Issue #29 | November 10, 2026 | 8 min read
The Brief
On June 30, DOJ announced a non-prosecution agreement with EagleBank. The bank admitted it willfully failed to maintain an AML program from 2010 through 2021 and agreed to pay $9.8 million in a fine and forfeiture. The dollar figure is small. The documents attached to it are the most detailed account we've read of how a bank's business side beats its compliance side in writing, email by email.
This issue covers a check-kiting scheme that ran through one family's accounts for more than a decade, the compliance staff who flagged it at every stage, and a policy that let anyone overrule them without explaining why.
Main Feature
EagleBank's Compliance Team Did Its Job. The Policy Let Everyone Else Ignore It.
The bank filed SARs on the same customers in 2010, 2014, 2017, and 2020. The failure sits one step after the filing, in the decision about whether to keep banking them.
EagleBank's staff spotted kiting early and kept spotting it. In 2010 the bank filed multiple SARs on a son, his father, and a family trust, after closing their trucking company's account in December 2009 for kiting. An analyst recommended another SAR and an account closure in March 2014. In 2017 the BSA officer wrote a memo of about 21 pages recommending closure of the trucking company's accounts for "questionable wires, potential check kiting, check fraud," listing hundreds of checks of up to nearly $1 million, nearly all in even thousand-dollar amounts. The 2014 and 2017 closure recommendations didn't stick.
The father was a neighbor, friend, and business partner of the bank's founder and CEO, with shared real estate investments, and he was also a shareholder who had pledged bank stock against a personal loan. In 2011 the trucking company, in bankruptcy for about a year, applied for a roughly $5 million SBA loan. A committee that reviewed SBA loans was set to decline it, and an employee wrote that the committee would understand the CEO's "belief in the character" of the father and his "strong desire to do what we can to help him." The loan went to the Directors Loan Committee and was approved after the son and father asked the CEO to help. It didn't get proper underwriting, even though both were personal guarantors. When the proceeds came due, $96,000 and then $24,000 moved into the trucking company's overdrafts from the account of the CEO's own real estate investment firm. The bank had no control on internal transfers that required independent approval.
DOJ fine: $9,057,821.62
Forfeiture: $736,515 (the bank's overdraft fee proceeds on the accounts)
Total: $9,794,336.62
Loss to the other bank that was left holding the kite: $6,290,153.90
Conduct period: 2010 to 2021
Term of the agreement: one year
Voluntary self-disclosure credit: none
Look at what happened after each warning. In December 2011 an operations officer wrote that "for the past two years we have had a recurring theme with overdrafts, return deposit activity, suspected kiting," and asked "at what point do we put a stop to this activity." A relationship manager answered that the father was the CEO's "dear friend" and asked staff to alert the CEO "so he is not blindsided." In late 2015 the son promised to bring daily overdrafts under $235,000 and reduce them by $15,000 every two weeks. Instead he added wire transfers to the cycle, knowing the bank treated incoming wires as good funds. A bank officer covered a year-end overdraft with the words "You are the only customer I would do this for." The bank backdated the SBA loan's payments from 2014 to 2016 so the loan didn't show as past due, and an officer told the son internal audit was "nit-picky" about it and that, if asked about his personal payments, "I'll just say the payments didn't arrive before our cutoff date."
From late 2015 to mid-2017 the reports on the trucking company logged deviations from its normal volume of nearly $10 million, over $24 million, nearly $56 million, and in October 2016 $125,738,309.77. Each time the report decided the account was probably fine, since it was a trucking company, and recommended no further review. The analyst noted 31 withdrawals over $1 million went to the father's law firm account and called that "reasonably consistent with the customer's transactional history." That reads fine as a narrative for a trucking company. It doesn't survive the fact that the same accounts had been running negative balances, in one 2016 snapshot by more than $480,000, with the bank paying out anyway.
