Source: https://www.paulweiss.com/practices/litigation/economic-sanctions-aml/publications/economic-sanctions-and-anti-money-laundering-developments-2017-year-in-review?id=25852
Timestamp: 2019-04-22 05:12:24+00:00

Document:
OFAC’s 2017 enforcement actions highlight the agency’s expanded jurisdictional reach as well as an increased focus on non-financial companies. OFAC also continued to make use of Findings of Violation, public enforcement actions that involve no assessment of a monetary penalty. We outline below some of the more significant enforcement actions of 2017.
Zhongxing Telecommunications Equipment Corporation and ZTE Kangxun Telecommunications Ltd. (“ZTE”). On March 7, 2017, Chinese telecommunications company ZTE reached a global $1.192 billion resolution with OFAC, DOJ, and the Department of Commerce that included a guilty plea to criminal sanctions and export control violations. ZTE’s approximately $100 million settlement with OFAC represents OFAC’s largest settlement to date with a non-financial entity. From 2010 to 2016, ZTE knowingly engaged in the systemic practice of utilizing third-party companies to obtain U.S.-origin goods, including controlled goods appearing on the CCL, which it then supplied to Iran.
The total value of ZTE’s transactions related to these 251 violations was approximately $39 million. The fact that the conduct at issue involved a “company-wide scheme” that was “developed and approved at the highest levels of management” contributed to the significant penalty. Furthermore, after learning of the U.S. regulatory investigations, ZTE deleted or attempted to delete references to Iran in internal documents and provided incomplete or altered information to its own forensic auditors. OFAC determined that these false submissions were designed to mislead U.S. regulators. This case is also notable for the significant cooperation across government agencies—it was the Commerce Department’s addition of ZTE to its entity list that forced the company to cooperate with U.S. authorities in order to maintain its access to U.S. exports.
CSE Global Limited and CSE TransTel Pte. Ltd. As described in our prior memorandum, on July 27, 2017, Singapore based CSE TransTel Pte. Ltd., and its Singaporean parent company CSE Global Limited (collectively, “TransTel”), reached an approximately $12 million settlement with OFAC. According to the settlement agreement, TransTel entered contracts to install telecommunications equipment for Iranian energy projects between August 2010 and November 2011. In furtherance of the contracts, TransTel used U.S. dollar accounts it maintained at a Singapore-based bank to make millions of dollars of payments to third party vendors—including Iranian companies—for goods and services connected to the contracts. Notably, TransTel had signed a letter of undertaking to the Singapore-based bank agreeing not to use its U.S. dollar account for Iran-related transactions. TransTel’s failure to comply with this undertaking resulted in the processing of 104 Iran-related wire transfers totaling more than $11 million dollars through the U.S. financial system, causing several financial institutions to engage in the prohibited exportation of financial services from the United States to Iran. This action appears to be the first time that OFAC penalized a non-U.S., non-financial company for violating the International Emergency Economic Powers Act (“IEEPA”) by “causing” sanctions violations through the use of U.S. dollar payments involving a sanctioned country.
COSL Singapore Ltd (“COSL”). On August 24, 2017, Singapore oilfield services company COSL agreed to a $415,350 settlement with OFAC for 55 apparent violations of the Iranian Transactions and Sanctions Regulations. COSL, a subsidiary of China Oilfield Service Limited, entered into agreements with third-party drilling companies to allow them to use COSL’s oil rigs. Under these arrangements, COSL was responsible for procuring equipment and spare parts for oil rig operations. Between 2011 and 2013, COSL purchased at least 55 orders of supplies (worth $524,664) from U.S.-based vendors on behalf of, and that were specifically intended for, re-export to four COSL oil rigs operating in Iranian territorial waters.
B Whale Corporation. On February 3, 2017, OFAC issued a finding of violation to B Whale, a Taipei based shipping company, for violations of the Iranian Transactions and Sanctions Regulations that occurred when the company’s vessel conducted a ship-to-ship oil transfer with an Iranian vessel on OFAC’s SDN list. Notably, OFAC’s jurisdiction was based on the fact that B Whale had entered into bankruptcy proceedings in the United States at the time of the transfer and that the vessel itself was “subject to U.S. sanctions regulations because it was property under the jurisdiction of a U.S. bankruptcy court.” As a result, the oil transferred to B Whale’s vessel was considered an “importation” from Iran to the United States.
ExxonMobil Corp., ExxonMobil Development Company, and ExxonMobil Oil Corp. (“ExxonMobil”). On July 20, 2017, OFAC assessed a $2 million civil penalty against ExxonMobil Corp. and two of its U.S. subsidiaries for violating OFAC’s Russia/Ukraine-related sanctions by executing eight legal documents with Russian oil company Rosneft OAO. Importantly, the legal documents were countersigned by Rosneft’s president, Igor Sechin, an SDN. OFAC took the position that by signing legal documents with Sechin, the companies dealt in the services of a blocked person. Rosneft itself is not an SDN and is not subject to blocking sanctions. ExxonMobil is challenging the penalty in federal court, arguing that U.S. sanctions applied to Sechin only in his “personal” capacity, and not in his “professional” capacity as president of Rosneft. OFAC maintains that there is no such “personal” versus “professional” distinction.
IPSA International Services, Inc. (“IPSA”) and BD White Birch Investment LLC (“White Birch”). On August 10, 2017, IPSA, an Arizona-based due-diligence firm, agreed to a $259,200 settlement with OFAC. IPSA and its Canadian subsidiary hired subcontractors to perform due diligence on Iranian nationals in Iran as part of its work related to citizenship by investment programs. OFAC alleged that, as part of its contracts with the subcontractors, IPSA “reviewed, approved, and initiated the foreign subsidiaries’ payments to providers of the Iranian-origin services” on 28 occasions. IPSA also allegedly imported Iranian-origin services into the United States on 44 occasions.
On October 5, 2017, White Birch, based in Greenwich, Connecticut, reached a settlement agreement with OFAC for $372,465. According to OFAC, White Birch USA facilitated the sale and shipment of 543,952 metric tons of paper from Canada to Sudan worth $354,602.26 in April and December White Birch USA employees were actively involved in the exportation of the paper as well as the negotiations that preceded the shipments.
These cases serve as a reminder of the facilitation risks associated with U.S. person involvement—including back office support—in transactions subject to U.S. sanctions. Companies with U.S. offices or U.S. person employees can violate U.S. sanctions by facilitating activity by their non-U.S. counterparts as to which U.S. persons are prohibited from engaging.
FinCEN saw a change in leadership in 2017, with Kenneth Blanco, a longtime DOJ prosecutor, taking over for veteran acting director Jamal El-Hindi. FinCEN issued $323 million in penalties in 2017 (compared to $20 million in 2016) and used its USA PATRIOT Act Section 311 authority to cut off a Chinese bank from the U.S. financial system. The agency was also active in issuing guidance on North Korea, Venezuela, and the risks associated with real estate transactions.
North Korea Advisory. In coordination with OFAC’s aggressive steps on North Korea sanctions, on November 2, 2017, FinCEN issued an advisory identifying a number of specific red flags that might be indicative of illicit North Korea-related financial activity. The advisory explained that North Korea relies heavily on front companies and trade-based payments in order to access the U.S. financial system. It specifically highlighted China’s Liaoning Province and Hong Kong as common areas of operation for North Korean front companies, and Liaoning-based correspondent accounts as a common feature of these transactions. The advisory suggested that financial institutions search for patterns across customers in which one company regularly making payments goes dormant at the same time that another company initiates the same pattern of activity. Other front company red flags included shared addresses, financial activity unrelated to a stated area of business, and the lack of an internet presence.
The advisory underscores the fact that the U.S. Government expects compliance departments to keep pace with increasingly sophisticated criminal strategies. The sophistication of North Korean financing may mean that a one-size-fits-all approach is particularly inapposite in this context, which may require more extensive and unique countermeasures on the part of financial institutions.
