No one disguised anything in this case, and no sanctioned party defeated a control. A very large bank had screening, and OFAC’s release describes four ways that screening produced the wrong answer without anyone knowing, for as long as three and a half years.
Payments through blocked banks
In May 2021 the bank automated how it chose correspondent banks for cross-border payments, using a vendor’s “routing directory.” Each payment was screened once its details were generated. But the directory itself contained banks OFAC had blocked, and after the Russia designations of 2022 the bank learned that it was screening these payments and still sending some through them. OFAC lists three reasons they got through: the bank’s filter had not yet caught up with a bank blocked shortly before; an analyst wrongly cleared the alert as a false positive; and an “alert suppression rule” released the payment automatically because an earlier alert on the same criteria had been closed as a false positive.
Between February 2022 and March 2025 the bank processed 403 transactions worth $14.3 million through 35 blocked banks. It removed blocked banks from the directory in January 2023. Aware of the problem since March 2022, it ran a single narrow lookback; OFAC says the full scope emerged only after a January 2025 administrative subpoena.
An exact match ranked as low priority
The bank’s relationship-screening system gave a customer alert a low or medium priority, not a high one, when both name and date of birth matched a blocked person exactly. The review of those alerts was therefore delayed, and three designated individuals made 31 transactions worth $56,258 on their accounts and cards between September 2021 and February 2024. The fix came six months after the bank first identified the flaw.
Watchlists that did not update
Twice the file the bank screened against missed an OFAC update. In 2023 a vendor’s error left it stale from 24 May to 28 June, and six transactions worth $100,828 went to designated parties; the bank found the error in July, about a month after another US bank blocked one of the payments downstream. On 7 February 2025 the bank’s own systems failed to load the previous day’s designations, and it processed 26 transactions worth $146,543 for a designated ship management company before the update was fully active five days later.
Two accounts and a person
An analyst dismissed an alert in May 2023 that identified a newly designated individual as the beneficial owner of a business, and the business’s account stayed unrestricted for about 14 months. A rescreen during the bank’s move to a new screening platform produced more alerts than it could clear. Separately, in April 2025 staff closed two business accounts that had a just-designated signer and moved $189,869 into new accounts at the request of the business owner, the signer’s adult child. Compliance staff caught the error before any funds moved, blocked the new accounts and self-disclosed.
The penalty
OFAC treated the case as non-egregious. It found the bank had acted recklessly: it did not promptly improve screening, update its watchlist for over a month, correctly prioritise exact matches or train its staff, and OFAC had previously sent it several cautionary letters about substantially similar conduct. It also found the bank had been less than fully cooperative, with piecemeal disclosures. The settlement equals the base penalty of $11,662,930, and the release says the bank got no reduction. The one mitigating factor, a tolling agreement on one set of violations, was outweighed.
What the record shows
- A control that is tuned is also a control that needs testing. The suppression rule and the low-priority setting were configuration choices. OFAC says alert rules and parameters should be “risk-based, adequately supervised, and subject to audit and testing.”
- Vendors do not carry the obligation. The release says each organisation “remains responsible for its own compliance regardless of whether it relies upon third-party providers,” and that tool migrations need controlled implementation to avoid gaps and backlogs.
- Repeat, similar failures are the aggravator. OFAC notes that recurring, thematically similar violations raise doubts about the whole programme.
The pattern is the one described on the untested screening controls technique page, where the TradeStation and Interactive Brokers cases show the same gap between a control existing and a control being checked.