The 2017 episode shows what the business side was actually protecting. In May 2017 another bank froze the accounts and tried to recall $1.4 million in wires. EagleBank's Chief Credit Officer told the CEO that staff had returned enough checks to pull the balance out of the red, and wrote "I am confident someone is going to be stuck holding the bag on this, and thanks to our folks, it isn't going to be us." The CEO answered with a string of capital letters thanking them. When the other bank asked EagleBank to hold what remained in the account, the Chief Credit Officer explained that EagleBank had "significant loans to the company, and we do not want to put them out of business," and the Chief Operating Officer and Chief Risk Officer were on the thread. The other bank lost nearly $6.3 million. EagleBank's own policy required it to consider closure after three SARs, and in September 2017 the BSA officer recommended exactly that. By October 27 a short memo to the Chief Risk Officer withdrew the recommendation, on the grounds that deposits were now limited to wires, and that the wires were funded from the account of the trucking company's parent company. A kiting customer was being cleared by the fact that his money moved by wire.
The son pleaded guilty to bank fraud in November 2020. EagleBank had caught him kiting again that June, and a BSA analyst asked whether the bank planned to close the accounts. It decided to keep them because of his outstanding loans. Another follow-up SAR went in March 2021, noting the relationship manager "has requested the accounts to remain open until the loans are paid off." The accounts closed around April 2021.
DOJ's conclusion is where the order turns into a finding about the program. Other high-risk customers with multiple SARs were never considered for closure, or closure decisions went undocumented, or business staff argued against closing them. The bank had no system to make sure a closure recommendation was actually considered. Its policy left it to compliance's discretion whether to recommend closure and to the bank's discretion whether to accept the recommendation, and it didn't say what criteria applied, who made the decision, what had to be documented, or how fast. The same policy specified no controls for high-risk customers.
DOJ settled on a non-prosecution agreement with a 20 percent discount off the low end of the Sentencing Guidelines fine range. It weighed remediation, the retirement of several executives, and a 2022 SEC and Federal Reserve settlement over insider lending and third-party risk. It gave no credit for self-disclosure, since the bank never told DOJ. The forfeiture is the line worth reading twice: $736,515 is what EagleBank earned in overdraft fees on the accounts. The bank was paid for the scheme. The combined payment is about 1.6 times the other bank's loss, which is our arithmetic, not DOJ's, and it's the only comparison in the file that shows what the program failure cost the victim and what it cost the bank. DOJ's release doesn't name an individual charged in connection with the bank's conduct.
Red Flags in This Case
A customer filed on for kiting repeatedly over years whose accounts are still open because loans are outstanding
Closure recommendations that disappear without a documented decision, or are withdrawn by a one-page memo
Overdrafts covered by officers as a favor to a named customer, with an email saying so
Alert narratives that explain a $125 million swing in volume by the customer's industry
A problem relationship managed by the group that owns the loan and the loss, rather than by an independent function
Loan payments backdated around quarter-end, and internal audit described as "nit-picky"
Another bank's fraud analyst contacting you about a shared customer and no one in compliance seeing it first
If you test a program, the question this order puts to you is who can say no to a BSA officer, and where it's written down. At EagleBank compliance recommended closure and the policy allowed any senior person to ignore it without a record. The audit finding doesn't need a kiting scheme to apply. Any closure recommendation that disappears without a documented decision is the same finding.
Source: DOJ Non-Prosecution Agreement and Statement of Facts, EagleBank, June 30, 2026 | DOJ, June 30, 2026
Controls & Testing
Risk & Control Matrix
Risk | Control |
|---|---|
A closure recommendation from BSA/AML is withdrawn, overruled, or lost without a documented decision | A closure decision log with defined criteria (for example, a SAR count that triggers a mandatory decision), a named decision owner independent of the business line, a required written rationale, and a decision deadline, reported to the audit or risk committee |
A customer with fraud history is retained because of loans, deposits, or personal ties | A conflicts and relationship check on every high-risk retention decision, with senior-executive and director ties disclosed, and retention approvals by a committee that excludes the relationship's sponsors |
Alert dispositions accept the customer's business model as an explanation for volume deviations | Disposition standards requiring analysts to quantify the deviation, confirm balances and returns, and escalate any alert with negative balances or round-dollar patterns, plus second-line sampling of "no further review" outcomes |
Credit officers or workout groups cover overdrafts, extend deadlines, or backdate payments for flagged customers | Overdraft and exception reporting by customer, independent approval of internal transfers, and a monthly review of overdraft coverage, payment backdating, and exception approvals for any customer with a SAR on file |
Audit Test Steps
An audit program built around this typology could test for it by:
Pulling every customer with three or more SARs in the last five years and tracing each to a documented closure decision: who decided, on what date, and on what stated criteria.
