Welcome to the latest Enforcement Actions Roundup. September 2026 was a packed month, with five actions from the DOJ and the FDIC. Governance runs through all of them: a former bank CEO was sentenced to 112 months in prison for insider abuse and a sanctions conspiracy, and three FDIC orders hold boards accountable for remediation.
Each month, we break down what went wrong, why it matters, and what your financial institution (FI) can do to stay ahead with two resources: the Enforcement Actions Tracker, a running tally of actions by agency, category, and topic, and the Enforcement Deep Dive below, a closer look at each action's details, takeaways, and controls to revisit.
If you manage policies and risk assessments in our compliance management software, each action below links to related Ncomply sample policies and Nrisk risk assessments.
Related: Bookmark the Ncontracts Enforcement Action Tracker to search the latest enforcement actions by date, category, and regulator.
| Year | Fair Lending | Advertising | AML/CFT | Underwriting | UDAAP | Electronic Funds Transfers | Insider Activities | Flood Insurance | Financial Risk | Concentration | Military Lending | Government Loan Programs | |
| CFPB | 2025 | 1 | 2 | 4 | 1 | 1 | |||||||
| 2026 YTD | 1 | ||||||||||||
| DOJ | 2025 | ||||||||||||
| 2026 YTD | 2 | 3 | 1 | ||||||||||
| OCC | 2025 | 3 | 1 | 8 | 3 | ||||||||
| 2026 YTD | 1 | 1 | |||||||||||
| FRB | 2025 | 1 | 3 | 1 | |||||||||
| 2026 YTD | 2 | 2 | 2 | ||||||||||
| FDIC | 2025 | 5 | 3 | 1 | 1 | 1 | 10 | 6 | |||||
| 2026 YTD | 1 | 2 | 3 | 2 | 6 | 6 | 1 | ||||||
| NCUA | 2025 | ||||||||||||
| 2026 YTD |
The CFPB issued no institutional enforcement actions in September 2026.
The DOJ sentenced a former bank CEO to 112 months in prison and three years of supervised release, with forfeiture of over $16.9 million, following a guilty plea to conspiracy to commit wire fraud and conspiracy to violate the International Emergency Economic Powers Act (IEEPA). According to court filings, the CEO and the board chairman concealed from other board members, executives, and the bank’s regulator that certain investments and loans benefited themselves.
Separately, between 2021 and 2023, the CEO conspired to conduct transactions prohibited by U.S. sanctions with an individual designated by the Office of Foreign Assets Control (OFAC), arranging an OFAC-authorized foreclosure on the individual’s home and then a private agreement to sell the property back through a front company for $4 million, which OFAC had not licensed.
This case shows both the insider abuse and the sanctions risks that can originate at the top of an FI. FIs should confirm that related-party and affiliate transactions are identified, independently reviewed, and reported to the board in sufficient detail to show who ultimately benefits. They should also confirm that any loan workout, foreclosure, or property sale involving a sanctioned party or its collateral is covered by documented OFAC authorization and buyer due diligence, including checks for front companies. The prosecution also demonstrates that officers, not just FIs, face personal criminal liability.
Related: Insider Fraud: How to Stay Vigilant in 2026
Ncomply Sample Policies
Nrisk Risk Assessments
The OCC issued no institutional enforcement actions in September 2026.
The FRB issued no institutional enforcement actions in September 2026.
The FDIC and the Wisconsin Department of Financial Institutions issued a Consent Order to a bank for unsafe or unsound banking practices relating to weaknesses in asset quality, earnings, and management. The order centers on governance. The board must increase its participation in the bank’s affairs, meeting at least monthly, and assess staffing needs, including the competencies and effectiveness of senior management and directors, and adopt a staffing plan if weaknesses are found.
Regardless of the results, the board must also adopt a plan to add at least two directors who are independent of management and have substantial banking and risk management experience. The bank must retain qualified management and obtain written regulator approval before adding any director or senior executive officer.
This order treats board participation and management capability as the core of the remediation. Regulators are increasing how often the board meets and what it reviews, and they are requiring a formal assessment of whether the people overseeing the bank have the skills to do it.
FIs should assess whether board composition includes enough independent directors with banking and risk management experience, whether the board package covers delinquent, classified, insider, and charged-off loans and audit and internal control findings, and whether minutes evidence discussion and dissent. A documented staffing assessment covering both management and directors, with a board-approved plan for any gaps, is a practical way to get ahead of this finding.
