Metropolitan Commercial Bank fined $29.5M for CIP and vendor risk deficiencies

The Federal Reserve Board issued a consent order to cease and desist and for assessment of a civil money penalty to Metropolitan Commercial Bank (MCB) after the Board and the Federal Reserve Bank of New York an investigation of MCB’s issuance of general purpose reloadable prepaid cards (“Accounts”) with MovoCash, Inc. (“Movo”), a former third-party program manager for MCB’s Global Payments Group (“GPG”), that identified deficiencies in the Bank’s third-party risk management and compliance with the Customer Identification Program (“CIP”) rule (31 C.F.R. § 1020.220) issued under the Bank Secrecy Act (“BSA”) (31 U.S.C. § 5311 et seq.) by the U.S. Department of the Treasury.

According to the order —

• From April through July 2020, MCB received multiple reports indicating widespread fraud related to the Movo program and continued to issue Movo Accounts to applicants for whom the Bank did not have a reasonable belief that it knew their true identity
• Although MCB took steps to identify and block or close fraudulent Accounts during this period, those steps were ineffective
• Illicit actors using stolen identities obtained from unknown sources used the fraudulent Movo Accounts to collect more than $300 million in illegally obtained state unemployment insurance benefits, approximately $200 million of which has not been recovered
• From January through July 2020, MCB failed to maintain an adequate third-party risk management program to oversee the Bank’s issuance of Accounts for the Movo program;
• As a result of the issuance of fraudulent Movo Accounts, MCB incurred pecuniary gain in the form of increased aggregate interchange and transaction fees

The order includes requirements for improvement in the areas of board oversight, new product review, customer identification, customer due diligence, and third-party risk management. It also assessed a divil money penalty of $14,478,676.

The New York State Department of Financial Services also took action against MCB in a Consent Order assessing a $15,000,000 civil money penalty.