One enforcement release, two different failures, both inside a screening process the bank believed was working. One was a population nobody screened. The other was a screen that could not read certain names.
The airline net settlement
JPMC ran a net settlement mechanism that resolved billings among airlines and other airline-industry participants for its client, a US entity with about 100 members, and a non-US entity with over 350 members. Between about 3 January 2008 and 8 February 2012, JPMC processed 87 net settlement payments through the US financial system between the client and the non-US entity. The non-US entity’s membership included eight airlines that were, at various times, on the SDN List, blocked under OFAC sanctions, or located in sanctioned countries.
The payments totalled $1,022,408,149, but only about $1.5 million, or 0.14%, appears to have related to sanctioned parties, because each payment was a net figure across many members. OFAC treated that as mitigating.
The gap was in what the bank screened. Before January 2012, JPMC does not appear to have had a process to evaluate the member entities of the non-US entity for sanctions risk, despite receiving red-flag notifications on at least three occasions, including two in 2011 from its client. The notice says JPMC held the information needed to screen the members and that its staff, reconciling the two organisations’ billings each week, had actual knowledge of the individual members in each transaction. From February 2012 the bank screened all net settlement participants.
The screening tool
The Finding of Violation concerns 85 transactions totalling $46,127.04 and eight accounts held for six customers who were on the SDN List at the time. From about 2007 to October 2013, JPMC used a vendor screening system whose logic failed to flag customer names with hyphens, initials or extra middle or last names as matches to similar or identical SDN entries, despite strong similarities in names, addresses and dates of birth.
JPMC identified weaknesses in the tool as early as September 2010 and made enhancements in 2010 to 2012. It moved to a new system in 2013. In November 2013 it re-screened 188 million client records through the new system, found these accounts and transactions, and reported them. This is the untested screening controls pattern in a different form: a screen that had a defect from about 2007, which the bank first identified in September 2010 and which a full re-screen found only in 2013. The notice says OFAC found it took over three years to fully address a known deficiency, and that compensating controls for the risk to accounts were not adequate.
The penalty
The airline matter was voluntarily self-disclosed and non-egregious, with a base penalty of $7,797,290 and a settlement of $5,263,171. OFAC called the bank’s conduct reckless disregard of its obligations as a clearing bank and cited a pattern of missed red flags. Mitigation included that no managers or supervisors appear to have been aware, the lower real harm, cooperation with a retroactive tolling agreement, and remediation (screening of participants, more compliance staff, new screening software and training that uses the case). The Finding of Violation carried no monetary penalty.
What the record shows
- A red flag is only a control if it triggers a change. The client twice told the bank about sanctioned participants in 2011; the notice records that the bank still lacked a process to evaluate them until January 2012.
- A re-screen found what the live process had not. The 188 million-record check in 2013 is what surfaced the six customers.
- Known weaknesses need a stopgap. OFAC’s closing point is the importance of remediating known deficiencies promptly and, where that is not possible, of compensating controls.