorities in support of the Under Secretary for Terrorism and Financial Intelligence, combined with her background in FinCEN enforcement, federal law enforcement, and the private sector, gives her an exceptional understanding of the threats facing our financial system and the strategic, regulatory, and enforcement tools needed to address them.”

The Office of the Comptroller of the Currency has denied London-based Wise’s application to establish a national trust bank.

In a July 21 letter, Stephen Lybarger, the OCC’s senior deputy comptroller for chartering, organization and structure, said Wise’s application “presents significant supervisory and compliance concerns.” He pointed to state regulatory actions taken against Wise related to anti-money laundering compliance and that organizers didn’t demonstrate “sufficient familiarity” with federal banking laws and regulations.

Wise plans to submit a new application to the OCC for a national trust bank charter under a Genius Act framework, the company said two days later in a filing.

In July 2025, less than a month after submitting its application to the OCC, the company’s U.S. arm was hit with a multi-state consent order over deficiencies in its Bank Secrecy Act, anti-money laundering and countering the financing of terrorism programs. 

Wise US agreed to pay $4.2 million and boost its compliance investments as part of the order that revealed flaws in how the company addressed certain compliance requirements. California regulators also issued their own consent order with Wise US to address certain requirements specific to that state. 

Lybarger noted “significant enforcement actions such as these are important to, but do not ultimately control,” the OCC’s application decisions.

The denial appears to be the first from the OCC amid the current influx of charter applications during the second Trump administration. 

The OCC determined the proposed trust bank’s AML/CFT compliance would be lacking, “until Wise has addressed existing deficiencies and develops an enhanced enterprise-wide AML/CFT program.” 

Wise US has a record of compliance failure with money services businesses requirements, and the company’s application “does not support a conclusion” that it will be able to meet added AML/CFT requirements trust banks are subject to, Lybarger wrote.

Since submitting its application more than a year ago, “our business and compliance maturity have evolved significantly,” the British fintech said in its July 23 filing. 

“This includes changes we have made in response to OCC feedback throughout the application process, and the OCC’s letter published today refers to these historical issues with our original application that we have been addressing,” Wise wrote. “We look forward to submitting a viable application to the OCC in due course which reflects both our growing business and the changing regulatory landscape.”

The OCC aims to make decisions on applications within 120 days, according to its handbook. 

Lybarger also had harsh words regarding proposed leadership of the would-be trust bank. “Organizers are part of long-standing AML/CFT deficiencies at Wise US,” which “has been in continuing noncompliance” with federal AML/CFT requirements, the letter said.

That the organizers “failed to select appropriate directors and management officials with sufficient experience” with AML/CFT requirements and operations or with fiduciary activities “did not reflect favorably on the application,” Lybarger wrote.  

The proposed management and board failed to demonstrate “sufficient competence” related to services the trust bank would provide, “most notably with respect to legal and regulatory requirements relating to the exercise of fiduciary activities by national banks as well as AML/CFT requirements,” the letter said. 

Proposed leaders “have demonstrated a persistent inability to sufficiently manage” money-laundering and illicit finance risks associated with the proposed trust bank’s activities, and organizers “collectively failed to demonstrate sufficient experience with relevant banking laws and regulations related to fiduciary activities,” Lybarger wrote. 

“Further, Wise US has no historical experience with fiduciary activities, and proposed management and directors failed to demonstrate sufficient experience with the fiduciary activities of national banks, including the OCC’s regulations governing such activities,” the letter said.

The denial doesn’t preclude Wise from filing another trust bank application, but the agency expects any subsequent application would “satisfactorily address the reasons for this action,” Lybarger wrote.

In addition to the substance of the issue, “the OCC also has to think about the consequences of not issuing a denial to an entity that receives a large, public, multi-state consent order,” said Carl Goss, a Dallas-based partner at law firm Hunton Andrews Kurth. 

Given the consent order, “it seems like, at that point, a denial would have been pretty much a foregone conclusion,” said Goss, a former OCC lawyer. “I have to think [Wise] understood that that was going to be an issue.”

“Everyone is always sensitive to AML considerations,” Goss said. “It's difficult to act favorably on an application if there are even large alleged issues with AML.”

Wise said it has strengthened its U.S. program, enhanced investigation and reporting processes, improved data integrity and increased compliance resourcing.

William Blair analyst Cristopher Kennedy, in a note, said about one-third of Wise’s workforce is focused on financial crime prevention.

