Fraud and AML in banking

The Office of the Comptroller of the Currency imposed a $434 billion asset cap on TD’s U.S. retail banking operations, the regulator and the bank announced in October.

The growth restriction comes in addition to $3.09 billion in penalties stemming from investigations into TD’s safeguards against money laundering, according to the Federal Reserve Board. The Fed, for its part, fined TD $123.5 million.

“TD Bank’s persistent prioritization of growth over controls allowed its employees to break the law and facilitate the laundering of hundreds of millions of dollars. The bank’s blatant risk management failures attracted illicit actors and are egregious and unacceptable,” Acting Comptroller of the Currency Michael J. Hsu said in a prepared statement. “The OCC’s coordinated and comprehensive action, including the imposition of an asset cap, will ensure that the bank focuses on building proper controls commensurate with its risk profile.”

U.S. Justice Department agents found that millions of dollars tied to the illicit drug fentanyl funneled through the bank, The Wall Street Journal reported in May. Separately, a TD employee in Florida allegedly took bribes to let criminals send millions of dollars to Colombia, court documents show.

U.S. Attorney General Merrick Garland said TD failed to monitor $18.3 trillion in customer activity, allowing three laundering networks to transfer hundreds of millions of dollars through the bank’s accounts.

TD will pay $1.8 billion in penalties to the DOJ, while the Treasury Department’s Financial Crimes Enforcement Network said it will collect $1.3 billion from the bank.

The DOJ and FinCEN will install independent monitors to ensure TD’s compliance with the penalties. FinCEN expects its monitor to be in place for four years.

The Fed is requiring TD to establish a new U.S. office dedicated to remediating its AML deficiencies, and relocate to the U.S. the parts of its AML compliance program responsible for complying with U.S. law. The bank must also certify that sufficient resources and attention are allocated to fixing its AML woes prior to issuing any dividends or capital distributions; its board and management will also be subject to an independent review.

The penalty amount tracks with what TD has set aside. The bank said in August that it was prepared to dish out $3.57 billion in penalties. That encompasses the $3.09 billion to DOJ and FinCEN total plus another $450 million TD set aside in April to cover what was revealed to be a fine by the OCC.

The asset cap applies only to TD’s U.S. retail banking division — meaning the bank’s other units, such as TD Securities, could still expand their balance sheets.

The asset cap carries with it an open timeline. The Federal Reserve, for example, capped Wells Fargo’s assets at $1.95 trillion in February 2018 — in response to the bank’s 2016 fake-accounts scandal — and has yet to lift the restriction. Sen. Elizabeth Warren, D-MA, has urged the OCC to issue an asset cap against Citi over the bank’s long-running tech-modernization issues.

An asset cap for TD — in the U.S., anyway — will likely put a pin in its plan to open 150 branches by 2027, mostly in the southeast. TD’s CEO, Bharat Masrani, acknowledged last month that the bank’s branch expansion plan has slowed “quite dramatically” in the face of the AML issues.

The impact of penalties against TD is expected to be significant. Analysts at Wolfe Research estimate that the asset cap imposed on Wells has cost the bank $540 billion in deposit growth, Reuters reported this spring. At its 1% return on assets, Wells would be generating $8 billion more in earnings per year; and LSEG estimates the bank would have gained $90 billion in additional market capitalization at today’s valuation.

While Wells’ balance sheet has been limited, those at JPMorgan Chase, Bank of America, PNC and U.S. Bank have ballooned 40% since 2018, Reuters reported.

TD’s AML shortcomings were rumored to be why the bank’s proposed acquisition of Memphis, Tennessee-based First Horizon fell apart. Months after the deal’s termination, news outlets reported that TD executives knew as early as November 2022 that U.S. agencies, including the DOJ, had found AML deficiencies serious enough to put the deal at risk of rejection.

TD’s U.S. entity pleaded guilty to criminal charges to resolve the DOJ investigation, the FRB said.

"We have taken full responsibility for the failures of our U.S. AML program and are making the investments, changes and enhancements required to deliver on our commitments. This is a difficult chapter in our Bank's history. These failures took place on my watch as CEO and I apologize to all our stakeholders," Masrani said in a prepared statement. "I want to thank our colleagues, who continue to demonstrate their dedication and who play an important role in preventing criminal activity."

TD has seen turnover this year in multiple compliance-related posts. Questions dogged the bank for months, though, as to whether there would be changes higher in the leadership chain. The bank announced in September that Masrani would retire in April and be replaced by TD’s Canadian personal banking chief, Raymond Chun.

That choice, too, may work in TD’s favor, as Chun’s expertise lies in a market where the bank can continue to grow.

“We recognize the seriousness of our U.S. AML program deficiencies and the work required to meet our obligations and responsibilities is of paramount importance to me, our senior leaders, and our boards,” Masrani said in August.

