Top Story Security Related

The FDIC has released a list of enforcement orders issued in July 2024.

• A Consent Order against The State Exchange Bank, Lamont, Oklahoma
• A Consent Order against Chesterfield State Bank, Chesterfield, Illinois
• Prohibition orders against:
  • Raqeel Rashida Alsalam, formerly affiliated with First-Citizens Bank & Trust Company, Raleigh, North Carolina
  • Brent D. Torgerson, formerly affiliated with The Union Bank, Beulah, North Dakota
  • Samuel Ortiz-Perez, formerly affiliated with FirstBank Puerto Rico, Santurce, Puerto Rico
  • Leann Athas, formerly affiliated with Bank of Montana, Missoula, Montana

The FFIEC has announced that, on behalf of its members, the FFIEC will sunset the Cybersecurity Assessment Tool on August 31, 2025. The FFIEC announcement includes links to other resources that can assist financial institutions in their self-assessment activities.

The Federal Financial Institutions Examination Council (FFIEC) has issued a new booklet to help examiners assess information technology practices.

The “Development, Acquisition, and Maintenance” booklet provides examiners with fundamental examination expectations regarding entities’ development and acquisition planning and execution, governance and risk management, and maintenance and change management practices. It discusses the interconnectedness of an entity’s assets and processes and those of its third-party service providers along with information to help examiners assess whether management adequately addresses risks and complies with applicable laws and regulations.

The booklet reflects the changing technological environment and increasing need for security and resilience. It also highlights the importance of providing examiners with current information regarding safety and soundness, consumer protection, and provision of secure and resilient business services to customers. This new booklet replaces the “Development and Acquisition” booklet issued in April 2004.

Yesterday, FinCEN announced two final rules designed to help safeguard the residential real estate and investment adviser sectors from illicit finance.

The final residential real estate rule, published [89 FR 70258] in today’s Federal Register and effective December 1, 2025, will require certain industry professionals to report information to FinCEN about non-financed transfers of residential real estate to a legal entity or trust, which present a high illicit finance risk. The rule will increase transparency, limit the ability of illicit actors to anonymously launder illicit proceeds through the American housing market, and bolster law enforcement investigative efforts.

• Residential Real Estate Rule Fact Sheet
• FAQs on Real Estate Reports

The final investment adviser rule, scheduled for Federal Register publication on September 4, and effective January 1, 2026, will apply anti-money laundering/countering the financing of terrorism (AML/CFT) requirements—including AML/CFT compliance programs and suspicious activity reporting obligations—to certain investment advisers that are registered with the U.S. Securities and Exchange Commission (SEC), as well as those that report to the SEC as exempt reporting advisers. The rule will help address the uneven application of AML/CFT requirements across this industry.

• Investment Advisor Rule Fact Sheet

Yesterday, FinCEN issued a press release reminding financial institutions to monitor for and report suspicious transactional activity related to the illicit fentanyl supply chain and the trafficking of illicit fentanyl and other synthetic opioids.

FinCEN has previously published resources on the trafficking of fentanyl, fentanyl analogues, and other synthetic opioids and the precursor chemicals and associated manufacturing equipment needed to synthesize these deadly drugs:

• Supplemental Advisory on the Procurement of Precursor Chemicals and Manufacturing Equipment Used for the Synthesis of Illicit Fentanyl and Other Synthetic Opioids (June 2024)
• Advisory to Financial Institutions on Illicit Financial Schemes and Methods Related to the Trafficking of Fentanyl and Other Synthetic Opioids (August 2019)

On Friday, the Department of the Treasury announced that OFAC and the State Department targeted nearly 400 individuals and entities both in Russia and outside its borders—including in Asia, Europe, and the Middle East—whose products and services enable Russia to sustain its war effort and evade sanctions. The United States government will continue to support Ukraine as it defends its independence and hold Russia accountable for its aggression.

For the names and identification information of the designated parties and vessels, see this August 23, 2024, BankersOnline OFAC Update.

The OCC yesterday released enforcement actions recently taken against national banks and federal savings associations (banks), and individuals currently and formerly affiliated with banks the OCC supervises.

