Not a bank that failed to notice a customer’s sanctioned dealings. A bank that built the tool specifically so a customer could do them on the bank’s own infrastructure, in a version designed from the start to be outside the bank’s own view.
Two versions of the same software
Wachovia sold a trade-finance platform called Eximbills to foreign banks in two forms. “Comprehensive” meant Wachovia processed the client’s trade transactions itself, under its own screening. “Hosted” meant Wachovia supplied the software and the client ran its own transactions on it. In 2006, Wachovia and a European bank (“Bank A”) agreed in writing that Bank A would keep sanctioned-jurisdiction business off the Hosted platform entirely, using separate systems Wachovia had no part in.
In 2007, Bank A asked to consolidate onto one platform — including the sanctioned-jurisdiction business. A mid-level Wachovia manager agreed. Wachovia built Bank A a customized Hosted version specifically so it could manage trade instruments involving Iran, Sudan and Syria, running on Wachovia’s — and after 2008, Wells Fargo’s — own technology infrastructure in Hong Kong and North Carolina. The software even included a redirect: if Bank A accidentally routed a sanctioned-jurisdiction transaction to the screened Comprehensive side, the system sent it back to the unscreened Hosted side automatically.
Seven years of a plan that was never run
Wells Fargo acquired Wachovia in 2008 and inherited the relationship. Staff raised sanctions concerns about it internally more than once over the following years — after two major OFAC enforcement cases in 2012 and 2013 prompted renewed attention, a working group was formed, identified “potential facilitation-related concerns,” and drew up a three-point plan: tighten contract language, obtain periodic compliance certifications from Bank A, and audit its Eximbills data.
The plan was never carried out. It was folded into a larger, slower review of the whole trade insourcing business, and Bank A kept using the Hosted platform for sanctioned-jurisdiction trade for at least two more years. A 2014 internal audit of the insourcing business line skipped the Hosted Eximbills product specifically, relying on the business line’s own assessment that it was low-risk. The gap was closed only in late 2015, during an unrelated business review, when it surfaced that Bank A might have been using the platform this way since 2008 — seven years after the fact. Wells Fargo cut off access immediately and self-disclosed.
What ties the two findings together
Providing a counterparty the specific means to transact with sanctioned jurisdictions is the professional-enablers pattern applied to software rather than legal or financial services — the platform did the enabling that a formation agent or nominee usually does. And a known, documented plan to test and audit that exposure that was drawn up and then never executed is exactly the gap untested screening controls describes: the firm did not fail to notice the risk. It identified the risk, planned a response, and did not complete it for years.
The penalty
Egregious and voluntarily self-disclosed. OFAC called the seven-year gap between acquisition and discovery “reckless disregard,” while crediting that senior management never directed or knew of the arrangement, that Wells Fargo’s broader compliance programme was otherwise strong, and that most of the 124 violations involved goods — agriculture, medicine, telecommunications — that might well have qualified for a licence had one been sought.
What the record shows
- A tool built for one purpose can be re-engineered for another. The redirect mechanism existed to make the unscreened pathway more convenient for Bank A, not to conceal anything — but its effect was to keep sanctioned-jurisdiction business permanently outside Wells Fargo’s own screening.
- Identifying a risk is not the same as closing it. A working group, a three-point plan and a documented “potential facilitation” finding sat on file for roughly two years while the business kept running.