Venezuela Advisory. On September 20, 2017, FinCEN issued an advisory regarding pervasive public corruption in Venezuela. FinCEN’s then-Acting Director explained that, “particularly now, during a period of turmoil in [Venezuela], financial institutions need to continue their vigilance to help identify and stop the flow of corrupt proceeds and guard against money laundering and other illicit financial activity.” The advisory alerted financial institutions to methods that senior Venezuelan officials may use to conceal the proceeds of corruption and move such funds through the U.S. financial system. The advisory includes a list of red flags to help financial institutions detect and report suspicious activity, including transactions related to Venezuelan government contracts that: (1) are directed to companies in an unrelated line of business or to personal accounts; or (2) are corroborated by documentation showing charges substantially higher than market rates or by overly simplified documentation. Another cited red flag is real estate purchases–especially in South Florida and Houston–involving government officials or their family members and associates that are not consistent with the individuals’ official salaries.
Given the specifics in the advisory, financial institutions with Venezuelan partners or customers could be subject to additional scrutiny from regulators regarding their practices for onboarding customers, updating KYC, and monitoring transactions. Such institutions should ensure that their risk assessment, due diligence, and transaction monitoring processes account for corruption and money laundering-related risk linked to Venezuela transactions and that they file suspicious activity reports (“SARs”) when warranted.
Geographic Targeting Orders (“GTOs”) Expansion. In February 2017 and August 2017, FinCEN reissued Geographic Targeting Orders (“GTOs”) (first issued in January 2016), which require U.S. title insurance companies to report beneficial information ownership on legal entities involved in certain high-end real estate purchases. The revised GTOs capture a broader range of transactions (including transactions involving wire transfers) and now include transactions conducted in all boroughs of New York City, certain counties in the Miami metropolitan area, five counties in California (including Los Angeles, San Francisco, and San Diego), the Texas county that includes San Antonio, and the City and County of Honolulu, Hawaii. In addition to expanding the scope of the GTOs, FinCEN also published an advisory to provide financial institutions and the real estate industry with information on the money laundering risks associated with real estate transactions, including those involving luxury property purchased through shell companies, particularly when conducted without traditional financing. The advisory provides information on how to detect and report these transactions to FinCEN.
Final Rule on Customer Due Diligence and Beneficial Ownership. As discussed in a previous Paul, Weiss memorandum, FinCEN issued its final rule (“CDD Rule”) on May 11, 2016. The rule codifies new and existing customer due diligence (“CDD”) requirements under the BSA for covered financial institutions, namely, banks, broker-dealers, mutual funds, and futures commission merchants and introducing brokers in commodities. The rule has two components. First, subject to exceptions, covered institutions are required to identify the beneficial owners of their legal entity customers—including corporations, limited liability companies, partnerships, and similar entities—that open new accounts. Specifically, covered institutions must identify and verify (1) one or more natural persons, if any, who directly or indirectly own 25 percent or more of a legal entity customer, and (2) a natural person who “controls” the entity. Second, the rule supplements the traditional “four pillars” of an effective AML program by adding as a fifth pillar what FinCEN describes as “preexisting” CDD expectations necessary to comply with suspicious activity reporting requirements. Pursuant to this fifth pillar, covered institutions are required to develop customer risk profiles and to conduct ongoing monitoring to identify suspicious activity and, on a risk basis, to maintain and update customer information (including beneficial ownership information).
Banks and other covered financial institutions are already in the process of implementing this rule, and compliance is required by May 11, 2018.
Western Union Financial Services, Inc. (“Western Union”). On January 19, 2017, Western Union, a global money services business (“MSB”), agreed to a forfeiture of $586 million to resolve AML and fraud investigations by DOJ, FinCEN, and the Federal Trade Commission (“FTC”). DOJ resolution included a deferred prosecution agreement (“DPA”) in which Western Union admitted to failing to implement and maintain an effective AML program and aiding and abetting wire fraud. FinCEN assessed a $184 million civil money penalty against Western Union, which was deemed satisfied by the forfeiture. FinCEN determined that, prior to 2012, Western Union willfully violated the BSA by failing to implement and maintain an effective, risk-based AML program and by failing to file timely SARs. Western Union also failed to conduct adequate due diligence (such as background checks and on-site reviews) on a number of its foreign agents and failed to conduct enhanced due diligence on certain Latin America-based agent locations. As a result of these violations, certain agent locations and outlets that Western Union suspected were involved in fraud and money laundering were able to continue to use Western Union’s money transfer system to facilitate illicit activity. Additionally, in many cases, Western Union either failed to file SARs when warranted, or filed such SARs with delays of more than 90 days.
In addition to a penalty, Western Union also agreed to a number of remedial undertakings, including increased scrutiny and periodic reporting regarding agent SAR reporting and disclosure of corrective actions taken against agents.
Merchants Bank of California, N.A. (“Merchants”). On February 27, 2017, FinCEN announced a $7 million civil money penalty against Merchants for BSA/AML violations. FinCEN found that Merchants failed to (1) establish and implement an adequate AML program, (2) conduct required due diligence on its foreign correspondent accounts, and (3) detect and report suspicious activity. Notably, Merchants allegedly failed to effectively monitor and detect suspicious activity for transactions involving billions of dollars on behalf of MSBs and encouraged staff to process these transactions without question or face potential dismissal or retaliation. FinCEN also faulted the bank for failing to identify that several of its foreign correspondent customers were located in high-risk jurisdictions, noting that $192 million in wire transfers were processed through high-risk accounts during a three-month sample period.
Thomas E. Haider. On May 4, 2017, DOJ and FinCEN settled their long-running effort to impose a $1 million penalty against Thomas Haider—MoneyGram International, Inc.’s former chief compliance officer—for BSA/AML violations. The civil penalty proceedings against Mr. Haider commenced in December 2014, two years after MoneyGram, a global MSB, entered into a DPA with DOJ and agreed to forfeit $100 million. Pursuant to the settlement, Mr. Haider agreed to pay a $250 million penalty, as well as to a three-year prohibition barring him from performing a compliance function for any money transmitter. In addition, Mr. Haider admitted and accepted responsibility for (among other things): (1) failing to terminate specific MoneyGram outlets after being presented with information that strongly indicated that the outlets were complicit in consumer fraud schemes; and (2) failing to implement a policy for terminating outlets that posed a high risk of fraud.
As discussed in a prior publication, the Haider case exemplifies the increasing focus on individual liability in the AML arena. Federal and state regulators continue to emphasize the need to hold individuals, including executives and compliance officers, accountable for AML violations.
BTC-E a/k/a Canton Business Corporation and Alexander Vinnik. On July 26, 2017, in coordination with the U.S. Attorney’s Office for the Northern District of California, FinCEN announced a $110 million civil money penalty against BTC-e, an internet-based, non-U.S.-based money transmitter that exchanged fiat currency as well as convertible virtual currencies (including Bitcoin). FinCEN stated that BTC-E did business “substantially in part” in the United States by conducting “at least 21,000 bitcoin transactions worth over $296,000,000 and tens of thousands of transactions in other convertible virtual currencies” with U.S. customers and recipients and utilizing U.S. servers. FinCEN also assessed a $12 million penalty against Russian national Alexander Vinnik, one of the operators of BTC-e.
FinCEN found that BTC-e lacked basic AML controls and had facilitated transactions involving ransomware, computer hacking, identity theft, tax refund fraud schemes, public corruption, and drug trafficking. Among other things, FinCEN asserted that BTC-E failed to obtain required information from customers beyond a username, a password, and an e-mail address. Users had openly and explicitly discussed criminal activity on BTC-e’s user chat, and BTC-e’s customer service representatives offered advice on how to process and access money obtained from illegal drug sales on dark net markets like Silk Road, Hansa Market, and AlphaBay. FinCEN also found that BTC-e had processed transactions involving funds stolen between 2011 and 2014 from one of the world’s largest bitcoin exchanges, Mt. Gox. Lastly, FinCEN found that BTC-e had failed to file a single SAR, and had also failed to register as an MSB with FinCEN as required by law.
