Capital One FinCEN $390 Million Penalty: Check Cashing Unit AML Lessons

In January 2021 the US Financial Crimes Enforcement Network (FinCEN) assessed a $390 million civil money penalty against Capital One, National Association. FinCEN credited the $100 million the bank had paid to the Office of the Comptroller of the Currency (OCC) in October 2018, so $290 million went to the US Treasury. The case concerns a business the bank ran until 2014, a lending unit that served check cashers, and it shows how a bank can fail on three fronts at once: an AML programme that did not fit the risk, suspicious activity that went unreported, and tens of thousands of currency transaction reports (CTRs) that were never filed because of a coding error. To build your AML knowledge, see our CPD courses.

This guide is based on FinCEN assessment number 2021-01. We read it through a summarising tool, so check every figure against the order before you quote it.

The business and the period

The order concerns the bank's Check Cashing Group, part of its commercial lending business. The group served roughly 90 to 150 check cashers in New York and New Jersey, which held more than 1,000 accounts with the bank. Check cashers are money services businesses, which must run their own AML programmes, and lending to them concentrates risk. The bank decided to exit the business in December 2013 and completed the exit in December 2014. The main period is about 2008 to 2014, with the AML programme violation dated from at least 2009.

FinCEN found willful violations of the AML programme rule (31 U.S.C. 5318(h)(1) and 31 C.F.R. 1020.210) and of the suspicious activity reporting rule (31 U.S.C. 5318(g) and 31 C.F.R. 1020.320), and negligent violations of the CTR rule (31 U.S.C. 5313). Our suspicious activity reporting guide explains the reporting duty.

What went wrong

Controls that did not fit the risk

FinCEN found that the bank's controls were inadequate for the risk of the check cashing business, inconsistently applied, affected by technical failures, and too deferential to explanations from the business line. A key report of large items was wholly inoperative from August 2012 to July 2013.

SARs filed late or not at all

No SAR was filed on the Check Cashing Group until October 2009. Analysts flagged suspicious activity at 30 or more customers, and some suspicious conduct went unreported for years. The order describes a customer who owned or controlled up to six check cashing entities and was the fourth-largest customer of the group. His entities cashed more than $14 million in checks above $9,000 in two months in 2010, he deposited $6.9 million through 58 checks he wrote to himself, and about $160 million moved through more than 20,000 of his transactions in roughly the year before December 2013. Between 2011 and 2013 the bank filed 59 SARs from 75 alerts on his activity, but none named him as a subject; the first to do so was filed on 12 December 2013. He later pleaded guilty to conspiring to launder the proceeds of loan-sharking and illegal gambling through the bank's accounts. The lesson is that a SAR must identify the right person, not just the transaction.

A coding error and 50,000 missing CTRs

About 50,000 reportable cash transactions, totalling more than $16 billion, went unreported because of a coding error. FinCEN treated this as negligence rather than a willful failure. The bank self-reported the problem in 2011 and backfiled the reports. Our Kingdom Trust case study shows another firm whose reporting depended on weak systems.

Remediation and self-reporting

The bank self-reported its CTR failure in 2011, began a voluntary lookback on transactions missed by the large-item report in 2013, repaired the report in July 2013, and exited the check cashing business by December 2014. Since 2014 it has tripled its AML budget and staff under new AML leadership. It provided documents and presentations, signed tolling agreements, and entered a 2015 consent order with the OCC for related conduct. The order contains no separate compliance undertakings or monitorship; the consent includes not contradicting the admissions, disclosing facts on request, waiving limitation defences and not contesting the statement of facts.

Why it matters now

The order was issued years after the conduct stopped, which tells you how long a regulator will look back at a bank's past. It also shows the value of early self-reporting: the CTR problem was reported voluntarily, and was treated as negligent rather than willful. Compare the bank-scale failings in our TD Bank guide.

Practical lessons

• Treat lending to money services businesses as high risk. The risk of your customers' customers is yours too.
• Monitor your own reports. A report that stops working for a year should trigger an alarm.
• Name the right subject. SARs that leave out the principal customer fail their purpose.
• Test coding changes. A single error caused 50,000 missing CTRs.
• Self-report early. It changes how the regulator characterises the failure.
• Challenge the business line. Controls that defer to explanations from relationship managers will be found wanting.

Frequently asked questions

How much did Capital One pay?

The penalty is $390 million; with the $100 million OCC credit, $290 million went to the Treasury.

What business line was involved?

The Check Cashing Group, which lent to check cashers in New York and New Jersey and was closed in 2014.

Was the CTR failure willful?

FinCEN described the CTR failures as a pattern of negligence; the AML programme and SAR failures were willful.

What we could not confirm

We read FinCEN's assessment through a summarising tool. The total number of SARs filed on the group is not stated, and the amount of unreported suspicious transactions is described only as millions of dollars. Please check all figures against the original document.