With the Consumer Financial Protection Bureau investigating the peer-to-peer payment tool Zelle, its bank owners are on the defensive.

However, Zelle’s owners might find a friendly reception in the federal courts if they follow through on threats to litigate, according to lawyers familiar with the industry. Zelle is owned by seven banks through the parent company Early Warning Services.

JPMorgan Chase, the biggest U.S. bank and an EWS owner, has said it would consider suing the CFPB over the investigation of the payments tool, if the agency issues an enforcement action against the bank over transfers through Zelle. Bank of America, Wells Fargo, Capital One, Truist, PNC and U.S. Bank also share ownership of Zelle.

Business-friendly rulings have made headlines in recent years, including a decision that undercut the Chevron doctrine. That was one of several rulings in the Supreme Court’s past term that limited the power of federal regulators.

Attorneys following the CFPB’s Zelle probe say the seven banks that own the payment platform may be able to find a judge sympathetic to their cause.

The agency is looking into “the transfers of funds through the Zelle Network,” a recent JPMorgan filing said. The filing does not elaborate, but regulators and lawmakers have long criticized Zelle over scammers using the service. Victims have testified before Congress about losing their life savings to scammers who convincingly impersonated legitimate business executives and government investigators.

JPMorgan didn’t immediately respond to requests for additional comment, but in the filing, the bank said it was considering its options, “including litigation.”

Any decision not to the banks’ liking will almost certainly be appealed to the U.S. Fifth Circuit Court of Appeals, which is stacked with some of the nation’s most conservative judges and regularly sides with businesses over regulators, said William Birdthistle, a law professor at the University of Chicago and former director of the Securities and Exchange Commission’s investment management division.

“If you feel like you're facing a damaging or difficult investigation, you can credibly threaten to have it challenged in the Fifth Circuit,” he said. That appellate court covers Texas, Louisiana and Mississippi, and any business with a presence in one of those states can appeal a regulator’s decision there, Birdthistle said.

The Fifth Circuit previously ruled the CFPB’s funding mechanism unconstitutional. While that Fifth Circuit CFPB decision was overruled, the high court has upheld others.

A legal dispute over the CFPB’s investigative action could take some unexpected turns because its regulatory power has not been fully tested in court, Birdthistle said.

“The CFPB is actually a relatively strange animal, it’s the youngest of the dozen or so federal financial regulators and I don't think we've seen the full breadth of its wingspan,” he said

John Diamond, director of the Center for Public Finance at Rice University's Baker Institute, also predicts a legal fight over the Zelle probe.

“They view themselves as complying with the law as it is currently written,” he said of Early Warning Services, citing public filings and the company’s past statements.

A representative of Early Warning Services did not immediately respond to a request for comment on the CFPB investigation.

Diamond is skeptical that any changes mandated by Congress or the CFPB will solve the problem of scams.

Consumers can send money over the Zelle network free of charge, and requiring the network to reimburse customers or spend more on fraud detection could force the Early Warning Services to start charging Zelle users, ending a free service away from consumers who depend on it, he said.

“I could see there being a fee on these person-to-person transactions, as opposed to the current system, where the transactions are essentially free,” Diamond said.

Educating consumers on scams before they send any money is a more effective solution that doesn’t threaten Zelle’s fee-free service, he said.

Zelle also faces congressional scrutiny.

In hearings in recent months, lawmakers castigated Zelle for allowing fraudsters and scammers to bilk money from unsuspecting consumers. Lawmakers in the House and Senate have introduced bills that would compel services like Zelle to better combat fraud and scams and reimburse scam victims.

Consumer advocates have also urged regulators and lawmakers to do more to combat scams and fraud on the platform. Those efforts will become especially important as payment networks become more widely used, said Adam Rust, director of financial services for the Consumer Federation of America.

“These payment systems are really in their infancy,” he said. “I strongly expect these to (eventually) be used at the point of sale.”

For its part, Early Warning Services has said that more than 99% of the transactions on the Zelle network are free of fraud and scams.

The Wall Street Journal first reported on the CFPB’s probe into the Zelle network. A spokesperson for the agency declined to comment.

Sponsored content

By Splunk

The hidden costs of downtime in financial services: What you need to know

In the fast-paced world of financial services, where reliability and trust are non-negotiable, unplanned downtime can inflict staggering costs—both visible and hidden. Recent insights highlight that the annual cost of downtime for financial services organizations reaches a jaw-dropping $152 million, with repercussions far beyond lost revenue.

The real costs: More than just revenue loss

Downtime is not just a line item on a balance sheet; it’s a systemic issue that ripples across industries. For financial services, the breakdown looks like this:

• Revenue loss: $37 million annually, nearly 25% of total downtime-related expenses.
• Regulatory fines: $22 million annually, underscoring the high stakes of non-compliance.
• Settlements and legal costs: $14 million annually, highlighting potential reputational risks.