Taking closure recommendations from BSA/AML in the last three years and comparing them to the accounts still open, then interviewing the relationship owner for each one that stayed open.
Sampling alert dispositions closed as "no further review" on accounts with large volume deviations, and recomputing balances, returns, and counterparty relationships to see whether the stated rationale holds.
Requesting overdraft, backdating, and exception data for customers on the SAR list and checking who approved each one and whether the approver also owns the loan.
Comparing the SAR list to the list of insider-related, shareholder, and director-connected relationships, and testing whether any customer appears on both.
Intelligence Briefing
FinCEN cuts MEXC Global off from the U.S. financial system. On November 6, FinCEN issued an order under section 9714(a) of the Combating Russian Money Laundering Act barring U.S. financial institutions from transmitting funds to or from the exchange. Treasury says MEXC Global was tied to at least $16 billion in illicit activity between May 2021 and May 2026, including about $1 billion in direct transactions with more than 40 identified Iranian exchangers and about $232 million with sanctioned Russian-linked entities. The order takes effect 30 days after Federal Register publication and doesn't change SAR or OFAC obligations, so institutions still have to look for MEXC exposure upstream and downstream of the direct prohibition.
Source: FinCEN, Nov. 6, 2026 | Treasury, Nov. 6, 2026
FinCEN and the Fed withdraw the proposal to lower the cross-border travel rule threshold. The agencies withdrew the 2020 proposal to cut the recordkeeping and travel rule threshold for cross-border transfers from $3,000 to $250 and to name convertible virtual currency and certain digital assets explicitly. Reporting on the notice says the agencies cited the burden on institutions, smaller ones especially, in the comments. It follows the October 5 withdrawals of the mixing and unhosted wallet proposals.
Source: FinCEN, Nov. 6, 2026
Career Intel
The most useful skill in this file is the unglamorous one: writing a closure recommendation that can't be quietly withdrawn. EagleBank's BSA officer did the analysis. What was missing was a record that forced the bank's answer into the open. Auditors and second-line reviewers who can test decision governance, meaning criteria, owners, documentation, and timelines for exits and retention of high-risk customers, are working on something regulators now cite in non-prosecution agreements. If you can show you built or tested a closure-decision log that survived a loud relationship manager, you have a story that fits a bank, a broker-dealer, or a fintech.
AI in Financial Crimes Compliance
EagleBank's analysts wrote "no further review is recommended" on a $125 million volume deviation. An AI triage model trained on a bank's past dispositions would learn that sentence as the correct answer for any account that looks like that trucking company. A model that learns from analyst decisions inherits whatever overrides shaped them, and the relationship a customer has with the bank is a feature it can pick up without anyone naming it.
Before approving an alert-triage model, ask which historical dispositions trained it and whether anyone sampled them for business-line influence. Then check whether the model sees the loan, overdraft, and exception data that explained those dispositions to the humans.
Source: DOJ Non-Prosecution Agreement and Statement of Facts, EagleBank
Tip Line
Got any idea for something you'd want to see covered here? Doesn't have to fit neatly into a category. If you think it's interesting, we probably will too.
Send it to [email protected].
If someone forwarded this to you, welcome.
The AML Brief goes out every Tuesday. Subscribe for free and get the Top 10 AML Red Flags cheat sheet as a thank-you:
[BUTTON: Subscribe → theamlbrief.com]
Already subscribed? Forward this to one colleague who works in financial crimes. That's how we grow.
The AML Brief | theamlbrief.com
Disclaimer: The AML Brief is an independent financial crimes intelligence publication. All content is sourced from publicly available regulatory documents, enforcement actions, and published research. Nothing published here constitutes legal, compliance, or regulatory advice. The AML Brief is not affiliated with any financial institution, regulator, law firm, or employer. For advice specific to your situation, consult a qualified attorney or compliance professional.