This Week in Global Compliance — Bank AML Penalties, Cartel Horse Racing and Charity-Channel Risks
October 16, 2026 — Week of 10–16 October
Executive Summary
Four distinct enforcement and financial-intelligence developments between 13 and 15 October point to a coherent operational pattern: U.S. authorities are targeting weaknesses and intermediaries across both the regulated financial system and the commercial structures used to move illicit proceeds. The actions covered a major bank's AML failures, a cartel-linked commercial network, and financial channels allegedly used to support Iranian sanctions evasion.
On 13 October, the Financial Crimes Enforcement Network (FinCEN), the Office of the Comptroller of the Currency (OCC), and the Office of Foreign Assets Control (OFAC) announced separate measures against Bank of America. On the same day, OFAC designated individuals and businesses connected to Cartel del Noreste, including actors in quarter-horse racing. On 15 October, FinCEN issued an alert on the potential misuse of religious charity networks, while Treasury announced further designations targeting Iran-related international financial channels.
The pattern is not simply an increase in sanctions or penalties. It highlights two distinct control challenges: financial institutions must identify and report suspicious activity effectively, while investigators and compliance teams must understand how funds move through commercial businesses, charities, foreign banks, exchange houses, and offshore structures. GFN's FinCEN Flags Iranian Abuse of Religious Charity Networks, published on 15 October, connects directly to this week's wider focus on the potential misuse of legitimate financial channels. The evidence supports this focused synthesis; it does not establish that every sector or jurisdiction is experiencing the same trend.
Top Signals
1. U.S. regulators imposed major penalties on Bank of America for persistent AML control failures
On 13 October 2026, FinCEN announced a $1.2 billion penalty against Bank of America, N.A., for failing to mitigate and report priority national-security risks, including Chinese money-laundering networks and illicit finance along the U.S. southwest border. The OCC separately assessed a $750 million civil money penalty for deficiencies in the bank's Bank Secrecy Act/anti-money-laundering programme. OFAC also announced an $11.6 million settlement over apparent sanctions violations involving programmes related to Iran, Russia, narcotics, and global terrorism.
FinCEN stated that the bank admitted willful violations of the Bank Secrecy Act. The OCC cited deficient transaction monitoring, late suspicious activity reports (SARs), inadequate escalation of potentially suspicious activity, shortcomings in staff expertise, and weaknesses in independent audit. The OCC also noted that deficiencies persisted after a December 2024 cease-and-desist order.
The actions distinguish between the failure to maintain an effective AML programme and the failure to comply with sanctions requirements. Together, they demonstrate how deficiencies in monitoring, investigation, reporting, and governance can produce overlapping enforcement exposure.
Why it matters:
Compliance leaders should test whether transaction monitoring produces timely, well-supported investigations and SAR decisions, rather than measuring performance primarily through alert volumes or case-closure rates. Independent testing should examine escalation delays, coverage gaps, correspondent-account due diligence, staff capability, and whether previously identified weaknesses have been remediated in practice.
Sources: FinCEN, FinCEN Assesses $1.2 Billion Penalty against Bank of America, 13 October 2026; OCC, OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance, 13 October 2026; U.S. Department of the Treasury, U.S. Treasury Announces Record Enforcement Actions Against Bank of America, 13 October 2026.
2. OFAC targeted Cartel del Noreste's commercial network, including quarter-horse racing
On 13 October 2026, the U.S. Treasury's Office of Foreign Assets Control designated four individuals and 11 entities connected to Cartel del Noreste (CDN), a U.S.-designated Foreign Terrorist Organization. Treasury identified businesses and individuals associated with quarter-horse racing, construction, trucking, and the oil and gas sector.
Treasury described the action as targeting commercial operations that support the cartel's activities and identified the horse-racing sector as a channel used to launder illicit proceeds. The package extended beyond individuals directly associated with the criminal organisation to businesses connected to its broader commercial footprint.
The case illustrates why financial-crime exposure may not be apparent from a customer's primary business description alone. Commercial entities operating in otherwise legitimate sectors can create indirect exposure where ownership, control, transactions, or business relationships connect them to designated criminal networks.
Why it matters:
Risk assessments should consider the economic purpose of transactions, beneficial ownership, related businesses, and counterparties across a customer's commercial network. For higher-risk customers, unexplained links between business revenues, asset purchases, racing activity, and connected entities may warrant enhanced due diligence and documented investigation. These indicators should support risk-based review, not automatic conclusions of criminal conduct.
Deep Dives
1. FinCEN's charity-network alert places donation flows within Iran-related sanctions-evasion risk assessments
On 15 October 2026, FinCEN issued an alert asking financial institutions to report potential Iranian regime abuse of religious charity networks, including the diversion of religious tithes known as khums. The alert forms part of Operation Economic Outcast, the U.S. initiative targeting Iranian illicit finance and sanctions evasion.
GFN's Daily Brief, FinCEN Flags Iranian Abuse of Religious Charity Networks, published 15 October 2026, covered the same alert and highlighted its operational implications for monitoring charitable giving, cross-border donations, and transfers involving higher-risk jurisdictions or intermediaries. Within this week's broader pattern, the alert adds a specific channel to the financial infrastructure under scrutiny: religious and charitable networks that may be misused to move funds.
