FinCEN Enforcement
A money transmitter calls me on a Friday afternoon. Their bank called that morning. FinCEN issued a civil money penalty assessment—a notice that appeared in their account. The amount was two million dollars. The violation was failing to file suspicious activity reports on transactions that met the SAR threshold. The violations occurred over a three-year period.
The company had no warning. There was no examination, no preliminary finding, no opportunity to remediate before the penalty was issued. The notice gave them thirty days to respond.
FinCEN enforcement is different from state enforcement in several critical ways. FinCEN can impose civil money penalties unilaterally. FinCEN does not need to find that you violated the law through an examination; they can issue a civil money penalty based on an investigation. FinCEN does not need to prove intent; they only need to prove that the violation occurred. And FinCEN's penalties are measured in millions of dollars, not thousands.
Types of FinCEN Enforcement Actions
FinCEN has several enforcement tools. The most severe is a criminal referral. If FinCEN's investigation reveals evidence of criminal conduct—willful violations of the BSA, conspiracy to circumvent reporting requirements, money laundering—they will refer the case to the Department of Justice. Criminal enforcement is relatively rare but catastrophic when it occurs.
More common is civil money penalty assessment. FinCEN can issue a civil money penalty for any violation of the Bank Secrecy Act or the rules implementing it. The penalty is assessed administratively and does not require a court proceeding or a prior examination. FinCEN can issue the penalty, and the regulated entity has thirty days to respond or request a hearing.
FinCEN also issues administrative enforcement actions short of civil money penalties. These might be cease-and-desist orders directed at a specific activity, consent orders requiring a remediation plan, or letters directing a business to cease unlicensed money transmission. These are less common than civil money penalties, but they are serious.
FinCEN also uses informal enforcement tools. An advisory letter might direct the industry to comply with a particular regulation or might call out a specific compliance risk. Sting operations and infiltrations of money transmitter networks are conducted by FinCEN investigators to identify non-compliance and to identify businesses engaged in unlicensed money transmission.
Civil Money Penalties
FinCEN can assess civil money penalties for violations of the BSA. The penalties are substantial. For a willful violation, the penalty can be up to one hundred thousand dollars per violation or the amount involved in the transaction, whichever is greater. For non-willful violations, the penalty can be up to the amount involved in the transaction.
In practice, FinCEN's civil money penalties are assessed against large institutions, not against small money transmitters. But this is changing. As FinCEN has increased its resources, it has begun to pursue smaller violations more aggressively.
The assessment notice does not come with a thorough explanation of the violation or the factual predicate for the penalty. FinCEN will say: "You failed to file suspicious activity reports on five transactions between January and June of 2023. These are violations of 31 USC 5318(g)." It will assess a specific penalty amount. It will give you thirty days to respond.
When you receive a civil money penalty assessment, you have several options. You can pay the penalty. You can request a formal hearing before an administrative law judge. You can request a pre-hearing settlement conference. In practice, most entities request a pre-hearing settlement conference first. The conference is an opportunity to understand FinCEN's position, to present your defense or mitigation factors, and to negotiate a settlement.
Notable Enforcement Cases and What They Teach
The Western Union settlement of 2015 is the largest civil money penalty FinCEN has ever assessed. Western Union agreed to a settlement of seven hundred and twelve million dollars for violations occurring over a ten-year period. The violations included failure to file suspicious activity reports, failure to maintain adequate records, and failure to implement adequate anti-money laundering controls.
What made Western Union's case instructive is that the violations were systematic, not isolated. Western Union had not implemented adequate monitoring systems to detect suspicious transactions. When transactions matching obvious red flags—patterns consistent with structuring, transactions to high-risk jurisdictions, transactions from customers with no legitimate business basis—passed through Western Union's system unreported, the company had no mechanism to catch them. The case demonstrated that having the people and the procedures in place is not sufficient; you also need the systems.
The HSBC settlement of 2012 is notable because it was the largest AML settlement at the time. HSBC agreed to a settlement of one billion nine hundred million dollars for failing to implement adequate anti-money laundering controls and for failing to file suspicious activity reports. HSBC's case demonstrates that even large financial institutions with dedicated compliance staff and substantial resources can fail in basic AML compliance.
Regarding money transmitters specifically, FinCEN has settled cases against smaller MTOs. A typical settlement involves penalties in the range of five hundred thousand to three million dollars, assessed for failure to file SARs, failure to conduct adequate CDD, or failure to implement adequate transaction monitoring. These cases are less publicized than the HSBC and Western Union cases, but they occur regularly.
What is consistent across all of these cases is that FinCEN's enforcement is triggered by a pattern, not by an isolated violation. A single unreported suspicious transaction is unlikely to result in enforcement. But if your system is not detecting suspicious transactions systematically, you will eventually be caught.
How FinCEN Investigations Begin
FinCEN begins investigations in several ways. A bank files a suspicious activity report on a money transmitter. The SAR describes transactions conducted by the money transmitter that appear suspicious. FinCEN reviews the SAR and determines whether to investigate. If the SAR describes a pattern—multiple transactions with similar characteristics, transactions to high-risk jurisdictions, transactions from customers with no legitimate business purpose—FinCEN is likely to open an investigation.
Alternatively, a financial institution may voluntarily report suspicious activity regarding a money transmitter. A bank may contact FinCEN and say, "We are processing transactions for a money transmitter, and we are seeing patterns that concern us. The money transmitter does not appear to be filing suspicious activity reports on these transactions." This kind of report is taken seriously by FinCEN.
