Who was sanctioned, and for what?

From 2016 to 2025, the operator of the OTC Link ATS trading system lacked complete policies on systems security, access control and vulnerability management as required under Regulation SCI. Although the examiners of the U.S. Securities and Exchange Commission (SEC) had criticised the gaps in several examinations, drafts remained unfinished; the SEC issued a censure and imposed 575,000 USD.

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

Information security and cyber · Critical infrastructure

Legal basis

Regulation SCI, Rule 1001(a)(1)–(3)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Repeat case

yes

Original amount 575,000 USD, converted at the ECB reference rate of 22 Sep 2026.

Checked against the official source on 25 Sep 2026 · Direct link

In 2023, a federal court found by way of summary judgment that the fuel card provider had charged its predominantly small business customers hidden or unauthorised fees and misrepresented savings; an appeals court upheld this in 2026. According to the FTC, the fees added up to hundreds of millions of dollars, and late fees were also charged despite punctual payment. Under the settlement resolving the administrative proceedings, FleetCor and a further settling party are jointly paying 100 million USD for refunds; the order is not yet final.

Authority / court

Federal Trade Commission (FTC)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Section 5 FTC Act

Action

Disgorgement of profits

Status of proceedings

unknown

Sector

Financial services and insurance

Liability of senior managers

Measures against individuals are not reported here.

Published

17 Sep 2026

Original amount 100,000,000 USD, converted at the ECB reference rate of 17 Sep 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

The licensed money transmitter had no adequate policies for system updates and insufficient risk assessments under New York's cybersecurity regulation, as found by the New York State Department of Financial Services (NYDFS). The company has already remedied the deficiencies.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

23 NYCRR Part 500 (Cybersecurity Regulation)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Because of its low turnover, the company was exempt from many Part 500 obligations; deficiencies already remedied.

Published

5 Aug 2026

Original amount 250,000 USD, converted at the ECB reference rate of 5 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The US Financial Crimes Enforcement Network (FinCEN) imposed 125 million USD on the broker-dealer – the highest BSA penalty against a broker-dealer to date. UBSFS admitted wilful infringements: the AML programme was inadequate, more than 50,000 foreign currency transfers totalling more than 10 billion USD were not adequately monitored and suspicious activity reports were not filed; it is already the second enforcement action after 2018.

Authority / court

Financial Crimes Enforcement Network (FinCEN)

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Bank Secrecy Act (BSA)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Culpability

intentional

Repeat case

yes

Mitigating circumstances

Up to 15 million USD (remaining amount due by 31 May 2028) may be waived to the extent that UBSFS bears the costs of the independent review of its AML programme and implements its recommendations

Published

3 Aug 2026

Original amount 125,000,000 USD, converted at the ECB reference rate of 3 Aug 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The CFTC fined the futures commission merchant 8 million USD for failing to supervise diligently the configuration and operation of its anti-money laundering transaction monitoring. From January 2019 to June 2023, thousands of foreign currency wire transfers through retail customers' commodity accounts were insufficiently monitored or not monitored at all: first because of an incomplete manual report which UBS, contrary to commitments made in earlier proceedings in 2018, replaced only more than two years later, and then because of incorrectly fed data in the new automated system. FinCEN, the SEC and FINRA announced their own settlements with UBS Financial Services at the same time. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. Commodity Futures Trading Commission (CFTC)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

CFTC Regulation 166.3 (17 C.F.R. § 166.3)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Repeat case

yes

Mitigating circumstances

The CFTC recognised the remediation described; according to the order, the core problems of the automated system had been fixed by the fourth quarter of 2022.

Published

3 Aug 2026

Original amount 8,000,000 USD, converted at the ECB reference rate of 31 Jul 2026.

Checked against the official source on 3 Oct 2026 · Direct link

The NYDFS imposed a penalty of USD 50 million on Swedbank AB (publ) and its New York branch. In response to several requests by the regulator under section 37 of the New York Banking Law concerning links between its Baltic subsidiaries and the law firm Mossack Fonseca (Panama Papers) and the status of European investigations, the bank did not provide the requested information, in breach of section 125(3) of the New York Banking Law. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

New York Banking Law § 125(3) i. V. m. § 37; Sanktion nach Banking Law §§ 39, 44

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Employees

10,000 or more

Liability of senior managers

According to the order, the bank has since, among other things, dismissed its then Chief Compliance Officer and its former CEO and parted ways with numerous other employees; the majority of the board has been replaced.

Published

16 Jul 2026

Original amount 50,000,000 USD, converted at the ECB reference rate of 16 Jul 2026.