The alert concerns potential abuse by actors seeking to divert funds or evade sanctions. It does not establish that religious charities generally are involved in illicit finance. Controls should therefore distinguish between legitimate charitable activity and transactions supported by evidence of suspicious counterparties, payment routes, or fund movements.
Practical impact:
- Review whether risk-based monitoring covers nonprofit and religious organisations, including cross-border donations and unusual payment patterns.
- Assess counterparties, intermediaries, ownership or control links, and the destination of funds rather than relying solely on the stated charitable purpose.
- Document the factual basis for escalation and suspicious activity reporting, distinguishing risk indicators from confirmed misconduct.
- Ensure that enhanced scrutiny remains proportionate and consistent with applicable legal obligations and protections for legitimate charitable activity.
2. Treasury's Iran action targeted foreign banks, offshore institutions, and exchange networks
Also on 15 October 2026, the U.S. Department of the Treasury announced new measures under Operation Economic Outcast targeting Iran-related international financial networks and shadow banking structures. Treasury identified the Iraq-based International Development Bank for Investment and Finance as providing financial facilitation and U.S.-dollar access for Iran. The action also included designations involving offshore banks, exchange houses, foreign-exchange specialists, and companies allegedly used to move funds through shell companies and intermediary networks.
Treasury further stated that the U.S. Department of State was designating Cuba-based Banco Internacional de Comercio S.A. (BICSA), citing services provided to the designated Iranian Karafarin Bank. The measures covered multiple jurisdictions and different points in the movement of funds, including banking access, foreign-exchange operations, and commercial entities used as intermediaries.
This action and FinCEN's charity-network alert are distinct measures, but together they show the range of channels U.S. authorities are examining in their Iran-related financial-crime response. One addresses named financial institutions and facilitators through sanctions designations; the other asks financial institutions to identify and report potential misuse of charitable channels.
Practical impact:
- Refresh sanctions-screening data against the latest designations, including entities, individuals, aliases, and relevant ownership or control relationships.
- Review correspondent banking, cross-border payments, and foreign-exchange activity for exposure to designated institutions and intermediaries.
- Examine whether shell companies, layered transactions, and multi-jurisdictional payment routes obscure the underlying beneficiary or purpose of a transaction.
- Assess potential secondary-sanctions exposure and escalation requirements for transactions involving foreign financial institutions connected to designated parties.
Data Points
- 13 October: FinCEN assessed a $1.2 billion penalty against Bank of America for failures to mitigate and report priority national-security risks.
- 13 October: The OCC assessed a $750 million civil money penalty against Bank of America for deficiencies in its BSA/AML programme.
- 13 October: OFAC announced an $11.6 million settlement with Bank of America over apparent sanctions violations.
- 13 October: OFAC designated four individuals and 11 entities connected to Cartel del Noreste, including actors in quarter-horse racing and other commercial sectors.
- 15 October: FinCEN issued an alert on potential Iranian regime abuse of religious charity networks, including diversion of khums.
- 15 October: Treasury announced further designations targeting Iran-related financial networks, including an Iraqi bank, offshore banks, exchange houses, and other facilitators.
Watchlist
- Remediation progress and independent testing following the Bank of America enforcement actions, particularly transaction monitoring, SAR escalation, correspondent-account due diligence, and audit effectiveness.
- Further OFAC action against commercial businesses allegedly used to support criminal organisations, including the role of ownership, control, and related-party relationships.
- Implementation of FinCEN's alert on potential abuse of religious charity networks, including the quality of risk-based monitoring and suspicious activity reporting.
- Additional designations under Operation Economic Outcast targeting foreign financial institutions, exchange houses, shell companies, and other Iran-related intermediaries.
- Correspondent-banking and cross-border payment exposure involving designated institutions or entities, including assessment of potential secondary-sanctions implications.
- Whether enforcement and alert activity produces further guidance on distinguishing legitimate charitable or commercial transactions from activity linked to illicit finance.
Sources
- Financial Crimes Enforcement Network (FinCEN), FinCEN Assesses $1.2 Billion Penalty against Bank of America, 13 October 2026.
- Office of the Comptroller of the Currency (OCC), OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance, 13 October 2026.
- U.S. Department of the Treasury, U.S. Treasury Announces Record Enforcement Actions Against Bank of America, 13 October 2026.
- U.S. Department of the Treasury / Office of Foreign Assets Control (OFAC), Treasury Targets Cartel del Noreste’s Horse Racing Enterprise and Expansive Criminal Network, 13 October 2026.
- Financial Crimes Enforcement Network (FinCEN), Operation Economic Outcast Targets Iranian Regime’s Abuse of Religious Charity Networks, 15 October 2026.
- Global FinCrime Network (GFN), FinCEN Flags Iranian Abuse of Religious Charity Networks, 15 October 2026.
- U.S. Department of the Treasury, Operation Economic Outcast Targets Iran’s International Financial Networks and Shadow Banking Architecture, 15 October 2026.