Related: What Examiners Are Looking for: Board Oversight
Ncomply Sample Policies
Nrisk Risk Assessments
The FDIC and the Illinois Division of Banking issued an Amended Consent Order against a bank to address serious new conditions and deficiencies, including unsafe or unsound practices and anti-money laundering and countering the financing of terrorism (AML/CFT)-related deficiencies.
The amended order opens with management and board requirements. The bank must have and retain qualified management with written authority to implement the order. Management’s qualifications are assessed on its ability to comply with the order, operate safely, follow applicable laws, and restore the bank to a safe and sound condition. It must obtain written regulator approval before adding any director or senior executive officer, and the board must assess staffing levels and the expertise of candidates for critical bank operations within 60 days. The board must increase its participation, meeting at least monthly to review loans, income and expenses, audit reports, internal control reviews, and compliance with the order, and must adopt a program within 30 days to monitor compliance.
The bank must also retain a qualified Bank Secrecy Act (BSA) Officer to oversee all aspects of its AML/CFT program and ensure compliance with applicable laws. Within 90 days of the order’s effective date, the bank must correct all other AML/CFT weaknesses identified in the previous Report of Examination.
Amending an existing order signals that examiners found new or continuing deficiencies after the original order was issued. Here, the first items are management qualifications, regulator approval of directors and senior officers, and board participation, which point to governance as the root cause examiners want corrected.
FIs should test whether management’s qualifications are assessed against the duties each role carries, whether staffing and candidate expertise for critical operations are documented, and whether the board has a formal program to monitor its own remediation progress. Board-level accountability also extends to individual directors signing off on credit extensions to classified borrowers and on quarterly progress reports. The order’s BSA Officer requirement is a reminder that the board must also ensure that the person has the authority, training, and resources to do the job.
The BSA/AML/CFT Officer’s input is sought regarding the ML/TF and other illicit financial activity risks related to expansion into new products, services, and customer types, and geographic locations; or operational changes, such as the implementation of, or adjustments to, systems that impact the BSA compliance function.
Appropriate independence of the BSA/AML/CFT compliance officer may include, but is not limited to: clear lines of reporting and communication ultimately up to the board of directors or a designated board committee that do not compromise the BSA compliance officer’s independence, the ability to undertake the BSA/AML/CFT compliance officer’s role without undue influence from other business lines, and identification and reporting of issues to senior management and the board of directors.
Related: How to Create Dynamic BSA/AML/CFT Risk Assessments
Ncomply Sample Policies
Nrisk Risk Assessments
The FDIC and the Louisiana Office of Financial Institutions issued a Consent Order to a bank for unsafe or unsound banking practices related to underwriting and commercial real estate (CRE) loan concentration.
The order requires a written CRE concentration monitoring plan that sets CRE limits relative to Tier 1 capital and the allowance for credit losses (ACL) by loan type and in aggregate, establishes procedures to identify, track, and report the concentration to the board, and includes strategies to reduce exposure above approved limits. The board must also correct weaknesses in CRE stress testing within 90 days.
For underwriting, the board must correct weaknesses in debt service coverage ratio (DSCR) standards used before extending credit, at renewal, and throughout the life of the loan, as well as weaknesses in the internal watch list, credit risk grading, and loans originated with supervisory loan-to-value exceptions. The bank must also ensure loan documentation is obtained and evaluated before origination and renewal, track and report loan policy exceptions, and maintain a loan review program commensurate with its CRE concentration.
This order ties a high CRE concentration directly to underwriting discipline. Examiners are requiring a concentration framework with limits tied to capital, stress testing that works, and underwriting standards that hold up at origination, at renewal, and over the life of the loan.
FIs with meaningful CRE exposure should confirm that concentration limits are set relative to Tier 1 capital and the ACL, and that stress testing is current and documented. They should also confirm that DSCR standards are consistently applied, that the watch list and risk grades are accurate and independently validated, and that loan-to-value exceptions and loan policy exceptions are tracked and reported to the board.
Ncomply Sample Policies
Nrisk Risk Assessments
The NCUA issued no institutional enforcement actions in September 2026.
Several of September’s actions come down to whether a program holds up under scrutiny.
If you’re new to compliance leadership or want a refresher on the fundamentals, our free guide, How to Build a Resilient Compliance Program, offers tips for keeping a program consistent over time.