Formal Agreements with:

• 1st National Bank, Lebanon, Ohio, for unsafe or unsound practices, including those related to strategic planning, capital planning, liquidity risk management, and interest rate risk management
• Generations Bank, Seneca Falls, New York, for unsafe or unsound practices, including those related to board oversight, strategic planning, liquidity risk management, and interest rate risk management.
• Maple City Savings Bank, FSB, Hornell, New York, for unsafe or unsound practices, including those related to board oversight and corporate governance, strategic and capital planning, liquidity risk management, and interest rate risk management, and a violation relating to transactions with affiliates
• Slovenian S&LA of Franklin-Conemaugh, Conemaugh, Pennsylvania, for unsafe or unsound practices, including those related to strategic planning, succession planning, balance sheet management, internal audit, and the bank’s Bank Secrecy Act/Anti-Money Laundering (BSA/AML) internal controls, audit, and training, and violations of 12 CFR 21.21 (BSA/AML compliance program) and 31 CFR 1020.210 (Customer Due Diligence)

Orders of Prohibition against:

• James Gomes, former branch manager at a New York, New York, branch of TD Bank, N.A., Wilmington, Delaware, for accessing an elderly bank customer’s accounts without authorization and transferring over $200,000 from the customer’s accounts to his own accounts
• Priscilla Jones-Cotton, former branch manager at a Fort Myers, Florida, branch of PNC Bank, N.A., Wilmington, Delaware, for stealing, embezzling, or otherwise misappropriating approximately $32,000 from the bank
• Deidre Katschke, former universal vault specialist at BOKF, N.A., Tulsa, Oklahoma, for misappropriating approximately $42,500 in cash from the bank
• Maria Salazar, former teller at a Louisville, Kentucky, branch of PNC Bank, N.A., Wilmington, Delaware, for conducting unauthorized debit card transactions using bank customer accounts that totaled approximately $10,200

Notices of Charges for an Order of Prohibition against:

• Roberto A. Garcia, former personal banker at a North Miami, Florida, branch of JPMorgan Chase Bank, N.A., Columbus, Ohio. The Notice of Charges alleges, among other things, that Garcia stole over $12,000 in cash from the bank, engaged in account takeovers of bank customer accounts, and used customer accounts to pay personal expenses.
• Lexus Inez Lewis, former fraud operations specialist, at a Jacksonville, Florida, branch of Citibank, N.A., Sioux Falls, South Dakota. The Notice of Charges alleges, among other things, that Lewis made false representations in her employment application and became employed at the bank in violation of federal law; caused fraudulent transactions totaling at least $389,000 to occur on bank customers’ credit card accounts; and kept bank equipment without authorization

OFAC has announced efforts to modernize its infrastructure and approaches to engaging with stakeholders to ensure sanctions are easily understood and enforceable — a key recommendation highlighted in Treasury’s 2021 Sanctions Review that OFAC is working to implement.

To ensure that its guidance remains up to date and relevant for the public, OFAC is updating many of its FAQs on general sanctions questions and issues. These FAQs are often OFAC's most viewed guidance, as they deal with basic principles of sanctions implementation. The first installment of updated FAQs is available now (FAQs 1, 3, 4, 6, 7, 9, 10, 11, 12, 13, 91, 126, 468, and 469) and includes guidance on key topics such as what OFAC means by “blocked property” and how to verify the authenticity of an OFAC document.

OFAC will continue reviewing FAQs through an ongoing process focused on providing up-to-date and useful information to the public. OFAC will announce subsequent FAQ updates via its Recent Actions Notices.

The Securities and Exchange Commission has announced settled charges against New York-based registered transfer agent Equiniti Trust Company LLC, formerly known as American Stock Transfer & Trust Company LLC, for failing to assure that client securities and funds were protected against theft or misuse. Those failures led to the loss of more than $6.6 million of client funds as a result of two separate cyber intrusions in 2022 and 2023. American Stock Transfer was able to recover approximately $2.6 million of the losses and fully reimbursed the clients for their losses. To settle the SEC’s charges, Equiniti agreed to pay a civil penalty of $850,000.

• SEC Order

The Treasury Department has reported that OFAC has sanctioned several companies, individuals, and vessels for their involvement in the shipment of Iranian commodities, including oil and liquefied petroleum gas, to Yemen and the United Arab Emirates on behalf of the network of Iran-based, Islamic Revolutionary Guard Corps-Qods Force-backed Houthi financial official Sa’id al-Jamal. OFAC also updated the Specially Designated Nationals and Blocked Persons List entry for the sanctioned vessel ARTURA (IMO: 9150365), which was responsible for shipping commodities for Sa’id al-Jamal, to reflect the changing of its name to OHAR.

For the names and identification information of the designated parties, see this August 15, 2024, BankersOnline OFAC Update.