“We have invested significantly in enhancing our processes and controls globally and in the U.S. since the original application for the trust charter was prepared, including those to prevent financial crime alongside other forms of risk,” Wise said in its filing. “Preventing bad actors from using financial institutions like Wise is of the utmost importance to us.”

Since the company has immediately said it plans to submit a new application, Wise may have gotten some indication from the OCC that a future application could be more favorably received, “or this thing is such a big part of [Wise’s] business plan, that they're comfortable burning the resources even without such statements,” Goss said.

In light of the OCC’s critiques of proposed management, Wise may try to retrain those leaders so that they can demonstrate sufficient competence under a new application process, Goss said.  

But “if I were them, I would just find new management when I repropose,” he said. “It's also a message to future applicants that people are important, and that’s something to think hard about when you’re submitting these applications.”

A spokesperson for Wise declined to comment on proposed management under another trust bank application, or how soon it might reapply. 

Mike Boush, named in the application as the proposed CEO of Wise National Trust, appears to have left the company in December 2025, according to his LinkedIn page. The OCC’s letter was addressed to Satyan Melwani, Wise’s head of North America banking and expansion since January, according to his LinkedIn profile. 

In its July 23 statement, Wise also noted its application approach became “non-viable” following a Federal Reserve master account change proposed in May, since Wise’s application depended on receiving direct master account access at the central bank.

But the company indicated it sees new opportunities under the Genius Act.

“With digital assets, such as stablecoins, becoming more visible alongside existing payment rails, Wise's infrastructure is well positioned to play an important interoperability role in this changing ecosystem,” the fintech said. “Our ability to efficiently connect payment systems, operate treasury management, and control risk in a regulated environment are more relevant than ever before to deliver even greater outcomes for customers.”

President Donald Trump signed an executive order in March intended to confront cybercrime and fraud schemes, the day after a House subcommittee hearing detailed a “staggering” fraud problem and how to better address it. 

Trump’s order called for a comprehensive review to identify “operational, technical, diplomatic, and regulatory tools” that could be improved to combat transnational criminal organizations that perpetrate cybercrime and fraud. 

The edict also requires the submission of an action plan labeling the criminal organizations engaging in scams and cybercrime and solutions to take down their operations. Trump also wants the attorney general to prioritize prosecutions of cyber-enabled fraud and scams and offer a recommendation on establishing a program that would return seized funds to victims; and prodded the secretaries of State and Homeland Security to get involved in addressing the issue, too. 

The Consumer Bankers Association applauded Trump’s order, saying it “has long called on policymakers to address the issue through a whole-of-government strategy that works across industries to protect consumers and their hard-earned money.”  

Trump’s action “will enhance interagency coordination, pursue the criminal networks behind these attacks, and prioritize prosecution of cyber-enabled fraud,” the trade group said.

Trump’s order was issued after a House Financial Services subcommittee hearing featured bank and credit union executives emphasizing the need for better coordination among lenders, law enforcement and government to address the snowballing fraud problem. 

Industry executives also voiced support for proposed legislation geared toward combating fraud and scams. The Transaction Risk Analytics and Collaborative Exchange Act, for example, would create a framework allowing banks, payment networks, fintechs and other financial institutions to share fraud-related information in a secure way.

Rep. Andy Barr, R-KY, the chair of the financial institutions subcommittee, said the scope of the fraud problem is “staggering,” with cybercrime losses jumping 33% in 2024, to $16.6 billion. Fraudsters are becoming more sophisticated, taking advantage of artificial intelligence and social media networks to perpetrate scams, as banks and credit unions devote substantial resources to fight back, he said.

Still, Barr cited “serious structural challenges” to confronting the issue, including an outdated legal framework that inhibits bank information-sharing, checking-account money availability rules written in a different era, and a lack of coordination between federal and local law enforcement.

Barr also said financial regulators “often lack robust understanding” of AI and machine learning, preventing the establishment of “clear guardrails” for lenders.

Gay Dempsey, the CEO of Fayetteville, Tennessee-based Bank of Lincoln County, told the subcommittee her bank has seen a significant rise in check fraud, as well as impostor scams, enabled by social media platforms and bitcoin ATMs. 

The $225 million-asset lender is investing considerable time and resources in consumer education and staff training to spot fraud and report suspicious activity, since fraud losses exceed the bank’s loan losses, she said. 

Scams in which victims are told to deposit money in bitcoin ATMs are “rampant,” Dempsey said, noting that it’s a challenge to get a customer to accept they’ve been the victim of a romance scam.