However, the hidden costs—such as operational disruption, customer dissatisfaction, and lost trust—are equally damaging. When a bank goes offline, its ripple effect causes delays and losses in adjacent industries, amplifying the stakes for financial services organizations.

What’s behind the downtime?

The causes of downtime in financial services are multifaceted, stemming from technical and human errors. According to the report:

• Cybersecurity incidents: Account for 56% of downtime, with human error being a primary offender in over half of these cases.
• Application or infrastructure issues: Make up 44% of incidents, often linked to data sprawl and missing critical tools.
• Malware attacks and SaaS/third-party application issues: Affect 43% and 28% of organizations, respectively, demonstrating the interconnected nature of today’s tech stack.

Perhaps the most troubling statistic is the average downtime duration:

• Mean Time to Detect (MTTD): 18 hours.
• Mean Time to Recover (MTTR): 61 hours.

The prolonged recovery time emphasizes the need for robust systems and quicker incident response mechanisms.

The role of generative AI and observability tools

Financial services organizations are increasingly turning to technology investments, particularly generative AI and observability tools, to mitigate downtime.

Generative AI adoption:

• 67% of organizations use standalone generative AI tools, such as ChatGPT, to address downtime.
• 56% embed generative AI features into existing tools for faster troubleshooting and improved operational resilience.

Observability tools:

• Financial services organizations invest $14.4 million annually in observability solutions, enabling them to centralize data, pinpoint root causes, and enhance cross-team collaboration.

Overcoming obstacles to resilience

Even with advanced tools, challenges persist. Key obstacles include:

• Data sprawl: Affecting 79% of respondents, data sprawl complicates visibility and decision-making.
• Alert fatigue: Too many false positives overwhelm teams, with 51% citing this as a top issue.
• System interdependencies: Understanding these relationships remains elusive for 41% of organizations, further complicating recovery efforts.
• Critical tool gaps: Impacting 40% of respondents, these gaps delay incident detection and resolution.

To address these challenges, organizations need a proactive approach, leveraging predictive analytics and fostering collaboration across SecOps, ITOps, and engineering teams.

Steps to minimize downtime

1. Strengthen Incident Response: Conduct root cause analyses and implement runbooks to streamline processes.
2. Invest in Observability: Centralize data for better visibility and faster issue resolution.
3. Adopt Generative AI: Use AI-driven solutions to detect patterns, address issues proactively, and reduce human error.
4. Foster Cross-Team Collaboration: Break down silos to ensure smoother communication during incidents.
5. Practice Chaos Engineering: Simulate real-world failures to build resilience and improve recovery times.
6. Prioritize Data Governance: Safeguard your systems against data leakage, especially when using generative AI.

Building resilience for the future

Downtime isn’t going away, but its impact can be mitigated. Financial services organizations can reduce costs, minimize disruptions, and build a more resilient future by making smart technology investments and addressing systemic challenges.

Learn how to tackle downtime and build a more resilient financial services organization with the full Hidden Cost of Downtime in Financial Services report.

The extended absence of a chief risk officer at Silicon Valley Bank, in the months before it failed, underscored the position’s significance — especially as risk chiefs have gained prominence at banks over the past 15 years.

SVB’s March 2023 collapse offered a stark reminder “of the cost of not managing risk effectively on an ongoing basis,” said James Lam, a risk management consultant. 

SVB, a $212 billion-asset bank, didn’t have a chief risk officer for much of 2022. The lender, which had a high proportion of uninsured deposits, experienced a bank run after rising interest rates affected its investment securities portfolio. That SVB didn’t confront rising risks before its downfall has served as a profound risk management reminder to banks. 

Banks have always been in the business of managing risk, from credit and interest rate risk to operational risk, said Lam, who served as a CRO as early as the 1990s for companies such as Fidelity Investments and GE Capital Market Services. 

Prudent risk management can be a point of pride for banks. Take, for example, PNC’s recent advertising campaign, where the lender embraces being “brilliantly boring.” 

Regulatory requirements related to the amount of capital banks must hold, their liquidity buffers and bank examinations all underscore the importance of risk for financial institutions. 

“When banks do forget, they get reminded in a very strong and powerful way,” Lam said.

A raft of changes over the past 20 years, following the Sept. 11, 2001 attack, the Great Recession and the COVID-19 pandemic, brought new risks to the fore and bolstered the CRO role’s prominence. 

The last decade has seen the emergence of the strategic CRO, with the role becoming increasingly complex and multilayered, said Ellen Yaffe, a director in the financial services sector at leadership advisory firm Russell Reynolds Associates. 

“Whatever the issues are, the CRO has to be right at the table, right from the beginning,” she said. 

How has the role evolved?

Early on, the CRO role was focused on financial risk and the integration of credit, interest rate and market risks, Lam said. Operational risks came into the fold in the mid-1990s, following high-profile occurrences of rogue traders and trading errors.

