2023 BSA/AML Enforcement Actions: Key Lessons for Regulated Businesses

The 2023 BSA/AML enforcement landscape was defined by several themes: increased coordination between FinCEN, DOJ, and OFAC on multi-agency actions; continued focus on virtual currency businesses; and a notable uptick in enforcement against non-bank financial institutions that had historically operated with limited regulatory scrutiny. The year's enforcement actions provide a clear picture of where regulators are focused and what compliance failures they're finding.

Virtual currency enforcement dominated the headlines in 2023. Several major exchanges and payment processors faced enforcement actions that resulted in penalties ranging from tens of millions to billions of dollars. The common thread across these actions was a failure to implement adequate transaction monitoring and customer due diligence - specifically, a failure to identify and report suspicious activity involving high-risk customers and jurisdictions. The message from regulators was unambiguous: the virtual currency sector is subject to the same BSA standards as traditional financial institutions.

Non-bank mortgage lenders were a significant enforcement focus in 2023, particularly in markets with elevated geographic risk. Several enforcement actions against Florida-based mortgage companies cited failures in source-of-funds verification, inadequate CDD for investment property purchases, and training programs that were either absent or not specific to the mortgage context. These actions confirm that the OFR and federal regulators are coordinating more closely than at any point in the past decade.

MSB enforcement in 2023 continued to focus on structuring facilitation and inadequate SAR filing programs. Several check cashing businesses and money transmitters faced enforcement actions for failing to identify and report structuring activity by their customers. The enforcement actions consistently cited training failures - specifically, front-line staff who could not identify structuring patterns - as a contributing factor. This is a preventable failure that adequate training directly addresses.

The lesson from 2023's enforcement activity is consistent with every prior year: the businesses that face enforcement actions are not failing because of novel or sophisticated compliance challenges. They're failing because of foundational gaps - missing training records, outdated risk assessments, inadequate monitoring procedures, and SAR programs that generate filings without genuine analysis. These are gaps that a competent program review would identify and that a well-designed compliance program would prevent.