“We’ve literally pulled up Facebook and showed them the photo, and they’ve told us, ‘Oh, they told us you were going to do that.’ We’ve shown them FBI reports, we do everything that we can from our end when we identify those to stop it and to inform them,” Dempsey said. 

Kate McKune, general counsel at Louisville, Kentucky-based Park Community Credit Union, said her credit union often runs up against “law enforcement’s limitations in terms of resources,” or it seems they can’t help unless losses are large enough. 

“Oftentimes, no amount of security investment or intervention can fully compensate for a consumer’s decision to trust a scammer,” McKune said.

Patrick McDade, senior vice president for fraud and technology risk management at Jacksonville, Florida-based EverBank, noted impersonation scams ensnaring consumers and small businesses are “especially dangerous” because they erode customer trust. 

The lack of coordination among banks and federal agencies stands in contrast to the fraudsters, who coordinate among themselves and don’t respect boundaries that law enforcement or other agencies do, witnesses said.

“We’ve had experience with banks where we call and they won’t give us any information just because of fear of sharing information, even though it should fall under the current [regulations] now, that they’re able to share with us and they don’t,” Dempsey said. 

Banks can’t face the problem alone, and because fraud activity often originates outside the financial sector, a national strategy to combat scams is essential, McDade said. 

Witnesses also recommended revising suspicious activity report policies to allow for “a fraud signal report.” 

Once a lender is aware of fraud, a report would enable “a concise way to get the metadata associated with that fraud reported to law enforcement, and if all the banks did that in the same fashion, they could immediately cross-reference that essential data and see the patterns and actually reach out and warn other banks that they might have fraudulent accounts,” McDade said. “Or even go upstream to the telecoms and the social media accounts and let them know, we’re seeing fraud on this phone number, or on this account, please take it down.”

As fraud losses mount, the subcommittee’s Democrats also blasted the Trump administration for sidelining the Consumer Financial Protection Bureau and said Congress should restore the agency’s authority to supervise payment apps and digital wallets.

President Donald Trump’s lawyers accused Capital One in August of deciding to close accounts connected to the president before gathering the evidence to do so.

The Trump team asked a federal court to deny Capital One’s motion to dismiss the March 2025 lawsuit accusing the bank of illegal debanking.

Capital One in July said an internal anti-money laundering team undertook “months of analysis and a careful review” of Trump-connected accounts before closing more than 300 of them in 2021.

Trump’s lawyers argued the investigation was not predicated on AML but was “the construction of a pretext,” adding that Capital One “buckl[ed] to political pressure and groupthink mentality.”

The bank “surveilled Plaintiffs” beginning in early 2017 “for no reason other than politics,” Trump’s lawyers argued.

Project Safeguard, as it was called, “produced only confirmation that all transactions and dealings by Plaintiffs and the other Trump-related accounts were completely proper and appropriate,” the president’s lawyers said.

The bank “broadly considered taking remedial action” twice but reconsidered because “the regulatory risk did not rise [to] the level to cause risk or concern,” the lawyers said.

“The transactions that Capital One would later invoke as a false pretext to try and justify a mass debanking – wire payments tied to a 2016 condominium project, a development project abandoned in 2016, and consulting payments back in 2008 – had been reviewed and cleared,” the attorneys asserted Friday.

The attorneys blamed “biased articles” on Trump’s finances – published in the fall of 2020 and based on “illegally stolen” tax information – for changing the “political winds.”

A Capital One representative testified under oath that “media sources … illuminated additional concerns” that prompted a new look at Project Safeguard’s conclusions, Trump’s lawyers argued.

After the Jan. 6, 2021, Capitol uprising, “Capital One shifted from monitoring to mobilizing – taking the politically self-serving path,” the attorneys said.

A Capital One executive, whose name is redacted, “directed his team to determine whether accounts tied to President Trump were receiving ‘stop the steal’ funds,” the attorneys said, using shorthand for a contentious election-fraud narrative.

The lawyers, however, asserted that the Capital One official who operationally led Project Safeguard labeled the reexamination as “logical, but also potentially concerning.”

The attorneys also highlighted an exchange between two Capital One investigators.

“I don’t think I would close solely on AML reasons,” one wrote.

A second investigator agreed and proposed designating certain transactions as “the straw,” the attorneys noted.

“I think [redacted] has the final chapter of the book written and we all agree with it but we still need to write the chapters leading up to that,” an investigator added, according to the lawyers.  