Today, risks have become more digitized and complex, as the industry grapples with concerns about cybersecurity, artificial intelligence and quantum computing.

Over time, the CRO’s purview has expanded, from a narrower focus on credit risk and the portfolio of assets, to now being involved in more strategic decisions and influencing organizational culture and decision-making. 

Today’s CRO has to have a far more strategic view of capital planning and “the fine line” between a commercial opportunity and a business risk, Yaffe said.

“A lot of financial services organizations would say that the No. 1 partnership to the CFO in a financial institution right now is their chief risk officer,” she said.

Chief risk officer isn’t a one-size-fits-all role for banks. Whether a bank should have one depends on its size — those with $50 billion in assets or more are required to — and the activities it’s involved in. Banks engaging in “complex” services and activities, such as working with fintechs, “need one now,” said Eric Holmquist, managing principal with consulting firm Capco.

The role has come into its own in the past 15 years, partly due to heightened standards the Office of the Comptroller of the Currency issued in 2014. 

The CRO’s two primary responsibilities, Holmquist said, are building the bank’s risk management program and framework, and providing an effective challenge to business leaders making decisions around risk-taking.

The “ultimate challenge” for CROs is influencing decision-making so that managers and executives are making their own intelligent risk-taking decisions around risks to accept, risks to mitigate, pricing for risk or transferring risk the bank doesn’t want, Lam said.

The CRO once was seen as a role carrying veto authority, but the industry has reconsidered that.

“The contemporary thinking is that the CRO should lead by influence, not by authority,” Holmquist said. 

While serving as chief risk officer at Customers Bank, Holmquist “built up some credibility where I could say, ‘Gosh, this just really feels like it's not lined up with our strategy, our risk appetite. It’s going to have a regulatory trigger.’ And management gets there and goes, ‘Yeah, that's kind of where we were at.’” 

There won’t be a policy or process for every risk the bank might face, so CROs need to affect a bank’s culture, using training or tools, so that employees act with integrity and consider the best interests of the bank and its customers, Lam said.

At large banks, in particular, it’s crucial that the CRO weigh in on strategy. 

When banks and other companies in the S&P 500 suffer a major decline in market value, it’s most often due to strategic risk, such as a failed acquisition or product launch, rather than operational or financial risk, Lam said.

Other key challenges for CROs at large banks: giving feedback on risk-adjusted pricing for products and relationships; ensuring the bank is incorporating risk into strategic planning and execution; and influencing thinking about incentives, so that CEO and C-suite performance evaluations take risk management and compliance into consideration.

“If you look at best-practice banks, they generally have very strong risk cultures,” Lam said.

What experience, skills and understanding are crucial to the role? 

There’s no set path to becoming chief risk officer. Some hail from the operations side of the bank, which comes with an emphasis on enabling processes necessary for the business to thrive, Holmquist said.

Others have legal, compliance or auditing backgrounds, or were former regulators. Gale Simons-Poole, the CRO at nonbank lender BHG Financial, said her 25 years at the Federal Deposit Insurance Corp. gave her exposure to a variety of risk management programs and skills at different banks.

But industry consultants agreed that having the courage to take an opposing view within the executive suite is a crucial quality.

The CRO has to “be strong enough to stand up and go toe-to-toe with senior management and ask hard questions,” Holmquist said.

Leading through influence is pivotal.

“Sometimes the chief risk officer is the one who says, ‘I don’t see it that way, everybody, and here’s why.’ You really have to be able to have that strength and confidence to say, ‘Let’s think of it a different way,’” Simons-Poole said. “Are you always going to win? No. But I think it’s the way to make everybody think more broadly.” 

To that end, CROs must understand “the organizational DNA,” Simons-Poole said. A bank’s risk culture can drive how workers are motivated and how a CRO will get the job done, and some banks are more open to risk than others. 

Independence is vital to the CRO role, particularly if risk-taking is excessive or there’s unethical behavior. 

While he was chair of the risk committee at E*Trade Bank, Lam sought to formalize the CRO’s independence by putting in writing that the CEO couldn’t hire, fire or change the CRO’s compensation without the risk committee’s approval.

At SVB, a strong, independent CRO was missing, Lam said. The lender had greater strategic risk, given its startup focus. That concentration led to elevated interest rate and liquidity risk, compounded by a digital bank run.

The biggest risks at a bank will depend on its business model and risk profile. When those are mapped against the capabilities of the bank’s risk management program, it can spotlight the skills that would be most beneficial in the next CRO, Lam said.

“You really have to be the right CRO for the moment,” he said.

Today’s boards and CEOs are looking for CROs with not just financial risk experience, but also strong operational and cybersecurity skills, and strategic and business backgrounds, observers said. That might be someone who’s run a large business or worked in an international market.   

