Bancrédito FinCEN $15 Million Penalty: Correspondent Due Diligence and SAR Lessons

Bancrédito International Bank and Trust Corporation was an international banking entity (IBE) organised under Puerto Rico law and headquartered in San Juan. IBEs operate under Puerto Rico's Law 52 and are barred from serving Puerto Rico residents; Bancrédito's customers were mostly in Venezuela and Florida. In September 2023 the US Financial Crimes Enforcement Network (FinCEN) assessed a $15 million civil money penalty for willful violations of the Bank Secrecy Act (BSA), and the bank surrendered its licence and is in receivership. The order is a case study in correspondent account due diligence and in what happens when a bank's suspicious activity reports (SARs) are late, missing or misleading. To build your AML knowledge, see our CPD courses.

This guide is based on FinCEN consent order number 2023-02. We read it through a summarising tool, so check every figure against the order before you quote it.

The penalty, the period and the rules

The penalty is $15 million. The relevant period is 1 October 2015 to 16 May 2022. FinCEN found willful violations of three BSA requirements: SAR reporting (31 U.S.C. 5318(g) and 31 C.F.R. 1020.320), due diligence on correspondent accounts for foreign financial institutions (31 U.S.C. 5318(i) and 31 C.F.R. 1010.610, from 1 October 2016) and the AML programme rule (31 U.S.C. 5318(h) and 31 C.F.R. 1020.210, from 15 March 2021 to the end of the period). The text we read does not give the date the order was signed; FinCEN's enforcement list shows 15 September 2023. The bank had already been subject to a 2015 consent order and a 2021 memorandum of understanding with its Puerto Rico regulator.

What FinCEN found

An AML programme that failed on every pillar

The failings spanned internal controls, independent audit, the compliance officer, training and risk-based customer due diligence, and they were already the subject of the 2015 order. The regulator's 2019 examination cited internal controls, the BSA officer, training, independent testing and ongoing monitoring. The bank did not staff the BSA/AML committee required by the 2021 memorandum of understanding and was not compliant by the end of the period.

Correspondent account due diligence

The correspondent programme deteriorated after 2016. The 2019 examination found incomplete forms, no review of invoices and no comparison with anticipated volumes. FinCEN identified tens of thousands of transactions by high-risk account holders, totalling hundreds of millions of dollars. One Panamanian foreign financial institution received more than $100 million between 2014 and 2019. The order gives examples such as six wires totalling $970,000 from Colombian companies in 2018 and a $100,000 wire to a company in the British Virgin Islands in December 2016. Our guide to the FATF Recommendations explains why correspondent relationships are a standing high-risk area.

Customer due diligence: ownership not verified

The order criticises inadequate verification of customers. For example, the bank did not independently verify the beneficial ownership of a customer who was a minor when his company was formed.

SARs that were missing, late or misleading

The bank filed no SARs before 2016 and, despite notice from its regulator by early 2020, only one on a particular executive before 2021. The regulator's 2019 examination identified dozens of transactions between October 2016 and March 2019 and ordered backfiling of more than 300 of them; the bank agreed to only 182, and many included misleading narrative language. FinCEN found hundreds of millions of dollars in suspicious transactions with untimely SARs or none, and after March 2021 more than $100 million in suspicious transactions by previously reported customers went unreported on time. Examples include a $7.5 million art sale in 2019 and over $13.6 million in transfers from July 2016 for one customer. Jurisdictions involved included Venezuela, South Florida, Panama, Colombia, the Cayman Islands, the British Virgin Islands, Hong Kong, Switzerland and the Bahamas. Our suspicious activity reporting guide explains why a SAR narrative must be accurate and complete.

Cooperation, remediation and the outcome

Bancrédito produced documents, signed several tolling agreements and completed a regulator-mandated SAR lookback during the investigation. It did not voluntarily disclose the violations. FinCEN found the bank failed to take prompt or effective action, filing some SARs months or years late and adding misleading language. Beyond surrendering its licence, no remediation programme is stated. The order requires the bank to surrender its international banking licence (which it may not seek again), preserve BSA records for at least five years and cooperate with FinCEN. The Puerto Rico regulator imposed its own penalty for the same conduct; the amount is not stated in the text we read.

Practical lessons

• Do not let an old consent order lapse into history. The same deficiencies persisted after the 2015 order.
• Compare correspondent flows with expectations. Transactions that exceed anticipated volumes need review.
• Verify who owns the customer. Beneficial ownership claims should be independently tested.
• Back-file when asked. Agreeing to refile only part of what a regulator requests is a poor position to defend.
• Write honest narratives. A SAR that misleads is worse than a late one.

For a recent large case where an inherited warning was not acted on, read our TD Bank guide.

Frequently asked questions

What is an international banking entity?

A Puerto Rico entity organised under Law 52 that may not serve Puerto Rico residents. Bancrédito's customers were mostly in Venezuela and Florida.

How much was the penalty?

$15 million. The text we read does not state any suspension or crediting.

Did the bank lose its licence?

Yes. It surrendered its international banking licence and may not seek a new banking licence; it is in receivership.

What we could not confirm

We read FinCEN's consent order through a summarising tool. The order's signing date is blank in the text we read, and the amount of the Puerto Rico regulator's penalty is not stated. Please check all figures against the original document.