“Yeah exactly,” the other investigator allegedly replied. “We all agree where this is headed but that doesn’t mean we are there.”

Soon after, a presentation identified Capital One by name and logo as one of three companies under media scrutiny for maintaining its relationship with Trump, the attorneys noted.

A Capital One representative testified that the presentation had “nothing to do with” the bank’s decision to close Trump-connected accounts, the attorneys said. But Trump’s team, at the same time, noted a redacted bank employee’s reaction to the presentation: “I think [redacted] is really feeling the pressure on this one.”

Trump’s lawyers called Capital One’s reasoning for closing the accounts “weak.”

“A contractual right to terminate without cause is not a license to terminate for an unlawful reason,” the attorneys wrote, accusing the bank of “[running] two tracks.”

“Internally, it concocted and invoked a specific, documented, risk-based rationale, used it to obtain sign-off from [redacted], and executed a 366-account closure on its authority,” the lawyers said. “Externally, it concealed that rationale from the customers whose accounts it closed, and hid behind a clause that contains no substance.”

Although the financial services industry has gotten better at thwarting fraud, it “squeezes the crime balloon,” spurring criminal effort and energy to be directed toward harder-to-detect scams, a Navy Federal Credit Union executive said.

“The puzzle for fraud is really straightforward compared to scams,” said Carrie Foran Sepulveda, Navy Federal’s vice president of fraud and physical security. “We've done a ton of work on fraud. We have great defenses.” 

Fraud attempts against Navy Federal members fell by about 25% from 2024 to 2025, the credit union said. But scams have become a bigger focus area for the country’s largest credit union, since that’s where criminal activity has shifted.

To detect scams, “for the most part, it's a totally different set of signals, data, tools,” Foran Sepulveda said. 

With fraud, there are a number of different clues that help the credit union recognize and defend against someone other than the customer moving money. But with scams, it’s the customer taking action, which prompts further probing as to whether the account holder was duped into moving money or not. 

Fraud and scams “get said in the same breath often, and for the consumer, I think the experiences have a lot in common,” she said. “But from how to actually fight this, it's very different.” 

Scams impersonating the credit union or law enforcement are most common. The credit union works with the Global Anti-Scam Alliance and stays in close contact with others in financial services, as well as social media companies and law enforcement, Foran Sepulveda said. 

An artificial intelligence-based crime prevention platform is also helping Navy Federal in the scams fight. 

The Vienna, Virginia-based credit union began working with Cube AI in January. The platform uses AI bots to converse with scammers, and when scammers think they’ve snagged a victim and share a bank account or handle for the victim to send money to, Cube sends that account information to financial institutions, Foran Sepulveda said. 

“So we get a list of essentially bad accounts, we know they're being used by scammers,” she said. “It's all just AI bots who are pretending to fall for scams. They were getting told where to send the money, so we’re very confident in that account” being a scammer’s, she said.

The credit union then uses that information to confidently warn members against sending money to those accounts.

“This is getting true data to say, this is a scam account,” rather than the credit union’s hunch that the scammer’s story doesn’t add up, she said. “We're able to interdict, and we've had a lot of success in that space.” 

When AI is being used offensively by scammers and defensively by financial institutions, “it's going to create new, novel threats, and we're also going to have new, novel solutions,” Foran Sepulveda said.

The $204 billion-asset credit union has prevented about $125 million from being lost to wire scams over the past 19 months, Foran Sepulveda said. 

If there are enough red flags in a suspected scam or fraud case, Navy Federal will not send the customer’s money. In the past, the credit union had members sign an affidavit if they insisted on sending or withdrawing money despite being warned or urged not to by Navy Federal, but the credit union discontinued that practice following a related lawsuit and instead refuses to facilitate the transfer, she said. 

“If I feel that sure that you shouldn't have done it, at some point, we need to not do it,” she said. “That was a big change,” but “we’ve rallied around it.” 

To address the issue more broadly, Foran Sepulveda would like to see enhanced guidance on financial institution rights in those situations. 

“What can we do to hold funds when we think that something looks suspicious?” she said. If “we won’t send the wire, but if they say they want a cashier's check for their balance, there's nothing we can do. We don't have the right to withhold their funds from them. So, places like that where we're able to figure out, what are the rules of the road, how do we have safe harbor so that we can fight against this?”

Banks and credit unions are bolstering their scam defenses through hiring and new services and tools, as they grapple with an increase in scams targeting older customers. 

