Protecting the US Financial System

The charges that carry the weight

Most financial crime cases against people rest on a short list of federal statutes. Laundering the proceeds of a "specified unlawful activity" under 18 U.S.C. 1956 carries up to 20 years. Spending more than $10,000 of criminal proceeds through a financial institution (18 U.S.C. 1957) carries up to ten. Wire fraud carries up to 20 years, and bank fraud up to 30. A willful violation of the Bank Secrecy Act is itself a crime under 31 U.S.C. 5322: up to five years, or ten when it is part of a pattern of illegal activity involving more than $100,000 in a year.

Prosecution follows the money too. A court sentencing someone for laundering must order forfeiture of the property involved in the offense (18 U.S.C. 982). Since the Anti-Money Laundering Act of 2020, a bank insider convicted of a BSA violation must also repay any bonus paid for the year of the violation or the year after (31 U.S.C. 5322(e)).

The timeline shows how heavy the sentences get. Allen Stanford received 110 years. Sam Bankman-Fried got 25 years for FTX, and Bill Hwang of Archegos 18. Binance's founder pleaded guilty to failing to maintain an effective AML program. In the Riggs case file, the embassy officer who handled Equatorial Guinea's accounts pleaded guilty to 14 counts and received 18 months.

Bankers face a second consequence. When someone working for a bank is convicted of laundering or a criminal BSA violation, the federal banking agency must remove them and bar them from the industry (12 U.S.C. 1818(g)).

When the defendant is a company

Corporations can be charged like people. The Justice Department's Principles of Federal Prosecution of Business Organizations (Justice Manual 9-28.000) tell prosecutors what to weigh: the seriousness of the offense, how far the wrongdoing ran inside the company and whether management condoned it, the company's history of misconduct, whether it disclosed the conduct itself, how fully it cooperated, and the state of its compliance program.

Self-reporting now carries a stated price. Under the Department's Corporate Enforcement and Voluntary Self-Disclosure Policy, a company that self-discloses, fully cooperates, remediates, and has no aggravating circumstances is declined, though it still pays disgorgement, forfeiture, and restitution. One that cooperates and remediates but falls short of a declination is offered a non-prosecution agreement of under three years, no monitor, and a 50 to 75 percent reduction off the low end of the Sentencing Guidelines fine range.

Banks rarely plead guilty, and the law shows one reason why. When a state-chartered insured bank is convicted of money laundering, the FDIC must open proceedings to end its deposit insurance (12 U.S.C. 1818(w)). The timeline still records a line of corporate pleas: Bank of Boston on unreported cash transactions in 1985, Riggs on suspicious activity reporting in 2005, Danske Bank on conspiracy to commit bank fraud in 2022, and TD Bank in 2024. The Justice Department called TD the first U.S. bank to plead guilty to conspiracy to commit money laundering. Binance's 2023 plea covered BSA, unlicensed money transmitting, and sanctions violations.

Penalties and consent orders

Most bank AML failures never reach a courtroom. They end in an administrative action from FinCEN, the bank's federal regulator, or both. FinCEN assesses civil money penalties under 31 U.S.C. 5321. The OCC, the Federal Reserve, and the FDIC act under 12 U.S.C. 1818, which lets them issue cease-and-desist orders, impose civil money penalties in three tiers, and order a bank to fix what it broke, including by restricting its growth.

For BSA failures the regulators have little choice about acting. Section 1818(s) requires every insured bank to keep procedures for BSA compliance and directs the agency to issue a cease-and-desist order when a bank fails to establish them or fails to correct a problem examiners already reported. Most such orders are signed with the bank's agreement, which is why they are called consent orders.

The Riggs case file shows the sequence. The OCC put Riggs under a consent order in July 2003. When the bank did not comply, FinCEN and the OCC assessed concurrent $25 million penalties in May 2004, then the largest BSA civil penalty against a U.S. financial institution. HSBC's 2012 resolution included a $500 million OCC penalty that also satisfied FinCEN's concurrent assessment. In 2024 the OCC fined TD Bank $450 million and imposed an asset cap on its U.S. banks.

Penalties stack across agencies. The Laws & Regulations guide tracks recent FinCEN actions, including the $1.2 billion assessment against Bank of America in October 2026, and its enforcement tools table sets out FinCEN's penalty powers.

Deferred prosecution, pleas, and monitors

When prosecutors want more than a fine, they choose among three corporate resolutions. In a deferred prosecution agreement (DPA), the government files charges and the agreement with a court, and the charges are dropped if the company meets its obligations for the term. In a non-prosecution agreement (NPA), no charges are filed and the agreement stays between the parties (Morford memorandum, 2008). A guilty plea is a conviction.

Wachovia took a DPA in March 2010 after failing to monitor wires, bulk cash, and remote deposits from Mexican casas de cambio, and paid $160 million. HSBC's 2012 DPA ran five years, carried $1.256 billion in forfeiture and required an independent compliance monitor for the full term.

A monitor is an independent outside party who assesses the company's compliance with the agreement and reports to prosecutors. TD Bank's plea and Binance's each came with a three-year monitor under their Justice Department plea agreements. Binance also accepted a separate five-year monitorship under a FinCEN consent order. The Criminal Division's May 2025 monitor policy says a monitor should never be imposed to punish, and that its scope should be tailored to the risk of the conduct recurring while keeping cost and disruption down.

Other systems punish differently. Wirecard, a German payments company rather than a U.S. bank, produced no U.S. corporate resolution. Its former chief executive went on trial in Munich in December 2022, and in June 2023 Singapore's central bank penalized three banks and an insurer S$3.8 million over dealings linked to Wirecard (case file).