Fraud and AML in banking

TD is under investigation after Justice Department agents discovered a money laundering operation through the bank associated with illicit fentanyl, The Wall Street Journal reported in May.

Agents discovered that millions of dollars in illicit funds in New York and New Jersey came through the bank, according to court documents seen by the newspaper and sources familiar with the matter. The DOJ alleges that criminals bribed TD employees, according to the Journal.

The investigation was born out of a 2021 criminal case in which federal prosecutors charged New York City-based Da Ying Sze with coordinating a scheme that laundered at least $653 million in proceeds from illegal drugs, according to court documents seen by the Journal.

DOJ agents had followed members of Sze’s group during their investigation. In one day, Sze’s team stopped at three separate TD branches, and DOJ prosecutors allege Sze and others provided gift cards and other bribes worth at least $57,000 to bank employees.

Sze’s organization laundered funds by buying cashier’s checks and wiring funds to thousands of individuals in the U.S., Hong Kong and other places, the DOJ said.

Sze pleaded guilty in 2022. Fentanyl has killed more than 150 people per day since 2021, according to data from the Centers for Disease Control and Prevention.

TD is cooperating with law enforcement and regulators, a bank spokesperson told Banking Dive. Criminals routinely seek to launder money through banks, she said, and TD’s system didn’t spoil their efforts.

“This is unacceptable, and we must and we will do better,” she said. “As previously disclosed, we have been and continue to cooperate with law enforcement and our regulators. A comprehensive effort is underway to strengthen our AML program, including investments in talent, tools and technology.”

The DOJ investigation into TD is being led by the U.S. Attorney’s Office in New Jersey, sources told the Journal. The U.S. Attorney’s Office in New Jersey declined to comment to the publication.

National Bank of Canada analysts led by Gabriel Dechaine wrote in a note to clients that “[t]he allegations against TD lead us to assess more severe ‘worst-case’ scenarios than what we previously contemplated,” according to Bloomberg.

The bank is facing three other anti-money laundering probes in the U.S., one of which it plans to resolve with a $450 million set-aside, it disclosed.

Now, analysts are estimating the fine ro be about $2 billion, rather than the $500 million to $1 billion previously estimated. 

Dechaine’s analysis “suggests that these issues might not only result in a much larger fine than initially contemplated ... but they could also have longer-term implications for TD’s financial performance.”

A TD spokesperson told Bloomberg that the bank has the capital, liquidity and capacity “to fund the critical effort currently underway to strengthen its AML program, invest in the business and continue to serve its customers and clients with excellence.”

Days before the fentanyl news broke, Canada’s banking regulator, the Financial Transactions and Reports Analysis Centre of Canada, imposed a C$9.2 million ($6.7 million) fine on TD connected to AML, including failure to take the prescribed measures for high risk and failure to assess and document money laundering and terrorist activity financing risks.

“Canada’s Anti-Money Laundering and Anti-Terrorist Financing Regime is in place to protect the safety of Canadians and the security of Canada’s economy,” FINTRAC’s CEO, Sarah Paquet, said in a prepared statement. “FINTRAC will continue to work with businesses to help them understand and comply with their obligations under the Act. We will also be firm in ensuring that businesses continue to do their part and we will take appropriate actions when they are needed.”

TD’s AML woes have cost the bank big, aside from money. Regulator concerns over how it monitored suspicious transactions were rumored to be behind the termination of its proposed acquisition of First Horizon. Buying the Tennessee-based bank would have given the Canadian lender a head start in its strategy to expand in the Southeast U.S.

Bankrupt small-business lender Kabbage will pay up to $120 million over allegations it committed Paycheck Protection Program fraud, the Justice Department said in May.

Through two separate settlements, KServicing Wind Down Corp. is resolving allegations “that it knowingly submitted thousands of false claims for loan forgiveness, loan guarantees and processing fees to the U.S. Small Business Administration” as part of PPP, government-backed COVID-19 relief program, in violation of the False Claims Act, the DOJ said. The company also employed lax fraud controls, investigators said. 

The resolution comes three years after reports that the DOJ was investigating whether Kabbage and other online lenders miscalculated how much PPP aid borrowers were entitled to. KServicing didn’t immediately respond to a request for comment. 