Fifth Third has expanded its scam investigations team, due to the increased volume of reported scams and the time involved in addressing them, said Kris Edwards, the bank’s head of fraud prevention. The bank declined to detail the number of recent hires, but Edwards said Fifth Third has established a dedicated scams program team and continues to hire. 

The Cincinnati-based regional is also increasing its detection strategies to better spot signals and identify scams as they’re happening, Edwards said in a recent interview. 

The bank’s goal is to intervene during a scam attempt, rather than relying on a post-scam investigation, he said.

“I'd rather spend the time calling out, ‘Hey, we're seeing some signals that you may be participating in a scam,’” where, historically, a lot of the bank’s efforts have been focused on outreach afterward, Edwards said. “I'd rather get out in front of that and place our resources there.”

Edwards told Banking Dive in April that Fifth Third has seen a “dramatic rise” in bank impersonation scams, where a fraudster impersonates the lender to trick a customer into parting with their money. Scams impersonating a government entity or tech support are also common.

In 2025, adults age 60 and older reported losses of about $7.7 billion, up about 59% from 2024, according to FBI data. And the number of complaints rose 37%, to 201,266 in 2025.   

Among other recent efforts to combat scam activity, $297 billion-asset Fifth Third has rolled out AARP’s BankSafe training for front-line staff and fraud teams, to educate them on signs of financial exploitation of older adults. And Fifth Third recently added a report phishing capability within SmartShield, its in-app security tool, which allows customers to upload a suspicious text, email or phone call so the bank’s fraud team can analyze its details.

About 25% of the submissions have been deemed fraudulent. The “good news is that 75% are legitimate, and customers are reporting just to get confirmation instead of guessing,” Edwards said. “For that other 25%, we're able to get them on the phone and help them to work through next steps and different pieces of education and prevention.”

Edwards said he didn’t expect so many of the bank’s legitimate fraud alerts to be submitted for scrutiny. 

While it’s positive that customers are on alert, Edwards said he is concerned that the bank’s real fraud alerts aren’t reaching customers, if they struggle to decipher between scam and authentic messages.

That has Fifth Third evaluating the language and phrasing used in its alerts, to make it abundantly clear messages are actually from the bank. The bank recently updated its one-time password protocol language, although Edwards noted it’s an ongoing battle.

Scammers “know exactly what our language looks like, and so it's very easy for them to replicate,” he said.

Star One

Since seeing a rise in scams targeting older members, Sunnyvale, California-based Star One Credit Union in January introduced a new opt-in service that allows members to add a trusted contact, said Vanessa Brosas, vice president of deposit services at the credit union.

That might be a family member or friend the bank can reach out to if a member can’t be reached or is exhibiting signs they might be a scam target, she said. Star One doesn’t share detailed information with the contact, but suggests they reach out to check on the member, she said.

“Sometimes it’s just a matter of talking to people,” Brosas said in a recent interview.

In other cases, the $9.3 billion-asset credit union leans on law enforcement to convince a member they’re being victimized, as it did with a recent situation where a member almost sent a wire transfer for a couple hundred thousand dollars, Brosas said.

Because bad actors try to get people to act quickly, the credit union emphasizes members should “stop, hang up and call Star One,” she said.

To help staff identify scam-related behavior, the credit union is also implementing a new fraud management system later this year that employs AI and features a consortium of thousands of financial institutions, Brosas said.

Star One also hosts webinars and visits senior centers to educate members on scams, as part of its multipronged effort. Charlotte, North Carolina-based Bank of America in June said it’s hosting 1,000 in-person scam and fraud prevention seminars through the rest of the year, as part of its efforts to educate consumers on the topic. 

As scammers alter their tactics, “you can’t just have a one-option solution when it comes to fraud mitigation,” Brosas said. “You really need to layer things on.”

To that end, Brosas welcomes the Financial Crimes Enforcement Network’s updated guidance, issued in June, which clarifies that financial institutions can share information in real time to respond quickly to emerging threats. Inhibited information sharing among banks and credit unions has prevented the industry from addressing the fraud and scams issue in a more robust way, lawmakers have said.

“We were all celebrating,” Brosas said of the FinCEN update. 

Edwards, too, said it’s a positive step and eliminates most uncertainty and legal risk tied to information sharing between banks. 

But more needs to be done, Brosas contended, from holding telecommunication companies accountable to broader education and awareness campaigns for consumers. 

“With the use of AI, if we don’t do something differently, the bad actors are going to far surpass our capabilities,” Brosas said.

