BSI Bank faces $394m penalty for 1MDB AML failures

BSI Bank has been charged $394 million for breaching anti-money laundering regulations during its handling of funds connected to the 1Malaysia Development Berhad (1MDB) fraud scheme. Regulators determined that the Swiss private bank failed to detect and report suspicious transactions linked to the embezzlement of approximately $4.7 billion from the Malaysian sovereign wealth fund between 2009 and 2014.

• The violation: BSI processed multiple transfers for 1MDB-linked entities without adequate customer due diligence or suspicious activity reporting, breaching AMLA obligations across multiple jurisdictions.
• The number: $394 million fine represents one of the largest penalties imposed on a Swiss bank for AML compliance failures in a single investigation.
• Timeline: The 1MDB scheme operated across a five-year window. BSI's involvement came to regulatory attention during the broader international investigation that culminated in criminal convictions in 2023.
• For compliance teams: Case demonstrates regulators' focus on transaction layering, shell company structuring, and private banking departments' susceptibility to high-value illicit flows masked as legitimate wealth management activity.

This enforcement action reinforces that AML control failures in private banking remain a priority regulatory concern, particularly where correspondent banking relationships cross multiple jurisdictions. Compliance teams should review their transaction monitoring thresholds for politically exposed persons and their beneficial ownership verification procedures for complex corporate structures. The case signals that regulators will hold banks accountable not merely for missing flags, but for systemic gaps in governance around high-net-worth client onboarding.

The U.S. Office of Foreign Assets Control has imposed a $7.5 million penalty on State Street for violations of Russian sanctions regulations. The financial services firm, a major processor of cross-border transactions and data provider, failed to apply adequate screening controls to Russian-linked activity.

• Regulator's line: OFAC confirmed State Street processed transactions involving sanctioned Russian entities or persons without proper identification or blocking procedures in place.
• The number: $7.5 million represents a civil penalty but avoids the criminal referral threshold that triggers mandatory reporting obligations.
• For compliance teams: Sanctions screening at the transaction initiation layer and SWIFT message level remains a high-risk operational gap across settlement infrastructure.

The fine underscores OFAC's continued focus on post-transaction detection failures rather than pre-transaction blocking gaps. For major custodians and processors, this signals enforcement priority sits on real-time screening effectiveness and audit trail completeness. Compliance teams should review whether screening occurs at payment instruction intake, not solely at settlement confirmation. Document the sequencing of OFAC list checks against transaction counterparties.

OFAC issued an amended General License 131E on 29 April 2026, authorizing transactions related to negotiation and contingent contracts for the sale of Lukoil International GmbH and associated maintenance activities. The amendment updates FAQs 1224 and 1225, directly affecting how credit providers and compliance teams handle Lukoil-related transaction monitoring and deal structuring.

• What changed: FAQ updates 1224 and 1225 now clarify permissible scope for credit providers supporting Lukoil divestiture negotiations and contingent sale arrangements.
• The number: Lukoil International GmbH remains a designated entity, but GL 131E carves out specific transaction types tied to orderly exit from Russian sanctions exposure.
• For compliance teams: Ensure your OFAC screening logic reflects FAQ 1224-1225 amendments immediately, particularly for transactions coded to divestiture or maintenance categories.

This amendment signals OFAC's intent to facilitate orderly unwinding of pre-2022 Russian energy assets while maintaining sanctions integrity. Compliance teams should flag any Lukoil transactions routed through your institution to legal and sanctions leads immediately. Verify GL 131E applicability before approving any credit facility or payment related to asset sales or maintenance.

Compliagence.ai went live on 29 April 2026, offering automated regulatory monitoring, gap analysis, and perpetual audit readiness across multiple jurisdictions. The platform was built by former compliance and cybersecurity practitioners from Fortune 500 companies and Big Four firms, targeting financial services, pharmaceuticals, and technology sectors facing escalating regulatory complexity and fines.

• Core functionality: The platform monitors regulatory changes in real time, flags compliance gaps against mapped frameworks, and maintains continuous audit-ready documentation across GDPR, SOX, MiFID II, and sector-specific rules.
• The gap: Compliance teams currently spend 60-70% of time on manual monitoring and evidence collection rather than strategic risk assessment, according to industry surveys cited by the vendor.
• Market timing: Launch coincides with heightened enforcement action by FCA, SEC, and ESMA on documentation standards and delayed breach reporting in 2025-2026.

Compliance teams should evaluate whether the platform integrates with existing control documentation workflows and reporting systems. The pitch rests on time savings and reduced audit friction. Test the regulatory database coverage depth for your sector before commitment. Vendor lock-in risk and data residency requirements warrant legal review.