Checked against the official source on 3 Oct 2026 · Direct link

The CFTC fined Netrios LP Ltd., incorporated in Saint Lucia, 1,750,000 USD and Maltese Red Acre Ltd. 750,000 USD, totalling 2,500,000 USD. From 2019 to September 2025, Netrios sold a white-label service (website, trading software, margin accounts, execution, back office) through which offshore platforms offered US retail customers who were not eligible contract participants leveraged forex, precious metals, crypto and equity transactions outside a registered exchange; Red Acre assisted with customer support and marketing. The SEC took parallel action over the same conduct. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. Commodity Futures Trading Commission (CFTC)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

Section 4(a) Commodity Exchange Act (7 U.S.C. § 6(a)); Beihilfe nach Section 13(a) (7 U.S.C. § 13c(a))

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

29 Jun 2026

Original amount 2,500,000 USD, converted at the ECB reference rate of 26 Jun 2026.

Checked against the official source on 3 Oct 2026 · Direct link

In 2023, attackers exploited a zero-day vulnerability in MOVEit Transfer to steal files containing social security, driving licence, account and health data. The New York State Department of Financial Services (NYDFS) criticised inadequate retention settings, policies and controls as well as the late notification of the cybersecurity incidents to the supervisory authority.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

23 NYCRR Part 500 (Cybersecurity Regulation)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

negligent

Published

30 Apr 2026

Original amount 2,250,000 USD, converted at the ECB reference rate of 29 Apr 2026.

Checked against the official source on 25 Sep 2026 · Direct link

On a complaint by the CFTC, the federal court in New York entered a consent order against the operator of the KuCoin crypto exchange, which is registered in the Turks and Caicos Islands. Peken Global had given US participants direct access to its trading system without being registered with the CFTC as a foreign board of trade; the court permanently prohibited this and imposed a fine of 500,000 USD. Disgorgement was waived because of the cooperation and the forfeiture in the parallel criminal case, in which Peken Global had pleaded guilty to operating an unlicensed money transmitting business. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. District Court for the Southern District of New York (auf Klage der CFTC)

Area of law

Capital markets and financial supervision · Organisational requirements

Legal basis

CFTC Regulation 48.3 (17 C.F.R. § 48.3); Section 6c Commodity Exchange Act (7 U.S.C. § 13a-1)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

Cooperation with the CFTC and in the criminal proceedings; because of the forfeiture ordered there, the CFTC did not seek disgorgement.

Published

30 Mar 2026

Original amount 500,000 USD, converted at the ECB reference rate of 30 Mar 2026.

Checked against the official source on 3 Oct 2026 · Direct link

Online broker TradeStation Securities, Inc. of Florida is paying USD 1,110,661 under a settlement with OFAC for 481 apparent violations of multiple sanctions programmes. According to OFAC's findings, following several failures in compliance controls, customers in Iran, Syria and Crimea were able to execute 481 securities trades worth a total of USD 4,442,645 via the mobile app between June 2021 and June 2022. OFAC treated the apparent violations as non-egregious and voluntarily self-disclosed and credited significant remedial measures; the base penalty was USD 2,221,322. Source: U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC), enforcement release "TradeStation Securities, Inc. Settles with OFAC for $1,110,661 Related to Apparent Violations of Multiple Sanctions Regulations", 17 March 2026, https://ofac.treasury.gov/media/935351/download?inline; summarised in our own words.

Authority / court

U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC)

Area of law

Sanctions and export control · Breaches of sanctions and embargoes

Legal basis

Iranian Transactions and Sanctions Regulations, 31 C.F.R. § 560.204; Syrian Sanctions Regulations, 31 C.F.R. § 542.207; Ukraine-/Russia-Related Sanctions Regulations, 31 C.F.R. § 589.207 (481 mutmaßliche Verstöße); Vergleich nach den Economic Sanctions Enforcement Guidelines, 31 C.F.R. part 501, app. A

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

17 Mar 2026

Original amount 1,110,661 USD, converted at the ECB reference rate of 17 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

The US Financial Crimes Enforcement Network (FinCEN) imposed 80 million USD on the broker-dealer, which admitted wilful BSA infringements: no effective AML programme, no due diligence on correspondent accounts of foreign financial institutions and failure to file suspicious activity reports in connection with securities fraud. Remedial measures that had been promised were not implemented for years.

Authority / court

Financial Crimes Enforcement Network (FinCEN)

Area of law

Money laundering and terrorist financing · Customer due diligence

Legal basis

Bank Secrecy Act (BSA)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

intentional

Published

6 Mar 2026

Original amount 80,000,000 USD, converted at the ECB reference rate of 6 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Following a guilty plea to charges including conspiracy to operate an unlicensed money transmitting business and to violate the AML obligations of the Bank Secrecy Act, the peer-to-peer crypto platform was sentenced to a penalty of 4 million USD. 112.5 million USD would have been appropriate, but the US Department of Justice (DOJ) found an inability to pay; in December 2025, FinCEN had additionally imposed a civil penalty of 3.5 million USD.