The Office of the Comptroller of the Currency and the Federal Reserve issued enforcement actions against American Express and its subsidiaries in October over failures in their anti-money laundering programs.

American Express National Bank was hit with a cease-and-desist order and a $350 million civil money penalty by the OCC, while American Express and its travel-related services arm received a cease-and-desist from the Fed.

Amex’s bank subsidiary, based in Sandy, Utah, failed to tailor its Bank Secrecy Act/anti-money laundering risk assessment to its business activities, according to the OCC, by focusing too much on its “relatively narrow” demand deposit account products and services and not enough on the risks in its “more dominant” credit and charge card products.

Additionally, the bank experienced “systemic breakdowns” in its suspicious activity monitoring and reporting processes, resulting in roughly $13 billion of suspected trade-based money laundering activity between June 2014 and May 2025, the OCC said.

The Fed called $308 billion-asset Amex’s AML program issues “enterprise wide,” but particularly an issue at its national bank subsidiary.

“The OCC expects banks of American Express’s size and complexity to devote sufficient resources to ensure compliance with laws and regulations designed to detect and prevent money laundering, which are critical to both economic and national security,” Comptroller of the Currency Jonathan Gould said in a prepared statement.

Amex’s banking subsidiary must create an action plan within 90 days to address its compliance deficiencies, as well as develop an effective BSA/AML risk assessment process and consumer due diligence and risk identification program, according the OCC order. It must also engage a third party to conduct a suspicious activity review look-back.

Under the Fed order, Amex is required to submit a plan to improve its enterprise-wide BSA/AML compliance risk management program. The travel-related services arm must submit to the Fed a plan to address Office of Foreign Assets Control compliance.

Amex CEO Stephen Squeri said his company “takes its responsibility to combat financial crimes seriously,” and that it will address the concerns of both the Fed and the OCC.

“Over the last few years, we have engaged closely with regulators as we have strengthened our controls and with law enforcement to provide information,” Squeri said in a prepared statement. “While we have made meaningful progress, we know there is more work to do.”

A portion of the civil money penalty was “reserved for in prior periods,” he said, and it does not impact the full-year 2026 guidance. The consent orders are not anticipated to affect Amex’s 2027 guidance, he said.

This is the first civil money penalty imposed on a bank by the OCC since it levied a $450 million penalty against TD in October 2024, according to data from the regulator.

Toronto-based TD’s penalty was also related to BSA/AML issues, but amounted to much more: more than $3.5 billion in penalties overall, and a $434 billion asset cap on TD’s U.S. retail banking operations.

“I know $350 million penalty gets the headline, but I think the bigger question is how $13 billion went inadequately reported for so long,” said Michael Padula, a former Justice Department trial attorney in the money laundering section, on Amex’s AML issues.

"Amex’s compliance program was wholly inadequate. It looks like they had people on the front lines who didn’t have the basics, and a compliance program is only as effective as the people, resources and oversight behind it,” said Padula, who now runs his own firm in Miami.

Padula sees the enforcement actions and penalty as a signal to financial institutions that filing suspicious activity reports is non-negotiable. SARs, he said, are not only important to regulators but also to law enforcement.

“A lot of times, they’re the first line for law enforcement to pick up on trends or illegal conduct occurring in a certain geographic area or certain business area,” he said.

Banks can discuss suspicious transactions with customers and discuss the potential that their accounts might be closed, as long as they don’t disclose the filing or planned filing of a suspicious activity report, federal regulators said in September.

The Federal Reserve, Office of the Comptroller of the Currency, Federal Deposit Insurance Corp., National Credit Union Administration and Financial Crimes Enforcement Network released a joint statement to clarify how financial institutions can “ensure compliance with SAR confidentiality requirements and provide customers with transparent and timely communication as part of the bank’s fraud investigation.”

Bank personnel expressed concerns about their abilities to communicate with customers in these situations in response to a request for information issued by regulators in June 2025.

The Bank Secrecy Act prohibits disclosing a SAR or information that would reveal the existence of a SAR, and this does not change the law itself, regulators said.

But SAR confidentiality does not “prohibit banks and credit unions from communicating with a customer or other person who may be the subject of a SAR or with third parties, including other banks or credit unions, when such communication involves the underlying facts, transactions, and documents upon which a SAR is based,” the regulators said.

Banks and credit unions can inform customers about account restrictions or closures, and can tell them when a deposit has been rejected because of suspected fraud. They can also request customer due diligence-related information to understand customer relationships, and can ask a customer about the purpose of a transaction or the source of funds, according to the joint statement.