Compliance had a split personality this week. Washington spent it handing out 9- and 10-figure AML penalties and BSA alerts, while the Supreme Court kept its hands off two agency fights. Meanwhile, NCUA added more lines to the Call Report, and the CFPB, now in its deregulatory phase, found a new reason to investigate banks. Here’s what crossed the desk.

Bank of America’s Almost $2 Billion Reminder That FinCEN Priorities Aren’t Suggestions

• What happened: FinCEN assessed a $1.2 billion penalty against Bank of America for failing to mitigate and report priority national security risks, including Chinese money laundering networks and southwest border illicit finance. The OCC added a $750 million penalty, and OFAC announced an $11.6 million settlement over apparent sanctions violations.
• The admissions: The bank admitted it willfully violated the Bank Secrecy Act, including failing to maintain a compliant AML program, conduct correspondent account due diligence, and file SARs.
• Why it matters for credit unions: This is a good week to check how your risk assessment maps to FinCEN’s priorities. No credit union operates at this scale. But FinCEN’s AML/CFT priorities are the yardstick examiners use. If your risk assessment doesn’t mention the southwest border, Chinese money laundering networks, or fentanyl-related typologies, document why they don’t apply to you.

Supreme Court Declines to Referee NCUA’s In-House Enforcement Process

• What happened: The Court declined to hear Moats v. National Credit Union Administration. That leaves in place the ruling that federal courts can’t hear a former credit union CEO’s constitutional challenge to NCUA’s in-house enforcement case.
• What’s at stake: According to the group backing the petition, NCUA is seeking $4 million in restitution, $1 million or more in penalties, and an industry bar.
• What it doesn’t mean: Denying review is not a ruling that NCUA’s administrative procedures are constitutional. The structural questions remain open. They just won’t be answered in this case.
• Why it matters for credit unions: For now, executives and directors facing NCUA enforcement must go through the administrative process first and save their constitutional arguments for appeal. A federal lawsuit filed up front won’t stop the proceeding.

NCUA Gives Stablecoins Their Own Call Report Schedule

• What happened: NCUA is taking comments on March 2027 Call Report changes, including a new schedule for Payment Stablecoin Activities. The comment period ends December 8, 2026.
• What’s in it: The proposed Schedule J has 26 accounts across four groups: custody of reserve assets for third-party issuers, cryptographic key custody, direct exposure to permitted payment stablecoin issuers, and stablecoins held on the credit union’s own balance sheet.
• Who it covers: The changes would apply to every federally insured credit union, starting with the March 31, 2027 report.
• Burden: NCUA says the stablecoin additions won’t materially change its existing burden estimates. Credit unions with zero stablecoin activity will mostly be reporting zeros. Credit unions exploring custody or issuer partnerships should read the account definitions now.

The CFPB Opens a Debanking Front

• What happened: After the OCC released its debanking report, the CFPB said it will investigate whether the banks named in the report and others complied with federal consumer financial laws. It will focus on ECOA and FCRA adverse action requirements and on UDAAP.
• Why it matters for credit unions: The CFPB’s direct supervision covers institutions over $10 billion. For everyone else, though the NCUA removed reputation risk from its supervisory framework, the takeaway is the adverse action angle. When you close an account or deny an application, the notice and the documented reason are what an examiner will review.

FinCEN’s Busy Week: Iran–Linked Charity Networks and Student Aid Fraud

• The charity alert: FinCEN issued an alert asking financial institutions to report potential Iranian regime abuse of religious charity networks, including diversion of religious tithes known as khums.
• Red flags include: charities that don’t appear to provide services, large unexplained donations followed by significant transfers, cash activity structured below reporting thresholds, and transfers to recipients with no clear relationship.
• The balance: FinCEN also stressed that legitimate charities should keep access to financial services under a risk based approach. No single indicator establishes suspicious activity. Train staff on patterns of activity, not on a member’s affiliations.
• Student aid fraud: Separately, FinCEN identified about $270 million in suspicious activity potentially linked to fraud against federal student aid programs and referred its findings to law enforcement.

NY Department of Financial Services Closes a Panama Papers Chapter With a $33 Million Penalty

• What happened: Acting Superintendent Kaitlin Asrow announced that Skandinaviska Enskilda Banken (SEB) and its New York branch agreed to pay a $33 million penalty under a consent order. The order resolves the Department’s investigation of SEB’s AML program failures and compliance with the New York Banking Law.
• Why it matters for credit unions: There’s no direct credit union exposure. The point is that NYDFS is still pursuing AML matters that are a decade old and historical files don’t age out of the DFS’s interest.

Let’s Make This Useful

I want this blog to be as relevant as possible to the people reading it. So:

• Got a topic you’d like me to break down?
• Burning desire to know more about that headline you read the other day?
• Have an industry-related question you want addressed?

Reach out to me at jeremy.newman@nycua.org. Let’s talk.

Until Next Time

From the big picture to the fine print, we’ve got you covered. Thanks for reading, and CU in the next post.