Authority / court

U.S. Department of Justice

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

Travel Act; Verschwörung zum Betrieb eines nicht lizenzierten Geldtransfergeschäfts und zur Verletzung der AML-Pflichten des Bank Secrecy Act

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

intentional

Mitigating circumstances

Penalty limited from 112.5 million to 4 million USD because of proven inability to pay

Published

11 Feb 2026

Original amount 4,000,000 USD, converted at the ECB reference rate of 10 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

FinCEN imposed a civil money penalty of USD 3.5 million on the peer-to-peer virtual currency trading platform Paxful, Inc. and Paxful USA, Inc. From February 2015 to April 2023 Paxful did not maintain an effective AML programme for its trading platform and hosted wallets and did not report suspicious transactions accurately and on time; the company also allowed its registration as a money services business to lapse and operated unregistered from January 2017 to September 2019 (974 days). Payments of USD 1.75 million to the DOJ are credited against the penalty; USD 1.75 million is payable to FinCEN. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

Financial Crimes Enforcement Network (FinCEN), U.S. Department of the Treasury

Area of law

Money laundering and terrorist financing · Internal controls

Legal basis

31 U.S.C. § 5330, § 5318(h)(1), § 5318(g)(1); 31 C.F.R. §§ 1022.380, 1022.210, 1022.320

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

FinCEN took into account that Paxful was forthcoming during the investigation, answered information requests completely and on time and agreed to toll the statute of limitations.

Original amount 3,500,000 USD, converted at the ECB reference rate of 9 Dec 2025.

Checked against the official source on 3 Oct 2026 · Direct link

In 2017/2018, the Chicago fund manager specialising in data centres took in capital from a Russian oligarch via nested structures and continued to manage this investment for four years after his designation in April 2018. The US Treasury's Office of Foreign Assets Control (OFAC) assessed the case as non-egregious and not voluntarily self-disclosed.

Authority / court

U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC)

Area of law

Sanctions and export control · Breaches of sanctions and embargoes

Legal basis

Ukraine-/Russia-Related Sanctions Regulations (31 C.F.R. part 589); IEEPA

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Mitigating circumstances

No prior violations in five years; cooperation improved significantly only after initially insufficient engagement (including waiver of attorney-client privilege), hence only limited credit

Published

2 Dec 2025

Original amount 11,485,352 USD, converted at the ECB reference rate of 2 Dec 2025.

Checked against the official source on 27 Sep 2026 · Version 2 · Direct link

US fintech Exodus Movement, Inc. is paying USD 3,103,360 under a settlement with OFAC for 254 apparent violations of the Iran sanctions. According to OFAC's findings, Exodus provided customer support to users in Iran and in some cases helped them access third-party crypto exchanges through its own wallet software. According to OFAC, on twelve occasions staff, despite being aware of the sanctions, advised users to hide their location via VPN in order to circumvent those exchanges' controls; OFAC treated these instances as egregious. The apparent violations were not voluntarily disclosed; the base penalty was USD 4,774,400. Extensive remediation and cooperation were taken into account. Exodus satisfies USD 630,000 of the settlement amount by investing in additional sanctions controls; USD 2,473,360 is payable to the Treasury. OFAC signed the settlement agreement on 19 November 2025 and published it on 16 December 2025. According to the settlement agreement, the settlement does not constitute an admission by Exodus of the apparent violations. Source: U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC), enforcement release "Exodus Movement, Inc. Settles with OFAC for $3,103,360 for Apparent Violations of Iran-related Sanctions Regulations", 16 December 2025, https://ofac.treasury.gov/media/934831/download?inline; summarised in our own words.

Authority / court

U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC)

Area of law

Sanctions and export control · Breaches of sanctions and embargoes

Legal basis

Iranian Transactions and Sanctions Regulations, 31 C.F.R. § 560.204 (254 mutmaßliche Verstöße), in 12 Fällen zusätzlich § 560.203 (Umgehung); Vergleich nach den Economic Sanctions Enforcement Guidelines, 31 C.F.R. part 501, app. A

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

16 Dec 2025

Original amount 3,103,360 USD, converted at the ECB reference rate of 19 Nov 2025.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

Attackers harvested driving licence numbers and dates of birth via inadequately secured online quoting tools and agent portals. According to the New York State Department of Financial Services (NYDFS), Farmers infringed the cybersecurity regulation and did not report the incident in time; the penalty is part of a package totalling $19 million against eight motor insurers.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Security measures and risk management

Legal basis

23 NYCRR Part 500 (Cybersecurity Regulation)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

negligent

Published

14 Oct 2025

Original amount 2,775,000 USD, converted at the ECB reference rate of 14 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Attackers extracted driver’s licence numbers in plain text via the motor insurer’s instant quote applications. Infinity discovered the anomalies on 9 February 2021 but only reported the cybersecurity event to the New York State Department of Financial Services (NYDFS) on 14 April 2021; the supervisor also criticised the lack of MFA and insecure development practices.