Analytical and communication skills, the ability to flexibly problem-solve and the capacity to build key relationships with regulators and board members are also essential. And at larger banks with bigger teams, CRO is “a much bigger leadership with capital L role,” Yaffe noted. 

When it comes to leadership development, risk leaders are most commonly looking to obtain breadth of experience, as that expectation has emerged, Yaffe said. That, in turn, is positioning CROs for other C-suite roles.

In recent years, a number of CROs have become CEOs, including Barclays CEO C.S. Venkatakrishnan. CROs now may see a path to CFO or CEO, “which was not necessarily a conversation people were having before,” Yaffe said.

What does the future of the role look like?

Last year’s regional banking crisis emphasized the importance of CROs, and smaller banks, too, have made the role more pivotal among executive ranks, observers said.

Additionally, since spring 2023, relationships with bank examiners, and alignment with those regulatory officials, have become more important, Lam said.

Ongoing technological advancements will keep CROs on their toes, analysts said. Artificial intelligence will “be both a risk management challenge, but also a risk management power for CROs,” Lam said.

Banks have been eager to assess how they can employ AI to the greatest effect. But the CRO role could never be replaced by AI, just as strategy wouldn’t, Holmquist said. AI may benefit risk management, serving as a “virtual smoke alarm” because it can see subtle patterns, he said.

Using AI, a bank could build a risk model of the future — a kind of digital twin of the bank, connected to external variables such as interest rates, credit defaults, cyberattacks or geopolitical risks — that’s updated continuously, and use that to understand how certain factors relate to a bank’s risk appetite, Lam said.

Lawyers for Citi again asked a federal judge in October to dismiss a lawsuit New York Attorney General Letitia James filed against the bank in January 2024, alleging it fails to protect consumers from fraud and refuses to reimburse victims.

James is trying to rewrite the Electronic Fund Transfer Act through “litigation rather than legislation,” Julia Strickland, a partner at Steptoe, told Judge Paul Oetken of the U.S. District Court for the Southern District of New York, according to Bloomberg.

James asserted in her suit that the EFTA requires Citi to reimburse victims of fraud because the bank makes wire transfers available to consumers online and through mobile banking apps. Citi, however, maintains the EFTA applies to consumer-initiated electronic fund transfers, including ATM transactions, but not wire transfers. Those are covered by Article 4A of the Uniform Commercial Code, the bank argued. Citi asked a judge in April to dismiss James’ suit because it targets the wrong law.

The case centers around what happens when money leaves a consumer’s bank account without their authorization or, in some cases, their knowledge, Christopher Filburn, a lawyer for New York state, told Oetken.

“We have heard from consumer after consumer” in the wake of the January suit, Filburn said, according to Bloomberg.

Strickland, though, argued that when a consumer is deceived into following a criminal’s instructions to transfer money, “that’s not a Citi issue.”

“It’s a consumer issue. It’s very unfortunate,” Strickland said. “Citi and the banking industry are not in any way the bad guys here.”

James wants Citi to document all denied customer claims from the past six years that were tied to unauthorized payment orders and debit authorizations. She also wants the bank to reimburse victims, pay a $5,000 fine for each instance in which it violated the law and adopt enhanced anti-fraud defenses.

A Citi spokesperson told Reuters the bank “closely follows all laws and regulations related to wire transfers and works extremely hard to prevent threats from affecting our clients and to assist them in recovering losses when possible.”

Strickland said big banks use multi-factor authentication and multiple layers of fraud detection to defend against scams, and that the attorney general is “well aware that Citi is on top of this issue.” 

The number of fraudulent transfers that go undetected is “minuscule” compared to the volume of legitimate payments that are processed, Strickland argued.

“The idea that some scams get through is unfortunate, it happens,” she said.

But what James is asking, in terms of how it would affect the EFTA, would “abruptly and dramatically upset how banks have organized their policies and practices for decades,” the bank wrote in a filing.

The irrevocability of instant payments, whether through peer-to-peer or real-time channels, is shaping up to be a fraud risk, especially since users can willingly send money to scammers. 

Banks can, however, do more to warn consumers of scammers before they send funds, said Carl Slabicki, executive platform owner of treasury services at BNY.

It would be valuable if banks told consumers “we actually just recognized a really big scam because we took all this market data and we're going to use it to implement even more friction,” Slabicki said at a July fintech conference in Washington hosted by Semafor. Banks could do more in the way of sharing information to identify upcoming trends in payment data to proactively warn customers, he added.

Bank responsibility for fraudulent transactions through Zelle, for example, is prompting scrutiny from legislators, with some institutions beginning to reimburse certain consumers who fall prey to impostor scams. 

They can do more to prevent these fraudulent transactions by implementing a more robust risk management framework and data-sharing protocols — principles outlined by the National Automated Clearing House Association, Slabicki said.