Bank of Dandong (Section 311 Action). On June 29, 2017, FinCEN found that Chinese-based Bank of Dandong was a financial institution of “primary money laundering concern” under Section 311 of the USA PATRIOT Act, and initiated rulemaking to cut off the Bank of Dandong’s correspondent banking relationships with the United States. On November 2, 2017, FinCEN finalized this rulemaking by imposing a prohibition on U.S. financial institutions from opening or maintaining correspondent accounts for, or on behalf of, Bank of Dandong.
The Bank of Dandong was allegedly involved in laundering money on behalf of North Korea and the Chinese trading firm Dandong Hongxiang Industrial Development (“DHID”). DHID and four of its employees were previously indicted by DOJ on charges of conspiring to use front companies to facilitate U.S. dollar transactions in violation of U.S. sanctions.
2017 marked leadership and policy announcements that may have a significant impact on future DOJ prosecutions. On the sanctions side, the most significant criminal corporate action of 2017 was the ZTE case described above. Apart from the Western Union matter described above and the Banamex USA matter described below, both involving MSBs, there were no significant DOJ enforcement actions involving AML violations. DOJ continued to focus on individual prosecutions in 2017, and sanctions and AML matters were no exception to this theme.
On June 5, 2017, President Trump announced his intent to nominate Brian A. Benczkowski to be the Assistant Attorney General of DOJ’s Criminal Division, who oversees, among other sections, the Money Laundering and Asset Recovery Section (previously known as the Asset Forfeiture & Money Laundering Section). This section leads DOJ’s AML enforcement efforts and has been involved in DOJ’s most significant recent AML and sanctions enforcement actions against financial institutions. Benczkowski’s nomination has not yet been confirmed by the Senate.
Review of DOJ Policies. Corporate enforcement and the policies governing such enforcement remain a priority for DOJ. In October 2017, Deputy Attorney General Rosenstein announced that his office would be conducting a review and incorporation into the U.S. Attorney’s Manual, where appropriate, of informal DOJ guidance. Any changes will reflect several common themes, specifically: (1) DOJ’s “resolve to hold individuals accountable for corporate wrongdoing”; (2) that “the government should not use criminal authority unfairly to extract civil payments”; (3) that “any changes will make the policy more clear and concise” and (4) that any changes will “reflect input form stakeholders inside and outside the Department of Justice.” Rosenstein also stated that “[c]orporate enforcement is an important focus” for DOJ and specifically referenced DOJ actions involving violations of AML and export control restrictions. This review is significant because it is not yet known which DOJ enforcement policies will ultimately be included in the U.S. Attorney’s Manual, or whether they will be substantially altered.
Banamex USA. On May 22, 2017, DOJ announced its first resolution of a BSA/AML matter under the Trump administration, an agreement concerning Citigroup Inc. (“Citigroup”) and one of its subsidiaries, Banamex USA (“BUSA”). Pursuant to this resolution, BUSA entered into a non-prosecution agreement (“NPA”) for a one-year period and agreed to forfeit $97.4 million. BUSA admitted that, from approximately 2007 to 2012, it willfully failed to maintain an effective AML program and file SARs relating to remittances it processed to Mexico in partnership with MSBs. Compared to past DOJ BSA/AML resolutions with other financial institutions, this resolution is notable for the relatively smaller size of the penalty, the use of an NPA (rather than a DPA or a guilty plea), and a global release for all conduct investigated by DOJ. DOJ gave BUSA and Citigroup credit, among other things, for devoting significant resources to remediating compliance violations, terminating participation in the high-risk business line at issue, and ultimately shuttering BUSA.
Sanctions Prosecution of Kassim Tajideen. On March 24, 2017, the U.S. Attorney’s Office for the District of Columbia announced the unsealing of an 11-count indictment against Kassim Tajideen of Lebanon. Tajideen and co-defendant Imad Hassoun were charged with, among other things, conspiracy to violate IEEPA and the Global Terrorism Sanctions Regulations (“GTSR”), conspiracy to commit money laundering, and conspiracy to defraud the U.S. Government. Due to his support for Hizballah, OFAC added Tajideen to the SDN List in 2009, effectively prohibiting U.S. persons from engaging in commercial transactions with Tajideen. Tajideen allegedly engaged in a complex evasive scheme—including by restructuring his business operations, creating new trade names, and misrepresenting his ownership interest in certain entities—to continue to purchase goods from U.S. companies and to use the U.S. financial and freight transportation systems while concealing his involvement in those transactions.
Sanctions Prosecution of Kenneth Zong. In December 2016, the U.S. Attorney’s Office for the District of Alaska charged Kenneth Zong and his co-conspirators with conspiracy to violate IEEPA and the ITSR, conspiracy to commit money laundering, and money laundering. Zong, a U.S. citizen, allegedly engaged in false and fictitious transactions in South Korea designed to unlawfully convert Iranian owned funds into 1 billion U.S. dollars in the span of six months. According to the indictment, Zong and his co-conspirators used an intermediary trading scheme by which Zong’s Korean shell company feigned selling construction supplies to a shell company in Iran. The Korean shell company then fictitiously purchased similar supplies from an Iranian-controlled shell company located in Dubai, which fictitiously shipped the supplies to a shell company in Iran. By fabricating bills of lading and invoices, Zong allegedly demonstrated to Korean banking regulators that Iranian funds held in restricted accounts in Korea could be released. Zong allegedly transferred the Iranian funds to his Korean shell company account, and then transferred the funds to entities and individuals throughout the world, including in Alaska and other U.S. states.
Sanctions Prosecution of Hakan Atilla and Reza Zarrab. On January 3, 2018, Mehmet Hakan Atilla, a Turkish citizen and the former Deputy General Manager of Halkbank, was convicted by a jury in the Southern District of New York on five counts relating to a scheme to violate U.S. sanctions targeting Iran. Atilla was convicted of a substantive count of bank fraud, as well as conspiracy to defraud the United States, to violate the IEEPA, to commit bank fraud, and to commit money laundering. He was found not guilty on a substantive count of money laundering.
The verdict came after an October 2017 guilty plea by Turkish-Iranian dual national Reza Zarrab relating to similar charges. Zarrab agreed to cooperate against Atilla, testifying in detail at trial how Atilla, Zarrab, and others used deceptive measures to provide the Government of Iran with access to the U.S. and international financial system. Among other schemes, using Halkbank, they took steps to conceal Zarrab’s supply of currency and gold to the Government of Iran, Iranian entities, and other SDNs. They also used a web of Turkish and other companies to make U.S. dollar payments in Iran-related transactions and used fraudulent documents to disguise prohibited transactions for Iran as transactions falling within humanitarian exceptions to the sanctions regime, and thereby induced U.S. banks to unknowingly process transactions in violations of the IEEPA.
Compliance Monitor Reports. As discussed in a prior Paul, Weiss memorandum, on July 12, 2017, the U.S. Court of Appeals for the Second Circuit ruled that a compliance monitor’s report, prepared pursuant to a 2012 DPA entered into between HSBC and DOJ and filed with the district court, could not be unsealed and made public by the district court. The Second Circuit rejected the district court’s ruling that the report was a “judicial” document subject to public disclosure and held that the district court erred in invoking its supervisory authority over the DPA in the absence of a showing of impropriety. Judge Rosemary Pooler’s concurring opinion expressed concern that the current use of DPAs allows prosecutors to “adjudicat[e] guilt and impos[e] sentences with no meaningful oversight from the courts,” and she urged Congress to consider legislation on this topic. The Second Circuit’s decision significantly limits district courts’ authority to review the substance of a DPA or to monitor its execution and implementation.