In 2020, Kabbage processed about $7 billion in PPP loans for more than 300,000 borrowers; it was the second-largest PPP lender in the nation by application volume. The company received about $190 million in processing fees on the loans, according to one of the settlement agreements.

Through the PPP — created in March 2020 as part of the federal government’s pandemic aid response — private lenders were authorized to approve loans for eligible borrowers who could pursue forgiveness as long as funds were used for employee payroll and other specific expenses. Lenders were required to confirm borrowers’ average monthly payroll costs by reviewing payroll documentation submitted with applications, and follow applicable Bank Secrecy Act/anti-money laundering requirements.

When the company’s technology and a portion of its team were bought by American Express in 2020, that left the holding company, KServicing, to administer the remaining $1.3 billion portfolio of PPP loans.

KServicing was informed in 2021 that Justice Department offices in Massachusetts and the Eastern District of Texas were investigating PPP fraud allegations, and the company filed for bankruptcy in October 2022.

The first settlement, providing the government with a recovery claim of up to $63.2 million, dealt with allegations that Kabbage “systemically inflated tens of thousands of PPP loans, causing the SBA to guarantee and forgive loans in amounts that exceeded what borrowers were eligible to receive under program rules,” the release said. 

KServicing Wind Down Corp. admitted that Kabbage double-counted state and local taxes employees paid as gross wages were calculated; failed to exclude yearly compensation over $100,000 per employee; and miscalculated payments made by employers for leave and severance. As early as April 2020, Kabbage was aware of its errors, U.S. attorneys said, but the company failed to address incorrect loans already disbursed and kept approving added loans with miscalculations. 

That settlement also allows Kabbage to receive a $12.5 million credit for payments it had already returned to the SBA during the investigation, the DOJ said.

The second settlement, with a recovery claim of up to $56.7 million, involves allegations that Kabbage knowingly failed to put in place appropriate fraud controls designed to comply with PPP, BSA and AML obligations.

Investigators said Kabbage removed underwriting steps from its pre-PPP procedures so the company could process a larger number of loan applications and maximize processing fees; knowingly established “substandard” fraud check thresholds even though the company was aware of SBA’s concerns about fraudulent borrowers; and leaned on automated tools that didn’t adequately identify fraud. 

The firm also had “insufficient personnel” conduct fraud reviews and discouraged employees from asking borrowers for more information to support loan requests. It also submitted to the SBA thousands of PPP applications that were either fraudulent or highly suspicious for fraud, investigators alleged.

“Kabbage received tens of millions of dollars through the PPP to help lend taxpayer funds to businesses in need. Instead of safeguarding those funds, Kabbage doled out inflated and fraudulent loans, in an effort to maximize its profits,” Joshua S. Levy, acting U.S. Attorney for the District of Massachusetts, said in Monday’s release. “Then, Kabbage sold its assets and left the remaining company so low on cash that it ultimately went bankrupt, leaving taxpayers exposed to the risk of loss caused by Kabbage’s conduct. This office will continue pursuing any company or individual, like Kabbage, that took advantage of the PPP.”

The Kabbage cases are not the only PPP-related settlements to arise this year. Fintechs Biz2Credit and Womply agreed in March to pay a collective $59 million to settle Federal Trade Commission allegations they deceived small businesses seeking PPP loans during the pandemic. KServicing, in its bankruptcy filing, said it was forced to turn to Biz2Credit to process PPP loan forgiveness applications due to lack of cooperation from Kabbage’s acquirer, American Express.

The civil settlement also includes the resolution of two qui tam claims: one brought by an accountant who submitted PPP loan applications to Kabbage and other lenders, and another brought by a former legal analyst in Kabbage’s collections department, the DOJ said. 

The amount recovered will depend on the assets available to the bankruptcy estate for distribution to unsecured creditors, the release noted.

A new guide designed to aid community banks as they assess and manage risk in third-party relationships signals that regulators are aware of the importance of those tie-ups for smaller banks, industry experts said.

The Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corp. in May jointly released a guide for community banks on third-party risk management. Although regulators noted the guide doesn’t prescribe specific risk management practices, it’s intended to be a resource for community banks as they develop and implement third-party risk management programs and policies. 

“The very clear acknowledgment that community banks benefit from a variety of third-party relationships and partnerships is just a reflection of the world that community banks operate in,” said Michele Alt, a partner at financial services advisory and investment firm Klaros Group. “And that is a welcome sign.”

