Kingdom Trust FinCEN $1.5 Million Penalty: Custodian SAR Failures Explained

The Kingdom Trust Company is a South Dakota trust company that provides custody for self-directed individual retirement accounts and acts as a qualified custodian for investment advisers. In April 2023 the US Financial Crimes Enforcement Network (FinCEN) assessed a $1.5 million civil money penalty against it for willfully failing to report suspicious transactions. The sum is small, but the order matters because it shows how a custodian that also moved payments for foreign investment firms and Latin American money services businesses can become a conduit for trade-based money laundering and securities fraud. To build your AML knowledge, see our CPD courses.

This guide is based on FinCEN consent order number 2023-01. We read it through a summarising tool, so check every figure against the order before you quote it.

The firm, the period and the rules

Kingdom Trust is treated as a "bank" under the Bank Secrecy Act (BSA) because it is a trust company. It is headquartered in Sioux Falls, South Dakota, with a trust services office in Murray, Kentucky, where most of its roughly 80 employees work. During the period it also provided account and payment services for foreign securities and investment firms and for money services businesses in Latin America, which carried elevated money laundering risk. The relevant period is 15 February 2016 to 15 March 2021. FinCEN found a violation of the suspicious activity reporting rule (31 U.S.C. 5318(g) and 31 C.F.R. 1020.320). The order mentions an AML programme rule with a compliance date of 15 March 2021, but says it was not a basis for the violations. The text we read does not give the date the order was signed; FinCEN's enforcement list shows 26 April 2023.

What FinCEN found

No real suspicious activity process

Before December 2018 there was no standalone process for detecting and reporting suspicious activity. The firm relied on operations staff and then on a single compliance employee with other duties and no previous AML experience. FinCEN said reliance on employee referrals was an unrealistic primary control, and described insufficient AML-experienced staffing, weak training and a weak culture of compliance.

Manual monitoring of thousands of daily transactions

Staff reviewed thousands of transactions a day by hand, with limited customer context. Work on an automated monitoring vendor began in late 2017, but the system was deployed only in autumn 2021, after the period, and had not been independently audited when the order was written. Our guide to AI in AML transaction monitoring explains why validation matters.

Hundreds of suspicious transactions not reported

FinCEN found hundreds of suspicious transactions that went unreported, though the order gives no precise total. Only four SARs were filed between February 2020 and March 2021, and no SARs were ever filed on watch-list persons. The order states that at least $4 billion in payments for foreign entities moved through Kingdom. Examples include a tourism company with nearly 200 transactions of about $16 million, a private fund with over 400 transactions of about $63 million including more than 150 wires to Miami-area mobile phone businesses linked to a trade-based money laundering scheme, and customers involved in securities fraud with over 80 transactions of about $8.9 million. At least 11 correspondent banks closed Kingdom's accounts. Our trade-based money laundering guide lists the red flags to watch for.

Undertakings

Kingdom must hire an independent consultant, subject to FinCEN approval, to carry out a SAR lookback of covered transactions, with the report due no later than January 2024; any required SARs must be filed within 60 days of the report, with one 60-day extension as of right. It must also hire an independent consultant for an AML programme review, submit the scope within 30 days of retention, and receive a final report within 60 days of the end of the review and no later than nine months after the effective date. It must then adopt the recommendations or propose alternatives and report on implementation.

Cooperation and remediation

Kingdom cooperated substantially, including a tolling agreement and organised submissions, and cooperated with law enforcement. It did not voluntarily disclose the violations and had no known previous enforcement action. It engaged an independent consultant in 2016, an outside law firm in 2018 and an experienced AML compliance officer in July 2020, and after the period deployed an automated system and added compliance staff, including four hires since FinCEN's investigation began.

Practical lessons

• Know the risk of the services you add. Payment services for foreign investment firms changed a custodian's risk profile.
• Appoint real AML expertise. One person with other duties and no AML background is not a function.
• Do not rely on referrals. Employee reports are an extra control, not the main one.
• Screen and report on watch-list persons. No SARs on watch-list hits is a clear gap.
• Watch your banking relationships. Account closures by correspondent banks are a signal.

For a far larger case of unmonitored channels, read our TD Bank guide.

Frequently asked questions

How much was the Kingdom Trust penalty?

$1.5 million.

Why is a trust company covered by the BSA?

The BSA treats a trust company as a "bank", so it must report suspicious activity.

What period does the order cover?

15 February 2016 to 15 March 2021.

What we could not confirm

We read FinCEN's consent order through a summarising tool. The order's signing date is blank in the text we read and the total number of unreported transactions is not stated. Please check all figures against the original document.