The direction of federal banking agency enforcement efforts will be influenced by President Trump’s recent nominations and appointments. President Trump has nominated Jerome Powell to replace Janet Yellen as Chairman of the Federal Reserve Board of Governors, and his appointee, Randall Quarles, has been confirmed as the Federal Reserve Board’s Vice Chair for Supervision. President Trump’s nominee Joseph Otting, former CEO of OneWest Bank, has been confirmed as head of the OCC, and the president has announced that he intends to nominate Jelena McWilliams, currently the chief legal officer for Fifth Third, to be chairman of the FDIC. While it is not clear how these appointees view enforcement in the sanctions/AML space, there appears to be considerable institutional momentum and staff commitment at each banking agency to maintain strong enforcement.
The federal banking agencies’ continued focus on BSA/AML enforcement is reflected in several actions brought against financial institutions by the Federal Reserve and the OCC.
Deutsche Bank. On May 26, 2017, the Federal Reserve levied a $41 million civil monetary penalty against Deutsche Bank AG and its U.S. operations (“Deutsche Bank”) for BSA/AML deficiencies. In the consent order, the Federal Reserve stated that its recent examination had identified “significant deficiencies” that resulted in Deutsche Bank’s failure to maintain an effective AML program, and that these deficiencies had “prevented [Deutsche Bank] from properly assessing BSA/AML risk for billions of dollars in potentially suspicious transactions processed between 2011 and 2015 for certain [Deutsche Bank] affiliates in Europe for which the affiliates failed to provide sufficiently accurate and complete information.” The conduct at issue appears to relate to the so-called Russian “mirror trading scheme” centered in Deutsche Bank’s Moscow branch, which was the subject of a DFS penalty described below. In addition to the penalty, the Federal Reserve required Deutsche Bank to engage a consultant to review its BSA/AML compliance and to conduct a transaction review of its foreign correspondent bank activity.
Citibank, N.A. On Jan. 4, 2018, the OCC issued a consent order against Citibank imposing a $70 million penalty based on the bank’s alleged failure to make the BSA/AML compliance reforms required in an OCC consent order from 2012.
Mega Bank. On January 17, 2018, the Federal Reserve and Illinois Department of Financial and Professional Regulation announced a $29 million penalty against Taiwan’s Mega International Commercial Bank and certain of its U.S. operations (“Mega Bank”) for BSA/AML violations, as well as violations of Illinois law. The consent order includes a number of requirements, including the submission of plans to create a consolidated framework for BSA/AML and OFAC compliance across the bank’s U.S. operations (including the bank’s New York, Chicago, and Silicon Valley branches) and to enhance oversight by U.S. senior management and the bank’s board of directors. Mega Bank and its New York branch are also required to engage an independent third party to conduct a lookback review of U.S. dollar clearing transaction activity for a six-month period to determine whether suspicious activity involving high risk customers or transactions was properly identified and reported. While the consent order does not detail specific findings, Mega Bank paid a $180 million penalty to the NY DFS in August 2016 based on a number of alleged AML deficiencies, including the failure to identify and report suspicious transactions with its Panama branches.
Resolutions Without Penalties. As in prior years, the federal banking agencies also issued BSA/AML-related consent orders or written agreements that lacked financial penalties. For example, BB&T Bank entered into a consent order with the Federal Reserve, which noted “significant deficiencies” in the bank’s firm-wide compliance program with respect to BSA/AML requirements. Similarly, the OCC entered into a written agreement with UBS AG New York for BSA/AML deficiencies. Both resolutions required the respective financial institutions to develop and implement plans for strengthening BSA/AML compliance; neither required a transactional lookback.
President Trump’s choice for SEC chairman, Jay Clayton, was sworn in on May 4, 2017. Under Chairman Clayton’s leadership, the SEC took several BSA/AML enforcement actions against broker-dealers last year.
In addition, the SEC alleged that from 2006 to May 2015, Merrill Lynch did not apply its automated transaction monitoring system to about 4.2 million retirement accounts, 228,000 retail brokerage accounts, and 421,000 security-based loan accounts. Although the company applied other AML detection systems to these accounts, the SEC believed they were not sufficient for the volume of transactions occurring in certain accounts. The SEC also identified other alleged deficiencies, including with respect to scoring and investigating hits produced by the transaction monitoring system.
Wells Fargo Advisors, LLC (“Wells Fargo”). On November 13, 2017, the SEC and Wells Fargo reached a settlement of $3.5 million for failure to file or timely file at least fifty SARs from approximately March 2012 through June 2013. According to the SEC, the majority of these failures involved the failure to file SARs on ongoing suspicious activity that continued after the initial filing of a SAR on related suspicious activity. The SEC found that, in 2012, new managers with responsibility over the Surveillance and Investigations group, which was responsible for investigating suspicious activity, created “confusion” by communicating to the group: that they were filing “too many SARs”; that continuing activity SARs were not a regulatory requirement; that they were to take steps to eliminate further continuing activity reviews; and that filing a SAR required “proof” of illegal activity. Among other things, the new AML management also instructed the investigators not to document any disagreements with management’s decisions not to file SARs in the company’s internal case management system, but instead to use the system to record only facts and management’s final decision. Following an employee complaint and an internal investigation, the company retained a compliance firm to re-review cases, which ultimately led to new SAR filings.
Alpine Securities Corporation (“Alpine”). In a federal lawsuit filed on June 5, 2017, the SEC charged that Alpine, a Utah-based broker-dealer, systematically failed to file SARs when required, despite having flagged transactions as suspicious. According to the SEC’s complaint, since 2001, Alpine has cleared thousands of deposits of microcap securities, most of them involving Scottsdale Capital Advisors as the introducing broker (which is owned by Alpine’s owner), and many of which were used as “part of various stock manipulation and other schemes.” The SEC also charged that the SARs that Alpine did file omitted material indications of suspicious activity of which Alpine was aware in nearly 2,000 instances. The complaint notes that regulators have repeatedly cited Alpine for SAR failures. The SEC enforcement action remains pending in federal court.
Merrill Lynch, Pierce, Fenner & Smith Incorporated (“Merrill Lynch”). On December 21, 2017, Merrill Lynch entered into a $13 million settlement with FINRA for “numerous deficiencies” in its AML controls applicable to retail brokerage accounts. FINRA essentially penalized the company for the same failures noted in the SEC enforcement action described above, but the FINRA settlement includes greater detail on suspicious account activity at Merrill Lynch’s branches in McAllen, San Diego, and New York. These accounts were used to transfer funds to and from high risk jurisdictions such as Russia, Zambia, Mexico, China, Lebanon, Panama, Venezuela, the Philippines, Syria, Egypt, Peru, Haiti, and Ecuador. One of the recurring issues was Merrill Lynch’s failure to link related accounts for purposes of transaction monitoring.
DFS continued its aggressive regulatory and enforcement activity in the sanctions/AML arena in 2017, issuing major consent orders against Deutsche Bank and Habib Bank and putting in place its new Part 504 regulation, which prescribes requirements for DFS-licensed institutions’ transaction monitoring and sanctions screening programs and mandates annual senior-level certifications.
Part 504 Regulation. As detailed in our prior memorandum, on June 30, 2016, DFS adopted Part 504, a wide-reaching set of requirements for the AML and sanctions compliance programs of DFS-regulated banks and branches. The regulation became effective January 1, 2017, and affected institutions have expended considerable resources and time over the past year in formulating their approaches to Part 504 compliance; conducting gap analyses; designing and, where possible, implementing remediation; and constructing their frameworks for annual senior-level certification, with the first certification due on April 15, 2018.