The document follows interagency guidance issued in June 2023 on how banks should approach third-party relationships, including partnerships with fintechs. Those relationships have faced more regulatory review of late, as regulators assess the oversight of such tie-ups and whether effective anti-money laundering and Bank Secrecy Act processes are in place, said Kristen Larson, who’s of counsel at law firm Ballard Spahr. 

Blue Ridge Bank, Cross River Bank and First Fed Bank have all faced penalties related to their fintech partnerships as regulators push for stricter oversight of the tie-ups. Tennessee-based Lineage Bank, New York-based Piermont Bank and Ohio-based Sutton Bank have also been hit with consent orders this year related to third-party relationships. 

The guide covers all types of third-party relationships, as smaller banks, in particular, are more likely to outsource certain functions. Indeed, the guide acknowledged that community banks tap third parties to remain competitive amid a changing landscape, and such tie-ups can offer banks access to new technologies, tools, services and markets.

However, a community bank’s reliance on third parties “reduces its direct operational control over activities and may introduce new risks or increase existing risks, including, but not limited to, operational, compliance, financial, and strategic risks,” the guide noted.

That’s why it’s important that community banks “appropriately identify, assess, monitor and control these risks” and ensure activities are conducted in a safe and sound manner and in compliance with fair lending laws and prohibitions against unfair, deceptive or abusive acts or practices, as well as regulations around fraud and money laundering, the guide said.

Many community banks struggle to prioritize all the activities required to monitor third-party relationships, said John Soffronoff, partner and U.S. head of community banking at consulting firm Capco. The guide “provides a good roadmap for community banks to evaluate their third-party relationships throughout their entire lifecycle,” he said in an email. 

The guide outlines examples related to planning, due diligence, contract negotiation, ongoing monitoring and termination, and the questions community bankers should consider in certain scenarios, as well as governance practices surrounding third-party relationships. 

The Independent Community Bankers of America engaged with regulators over the past year, suggesting how to further assist community banks in internalizing the interagency guidance, said Michael Emancipator, senior vice president and senior regulatory counsel at ICBA.

“It’s almost a guide to how to read that guidance,” which was principles-based, Emancipator said. “Sometimes it is nice to have a little bit more meat and a little bit more specificity, in what lens [regulators are] looking at these activities.”

The specifics provided in the guide may put at ease the banks that have just dipped their toes in third-party relationship water, or haven’t yet, or may be worried about running afoul of regulators, Emancipator said.

The initial framing questions and hypothetical use cases can help bankers “get in the same mindset as the examination team” and might lead them to mull and ask next questions, Emancipator said. 

Still, to Matthew Bisanz, a partner at Mayer Brown, the guide suggests “the supervisory expectations for community banks to offer integrated products with third parties, such as fintechs, are extremely high,” he said in an email. “So high that the regulators doubt most community banks can handle it.”

Bisanz said he believes bank regulators are unhappy with the number of community banks partnering with fintechs to offer digital banking products, and pointed to high-profile enforcement actions that resulted in community banks ending partnership programs.

Alt, for her part, views the guide not as a “gotcha” or a scolding, but as a useful resource in helping banks manage the risks. Community banks should view the guide as a rough checklist, to apply to their own programs and to expect examiners to apply.

Alt also noted banks that don’t have a strategic plan in place should consider implementing one, if they engage in certain critical third-party risk relationships, given the guide’s mention of risk assessment aligning with a bank’s strategic plan.

The Financial Technology Association and the American Fintech Council applauded the guide, which provides clarity around bank-fintech partnerships, and “should help mitigate information asymmetries and provide clear expectations” around managing third-party relationship risks, according to a statement from AFC CEO Phil Goldfeder. 

But it’s also important that examiners make sure they’re properly assessing the risks posed by bank-fintech tie-ups, Goldfeder said, adding that there’s “a crisis of significant mismatch” between fintech services and regulatory mechanisms.

FTA CEO Penny Lee urged regulators “to ensure examiners are properly equipped to evaluate bank-fintech partnerships in a way that preserves access to valued financial tools and doesn’t stifle innovation,” according to a statement.

Former Heartland Tri-State Bank CEO Shan Hanes has been charged with embezzling $47.1 million in bank funds to buy cryptocurrency, court documents show.

