The Office of the Comptroller of the Currency (OCC), the federal regulator of national banks in the United States, has imposed a $350 million penalty on one of the country’s largest card issuers through its banking subsidiary. According to the regulator’s findings, which the institution has neither admitted nor denied, the subsidiary failed to detect and report to the authorities in a timely manner approximately $13 billion in suspected trade-based money laundering, in transactions spanning 2014 to 2025.
The regulator points to customer knowledge
The OCC identifies deficiencies in resources, internal controls, independent testing and training, and highlights two underlying issues. According to the regulator, the subsidiary’s risk assessment was not tailored to its business activities, and its processes for identifying and understanding customers contributed to suspicious activity going undetected.
That understanding of the customer is what regulation calls customer due diligence, and it goes beyond verifying identity at onboarding. It covers the purpose of the relationship and the activity the customer is expected to generate, and it gives meaning to everything that is monitored afterwards.
Trade-based money laundering hides illicit funds behind manipulated prices or inflated invoices. In this case, according to published reports on the order, the funds allegedly moved through card spending and related refunds. In schemes of this kind, a charge for an inflated or fictitious sale followed by a refund can move money under the appearance of a commercial transaction. Viewed one by one, these transactions rarely stand out. The pattern emerges when they are compared against the customer’s expected profile, provided that profile exists and is kept up to date.
Identity verified at onboarding also expires
AML regulation already addresses this risk through ongoing due diligence, which requires institutions to review customers for as long as the relationship lasts. It is a challenge for any institution with a large customer base and long-standing relationships. The risk arises when the customer file is frozen at onboarding and only reopened when something forces a review. With a file like that, how can an institution know whether the person transacting today still matches the one verified years ago, or whether the declared purpose still holds?
Continuous identity starts from a different premise. Trust in a customer is updated with every interaction, combining who they are, how they behave and what transactions they carry out. For compliance teams, this makes it possible to spot a deviation as it begins, instead of reconstructing it years later.
The institution has committed to addressing the regulator’s requirements, which include an action plan within 90 days, a new risk assessment, a rebuilt due diligence program and a lookback review conducted by an independent third party. Reviews of this kind require reconstructing years of decisions about customers and transactions, and for any institution their difficulty depends on the evidence retained about what was checked, when and with what result. For the industry, the message is that supervisors examine customer knowledge across the entire relationship, from onboarding to the latest transaction.