Institutions have been wrangling with a number of questions under the regulation, including how to certify compliance despite the presence of open compliance issues. On October 26, 2017, DFS published long-awaited guidance on Part 504. However, the guidance consisted of only five “frequently asked questions”; by contrast, DFS issued twenty-six FAQs on its Part 500 regulation concerning cybersecurity. The Part 504 FAQs still leave affected institutions with uncertainty on important issues.
Deutsche Bank. On January 30, 2017, DFS issued a consent order against Deutsche Bank AG and its New York branch (“Deutsche Bank”), assessing a $425 million penalty and installing an independent monitor for a two-year term to review the bank’s AML programs on a global basis, insofar as they affect the New York offices. As noted above, the Federal Reserve also assessed a $41 million penalty against Deutsche Bank for BSA/AML deficiencies. The DFS order involved an alleged “Russian mirror-trading scheme,” in which traders based mainly in the bank’s Moscow branch purportedly arranged matching securities trades, which were executed closely in time and between closely related entities and that, according to DFS, “had no economic purpose other than disguising what the client was doing.” The transactions are alleged to have also involved the bank’s London and New York offices, with more than $10 billion allegedly flowing through the latter. According to DFS, the bank missed several “clear” opportunities to identify this scheme from 2011 until early 2015. Notably, the consent order largely focuses on asserted AML deficiencies at the bank’s Moscow branch; there is little focus on actions or inactions at the bank’s New York offices. The deficiencies alleged include: flaws in KYC policies and procedures at the Moscow branch, including with respect to onboarding new customers and periodically reviewing them; the lack of a “central repository” at the bank for KYC information; and failure to accurately rate AML country and client risks.
DFS’s consent order appears to go further than previous actions in penalizing a bank for alleged AML failures that were predominantly centered outside of New York. The order suggests a DFS expectation that non-U.S. banks impose U.S.-style, “[c]entralized” AML frameworks across their global operations. The U.K. Financial Conduct Authority concurrently issued a consent order against the bank imposing a penalty of £163 million.
Habib Bank. As discussed in a previous memorandum, on September 7, 2017, DFS issued a consent order against Habib Bank Limited (“Habib”) and its New York branch that imposed a $225 million penalty for alleged persistent BSA/AML and sanctions compliance failures. In the consent order, Habib stipulated to: failing to maintain an effective AML and OFAC compliance program; failing to maintain true and accurate books and records; operating in an unsafe and unsound manner; and violating provisions of a prior written agreement and consent order. The consent order came approximately 10 days after DFS had issued a rare “Notice of Hearing and Statement of Charges,” which sought to impose a nearly $630 million civil penalty against Habib for a laundry list of violations. Habib had indicated that it planned to contest any DFS penalty and surrender its DFS banking license, thus eliminating its only U.S. branch.
Ultimately, Habib–the largest bank in Pakistan–will surrender its license to operate its New York Branch upon the fulfillment of conditions outlined in a separate Surrender Order issued by DFS. And, Habib is required to complete an expanded transactional lookback conducted by an independent consultant, which was already underway under the terms of a prior order.
This consent order is particularly notable for the relatively modest size of the penalty imposed—$11 million—compared to other AML/sanctions penalties DFS levied during Superintendent Vullo’s tenure. The order also does not impose a monitor or independent consultant and does not require that NongHyup perform a transactional lookback. Finally, DFS’s order expressly “recognizes and credits the manner in which [the Bank] has cooperated with the Department in its investigation of this matter,” and the remedies imposed reflect the DFS’s “positive consideration” of that cooperation.
In addition to the $60 million penalty, DFS required Western Union to submit a written plan designed to ensure the adequacy of its AML programs. Notably, this plan would, among other things, require all Western Union agents “around the world, regardless of their location,” to adhere to U.S. regulatory and AML standards, “unless in direct conflict with local law.” It would also require Western Union to file SARs for any suspicious activity in customer-to-customer transfers of over $2,000. The order does not, however, impose a monitor or independent consultant or require a lookback.
Licensing Conversion. In November 2017, media outlets reported on the Bank of Tokyo Mitsubishi UFJ’s (BTMU’s) decision to convert its U.S. branches and agencies—which were licensed and supervised by different state banking regulators in New York, California, Illinois, and Texas—to federal licenses granted by the OCC. BTMU sought to obtain a unified supervisory framework for its operations in the United States, and its California-based subsidiary was already OCC-supervised. Following an order issued by DFS in the aftermath of BTMU NY’s license conversion, the bank filed suit against DFS based on federal preemption. The litigation is ongoing.
The Paradise Papers. As something of a sequel to the 2016 release of the “Panama Papers” purloined from the Panamanian law firm Mossack Fonseca, in November 2017 newspapers began running stories concerning the so-called “Paradise Papers.” The Paradise Papers consist of a trove of approximately 13.4 million documents stolen from the files of Bermuda-based law firm Appleby, as well as the Singapore-based trust and corporate services company Asiaciti. The stolen documents have already been connected to more than 100 prominent politicians and political leaders—including Britain’s Queen Elizabeth and Prince Charles, Colombia’s Juan Manuel Santos, and Secretary of Commerce Wilbur Ross. The Paradise Papers have also shed light on the tax planning structures of more than 31,000 individuals and companies. In significant contrast to the public outcry following publication of the Panama Papers, the release of the Paradise Papers has generated a more muted reaction, perhaps because the conduct described in the documents is, at least in part, lawful tax planning. Nevertheless, as of this writing, a number of countries, including Canada and Australia, have initiated investigations based on the documents.
Regardless of any illicit activity, the Paradise Papers present a potential opportunity for financial institutions and other companies to gain additional intelligence on the beneficial ownership structures of, and relationships between, new or existing clients. The International Consortium of Investigative Journalists maintains a database made up of structured datasets detailing networks and interrelationships between companies and people (officers, owners, directors) and providing jurisdiction and location information. The database comprises information from four major leaks—the Offshore Leaks, the Bahamas Leaks, the Panama Papers, and the Paradise Papers—and includes information on more than 680,000 offshore companies, funds, and trusts, including more than 600,000 names of people and entities behind them. Financial institutions may want to consider whether this information could be appropriately utilized to improve KYC and suspicious activity monitoring efforts.
The Russian Laundromat. In 2014, the Organized Crime and Corruption Reporting Project (“OCCPRP”) unveiled the “Russian Laundromat,” an alleged criminal scheme designed to move vast sums of illegal funds out of Russia. In March 2017, the OCCPRP revealed, for the first time, details regarding how the scheme was allegedly structured.
Between 2011 and 2014, at least $20.8 billion was allegedly laundered through 19 Russian banks. The funds allegedly went to 5,140 companies with accounts at 732 banks, including global financial institutions, in 96 countries. Typically, one offshore shell company (the “loaning company”) would pretend to loan a large sum of money to another overseas shell company (the “receiving company”). Most of the loaning and receiving companies were located in the United Kingdom. Russian businesses, fronted by Moldovans, would then guarantee these “loans.” The receiving companies would fail to return the “money.” Moldovan judges (complicit in the alleged scheme) would then authenticate the “debt,” allowing the Russian companies to transfer real money to Moldindconbank in Moldova. From there it was transferred to a Latvian bank, Trasta Komercbanka. Moldovan prosecutors have reportedly launched criminal cases against 14 judges as well as 10 senior bank managers, 10 senior central bank officials, and four bailiffs in relation to the scheme.
The OCCPRP website lists the thousands of shell companies allegedly involved in the scheme, as well as the volumes of dollars allegedly processed through major global financial institutions. Financial institutions may want to consider whether and how to use this information to evaluate their own transactions.
AML/CFT Modernization Legislative Proposals. Both the Senate and House of Representatives are discussing measures to modernize the U.S. AML/counter-financing of terrorism (“CFT”) regime.