Hanes, a three-decade employee of Heartland and its predecessor, was chief executive from 2008 until July 2023, when the firm collapsed due to what Kansas regulators at the time dubbed “an isolated event.”

What tanked the bank, according to Bloomberg, was Hanes’ crypto investments, which a wealthy Heartland customer close to the matter brought to the attention of regulators after Hanes asked him for a loan.

Heartland customer Brian Mitchell told authorities he saw a red flag when Hanes asked him for $12 million to help take his money out of a crypto investment, which had run into a supposed wire transfer issue. Mitchell declined to provide Hanes, who said the funds were not bank funds, with the loan, but learned later from a bank employee that Hanes did wire $12 million out of the bank.

Court documents filed in Wichita allege that Hanes began buying crypto in December 2022 with his own money. By early 2023, however, some of the purchases were made with funds embezzled from a local church and local investment club; and in May 2023, Hanes started purchasing crypto with bank funds, prosecutors allege.

“Shan Hanes used his position and authority as CEO of Heartland Tri-State Bank to make and authorize the wire transfers or direct other employees to make the wire transfers on his behalf,” prosecutors allege. Through July 2023, Hanes embezzled bank funds “by causing at least 11 wire transfer financial transactions from Heartland Tri-State Bank” to purchase crypto, without the authority to do so.

It's possible, Bloomberg reported, that Hanes fell victim to “pig butchering,” where scammers “fatten” victims up with a pledge of profitable returns but “slaughter” them before making good on their promises.

The FBI warned the public in December of such scams, noting that it “anticipates a higher loss in funds with investment scams this year, primarily due to the increase in Cryptocurrency Confidence [‘pig butchering’] scams which are one type of investment scam following particular typologies to scam victims.”

Heartland’s $139 million in assets and $130 million in deposits were acquired in July by Syracuse, Kansas-based Dream First Bank, and the Office of the State Bank Commissioner of Kansas said the state’s banking sector was “unaffected by this event.”

At the time of Heartland’s collapse, Hanes was chairman of the Kansas Bankers Association, and he previously served at least one term on the American Bankers Association’s board of directors. Neither association responded to Banking Dive’s request for comment.

Hanes did not return a request for comment by Bloomberg.

If convicted, he faces up to 30 years in prison, followed by a supervised release of up to five years, as well as the forfeiture of all property derived from the embezzled amount.

Piermont Bank and Sutton Bank each entered into consent orders with the Federal Deposit Insurance Corp. in February, the regulator disclosed, highlighting alleged deficiencies in the lenders’ banking-as-a-service work and partnerships with fintechs.

New York City-based Piermont Bank “engaged in unsafe and unsound banking practices,” and failed to have the internal controls and information systems needed for the bank’s size, as well as for the scope and risk involved with its third-party relationships, the FDIC said in the consent order.

In a separate order, Attica, Ohio-based Sutton Bank was also charged with unsafe or unsound banking practices and violations related to the Bank Secrecy Act.

The FDIC’s month-end disclosure of consent orders is becoming a regular spot to find pushback against banks’ fintech partnerships. The FDIC, at the end of February, made public its consent order against Franklin, Tennessee-based Lineage Bank, which the regulator required to implement an enhanced risk management program, increase capital levels, and let go of some fintech partners. Blue Ridge Bank, Cross River Bank and First Fed Bank, in recent months, have also received consent orders related to their fintech partnerships — though not always through the FDIC.

"Every bank that touches BaaS is getting an enforcement action," Wendy Cai-Lee, CEO of Piermont Bank, told American Banker. "I don't think anyone is not getting one at this point."

Piermont’s 35-page consent order, dated Feb. 26, directs the bank’s board to increase its supervision of management, as well as oversight and monitoring of the bank’s financial condition, risk profile, activities, third-party relationships, anti-money laundering and counterterrorism financing, and the bank’s internal controls and audit systems.

The FDIC ordered Piermont to review all transactions since September 2022 to ensure all suspicious activity was reported. It must also review Electronic Funds Transfer Act disputes since August 2020.

The regulator outlined requirements related to maintaining “an appropriate number” of bank officers, establishing systems and procedures to maintain compliance, ensuring an appropriately sized internal audit, and assessing whether the bank’s board committee members have appropriate expertise. 

