The same mechanism documented on the FTI Consulting note — debt that outruns its licensed maturity, disguised by changing the date on the paper — run by a subsidiary State Street had already owned for two years when the redating was still going on.
A sectoral rule, and an old habit
Directive 1 under E.O. 13662 bars US persons from dealing in new debt of designated Russian banks beyond a set maturity — 90 days when first issued in 2014, cut to 30 and then, from November 2017, to 14. An unpaid invoice counts as debt, so a payment arriving after the clock runs out has to be rejected.
Charles River Systems sold continuous network access to subsidiaries of Sberbank and VTB Bank — both on the Directive 1 list since 2014 — billed through individually signed contracts. By 2014, a US financial institution processing Charles River’s receivables had started rejecting payments that arrived outside the tenor and sent Charles River guidance on exactly why.
Rather than reject the late payments itself, Charles River redated the invoices — one as many as six times — and resubmitted them so they would appear to fall inside the licensed window, while keeping the true dates in its own internal records. A collections manager’s own words, quoted in the release: she would “do whatever it takes to get this invoice paid.” At least 18 staff across accounting, collections and client management took part or knew.
Acquired in the middle of it
State Street acquired Charles River in October 2018 — four years into the redating practice. A post-acquisition onboarding review correctly flagged which Charles River clients were subject to Directive 1. It did not extend that analysis to late invoice payments specifically, and State Street’s own automated screening system kept generating alerts on exactly those payments for the next 19 months. Staff dismissed the alerts manually each time, without connecting them to Directive 1.
The conduct continued until May 2020 — six years after the US financial institution’s first rejected payment, and nearly two years after State Street took over.
Two gaps, one case
The acquisition did not create the redating habit, but it inherited it and then sat on top of it: onboarding correctly identified the regulatory exposure and still missed how that exposure actually showed up in the payment stream, which is the acquisition integration gaps pattern exactly. And the screening system worked — it generated the alerts — while the people reviewing them dismissed every one, which is the untested screening controls pattern from the opposite angle: not a control that silently broke, but a control that fired correctly and was overridden every time regardless.
The penalty
Egregious and not voluntarily self-disclosed — the maximum outcome available, reflecting six years of conduct, repeated warnings from a US bank that named the relevant executive order directly, and 19 months of dismissed alerts after acquisition.
What the record shows
- Onboarding analysis and operational screening are different checks. Knowing which clients are covered by Directive 1 is not the same as recognising a Directive-1 violation inside a routine payment-processing queue.
- A dismissed alert and a missing one cost the same. The record here would look identical to an investigator whether the screening system had never fired or had fired every time and been waved through.