Two 2026 OCC consent orders deliver a clear message: when business complexity outpaces BSA/AML controls, enforcement follows. This executive brief examines the warning signs, board responsibilities, third-party risks, and practical growth gates banks should use to keep governance, staffing, systems, and independent assurance aligned with expanding payment, fintech, and cross-border activity.
Executive Summary
Two 2026 OCC consent orders carry the same warning from very different institutions: business complexity can outgrow the controls meant to govern it. In April 2026, the OCC cited a federal savings association whose payment-processing line generated wire, ACH, and cross-border volume that its BSA/AML program could not supervise. Weeks later, the OCC approved a state member bank’s conversion to a national charter only on the condition that it enter a consent order that carried forward unresolved deficiencies in foreign-correspondent banking and virtual-currency oversight. Neither action turned on a single product, partner, or technology. Both turned on whether governance, staffing, data, systems, and independent assurance scaled with the risk profile. New products, partners, and payment rails do not diminish a bank’s accountability for BSA/AML compliance, and that is the question this brief poses to boards and management. [1][8]
Key Takeaways
• Compliance capacity must scale with risk. Recent OCC actions indicate that rising transaction volume, cross-border exposure, foreign-correspondent activity, virtual-currency customers, and third-party dependence require documented changes to staffing, monitoring, technology, and testing. [1][3][8]
• The board owns the risk appetite. Directors need program-specific reporting that shows whether actual activity remains within approved limits and whether any exceptions are promptly resolved. [1][2]
• Third-party oversight must be continuous. Due diligence at onboarding is only the starting point. Banks must monitor performance, compliance, data quality, complaints, suspicious activity, and emerging concentration risk throughout the relationship. [2]
• Independent testing must challenge the operating model. The OCC found that one bank’s internal auditor failed to identify BSA/AML program weaknesses and to scope high-risk areas. Audits should test whether controls hold at current volumes, not whether policies exist. [1][4]
• Management should establish measurable growth gates. New products, partners, geographies, and payment rails should not proceed until compliance readiness criteria are met and independently validated.
OCC Actions Reveal a Broader Risk Pattern
The April 2026 order illustrates how a risk footprint can outgrow a balance sheet. Since 2020, the bank had significantly expanded its payment processing line relative to its size, generating substantial annual wire and ACH activity, including cross-border activity involving foreign financial institutions. The controls did not keep pace. Alert filtering criteria and thresholds were not tuned to the payment processing risk profile, and an automated triage tool auto-closed a very high percentage of ingested alerts that should have been escalated for review. Customer due diligence was ineffective, so the bank did not understand the nature of certain customers’ businesses or the purpose of transactions moving through the line. In various instances, it did not determine whether it maintained correspondent accounts for foreign financial institutions under Section 312 of the USA PATRIOT Act. The violations spanned the BSA/AML program rule, suspicious activity reporting, and 314(a) information sharing. Notably, the OCC stated that its findings were based on concerns largely unrelated to customers involved in digital asset activities. The issue was not a single technology or customer segment. It was a control structure that never caught up to the business. [1]
The second order shows that unresolved obligations travel with the institution. Significant deficiencies in foreign correspondent banking and virtual currency oversight, spanning BSA/AML and OFAC requirements, were identified in 2024 by the bank’s state banking department and its Federal Reserve supervisor while the bank was a state member bank. When the bank later applied to convert to a national charter, the OCC approved the conversion only if it entered a consent order carrying forward the 2024 corrective actions. A change in charter does not reset a compliance obligation, and the incoming regulator inherits and enforces it. Two very different risk profiles, one supervisory conclusion: growth must be matched by governance and control capacity. [8]
These are not isolated cases. Published OCC enforcement actions link BSA/AML failures to recurring conditions: rapid growth, complex payment activity, thin staffing, weak independent testing, and unresolved prior findings. The OCC’s Semiannual Risk Perspective for Spring 2026, published May 7, 2026 and reflecting data as of December 31, 2025, states that geopolitical tensions increase sanctions and money laundering risk, strain bank compliance systems, and may heighten the risk of sanctions and Bank Secrecy Act/anti-money laundering violations. The same report flags elevated and increasingly sophisticated fraud, persistent cyber threats, and accelerating adoption of artificial intelligence. This is not a retreat from innovation. It is a sharper expectation that risk management remain commensurate with the activity. [5][6][7][9]
Accountability Cannot Be Outsourced
That expectation applies with particular force to sponsor bank, banking-as-a-service, and fintech partnership models, where much of the customer-facing activity occurs outside the bank’s own systems. The chartered institution remains responsible for what moves through its platform and its partners. Contracts allocate tasks; they do not transfer regulatory accountability. When a third party performs onboarding, transaction processing, monitoring support, or complaint handling, the bank must understand the control design, obtain reliable data, test performance, escalate exceptions, and act when risk exceeds tolerance.