Within 90 days of the order, the bank must conduct a review of the data, documents and records related to its operations, bank activities and third-party relationships, the FDIC said. That assessment must consider whether the data “appropriately enables the bank to operate … in a safe and sound manner,” and to determine whether its third-party relationships comply with laws and regulations, the order said. The bank also has to assess its systems to ensure compliance with laws and regulations.

The order underscored that the bank’s procedures, data and systems tied to third-party relationships and the bank activities conducted through those relationships must “include clear lines of authority and responsibility” when it comes to monitoring adherence to bank procedures and laws and regulations, as well as effective risk assessment.

Within 120 days of the order, the bank has to review whether its third-party relationships program has the appropriate due diligence procedures; written agreement parameters; policies related to oversight and monitoring; data, systems and reporting; and recommendation and approval processes, the FDIC said. Within 30 days from that point, the bank has to come up with an action plan addressing any deficiencies discovered in its third-party relationships program. 

Piermont has partnered with BaaS companies Treasury Prime and Unit.

Sutton’s consent order

In Sutton Bank’s 10-page consent order, issued Feb. 1, the FDIC said the bank must implement, within 180 days of the order, a revised AML/CFT program designed to maintain bank compliance with the Bank Secrecy Act.

The FDIC also directed the bank to “develop appropriate policies and procedures relating to third-party risk management,” and compile an inventory of those relationships.

Sutton must designate program managers responsible for customer identification programs, transaction monitoring, independent testing and reporting suspicious activity for each partnership, the FDIC said.

Sutton also must have at least one BSA officer who reports to the board, and must establish a board committee to ensure compliance with the consent order, the FDIC said.

The bank, within 60 days of the order, must devise a plan to review all prepaid card customers since July 1, 2020, to ensure the bank knows their true identities, the FDIC said.

The orders pin responsibility for compliance on banks rather than their partners. “Banks that chose to outsource their risk [to third-party partners] will continue to be at risk of regulatory scrutiny," Matthew Smith, president of Bankers Helping Bankers, told American Banker.

But Phil Goldfeder, CEO of the American Fintech Council, told the publication that banks “also require clarity and appropriate rules of the road from regulators.” 

"It absolutely looks and feels like innovation within the banking system is being disproportionately targeted by regulators who at times seem like they are trying to make a point rather than helping to build the future of financial services," Goldfeder said. 

Charlie, a neobank for the 62-plus demographic, intends to launch fraud protection products after closing a $23 million Series A round, the fintech announced in October.

After garnering investment from TTV Capital, FPV, Better Tomorrow Ventures and other seed investors, the latest round of funding will help the firm launch products that address the more than $28 billion stolen from older Americans every year, the company said in a statement.

“Charlie is on a mission to fundamentally transform financial services for the 62+ community and with this new funding, we are able to take great strides in doing just that,” Kevin Nazemi, co-founder and CEO of Charlie, said in a statement. “Everything we do at Charlie is designed to meaningfully address the unique challenges retirees and soon-to-be-retirees face financially and help them make the most of their limited resources to enjoy life.”

The fresh capital, a combination of $16 million in equity and $7 million in debt, comes less than six months after the firm’s public launch, when it rolled out its retiree-focused banking services after securing an initial $7.5 million in funding.

The company will soon launch a set of anti-fraud tools designed specifically for the 62+ population, “using their habits, patterns, and preferences,” the fintech said in a release. The funding will also go toward hiring and training new talent, as well as additional product development. 

Charlie declined to share how many customers it has acquired since its launch, but a spokesperson said it has users in all 50 states. 

The fintech, whose banking services are provided by Attica, Ohio-based Sutton Bank, has several features aimed at solving pain points facing retirees and soon-to-be-retirees.

“Most financial services offerings aren’t built for them, unless they have a ton of money,” Nazemi told Banking Dive in May 2023. “The industry could do a lot better.”

Charlie account holders receive a 3% annual percentage yield on average balances, and have access to a network of 55,000 ATMs, including retailers CVS and Walgreens, the company said.

The fintech launched with a feature that allowed account holders who linked their Social Security direct deposit to their Charlie deposit account to withdraw the funds up to four weeks early. The startup, however, had to limit the number of users who can access the benefit, due to demand, a company spokesperson told Banking Dive.

“Charlie’s up-to-four-weeks-early Social Security benefit requires a tremendous amount of capital, and given the incredible demand from customers since our launch in May, we’ve reached capacity at this time,” the spokesperson said.