There appears to be growing support across the banking industry, law enforcement, and legislators in favor of addressing the use of shell companies with anonymous ownership. One draft bill under consideration, the Counter Terrorism and Illicit Finance Act, would be sponsored by Congressmen Steve Pearce (R-NM) and Blaine Luetkemeyer (R-MO) and would require new and existing corporations to report beneficial ownership information to FinCEN. Such a measure could remove some burden from financial institutions in complying with FinCEN’s 2016 regulation on customer due diligence and beneficial ownership. The draft House bill also includes provisions requiring the Secretary of the Treasury to: facilitate information sharing between government and financial institutions; encourage the use of technological innovation in AML programs; and establish and publicize priorities for AML/CFT laws. Another House bill, the Anti-Money Laundering and Counter-Terrorism Financing Modernization Act introduced by Congressmen Ed Royce (R-CA) and Vicente Gonzalez (D-TX), would similarly promote greater information sharing and require the Treasury Department to explore the potential role of technology in money laundering and terrorist financing detection efforts.
Another theme in AML/CFT regime modernization discussions is addressing the use of cryptocurrencies for illicit activities. A bill considered in November 2017 by the Senate Committee on the Judiciary—the Combating Money Laundering, Terrorist Financing, and Counterfeiting Act—is sponsored by Senator Chuck Grassley (R-IA) with bipartisan co-sponsorship and would amend the definition of “financial institutions” to which U.S. AML laws apply to include issuers of digital currencies and digital currency exchangers and tumblers. The Senate bill would also make it a crime to lie to a financial institution about the beneficial ownership or control of an account or assets in an account at the financial institution.
On January 9, 2018, the Senate Committee on Banking, Housing, and Urban Affairs held a hearing on modernizing U.S. AML/CFT laws. The witnesses from industry and AML/CFT groups testified that amendments to the current regime should require entities incorporated in the United States to report their ownership information and should address the use of cryptocurrencies. There was also general agreement that the incorporation of innovative technologies and artificial intelligence could improve the efficiency of financial institutions’ transaction monitoring. One area of disagreement in the hearing was whether monetary thresholds that trigger currency transaction reports should be increased, as contemplated in the aforementioned House proposals.
1. Take proactive steps to analyze data and identify risky parties. As illicit actors develop increasingly sophisticated schemes to evade sanctions and AML controls, regulators are expecting companies—and financial institutions in particular—to develop more sophisticated compliance solutions. While it is not possible (or reasonable, in a risk-based compliance environment) to detect every illicit transaction, there are steps that companies can take to stay ahead of the curve. These steps include leveraging public information and internal reporting to identify entities and individuals with potential ties to sanctioned parties and sanctioned countries, searching for any such identified entities or individuals within customer accounts/transactions, and conducting “micro” lookbacks to identify parties associated with problematic transactions. Such efforts should make use of the guidance issued by FinCEN on detecting North Korean front activity and corrupt activity related to Venezuela, and should also utilize sources as diverse as C4ADS (a nonprofit that maps elicit North Korean networks), U.N. sanctions reports, and data from the Paradise Papers, the Russian Laundromat, and similar phenomena.
2. Bolster customer due diligence, customer screening, and transaction monitoring. A main theme of enforcement continues to be the failure to identify the prohibited status of certain customers, often despite the fact that such information was within an institution’s possession or readily accessible. The reasons for these problems include weak procedures, inadequate information sharing across an institution’s branches and units, and systems misconfigurations. Financial institutions should continue to bolster their KYC and CDD efforts, as well as strengthen their daily screening of customers. And as evidenced by DFS’s consent order against Deutsche Bank, the more difficult but necessary task is ensuring that strong and relatively consistent procedures are in place across the institution’s locations worldwide, given that deficiencies at non-U.S. branches can expose the U.S. locations to sanctions/AML risk.
FinCEN’s action against BTC-e highlights the increased AML-related risks associated with certain FinTech companies. Although the FinTech regulatory environment is relatively nascent, the BTC-e action demonstrates the U.S. Government’s ability to employ existing MSB-related AML regulations as an enforcement tool. Additionally, financial institutions and companies with FinTech companies as customers or partners should consider adopting appropriate KYC and CDD mechanisms to mitigate against these enhanced risks.
Non-financial companies should also implement risk-based due diligence and screening procedures, commensurate with their business operations and risk profiles. For example, OFAC’s settlement with Cartier highlights the sanctions risks for retail companies that engage in international transactions and drives home the need for all U.S. entities to develop, implement, and maintain risk-based compliance programs based upon the scope and nature of their operations. Depending on a company’s international business profile, a risk-based approach may counsel in favor of incorporating OFAC prohibited-party screening, in addition to country/region-based screening, into the company’s procedures for processing customer transactions.
3. Strengthen due diligence on foreign correspondent banks, including affiliates. Regulators have increasingly emphasized the importance of conducting risk-based due diligence on foreign correspondent banking clients, which generally present heightened risks. One of these risks includes “nested” activity, in which a correspondent banking client is serving as an intermediary for an upstream and potentially unknown bank. For example, the DFS consent order against Habib Bank noted that the bank had not conducted sufficient due diligence on a correspondent banking client, Al Rajhi Bank, a Saudi entity with alleged links to Al Qaeda. The Al Rajhi account allegedly engaged in correspondent clearing activities for several of Al Rajhi’s own affiliates, including Al Rajhi branches in Malaysia and Jordan. According to the DFS consent order, this nested account activity was entirely unknown to New York branch management, as it was not captured in the relevant customer file or correspondence and was not accounted for by Habib’s transaction monitoring system.
Since at least HSBC’s December 2012 DPA, regulators expect banks to conduct due diligence on their non-U.S. branches and other affiliates as though they were unaffiliated banks. As a practical matter, regulators’ diligence expectations are sometimes even higher with respect to affiliates, as there is a general assumption that a U.S. branch can obtain greater access to its affiliates’ information, despite non-U.S. banking and privacy laws that might pose significant obstacles. Although it is sometimes institutionally difficult for a U.S. branch to conduct this sort of diligence on its affiliates (much less its head office), regulators will generally expect to see thorough diligence, including a well-documented review of the non-U.S. affiliate’s compliance systems, products, customer types, and other risk factors. For instance, the DFS consent order against NongHyup faulted the New York branch for conducting inadequate diligence on the NongHyup Head Office and its executive management.
4. Consider implementing or updating standards for wire messages. Given the regulatory focus on wire transfers, financial institutions should consider establishing or updating policies governing the minimum information required to be included in wire messages. DFS, in particular, has signaled the importance of including sufficient information in wire messages to promote sanctions screening and AML transaction monitoring. For example, in its consent order against Habib Bank, DFS faulted the bank for processing wires that omitted “essential information” from SWIFT payment messages, “such as the identities of the ultimate originator and beneficiary of each transaction.” Another relevant precedent is DFS’s 2014 consent order against Standard Chartered Bank (“SCB”), which required, among other remedial measures, that SCB’s New York branch require that SCB affiliates include originator name and address (including country) information and any beneficiary identification information received in wire messages sent to the New York branch. DFS further obligated SCB’s New York branch to obtain any missing originator address information and to “undertake good faith efforts” to do the same for missing beneficiary address information. Processing payments without this identifying information could expose financial institutions to sanctions and AML risk. Similarly, given the increasing regulatory focus on data integrity, policies on wire messages can prescribe the number of characters in input fields and other controls to help ensure that wire information is not inadvertently truncated or deleted as it travels through the banks’ systems and is converted to the SWIFT format.