“Greater and better information sharing among financial institutions can be used to counter fraud in multiple ways: improved dissemination and awareness of fraud scenarios; communication and collaboration between participants on specific instances of fraud; and qualitative and quantitative data sharing on fraud patterns,” Nacha said in a 2022 white paper on the topic.

Asked about the relatively slow uptake for FedNow, Slabicki suggested greater adoption will be tied to the promotion of instant payments more broadly — whether through FedNow or RTP, the real-time payments network operated by The Clearing House. 

Buy-in for instant payments, in the U.S. market, is complicated by a large number of financial institutions. Other countries, including Australia, Singapore and India, have a leg up because a smaller number of banks can push instant-payment adoption more quickly, he added.

“We really want to sell and promote the value of instant payments — network agnostic,” with use cases that include business-to-consumer disbursements, e-bills and account funding, Slabicki said.

“We’re actually spending a lot of time bringing our clients who are other banks, corporates, fintechs to the table to bring their voice in on questions like ‘What would you need to actually use RTP are FedNow more to help your business case?’” he said.

BNY plans to take this feedback to the Federal Reserve and The Clearing House to advocate for a common instant payment user experience, Slabicki said.

“You really do need [a] network effect for those types of use cases to flourish,” he said.

Slabicki said 70% of U.S. accounts can accept an instant payment credit 24 hours a day.

“It’s actually pretty good adoption, when you think about it,” he said. “The challenge is: there's a huge, long tail of banks in the market that we're going to have to continue to work through to get to that aggregation point.”

TikTok users who latched onto a viral get-rich-quick trend were in violation of the law, JPMorgan Chase said in September.

Taking advantage of a temporary glitch in Chase’s ATM system, users deposited bad checks and immediately withdrew funds before the checks bounced.

A video posted on social media showed people in line at a Chase location allegedly waiting to withdraw money they’d just “deposited” via fraudulent check on their banking apps, and another video showed others allegedly celebrating with wads of ill-gotten money.

“We are aware of this incident, and it has been addressed,” a Chase spokesperson told Banking Dive. “Regardless of what you see online, depositing a fraudulent check and withdrawing the funds from your account is fraud, plain and simple.”

The spokesperson didn’t comment on the reason for the glitch, nor did he comment on the extent to which it was taken advantage of — by either the number of customers or the dollar amount.

Dan Awrey, a Cornell University law professor specializing in financial regulation, said on X, formerly Twitter, that so-called check kiting, has “been around since the invention of … checks.”

Those who tried to take advantage of the glitch were hit with seven-day holds and negative balances, according to the New York Post.

“If they took the money out of the bank, the banking law is pretty clear that they committed fraud and they have to get the money back,” Mark Guthner, an associate professor of financial practice at Rutgers University, told Banking Dive, of the customers who participated in the scheme. “Then it's up to the bank to go chase the people down and take them to court. [It’s] a criminal offense, subject to potential jail time and and a fine. The people that did this are in trouble.”

Guthner said he expects Chase’s losses from the glitch to be insignificant.

“There's certainly people that will get away with it that they won't be able to find; or [from whom] it's like trying to squeeze blood out of a rock: they don't have it, you're not going to get it out of them,” he said. “But this is not going to be a big loss. It's more like a big embarrassment for the people that run the bank. This is egg on everybody's face, but it will have no bearing or impact on the soundness of the banking industry because it’s not big enough.”

While check use has plummeted in recent years according to the Federal Reserve, check fraud has been on a different trajectory, increasing 385% nationwide since the COVID-19 pandemic, Treasury Department figures show.

And while the glitch in Chase’s system was temporary, this particular type of fraud — writing checks and cashing them out before the check is deemed fraudulent — isn’t unique. A Michigan man was sentenced to more than eight years in prison in a check kiting scheme last year. A California man, in a separate case, received a sentence of more than six years.

A Chase spokesperson did not comment on any potential ramifications for those who attempted to take advantage of the now-fixed glitch.

Metropolitan Commercial Bank aided bankrupt cryptocurrency firm Voyager’s scheme to defraud and mislead crypto customers because the bank stood to financially gain from the continued deceit, Voyager’s wind-down plan administrator alleged in a lawsuit in November.

Michael Wyse alleged that New York City-based MCB, which served as banking partner for Voyager from 2018 until its bankruptcy in 2022, knowingly allowed Voyager to claim that the exchange’s customers were protected by the Federal Deposit Insurance Corp. insurance that backed the bank.

Despite “repeated misleading statements that caused some to conclude that FDIC insurance protected customer deposits, including their crypto, in the event of the failure of Voyager,” deposits were never protected in the event of a Voyager collapse, the lawsuit contends. And while fiat deposits within Voyager’s platform would have been protected in the event of MCB’s collapse, crypto held on the platform never was.