All Charlie customers who signed up before Sept. 1 continue with the up-to-four-weeks-early benefit. Customers who signed up after Sept. 1 can withdraw their Social Security benefit three-to-five days early, the spokesperson said.

“Charlie has generated impressive customer traction just six months post-launch, and that's a testament to what the team has created,” Gardiner Garrard, co-founder and managing partner of TTV Capital, said in a statement. “We're energized by their vision and are proud to invest in their future.” 

The company’s capital raise comes as high interest rates and inflation are contributing to a difficult funding environment for fintech startups. Fintech venture capital funding has dropped globally by 49% year over year to $23 billion in the first half of 2023, according to S&P Global Market Intelligence.

While check use has plummeted over the last three decades, according to the Federal Reserve, check fraud has been on a different trajectory, increasing 385% nationwide since the COVID-19 pandemic, Treasury Department figures show.

Codat, a fintech based in London and New York, aims to remedy the issue.

The firm in April launched its Supplier Enablement API product, which seeks to help banks drive spending through virtual card products by allowing business customers to more easily share data from their accounting software with their bank.

By ousting static supplier payment files for secure, continuous API connnections, Supplier Enablement offers more robust data sets and analysis to banks.

JPMorgan Chase is one of the early users of the product.

“Thanks to our work with Codat, our clients can easily and digitally deliver critical supplier enablement data to our firm, helping to realize efficiency gains and cost savings sooner as well as across a greater share of their spend,” Stephen Markwell, head of product strategy and fintech partnerships for commercial banking at JPMorgan, said in a prepared statement.

When a business customer first engages a bank in search of a product — perhaps a loan or a commercial card — the first thing the bank asks of them is to provide data, Codat Chief Revenue Officer Joey Rault said in an interview with Banking Dive.

Getting the data to the bank, and in a format the bank can use, can be a timely process, he said, in particular for small- to medium-size businesses.

“What we're hearing from the banks and what we're hearing from the relationship managers, the sales professionals, the bankers who are engaging with these small- and medium-sized businesses, is that it’s two, three, four weeks for them to actually get the file manually on average. With Codat, we’re talking about five minutes,” he said.

“That time savings makes it easier for the bank to build a deeper connection with the small business because they literally are connected directly to the source data,” Rault said. “And more importantly, from an actual customer relationship standpoint, now we're not going back and forth about the data — we're actually having a conversation about the service.”

Supplanting check use with virtual cards has two main benefits, said Ed Sherrington, Codat’s head of product for banking.

“In this high inflationary environment, there's a lot of pressure on cash flows, both for the customers who are paying their bills and for the vendors and suppliers themselves. Virtual cards are a win for both sides because they enable bank customers to pay their vendors on credit, and for the suppliers that on average, get paid much, much quicker when it's by virtual card [as opposed to check]. That has huge benefits to their cash flow,” Sherrington told Banking Dive.

The other benefit, he said, is “an increased sensitivity towards fraud and keenness” to prevent check fraud.

“Check payments are highly susceptible to fraud,” he said. “The more that we can get payments off of check and onto more secure payment methods like virtual card, the better for everyone involved.”

New York Attorney General Letitia James sued Citi in federal court in January, alleging the bank fails to protect customers from fraud and refuses to reimburse victims. 

“Banks are supposed to be the safest place to keep money, yet Citi’s negligence has allowed scammers to steal millions of dollars from hardworking people,” James said in a statement. “Many New Yorkers rely on online banking to pay bills or save for big milestones, and if a bank cannot secure its customers’ accounts, they are failing in their most basic duty.”

James cites a case in which a Citi customer, in October 2021, received a text message appearing to be from the bank, instructing her to log onto a website or call her local branch. The customer clicked the link in the message and later called her branch to report the activity. The customer alleges Citi told her not to worry about it.

But within three days, she said, she realized a scammer had changed her banking password, enrolled in online wire transfers, transferred $70,000 from her savings to her checking account, and electronically pushed a $40,000 wire transfer. Such transfers were inconsistent with the customer’s account history, James argued. The customer stayed in touch with the bank and submitted affidavits, but her fraud claim was ultimately denied, James said.

Particularly, James asserted, Citi is required by the Electronic Fund Transfer Act to reimburse victims of fraud because the bank makes wire transfers available to consumers online and through mobile banking apps.