The Regulatory Baseline Is Clear
Start with the program rule. Under 12 CFR 21.21 and 31 CFR 1020.210, a bank must maintain a written, board-approved program that includes internal controls, independent testing, a designated BSA officer, training, and risk-based customer due diligence, including understanding the nature and purpose of customer relationships and identifying the beneficial owners of legal entity customers. Every element is scaled to the institution’s risk profile. That is why a program deemed adequate at one level of activity can fall short after a material change in volume, geography, partner mix, or payment rail.
The 2023 Interagency Guidance on Third-Party Relationships applies the same logic to partners. Risk management should be commensurate with the bank’s size, complexity, risk profile, and the criticality of the activity, and it spans the full life cycle: planning, due diligence, contracting, ongoing monitoring, and termination. The FFIEC BSA/AML Examination Manual reaches the same conclusion from the examiner’s perspective, directing examiners to compare expected activity with actual activity and to assess higher-risk payment processor accounts. The standard is proportional rather than formulaic. That flexibility is useful, but it leaves no defense based on a checklist completed at onboarding. The institution must show that oversight evolved as the relationship did. [2][3]
Why Control Environments Fall Behind
Control failures rarely start with a decision to accept unmanaged risk. Growth arrives in increments, each appearing manageable. A new partner is approved. Volume runs ahead of forecast. A country corridor is added. Temporary manual reviews become permanent. Staffing requests trail revenue commitments. Each step is defensible on its own. Together, they create a control environment built for yesterday’s business.
This is why balance-sheet size and headcount are poor proxies for compliance capacity. Payments and embedded finance businesses generate operational complexity far out of proportion to their assets. Transaction volume and velocity, alert generation, foreign exposure, partner concentration, data quality, and the time required to investigate and report suspicious activity are better measures, and boards should expect management to translate them into explicit capacity thresholds. Monitoring backlogs, quality-assurance failures, unresolved data gaps, and permanent manual workarounds signal that expansion has become an unmanaged execution risk. Revenue growth does not offset that weakness. It raises the urgency of correcting it.
“The control environment is part of the product. Control readiness must be a condition of expansion—not an obligation left to catch up after growth.”
What Effective Board Oversight Looks Like
Both orders place responsibility on the board to oversee compliance and ensure timely corrective action. That requires more than a quarterly BSA report. Directors need a view of risk by program, partner, product, payment rail, customer type, and geography, including approved limits, actual activity, breaches, remediation status, and trends that could shift the institution’s risk profile. [1][8]
A useful board dashboard answers five questions. Is the program operating within risk appetite? Is compliance capacity sufficient for current and forecasted volume? Are critical third parties meeting contractual and regulatory expectations? Are material issues aging beyond approved timelines? Has independent assurance validated management’s conclusions? Reporting that cannot answer these questions delivers information without oversight.
The IIA’s Global Internal Audit Standards, effective January 9, 2025, raise the bar for what a board should expect. Domain III makes the board responsible for authorizing the internal audit mandate, ensuring the function’s independence, and providing the essential conditions it needs to deliver. Domain IV requires the chief audit executive to set strategy, secure sufficient resources, and build a plan that responds to changing strategies, objectives, and risks rather than simply repeating last year’s coverage. The Standards also govern reliance on other assurance providers, which is directly relevant when management offers a partner’s control attestation as evidence. In a growing payments or fintech portfolio, internal audit needs access, expertise, data, and authority to challenge whether the control framework still fits, and the board should confirm that it has them. [4]
Internal Audit Must Test the Business Model, Not the Binder
This is not hypothetical. In the April 2026 order, the OCC found the bank’s independent testing was weak: the internal auditor failed to identify BSA/AML program weaknesses and failed to scope high-risk areas of the program. A conventional BSA audit misses the central risk when it concentrates on policy language, training records, and samples drawn from the legacy business. In a high-growth payments environment, the plan has to reach the operating model itself, including partner onboarding governance, data lineage, monitoring coverage, alert tuning and auto-closure logic, investigation quality, suspicious activity reporting, sanctions controls, customer due diligence, foreign correspondent determinations, complaint escalation, model validation, staffing assumptions, and exit readiness. [1]
Testing should be calibrated to the actual scale. If volume has doubled, audit should assess whether system capacity, scenario coverage, quality assurance, and investigator productivity kept pace. If a partner supplies critical data, audit should trace it from source to decision and identify any missing, transformed, delayed, or unreliable fields. If management relies on a partner’s attestation, audit should evaluate its scope, exceptions, and relevance rather than accept the document as proof. Most importantly, audit should connect findings to risk appetite and growth decisions. A recurring monitoring gap is not merely an audit issue. It may be evidence that the institution should pause onboarding, cap volume, restrict a corridor, or invest before expanding. Independent assurance earns its value when it informs those decisions early, not when it documents the consequences after examiners arrive.