“Both Voyager and MCB believed FDIC insurance to be a major selling point for their product. [Voyager CEO Stephen] Ehrlich recalled that it was MCB that suggested to Voyager that Voyager make FDIC insurance a differentiating factor worthy of inclusion in their marketing,” Wyse alleged in the lawsuit filed Nov. 21 in the U.S. District Court for the Southern District of New York.

The 53-count, 149-page lawsuit alleged that MCB knew that Voyager was conducting business without the required money transmitter licenses, and that the bank even helped the crypto exchange evade money transmitter license regulations.

“MCB’s actions were a substantial factor in causing actual damages to Voyager’s customers … including the lost value of their assets held on the Voyager Platform and not receiving the FDIC insurance they had been led to believe would cover that loss,” Wyse alleged.

“Had MCB not encouraged and assisted Voyager in evading MTL regulations, Voyager would have had to post surety bonds in additional states that would have covered or mitigated [customer] losses after Voyager filed for bankruptcy, and Voyager would have been subject to regulatory scrutiny that could have prevented or deterred the conduct that led to Voyager’s demise,” he alleged.

A Metropolitan Commercial Bank spokesperson told Banking Dive via email that, based on the bank’s understanding of the facts and the law, Wyse’s “claims are meritless, and we will defend ourselves vigorously.”

“The alleged false and deceptive statements and actions by Voyager are the sole responsibility of Voyager, its principals and successors and not of Metropolitan Commercial Bank,” the spokesperson said.

Wyse also alleged that without MCB’s help, Voyager would not have been able to grow and retain its customer base, and therefore those customers would not have incurred losses when Voyager filed for bankruptcy.

At the time of its bankruptcy, Voyager owed U.S. customers some $1.7 billion. Much of that has yet to be returned more than two years later, according to the lawsuit.

Wyse, as plan administrator, is representing 31,867 former Voyager customers, and seeks punitive and exemplary damages in an amount to be determined at trial, along with reasonable costs and expenses including counsel and expert fees.

In January 2023, about six months after Voyager’s bankruptcy, MCB announced it would be leaving the crypto business. It had “never represented a material portion” of its business, the bank said, claiming at the time that the pivot from crypto began in 2017.

The bank in 2024 exited the banking-as-a-service space, noting at the time that the decision to terminate BaaS partnerships would “reduce the Company’s exposure to the heightened, and evolving, regulatory standards related to these activities.”

The founders of fintech Blueacorn have been indicted on federal fraud and conspiracy charges in connection with an alleged pandemic-era Paycheck Protection Program fraud scheme that netted them nearly $300 million, according to a congressional report.

The Department of Justice alleged that Nathan Reis and Stephanie Hockridge submitted fraudulent PPP loan applications and facilitated fraudulent loan applications for thousands of other businesses through Blueacorn, which they founded in April 2020, at the height of the COVID-19 pandemic, with an aim to “democratiz[e] access to loan relief” to America’s small businesses and independent contractors.

Under service provider agreements with two lenders, the fintech collected and reviewed PPP loan applications from borrowers, and worked with those lenders to submit applications to the Small Business Administration in exchange for a piece of the fees paid to lenders by the SBA for approved PPP loans.

Additionally, through its VIPPP program, Blueacorn offered personalized service to potential PPP borrowers in which Reis, Hockridge and others allegedly coached borrowers on how to submit false PPP applications.

“In order to obtain a greater volume of kickbacks from borrowers and percentage of lender fees from the SBA, Reis, Hockridge, and their co-conspirators submitted PPP loan applications that they knew contained materially false information,” the DOJ said in a release.

According to Scottsdale, Arizona-based ABC15, where Hockridge was previously employed as a newscaster, the couple has spent the last few years living a “lavish lifestyle” in Puerto Rico, where Reis was arrested in November, a court docket shows.

A criminal trial is set for Jan. 6, 2025, according to court documents.

Reis and Hockridge have each been charged with four counts of wire fraud and one count of conspiracy to commit wire fraud. Each count carries a maximum of 20 years in prison.

A request for comment submitted via Blueacorn’s still-active website was not returned.

Blueacorn, along with fintech Womply, was barred from working with the SBA in December 2022, after a House subcommittee report identified both firms as among the most lax PPP participants in regard to anti-fraud standards.

Womply — along with Biz2Credit, another fintech — agreed to pay the Federal Trade Commission a collective $59 million in March to settle allegations they deceived small businesses seeking PPP loans.

A federal judge sentenced former Heartland Tri-State Bank CEO Shan Hanes in August to more than 24 years in prison for embezzling millions as part of a cryptocurrency scheme.

The 293-month sentence from U.S. District Judge John Broomes represented the maximum under the guidelines for one count of embezzlement as a bank officer.

Hanes pleaded guilty in May, 10 months after his bank was taken over by the Federal Deposit Insurance Corp. and sold to nearby Dream First Bank after becoming insolvent after Hanes took $47.1 million in bank funds.

The FDIC absorbed the loss, but bank investors lost $9 million.