“Banks are not required to make customers whole when those customers follow criminals’ instructions and banks can see no indication the customers are being deceived,” Citi said in a statement seen by CNBC.

The bank said it has “taken proactive steps” to buffer accounts with “leading security protocols, intuitive fraud prevention tools [and] clear insights about the latest scams.” 

“Our actions have reduced client wire fraud losses significantly, and we remain committed to investing in fraud prevention measures to help our clients secure their accounts against emerging threats,” the bank said. A spokesman added that Citi has followed all laws and regulations related to wire transfers, according to CNBC.

James wants a judge to order Citi to document all denied customer claims from the past six years that were tied to unauthorized payment orders and debit authorizations. She also wants the bank to reimburse victims, pay a $5,000 fine for each instance in which it violated the law and adopt enhanced anti-fraud defenses.

“My office will not write off illegal behavior from big banks,” James said.

James was one of 21 attorneys general who, in December, urged the Office of the Comptroller of the Currency and the Consumer Financial Protection Bureau to push banks to cooperate with state agencies.

Sen. Elizabeth Warren, D-MA, for one, chastised big-bank CEOs who testified on Capitol Hill in 2022, claiming most were less than forthcoming in giving the Senate Banking Committee data detailing how many customers had submitted claims related to transfers through the platform Zelle.

Zelle reimbursed 47% of the amount customers reported in fraud in 2021 and the first half of 2022, Warren found.

CFPB Director Rohit Chopra in June 2023 told lawmakers in a separate hearing that financial institutions are not working fast enough to implement ways to make consumers whole after they fall victim to peer-to-peer payments scams.

The Federal Reserve’s FedNow instant payments system faces participant concern about potential fraud, according to commentary during a webcast hosted by the central bank.

That Fed “town hall” was billed as a discussion of new use cases for the real-time payments system, with representatives from the fintech Plaid and the Virginia Department of Treasury joining to share their experiences. But it also touched on fraud repeatedly as some 800 attendees listened in on the webcast.

FedNow’s early volume since the July 2023 launch has been “modest,” said Bernadette Ksepka, FedNow’s head of product development. Still, the number of participants on the system jumped from 35 financial institutions at the start to about 330 as of December, she said. They range in size from less than $500 million assets to more than $3 trillion and hail from 45 states, she added. (A senior vice president at the Atlanta Fed said the number of FedNow participants had increased to 700 as of April 2024.)

As it’s building out the new system, the Fed is planning to enhance “configurable fraud controls,” among other improvements, she noted as part of a slide presentation. Those tools will be in addition to some FedNow fraud-prevention capabilities and reporting requirements that were there from the start.

“We know that fraud is top of mind for many of you, and it’s definitely top of mind for us,” Ksepka said.

FedNow is aimed at speeding up payments in the U.S., allowing consumer and business transactions to clear and settle within minutes, as opposed to days. The nation is playing catch-up with other countries that already count real-time payments as a higher percentage of their overall payments volume. While the U.S. has had a private real-time payments system in place in the form of the RTP network since 2017, it has made inroads only slowly.

One presenter on the Fed’s webcast, Ajay Andrews, who heads product development at the fintech Plaid, underscored the need for users to understand the particular potential risks of any disbursement use case, including the impact of possible account takeovers, “mule” accounts and other scams.

“You need to have some form of intelligence to understand that the receiver is who they claim to be,” Andrews cautioned the webcast audience. “Because the flip side of instant money movement — and we've seen this in other markets, like the U.K. — is that scams and fraud may go up. So, thinking ahead of that, and putting in those controls, is really important.”

The configurable tools the Fed is mulling will allow banks and credit unions to tailor fraud-prevention safeguards to their own needs and risk tolerances, based on the “cumulative value and velocity” of transactions, Ksepka said. Those guardrails will likely be welcome by an industry that has faced a significant increase in fraud in recent years.

“The vision is to allow a participating bank the ability to set limits based on a particular customer segment,” Ksepka said. “For example, a financial institution may decide to set a higher value or velocity limit for its business customers while imposing a stricter limit on those holding, say, a student account.”

Kara Ford, the Federal Reserve Bank of Chicago payment services specialist who moderated the webcast discussion, elaborated on what the new tools might look like. 

