01OFSI · Sep 2OFSI fines Citibank London £4.73m for sanctions screening gaps
OFSI (HM Treasury) imposed a penalty of £4,732,830.58 on Citibank, N.A., London Branch on 11 August 2026 for breaches of the Russia and Global Anti-Corruption sanctions regulations. The notice puts the breaches at about £19.7m in total value. OFSI set a baseline of £7,888,050.97 and treated the case as Level 4 on its seriousness scale. It applied a 20% voluntary disclosure and co-operation discount, plus a further 20% settlement discount. Publication on Sep 2 is per secondary reporting (Zyphe); the primary source is the OFSI notice dated Aug 11. OFSI is outside your named regulator list; it is included because correspondent-banking screening gaps are common to banks.
Per Zyphe's summary of the notice, screening missed the 'PAO' prefix on Sovcomflot, so payments to its accounts went through. It also reports unscreened correspondent lists, missing BICs, alert backlogs and an unreasonable minority-ownership judgment, with breaches mostly in 2022 and some running to July 2025. The notice records that the bank voluntarily disclosed the majority of breaches, so this was largely self-reported, but two groups, worth about £6.9m, were not disclosed voluntarily. The order is a settled imposition; I did not find a remediation mandate or a challenge route in the sections reviewed.
For your program: test name-matching against prefixes, suffixes and legal-form variants, confirm every correspondent list and BIC feeds screening, and age-limit alert queues.
02DOJ · Sep 21Ex-Nodus Bank CEO gets 112 months for Venezuela sanctions evasion
The Justice Department announced on Sep 21 that Tomás Niembro Concha, former CEO of Puerto Rico's Nodus International Bank, was sentenced to 112 months in prison and three years' supervised release, and ordered to forfeit over $16.9 million. He had pleaded guilty on March 19 to conspiracy to commit wire fraud and conspiracy to violate IEEPA.
The release says that from 2021 to 2023 he conspired to deal with an OFAC-designated individual. After a foreclosure OFAC had authorised, they privately agreed that the bank would sell the home back to the designated person for $4 million through a front company, a transaction the release calls prohibited and unlicensed. The fraud ran 2017 to 2023. The bank failed in 2023. This is an individual, not a bank, prosecution; appeal status is not stated in the release.
For your program: check how licensed sanctions transactions are monitored after authorisation, and whether insiders can approve related-party or front-company dealings alone.
03DNB · Oct 5DNB fines payments firm Modulr €722,160 for weak customer due diligence
De Nederlandsche Bank announced on 5 October 2026 an administrative fine of €722,160 on Modulr Finance B.V., decided on 30 September. The base fine was €849,600, reduced 15% under the simplified settlement procedure. DNB is outside your named regulators; it is included because the failure sits in payments-sector onboarding and monitoring.
DNB found shortcomings in customer due diligence and ongoing transaction monitoring from 1 January 2023 to 16 July 2024, with heavy reliance on intermediary partners, including crypto-asset service providers. Modulr acknowledged the facts and will not object. I did not retrieve the decision text for remediation terms.
For your program: test whether partner-introduced customers get your own due diligence and monitoring, and who owns the controls when an intermediary onboards them.
04SEC · Sep 11SEC: Haywood USA pays $750,000 for SARs it never filed
The SEC issued an order dated September 11, 2026 against Haywood Securities (USA) Inc., a Canada-based broker-dealer, censuring it and imposing a $750,000 civil money penalty plus a cease-and-desist order. The order finds that from at least May 2021 through January 2026, in non-compliance with its own AML procedures, Haywood USA failed to file SARs and willfully violated Exchange Act Section 17(a) and Rule 17a-8.
Red flags arose at account opening, in due diligence and in later activity, but were not identified or adequately investigated; the order cites accounts tied to suspected criminal activity and suspicious trading. Haywood settled without admitting or denying the findings, other than jurisdiction. The order notes it increased AML compliance staffing and retained a third-party consultant. The order text I reviewed does not say how the failure was found.
For your program: sample red-flag alerts closed without a SAR decision, and check that written escalation procedures were actually followed within the 30-day filing clock.