“Hanes’ greed knew no bounds. He trespassed his professional obligations, his personal relationships, and federal law. Not only did Shan Hanes betray Heartland Bank and its investors, but his illegal schemes also jeopardized confidence in financial institutions,” said Kate E. Brubacher, U.S. Attorney for the District of Kansas, in a prepared statement.

“Today’s sentence is a measure of justice for the victims, and a statement that the U.S. Department of Justice will hold those accountable who violate positions of trust for their own gain,” she said.

“Mr. Hanes, as the CEO of Heartland Tri-State Bank, held the trust and confidence of the community of Elkhart, KS, but he violated that trust. He attempted to benefit financially by embezzling funds from the bank,” said Stephen Cyrus, special agent in charge at the FBI’s Kansas City field office, in a prepared statement.

“His idea to get rich quick, in all reality, was a pig butchering scheme. His involvement in this scheme ultimately led to the bank’s collapse. His job, the bank’s job was to protect its customers and identify fraudulent scams — not to participate in them,” Cyrus said.

Pig butchering involves crypto scammers “fattening” up victims up with a pledge of profitable returns and then “slaughtering” them before making good on their promises.

Hanes, who was charged in February, transferred the funds between May and July 2023 to crypto wallets operated by unidentified individuals. He made 11 transactions between $5,000 and $10.3 million.

Prosecutors had requested Hanes be sentenced to 264 months, or 22 years; and Hanes’ attorney John Stang requested a downward variance on the grounds that his client was a victim, too.

“Falling victim to this scam does not excuse the illegal actions taken by Mr. Hanes in wrongfully taking money from the bank, resulting in the bank’s failure and the loss to the Stockholders,” Stang wrote in his sentencing memo. “However, this is what precipitated those actions.”

“Mr. Hanes is sorry about the loss he caused to the community and specifically the Stockholders of the Elkhart Financial Corporation,” Stang wrote. “These people were his friends, co-workers, and neighbors, and all that he can do at this point is try to pay back the restitution upon his release from prison.”

Hanes did not gain financially from his involvement in the scheme, Stang wrote. Restitution will be finalized at a future hearing.

The former CEO is facing 28 additional charges related to the crypto scheme in Morton County District Court, the Topeka Capital-Journal reported. Hanes faces a further 86-month sentence — slightly more than seven years — in that case.

The Federal Reserve banned Hanes from the banking industry in November 2024. 

While check use has plummeted over the last three decades, according to the Federal Reserve, check fraud has been on a different trajectory, increasing 385% nationwide since the COVID-19 pandemic, Treasury Department figures show.

Codat, a fintech based in London and New York, aims to remedy the issue.

The firm in April launched its Supplier Enablement API product, which seeks to help banks drive spending through virtual card products by allowing business customers to more easily share data from their accounting software with their bank.

By ousting static supplier payment files for secure, continuous API connnections, Supplier Enablement offers more robust data sets and analysis to banks.

JPMorgan Chase is one of the early users of the product.

“Thanks to our work with Codat, our clients can easily and digitally deliver critical supplier enablement data to our firm, helping to realize efficiency gains and cost savings sooner as well as across a greater share of their spend,” Stephen Markwell, head of product strategy and fintech partnerships for commercial banking at JPMorgan, said in a prepared statement.

When a business customer first engages a bank in search of a product — perhaps a loan or a commercial card — the first thing the bank asks of them is to provide data, Codat Chief Revenue Officer Joey Rault said in an interview with Banking Dive.

Getting the data to the bank, and in a format the bank can use, can be a timely process, he said, in particular for small- to medium-size businesses.

“What we're hearing from the banks and what we're hearing from the relationship managers, the sales professionals, the bankers who are engaging with these small- and medium-sized businesses, is that it’s two, three, four weeks for them to actually get the file manually on average. With Codat, we’re talking about five minutes,” he said.

“That time savings makes it easier for the bank to build a deeper connection with the small business because they literally are connected directly to the source data,” Rault said. “And more importantly, from an actual customer relationship standpoint, now we're not going back and forth about the data — we're actually having a conversation about the service.”

Supplanting check use with virtual cards has two main benefits, said Ed Sherrington, Codat’s head of product for banking.

“In this high inflationary environment, there's a lot of pressure on cash flows, both for the customers who are paying their bills and for the vendors and suppliers themselves. Virtual cards are a win for both sides because they enable bank customers to pay their vendors on credit, and for the suppliers that on average, get paid much, much quicker when it's by virtual card [as opposed to check]. That has huge benefits to their cash flow,” Sherrington told Banking Dive.

The other benefit, he said, is “an increased sensitivity towards fraud and keenness” to prevent check fraud.

“Check payments are highly susceptible to fraud,” he said. “The more that we can get payments off of check and onto more secure payment methods like virtual card, the better for everyone involved.”