5. Consider risks posed by Russia-related secondary sanctions. The secondary sanctions provisions enacted in the CAATSA legislation create new risks for non-U.S. and U.S. entities alike, even as there remains uncertainty as to whether or how the Trump administration would implement these “mandatory” and “discretionary” provisions. It is particularly important for non-U.S. entities to conduct enhanced due diligence, if they wish to participate in: transactions targeted by secondary sanctions, including the privatization of Russia’s state-owned assets; investment in, or the provision of significant goods or services to, Russian energy export pipeline projects (a potentially broad category that will likely be the subject of negotiations between the United States and EU countries); or significant transactions with the Russian defense and intelligence sectors. Non-U.S. entities also face the risk of sanctions for knowingly facilitating significant transactions, including deceptive or structured transactions, for or on behalf of any Russian related parties on the SDN list or SSI list—regardless of whether the transactions have a U.S. nexus.
Meanwhile, U.S. entities may want to consider the commercial and reputational concerns associated with entering into business relationships with non-U.S. entities facing a significant risk of secondary sanctions. For example, U.S. defense companies may want to consider the risk of secondary sanctions in deciding whether to form new business relationships with (currently non-designated) entities that are potential targets of future sanctions, and financial institutions may want to screen for such transactions.
We will continue to monitor sanctions and AML developments and look forward to providing you with further updates.
 On October 20, 2017, President Trump announced the designation of North Korea as a state sponsor of terrorism, triggering additional sanctions authorities. From a compliance perspective, this designation was largely symbolic, as it is mostly duplicative of other sanctions authorities already in place. See Jeff Mason, Trump Declares North Korea State Sponsor of Terrorism, Triggers Sanctions, Reuters (Nov. 20, 2017), available here.
 OFAC’s March 7, 2017 settlement agreement with ZTE is available here.
 The March 7, 2017 OFAC enforcement information is available here.
 Paul, Weiss memorandum, OFAC Breaks New Ground By Penalizing Non-U.S. Companies for Making U.S. Dollar Payments Involving a Sanctioned Country (July 28, 2017), available here.
 The July 27, 2017 OFAC enforcement information is available here.
 See Paul, Weiss, OFAC Breaks New Ground By Penalizing Non-U.S. Companies for Making U.S. Dollar Payments Involving a Sanctioned Country (July 28, 2017), available here.
 The June 26, 2017 OFAC enforcement information is available here.
 The August 24, 2017 OFAC enforcement information is available here.
 See U.S. Dep’t of the Treasury Office of Foreign Assets Control, Enforcement Information for Feb. 3, 2017, available here.
 See U.S. Dep’t of the Treasury, Office of Foreign Assets Control, Enforcement Information for July 20, 2017, available here. Rosneft is on the SSI List as subject to Directives 2 and 4 under Executive Order 13662 of March 20, 2014, “Blocking Property of Additional Persons Contributing to the Situation in Ukraine,” but those authorities are not implicated in the enforcement action. Rosneft is not subject to blocking sanctions.
 See U.S. Dep’t of the Treasury, Office of Foreign Assets Control, The U.S. Department of the Treasury's Office of Foreign Assets Control Assesses a Civil Monetary Penalty Against ExxonMobil Corporation (Jul. 20, 2017), available here.
 The September 26, 2017 OFAC enforcement information is available here.
 The August 10, 2017 OFAC enforcement information is available here.
 The October 5, 2017 OFAC enforcement information is available here.
 The November 28, 2017 OFAC enforcement information is available here.
 See Section 560.325 of the Iranian Transactions and Sanctions Regulations.
 FinCEN Advisory FIN-2017-A008, Advisory on North Korea’s Use of the International Financial System, dated Nov. 2, 2017, available here.
 Striking a similar note in 2016, Juan Zarate, former Assistant Secretary of the Treasury for Terrorist Financing and Financial Crimes, described the future of BSA/AML compliance as follows: “Higher-quality data and greater information sharing would be essential for this model, using big data capabilities, biometrics and identity verification, and network and behavioral analysis.” See Juan Zarate & Chip Poncy, Designing a New AML System (2016), available here. This trend is already emerging more broadly in the form of in-house Financial Intelligence Units (FIUs) dedicated to investigations beyond day-to-day monitoring and the more frequent deployment of sophisticated analytics software.
 U.S. Dep’t of the Treasury, Fin. Crimes Enforcement Network, Advisory on Widespread Public Corruption in Venezuela (Sept. 20, 2017), available here.
 U.S. Dep’t of the Treasury, Fin. Crimes Enforcement Network, FinCEN Warns Financial Institutions to Guard Against Corrupt Venezuelan Money Flowing to U.S. (Sept. 20, 2017), available here.
 U.S. Dep’t of the Treasury, Fin. Crimes Enforcement Network, FinCEN Advisory to Financial Institutions and Real Estate Firms and Professionals (Aug. 22, 2017), available here.
 See Paul, Weiss, FinCEN Issues Sweeping Requirements on the Collection of Beneficial Ownership Information and Customer Due Diligence (May 10, 2016), available here; see also Customer Due Diligence Requirements for Financial Institutions, 81 Fed. Reg. 29397 (May 11, 2016).
 See United States v. The Western Union Company, No. 1:17-cr-00011 (M.D. Pa. Jan. 19, 2017).
 U.S. Dep’t of the Treasury, Fin. Crimes Enforcement Network, FinCEN and Manhattan U.S. Attorney Announce Settlement with Former MoneyGram Executive Thomas E. Haider (May 4, 2017), available here.
 The National Law Journal, R. Gonzalez and J. Carey, The Government’s Making AML Enforcement Personal (Feb. 22, 2016).
 Final Rule, Imposition of Special Measure Against Bank of Dandong as a Financial Institution of Primary Money Laundering Concern, Nov. 8, 2017, available here.
 U.S. Dept. of Justice, Four Chinese Nationals and China-Based Company Charged with Using Front Companies to Evade U.S. Sanctions Targeting North Korea’s Nuclear Weapons and Ballistic Missile Programs (Sep. 26, 2016), available here.
 Ian Talley, WSJ, U.S. to Sanction Chinese Bank Over North Korea Financing (June 29, 2017), available here.
 Testimony of Assistant Secretary Billingslea to House Foreign Affairs Committee (Sept. 12, 2017), available here.
 U.S. Dept. of Justice, Banamex USA Agrees to Forfeit $97 Million in Connection with Bank Secrecy Act Violations (May 22, 2016), available here. Paul, Weiss represented Citigroup and BUSA in this matter.
 DOJ recognized BUSA’s prior payment of $140 million in penalties to the Federal Deposit Insurance Company and the California Department of Business Oversight to resolve related BSA/AML investigations.
 U.S. Dept. of Justice, Lebanese Businessman Tied to Hizballah Arrested For Violating IEEPA and Defrauding the U.S. Government (Mar. 24, 2017), available here.
 Indictment, United States v. Tajideen, 1:17-cr-00046-RBW, (D.D.C. Mar. 7, 2017); U.S. Dept. of Justice, Lebanese Businessman Tied to Hizballah Arrested For Violating IEEPA and Defrauding the U.S. Government (Mar. 24, 2017), available here.
 Indictment, United States v. Zong, 3:16-cr-00142-SLG-DMS (D. Alaska Dec. 14, 2016), ECF No. 1.
 U.S. Dep’t of Justice, Turkish Banker Convicted of Conspiring to Evade U.S. Sanctions Against Iran and Other Offenses (Jan. 3, 2018), available here.
 Sealed Superseding Information, United States v. Zarrab, 1:15-cr-00867-RMB (S.D.N.Y. Oct. 16, 2017), ECF No. 364.
 Paul, Weiss, Second Circuit Rules that Compliance Monitor’s Report is not a Judicial Document, Rejecting District Court’s Supervisory Power Over Deferred Prosecution Agreement (Jan. 18, 2017), available here.
 U.S. v. HSBC Bank, N.A., 16-308(L), slip op. at 3 (2d Cir. July 12, 2017) (Pooler, J., concurring).