Authority / court

New York State Department of Financial Services (NYDFS)

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

23 NYCRR § 500.17(a), § 500.12(a) u. a.

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

negligent

Original amount 2,250,000 USD, converted at the ECB reference rate of 14 Oct 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Crypto exchange ShapeShift AG, incorporated in Switzerland and operated from Denver, Colorado, is paying USD 750,000 under a settlement with OFAC for apparent violations of multiple sanctions programmes. According to OFAC's findings, between December 2016 and October 2018 ShapeShift exchanged digital assets worth USD 12,570,956 with users in Cuba, Iran, Sudan and Syria in 17,183 instances, although IP addresses revealed their location. The company introduced a sanctions compliance programme only after receiving an OFAC subpoena. OFAC treated the apparent violations as non-egregious and not voluntarily self-disclosed; the base penalty was USD 39,515,000. The low settlement amount reflects the fact that ShapeShift has ceased operations and has limited assets. Source: U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC), enforcement release "ShapeShift AG Settles with OFAC for $750,000 Related to Apparent Violations of Multiple Sanctions Programs", 22 September 2025, https://ofac.treasury.gov/media/934641/download?inline; summarised in our own words.

Authority / court

U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC)

Area of law

Sanctions and export control · Breaches of sanctions and embargoes

Legal basis

Cuban Assets Control Regulations, 31 C.F.R. § 515.201(b) (39); Iranian Transactions and Sanctions Regulations, 31 C.F.R. § 560.204 (16.839); Sudanese Sanctions Regulations, 31 C.F.R. § 538.205 (33); Syrian Sanctions Regulations, 31 C.F.R. § 542.207 (272); Vergleich nach den Economic Sanctions Enforcement Guidelines, 31 C.F.R. part 501, app. A

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Published

22 Sep 2025

Original amount 750,000 USD, converted at the ECB reference rate of 22 Sep 2025.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

Between March 2023 and February 2024 a trader at the Korean financial services firm placed near-simultaneous opposing orders for accounts with the same beneficial owner, so that 127 trades in 440 crude oil futures (around 33.5 million USD) offset each other, some of them against orders from traders on other desks of the firm. The CFTC (U.S. Commodity Futures Trading Commission) treated this as prohibited wash sales and non-competitive trades and, in a settlement, imposed a civil monetary penalty of 212,500 USD and a cease-and-desist order; it granted a 20% reduction for excellent cooperation. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. Commodity Futures Trading Commission (CFTC)

Area of law

Capital markets and financial supervision · Market abuse and insider dealing

Legal basis

Section 4c(a)(1) und (2)(A) Commodity Exchange Act; CFTC Regulation 1.38(a)

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

intentional

Mitigating circumstances

Excellent cooperation with the Division of Enforcement (20% reduction of the penalty); the CFTC also acknowledged the company's representations regarding its remedial measures.

Published

17 Sep 2025

Original amount 212,500 USD, converted at the ECB reference rate of 17 Sep 2025.

Checked against the official source on 3 Oct 2026 · Direct link

The CFTC imposed a fine of 200,000 USD on the Illinois trading firm. Measures against individuals are not set out here. From May to December 2022, orders were placed for Flatiron in E-mini S&P 500 and E-mini Nasdaq 100 futures on the CME that were intended to be cancelled before execution, so that the genuine orders on the opposite side were filled faster, in larger quantities or at better prices. The spoof orders exceeded the genuine orders in contract volume by a ratio of five to one. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. Commodity Futures Trading Commission (CFTC)

Area of law

Capital markets and financial supervision · Market abuse and insider dealing

Legal basis

Section 4c(a)(5)(C) Commodity Exchange Act (7 U.S.C. § 6c(a)(5)(C))

Action

Fine

Status of proceedings

final

Sector

Financial services and insurance

Culpability

intentional

Liability of senior managers

Measures against individuals are not set out here.

Published

9 Sep 2025

Original amount 200,000 USD, converted at the ECB reference rate of 9 Sep 2025.

Checked against the official source on 3 Oct 2026 · Direct link