Top Story Security Related

FinCEN has updated its Beneficial Ownership Information FAQs webpage, adding Reporting Company questions C.15 and C.16, and updating Reporting Company question C.14 and Initial Report question G.4.

FinCEN on Monday released a Financial Trend Analysis on mail theft-related check fraud incidents based on Bank Secrecy Act data filed in the six months following FinCEN’s issuance of its 2023 alert on this same topic. During the review period, FinCEN received 15,417 BSA reports from 841 financial institutions on mail theft-related check fraud, amounting to more than $688 million in reported suspicious activity (the average amount reported was $44,774 per reported incident).

FinCEN identified three primary outcomes after checks were stolen from the U.S. Mail:

• 44 percent were altered and then deposited
• 26 percent were used as templates to create counterfeit checks
• 20 percent were fraudulently signed [indorsed] and deposited

Check manipulation methodologies ranged in sophistication, and many perpetrators tried to avoid interaction with bank personnel. FinCEN also found that banks filed 88 percent of all mail theft-related check fraud reports. Additionally, analysis revealed that financial institutions reported transactional activity or BSA filing subjects linked to every U.S. state, Washington, D.C., and Puerto Rico. While every state was affected, populous states with large urban areas had more reported incidents.

Mail theft-related check fraud losses can affect personal savings, checking accounts, business accounts, and retirement savings, as well as negatively impact financial institutions that typically cover the check fraud losses.

The Treasury Department yesterday announced that OFAC has designated 10 individuals and two entities as part of a coordinated U.S. government response to Moscow’s malign influence efforts targeting the 2024 U.S. presidential election. Beginning in early 2024, executives at RT—Russia’s state-funded news media outlet—began a nefarious effort to covertly recruit unwitting American influencers in support of their malign influence campaign. RT used a front company to disguise its own involvement or the involvement of the Russian government in content meant to influence U.S. audiences.

Yesterday’s designations complement law enforcement actions taken by the Department of Justice and the Department of State’s designation of the Rossiya Segodnya media group and five of its subsidiaries, RIA Novosti, RT, TV-Novosti, Ruptly, and Sputnik, as Foreign Missions, steps to impose visa restrictions, and release of a Rewards for Justice (RFJ) reward offer of up to $10 million relating to information pertaining to foreign interference in a U.S. election.

For the names and identification information of the designated parties, and information on related OFAC actions, see this September 4, 2024, BankersOnline OFAC Update.

The Federal Reserve Board has announced it has issued enforcement actions against two banks.

• First Interstate Bank, Billings, Montana, was assessed a $70,000 civil money penalty for a pattern or practice of violations of Regulation H, 12 C.F.R. § 208.25, which implements the requirements of the National Flood Insurance Act.
• United Texas Bank, Dallas, Texas, received a consent cease and desist order issued jointly by the Federal Reserve Board and the Texas Department of Banking after a May 2023 examination identified deficiencies in its BSA/AML compliance program.
  

The Federal Trade Commission reports that new data show a massive increase in the amount of money consumers report losing to scammers involving Bitcoin ATM machines. Since 2020, the amount consumers reported losing has increased nearly tenfold to over $110 million in 2023.

In a newly released data spotlight, the FTC says that fraud losses to Bitcoin ATMs have topped $65 million in just the first six months of 2024. During this timeframe, consumers over the age of 60 were more than three times as likely as younger adults to report losing money to Bitcoin ATM scams. Across all ages, the median loss reported in the first half of this year was a staggering $10,000.

The majority of scam losses involving Bitcoin ATMs come as a result of government impersonation, business impersonation, and tech support scams. The lies told by scammers vary, but they all create some urgent justification for consumers to take cash out of their bank accounts and put it into a Bitcoin ATM. As soon as consumers scan a QR code provided by scammers at the machine, their cash is deposited straight into the scammers’ crypto account.

The NCUA has reported it has permanently prohibited Luz Araceli Davila-Hernandez, a former employee of Magnifi Financial Credit Union, Melrose, Minnesota, from ever working for a federally insured depository institution.

The FDIC has released a list of enforcement orders issued in July 2024.

• A Consent Order against The State Exchange Bank, Lamont, Oklahoma
• A Consent Order against Chesterfield State Bank, Chesterfield, Illinois
• Prohibition orders against:
  • Raqeel Rashida Alsalam, formerly affiliated with First-Citizens Bank & Trust Company, Raleigh, North Carolina
  • Brent D. Torgerson, formerly affiliated with The Union Bank, Beulah, North Dakota
  • Samuel Ortiz-Perez, formerly affiliated with FirstBank Puerto Rico, Santurce, Puerto Rico
  • Leann Athas, formerly affiliated with Bank of Montana, Missoula, Montana

The FFIEC has announced that, on behalf of its members, the FFIEC will sunset the Cybersecurity Assessment Tool on August 31, 2025. The FFIEC announcement includes links to other resources that can assist financial institutions in their self-assessment activities.

The Federal Financial Institutions Examination Council (FFIEC) has issued a new booklet to help examiners assess information technology practices.

The “Development, Acquisition, and Maintenance” booklet provides examiners with fundamental examination expectations regarding entities’ development and acquisition planning and execution, governance and risk management, and maintenance and change management practices. It discusses the interconnectedness of an entity’s assets and processes and those of its third-party service providers along with information to help examiners assess whether management adequately addresses risks and complies with applicable laws and regulations.

The booklet reflects the changing technological environment and increasing need for security and resilience. It also highlights the importance of providing examiners with current information regarding safety and soundness, consumer protection, and provision of secure and resilient business services to customers. This new booklet replaces the “Development and Acquisition” booklet issued in April 2004.

Yesterday, FinCEN announced two final rules designed to help safeguard the residential real estate and investment adviser sectors from illicit finance.

The final residential real estate rule, published [89 FR 70258] in today’s Federal Register and effective December 1, 2025, will require certain industry professionals to report information to FinCEN about non-financed transfers of residential real estate to a legal entity or trust, which present a high illicit finance risk. The rule will increase transparency, limit the ability of illicit actors to anonymously launder illicit proceeds through the American housing market, and bolster law enforcement investigative efforts.

• Residential Real Estate Rule Fact Sheet
• FAQs on Real Estate Reports

The final investment adviser rule, scheduled for Federal Register publication on September 4, and effective January 1, 2026, will apply anti-money laundering/countering the financing of terrorism (AML/CFT) requirements—including AML/CFT compliance programs and suspicious activity reporting obligations—to certain investment advisers that are registered with the U.S. Securities and Exchange Commission (SEC), as well as those that report to the SEC as exempt reporting advisers. The rule will help address the uneven application of AML/CFT requirements across this industry.

• Investment Advisor Rule Fact Sheet