A Practical Control Agenda for Management
Management should address this trend with a focused agenda. Refresh the enterprise and BSA/AML risk assessments with current transaction data and forward-looking growth forecasts. Map each material risk to an accountable owner, required data, monitoring method, escalation trigger, and an independent test. Set growth gates so that new partners, products, geographies, and payment rails do not proceed until readiness is documented across compliance, operations, technology, legal, finance, and internal audit.
Track measures that signal strain before breakdown: alert backlog, case aging, false-positive rates, quality-assurance defects, investigator throughput, unresolved data exceptions, overdue partner issues, filing timeliness, and turnover in critical roles. Build credible contingency and termination plans so a bank can reduce or exit exposure without losing records, disrupting customers, or compromising compliance. Require evidence that remediation worked. A revised policy or a newly installed system is not proof that a control operates at current volume, and independent validation should precede the board’s acceptance of closure on high-risk issues. [2]
The Bottom Line
These actions warn against a common governance mistake: treating compliance infrastructure as a support function that can catch up after growth. Whether expansion comes through payment processing, foreign correspondent banking, virtual currency customers, or banking-as-a-service arrangements in which the chartered institution provides accounts, payments, or card issuance to customers acquired and served by a fintech partner, the control environment is part of the product. Nor are these expectations unique to national banks and federal savings associations. The FFIEC manual is common ground among the federal banking agencies and the NCUA, and state supervisors apply comparable due diligence and monitoring expectations. Any institution pursuing payments, indirect customer or member acquisition, or fintech-enabled delivery should read these orders as a preview of the questions its own examiners will ask. [1][2][3][8]
The choice is not between innovation and compliance. It is between disciplined growth and growth that ultimately invites restrictions, remediation costs, reputational damage, or enforcement. The institutions that succeed will make control readiness a condition of expansion, use independent assurance to challenge optimistic assumptions, and give directors what they need to act before a control gap becomes a regulatory finding.
Ryan McAbee is the BSA Practice Director at AuditOne, where he leads independent BSA/AML program testing and automated AML system validation for community banks, credit unions, and their fintech partners nationwide. He works with boards and BSA officers on the questions this article raises: whether the risk assessment truly drives decisions, whether monitoring capacity and staffing have kept pace with actual volume, and whether the record supporting those decisions would withstand examination. To discuss how these OCC actions apply to your institution, contact AuditOne.
References
[1] Office of the Comptroller of the Currency. Consent Order, AA-ENF-2025-21, April 2026, released publicly May 21, 2026.
[2] Office of the Comptroller of the Currency, Board of Governors of the Federal Reserve System, and Federal Deposit Insurance Corporation. Interagency Guidance on Third-Party Relationships: Risk Management, June 2023.
[3] Federal Financial Institutions Examination Council. BSA/AML Examination Manual: Third-Party Payment Processors.
[4] The Institute of Internal Auditors. Global Internal Audit Standards, issued January 9, 2024, effective January 9, 2025.
[5] Office of the Comptroller of the Currency. Enforcement Actions, accessed September 2026.
[6] Office of the Comptroller of the Currency. Consent Order, AA-ENF-2023-68, January 24, 2024 (BSA/AML internal controls, independent testing, and staffing deficiencies, and failure to correct previously reported problems); terminated November 13, 2025, AA-ENF-2025-58.
[7] Office of the Comptroller of the Currency. Bank Secrecy Act/Anti-Money Laundering Bulletins and Related Information, accessed September 2026.
[8] Office of the Comptroller of the Currency. Consent Order, AA-ENF-2026-29, June 2026, effective upon the bank’s conversion to a national charter on June 12, 2026; announced in the OCC’s July 2026 enforcement actions as a cease and desist order.
[9] Office of the Comptroller of the Currency. Semiannual Risk Perspective, Spring 2026, May 7, 2026.