“Future features under consideration would enable financial institutions to activate a control setting that rejects payments that exceed established velocity limits, or cumulative value over a period of time,” she said. “Later, potential features could provide the ability to fine-tune controls for different types and segments of customers and also identify higher-risk transactions.”

Since September, the Fed has convened a series of meetings with interested financial institutions to discuss the FedNow fraud-related issues in the second half of the year.

Some of the fraud issues discussed included Fed support for financial institutions’ anti-fraud programs, such as network-level tools; participant level limits; information and data sharing regarding transactions; and processes for fraud reporting, detection and investigations, Ford said.

“The feedback we received so far is helping inform and then shape the next set of fraud mitigation capabilities and tools,” Ford said.

Another series of such meetings focused on the potential for the use of alias-based payments and various approaches the Fed might take for incorporating them in FedNow.

“We worked to obtain perspectives and feedback on the market needs, including gaps that are out there in existing alias-based solutions, pain points and concerns around fraud and scams, as well as some security considerations,” Ford said. The “potential alias-based payment facilitation services” and use cases for an alias directory were also discussed, she said. 

FedNow officials in 2023 discussed high demand for use cases that would require the ability to originate payments on the basis of a phone number or email identity, what the industry refers to as an “alias” that doesn’t reveal other personal information. To accommodate that interest, the central bank has reviewed the development of a FedNow alias directory for financial institutions so they could manage accounts in such an environment. 

A spokesperson for the Fed declined further comment related to any FedNow fraud issues.

Binance founder and former CEO Changpeng Zhao was sentenced in April to four months in prison for violating anti-money laundering laws while at the helm of the world’s largest cryptocurrency exchange.

Judge Richard Jones of the U.S. District Court for the Western District of Washington handed down the sentence five months after Zhao — long considered one of the most powerful and successful people in crypto — pleaded guilty to failing to maintain an effective AML program, in violation of the Bank Secrecy Act.

The Justice Department wanted Zhao locked up for three years and to pay a $50 million fine, according to a sentencing memo. Sentencing guidelines, by contrast, recommended 12 to 18 months.

Zhao’s legal team had suggested he instead serve five months of probation in Abu Dhabi, where his family lives, adding that “[n]o defendant in a remotely similar BSA case has ever” been sent to prison.

In court, Jones said to Zhao, “Everything I see about your history and characteristics are of a mitigating nature and a positive nature,” according to The Verge reporter Elizabeth Lopatto, who was present in the courtroom.

Jones said the court recognizes that Zhao took “extraordinary steps and significant steps” to cooperate with the government, and that he doesn’t believe Zhao is likely to re-offend.

The scale of his offense, however, is “remarkable,” and the judge “wants to consider deterring future crime,” Lopatto reported.

Earlier in the hearing, prosecutor Kevin Mosley — addressing the possibility that Zhao receive no prison time, per the defense’s suggestion — told the judge, “If Mr. Zhao does not face incarceration after deliberately and willfully planning to violate U.S. law to build the largest crypto exchange in the world and get rich in the process … then no one will face incarceration and the BSA will for intents and purposes be a dead letter,” according to a post on social media site X from CoinDesk reporter Nikhilesh De, who was present in the courtroom.

Defense attorney William Burck, however, told the judge that sentencing Zhao to prison would “tell people not to come to the U.S. and accept responsibility for their crimes,” Lopatto reported.

Burck and Mark Bartlett, Zhao’s other defense attorney, leaned into Zhao’s cooperation with the government as a factor in consideration.

“He never minimized his conduct” and “admitted his mistake,” said Bartlett, according to Lopatto; and he returned to the U.S. voluntarily to plead guilty and face sentencing, rather than stay in the United Arab Emirates.

Zhao spoke at the hearing, too, noting, “The first step to taking responsibility is to fully recognize the mistakes.”

While he failed to set up a know-your-customer/AML program at Binance, he said he’s tried to rectify that and has directed the company he once led to cooperate with the government, De reported.

Zhao had already agreed to pay a $50 million fine. Binance, for its part, paid $4.3 billion in penalties when Zhao stepped down from the company in November. Richard Teng replaced him as CEO.

Zhao’s four-month sentence stands in contrast to the 25 years of prison time given to FTX founder Sam Bankman-Fried, another former crypto luminary whose trial wrapped up in March.

Defense attorneys have requested that Zhao be sent to SeaTac, a federal prison in Seattle.