FinCEN also launches investigations based on its own analysis of data. FinCEN receives copies of all suspicious activity reports filed by depository institutions. FinCEN analyzes these reports to look for patterns. If multiple banks are filing SARs naming the same money transmitter, FinCEN will notice. If the SARs describe a pattern of unreported suspicious activity, FinCEN will investigate.
State regulators also initiate FinCEN investigations. A state examination may uncover evidence of SAR filing failures. The state regulator will refer the matter to FinCEN. FinCEN then conducts its own investigation.
Once FinCEN opens an investigation, they have several tools at their disposal. They can subpoena records directly from the money transmitter. They can subpoena records from the money transmitter's banking partners. They can interview customers and counterparties. They can conduct undercover purchases—sending investigators to conduct transactions through the money transmitter to test whether the money transmitter is filing SARs appropriately.
FinCEN investigations can take years. The typical investigation I have observed runs twelve to eighteen months from opening to resolution. During this time, the money transmitter may not know the investigation is occurring. FinCEN does not provide advance notice.
Cooperating with FinCEN vs. Fighting Enforcement
When FinCEN issues a civil money penalty assessment, you face a choice: cooperate and negotiate a settlement, or request a hearing and fight the case through the administrative process.
I will be direct: you should almost never fight a FinCEN enforcement action through a hearing. FinCEN has substantial resources, has a team of attorneys, and has already made a factual determination that you violated the law. If you go to a hearing, you will incur significant legal costs. You will need to conduct discovery. You will need to depose FinCEN employees. You will need to litigate factual questions about whether you filed SARs, about whether transactions met the SAR threshold, about whether you implemented adequate controls. The hearing will last months.
And when the hearing ends, the administrative law judge will issue a decision. If you lose, you will owe the penalty plus legal fees plus potentially interest on the unpaid penalty. If you win, you have eliminated the penalty, but you have spent a year of management time and hundreds of thousands of dollars in legal fees on a case that you could have settled for less.
The pragmatic approach is to request a pre-hearing settlement conference. In this conference, you present FinCEN with your position: yes, we made mistakes; here is what happened; here is what we have done to remediate; here are the factors that should mitigate the penalty.
FinCEN's enforcement counsel will listen to your case. They will ask questions. They will push back on any factual claims you make. But they will also make a judgment about whether the case is worth the cost of litigation. If you can demonstrate that the violations were not systematic, that the violations have been remediated, and that you have implemented meaningful controls to prevent recurrence, FinCEN may agree to a reduced penalty or may agree to resolve the case without penalty in exchange for a commitment to implement specific remediation.
A settlement agreement with FinCEN will typically include a penalty amount, a detailed remediation plan, and a timeline for implementing the remediation. The settlement will also require you to conduct internal testing to verify that the remediation is effective, and you will be required to submit written reports to FinCEN describing your testing results.
The Role of FinCEN Advisories and Guidance
FinCEN issues advisories and interpretive guidance on BSA compliance issues. This guidance is not legally binding in the way a regulation is, but it is the official interpretation of FinCEN, and courts and agencies defer to it.
The guidance is important because it provides clarity on what FinCEN expects. When FinCEN issues guidance on beneficial ownership verification, you can use that guidance to understand what FinCEN considers adequate verification. When FinCEN issues guidance on transaction monitoring, you can use that guidance to evaluate your own systems.
More importantly, if you violate FinCEN's published guidance, you will have difficulty defending yourself in an enforcement action. You cannot say, "We interpreted the regulation differently." FinCEN has already told you what the regulation means. If you violated it anyway, FinCEN will characterize that as willful.
Penalty Mitigation Factors
FinCEN has published guidance on the factors that will mitigate a civil money penalty. These factors include: the seriousness of the violation, whether the violation was a first-time violation, the size and financial condition of the entity, any corrective actions the entity has taken, and the compliance history of the entity.
In practice, this means that if you have never been penalized before, if you take quick corrective action when you discover the violation, if you are a smaller entity, and if the violations are not egregious, you have better prospects for a reduced penalty.
Conversely, if you have a history of violations, if you discovered the violation but delayed remediation, if you are a large entity, and if the violations are systematic, you should expect a substantial penalty.
Post-Enforcement Remediation
When you settle a FinCEN enforcement action, the settlement agreement will require specific remediation steps. These might include: implementing new transaction monitoring rules, hiring a BSA officer, engaging an external compliance consultant, conducting a comprehensive risk assessment, or retaining an external auditor to test your controls.
You will be required to submit a remediation plan to FinCEN within a specified timeframe—typically sixty days after the settlement. The plan should be detailed and should describe exactly what you will do, who will do it, and when it will be complete.
FinCEN will then monitor your compliance with the remediation plan. You will be required to submit written reports at specified intervals—typically monthly or quarterly—describing your progress.
This post-enforcement monitoring can last two years or longer. During this period, your compliance program will be scrutinized. Any violation discovered during the monitoring period will be treated as a violation of the settlement agreement and could result in additional penalties.
Practitioner's Bottom Line
FinCEN enforcement is civil, not criminal, and is based on assessing penalties administratively without need for a court proceeding. When faced with a FinCEN enforcement action, cooperate through settlement negotiations rather than fighting through administrative hearings—litigation costs and time rarely justify the effort to fight. Use published FinCEN guidance to understand expectations and to evaluate your own compliance posture, treating that guidance as binding interpretation of the regulations.