 In December of 2017, DOJ submitted to the district court a motion to dismiss the criminal information DOJ filed against HSBC five years earlier. Under the DPA, DOJ agreed that it would move to dismiss the information against HSBC within 30 days following the expiration of the DPA’s five-year term, provided that HSBC fully complied with its obligations under the DPA. DOJ informed the district court that it had determined that HSBC complied with its DPA obligations, and, accordingly, dismissal of the information with prejudice was appropriate. That same day, the district court granted the government’s motion and dismissed the information against HSBC with prejudice. Motion to Dismiss Information at 2, United States v. HSBC Bank, USA, N.A., et al., No. 12 CR 763 (AMD), (E.D.N.Y. Dec. 12, 2017) (“HSBC”), ECF No. 96.
 Office of the Comptroller of the Currency, OCC Report Discusses Key Risks for Federal Banking System (Jan. 18, 2018), available here.
 Jeff Cox, Trump Picks Jerome Powell to Succeed Yellen as Fed Chair, CNBC.com (Nov. 2, 2017), available here.
 Jesse Hamilton, Senate Confirms Ex-Carlyle Executive Randall Quarles as Fed Vice Chairman, Bloomberg (Oct. 5, 2017), available here.
 Pete Schroeder & Patrick Rucker, Ex-banker Otting Confirmed as U.S. Comptroller of the Currency, Reuters (Nov. 17, 2017), available here.
 Pete Schroeder, Trump Taps Fifth Third Lawyer McWilliams to Lead FDIC, Reuters (Dec. 1, 2017), available here.
 Brett Wolf, Exclusive: Trump Unlikely to Curb AML rules; new, ‘fairly loose’ cyber standards seen–Guiliani, Reuters (Mar. 11, 2017), available here.
 See Bd. Of Governors of the Fed. Reserve System, Cease and Desist Order Issued Upon Consent Pursuant to the Federal Deposit Insurance Act, as amended, In the Matter of Deutsche Bank AG, et al. (May 26, 2017), at pg. 2–3.
 Financial Conduct Authority, FCA fines Deutsche Bank £163 million for serious anti-money laundering controls failings (Jan. 31, 2017), available here.
 Office of the Comptroller of the Currency, OCC Assesses $70 Million Civil Money Penalty Against Citibank (Jan. 4, 2018), available here.
 See Bd. Of Governors of the Fed. Reserve System, Cease and Desist Order and Order of Assessment of a Civil Money Penalty Issued Upon Consent Pursuant to the Federal Deposit Insurance Act, as amended, In the Matter of Mega International Commercial Bank (Jan 17, 2018).
 See Bd. Of Governors of the Fed. Reserve System, Cease and Desist Order Issued Upon Consent Pursuant to the Federal Deposit Insurance Act, as amended, In the Matter of BB&T Corporation (Jan. 25, 2017).
 See U.S. Dep’t of the Treasury, Comptroller of the Currency, Agreement by and between UBS AG New York, New York, and The Office of the Comptroller of the Currency (March 24, 2017).
 See Securities and Exchange Commission, Order Instituting Administrative and Cease-and-Desist Proceedings, Pursuant to Sections 15(b) and 21C of the Securities Exchange Act of 1934, and Section 203(e) of the Investment Advisers Act of 1940, Making Findings, and Imposing Remedial Sanctions and a Cease-and-Desist Order, In the Matter of Merrill Lynch, Pierce, Fenner & Smith Incorporated (Dec. 21, 2016).
 See Securities and Exchange Commission, Order Instituting Administrative and Cease-and-Desist Proceedings Pursuant to Sections 15(b) and 21C of the Securities Exchange Act of 1934, Making Findings, and Imposing Remedial Sanctions and a Cease-and-Desist Order, In the Matter of Wells Fargo Advisors, LLC (Nov. 13, 2017).
 See Complaint, U.S. Sec. & Exch. Comm’n v. Alpine Securities Corporation (S.D.N.Y. June 5, 2017), available here.
 FINRA’s 2018 Annual Regulatory and Examinations Priorities Letter, available here.
 See Merrill Lynch, Financial Industry Regulatory Authority Letter Of Acceptance, Waiver And Consent (Dec. 23, 2016), available here.
 See our prior Paul, Weiss memorandum, New York DFS Finalizes Stringent Anti-Money Laundering and Sanctions Regulation (Jul. 1, 2016), available here.
 N.Y. Dep’t of Fin. Servs., Frequently Asked Questions Regarding 3 NYCRR 504 (Oct. 26, 2017), available here.
 N.Y. Dep’t of Fin. Servs., Frequently Asked Questions Regarding 23 NYCRR 500 (Mar. 1, 2017), available here.
 N.Y. Dep’t of Fin. Servs., Consent Order Under New York Banking Law §§ 39, 44 and 44-a in the Matter of Deutsche Bank AG and Deutsche Bank AG New York Branch (Jan. 30, 2017) , available here.
 Federal Reserve, Order to Cease and Desist and Order of Assessment of a Civil Money Penalty Issued Upon Consent, Pursuant to the Federal Deposit Insurance Act, as Amended (May 26, 2017), available here.
 N.Y. Dep’t of Fin. Servs., DFS Fines Deutsche Bank $425 Million for Russian Mirror-Trading Scheme (Jan.30, 2017), available here.
 The consent order can be found here. For a more detailed analysis of the Habib case, see a prior Paul, Weiss memorandum available here.
 The August 24, 2017 notice of hearing and statement of charges by DFS is available here. While the document is dated August 24, 2017, DFS did not publish it until August 28, 2017.
 The order regarding the surrender of the Branch’s banking license can be found here.
 The order regarding the expanded transactional lookback can be found here. DFS’s December 15, 2015 consent order against Habib is available here. The Federal Reserve’s December 11, 2015 consent order against the Habib is available here. As noted by DFS, Habib had recognized compliance issues dating back more than a decade, as evidenced by a December 2006 agreement among Habib, the Federal Reserve, and the New York State Banking Department, which is available here.
 N.Y. Dep’t of Fin. Servs., DFS Fines Habib Bank and its New York Branch $225 Million for Failure to Comply with Laws and Regulations Designed to Combat Money Laundering, Terrorist Financing, and Other Illicit Financial Transactions (Sep. 7, 2017), available here.
 N.Y. Dep’t of Fin. Servs., Consent Order Under New York Banking Law §§ 39 and 44 in the Matter of NongHyup Bank and NongHyup Bank, New York Branch (Dec. 21, 2017), available here.
 The consent order can be found here.
 N.Y. Dep’t of Fin. Servs., Consent Order Under New York Banking Law §§ 39 and 44 in the Matter of Western Union Financial Services, Inc. (Jan. 4, 2018)(hereafter, the “Consent Order”).
 N.Y. Dep’t of Fin. Servs., DFS Fines Western Union $60 Million for Violations of New York’s Anti-Money Laundering Laws and for Ignoring Suspicious Transactions to Locations in China (Jan. 4, 2018), available here.
 As with the Panama Papers, the Paradise Papers were leaked to reporters affiliated with the German newspaper Suddutsche Zeitung and then shared with the International Consortium of Investigative Journalists (“ICIJ”), a network of more than 380 journalists from journalistic institutions around the world.
 OCCRP, The Russian Laundromat Exposed, available here.
 The draft bill, as published by the House Financial Services Committee, is available here.
 H.R. 4373, 115th Cong. (1st Sess. 2017), available here.
 S. 1241, 115th Cong. (1st Sess. 2017), available here.
 N.Y. Dep’t of Fin. Servs., Consent Order Under New York Banking Law §§ 39, 44 and 605 in the Matter of Habib Bank Limited and Habib Bank Limited, New York Branch (Aug. 24, 2017), at 8.

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.