Fraud, AML, OFAC Sanctions and Data-Security Controls. Connect distinct fraud, AML, sanctions and data-security decisions to payment execution, reporting, protected evidence and control assurance.
A supplier payment reaches Malla Bank shortly after the customer's beneficiary details changed. The fraud engine flags an unusual destination, sanctions screening produces a possible name match, and an AML scenario later identifies similar receipts moving rapidly through the receiving account. These signals can concern the same money without asking the same question. Treating them as one failed compliance check leaves staff uncertain about whether to verify, investigate, block, reject or release.
Chapter 57 examined the customer's protection when something goes wrong. This chapter explains how banks prevent, detect and handle fraud, suspicious activity, sanctions exposure and data-security failures. It follows the control decisions and their financial consequences without repeating the detailed authorization or rail-processing chapters.
Give every control a defined purpose, accountable owner and permitted action. Fraud suspicion is not a sanctions determination, a SAR does not freeze an account, and a clean screening response is not evidence that a payment is legitimate.
Allow roughly 60 minutes for the chapter, diagram walkthroughs and worked cases. The bank, payment patterns, scores and control designs are fictional. Sources were checked on October 5, 2026. Actual legal restrictions, filing duties and production control settings require current rules and institution-specific assessment.
Chapter navigator
- Four control purposes that must remain distinguishable
- Use customer and product context without assuming it is complete
- Position controls around the decisions they can influence
- Fraud prevention begins before the payment instruction
- Monitor outgoing and incoming activity under the relevant rules
- AML monitoring examines activity and context over time
- SAR decisions, timing and confidentiality
- Sanctions analysis goes beyond a name-list comparison
- Distinguish a review hold, blocking and rejection
- Preserve screening data through files, APIs and transformations
- Protect data according to its purpose and sensitivity
- Handle security incidents as payment incidents too
- Test controls for coverage, effectiveness and recoverability
- Reconcile dispositions, funds and records
- Worked cases and implementation decisions
- Role checklist and learning closure
1. Four control purposes that must remain distinguishable
Fraud controls seek to prevent or detect deception, unauthorized activity and related losses. AML and countering-the-financing-of-terrorism controls assess relevant customer and transaction risks, investigate suspicious activity and support required reporting. Sanctions controls identify activity subject to applicable prohibitions or restrictions. Data-security controls protect information and the systems that process it.
Their inputs overlap. A beneficiary account change, unusual geography, new device or unexpected transaction pattern can matter to more than one team. Their decisions do not become interchangeable. A fraud analyst may seek independent customer verification; a sanctions specialist may need to determine whether a prohibited interest exists; an AML investigator may examine activity across many payments.
The opening supplier payment should therefore retain separate decision records. If sanctions review clears a false match, the fraud concern does not disappear automatically. If the customer confirms that it initiated the instruction, that does not resolve whether it was deceived or whether the destination is legally restricted.
A practical operating model shares relevant evidence while preserving each function's authority. It prevents a generic green status from overriding another unresolved control. It also avoids unnecessary repeated questioning when several teams need the same customer or transaction facts.
2. Use customer and product context without assuming it is complete
Customer identification and due diligence establish information that helps the bank understand relationships and assess risk. Expected activity, business purpose, ownership, counterparties and geographic exposure can provide context for payment monitoring. They do not certify every future transaction as legitimate.
Keep customer-profile information current under the applicable requirements and risk-based processes. A genuine business may change its suppliers or expand into a new market; a compromised account may retain an apparently ordinary profile. The bank needs a way to distinguish a reasonable change from activity that warrants further inquiry without treating all novelty as misconduct.
Product design influences the available evidence. A receiving bank may see incoming payment data and its own customer's behavior but lack the sender's original interface or device history. An originating bank may know the initiating session but have limited visibility into the beneficiary's later withdrawals. Controls should reflect those different roles.
The bank should document data gaps, reliable sources and escalation routes. A blank ownership field is not the same as evidence that no relevant owner exists. Equally, uncertain information should not be silently converted into an accusation. The control record should show what is known and what the responsible specialist still needs to establish.
3. Position controls around the decisions they can influence
Some controls operate before release, when the bank can still prevent an instruction from leaving. Others monitor incoming funds or analyze behavior after settlement. A retrospective alert can support investigation and recovery but cannot be described as having stopped the original payment.
Place controls against actual decision points: onboarding, account linking, beneficiary maintenance, authentication recovery, payment preparation, release, incoming posting and subsequent account activity. The specific architecture varies by bank and rail. There is no universal rule that every fraud, AML and sanctions engine must be called in one fixed sequence.
The diagram shows distinct purposes connected to controlled execution. It is not a production screening topology or a claim that all analysis completes synchronously. The bank must decide which checks are prerequisites to release and how delayed or unavailable checks are handled under its obligations.
A response such as service unavailable must remain distinguishable from a completed no-match result. Otherwise a technical outage can silently disable a required control. The release policy should identify supported contingency actions, decision authority and evidence, with the financial state preserved throughout.
4. Fraud prevention begins before the payment instruction
Business email compromise often targets the information used to create a payment rather than the bank's settlement connection. A criminal can replace supplier details in a believable message and rely on a legitimate employee to authorize the resulting transfer. A strong login alone does not protect the business purpose of that instruction.
Independent verification of a sensitive destination change should use a trusted contact route established separately from the change request. A phone number contained in the suspicious email can belong to the attacker. The bank's and customer's responsibilities depend on the product and agreement, but the control principle is to verify the change through evidence that the same deception does not control.
Account takeover can also begin through help-desk resets, new device enrollment or privilege changes. Monitoring should consider the sequence leading to release, not only the final payment amount. A newly reset administrator who adds a beneficiary and immediately sends money presents a different context from an established recurring instruction.
These controls need a legitimate customer path. When a real supplier changes its bank, the business still needs to pay it. The operational design should identify what verification resolves the concern, who can approve the change and how the decision binds to the instruction. An indefinite hold without an accountable next action is not a complete fraud process.
5. Monitor outgoing and incoming activity under the relevant rules
Nacha's phased fraud-monitoring amendments are effective by this chapter's review date. Phase 2 had a stated June 19, 2026 effective date, with June 22 as the practical banking-day implementation because of the holiday. The originating-side requirements cover specified non-consumer participants and address entries suspected of being unauthorized or authorized under false pretenses. They require risk-based processes and at least annual review, rather than one prescribed scoring product.
Receiving-side ACH credit monitoring addresses the RDFI's role in identifying suspicious incoming activity. Originating and receiving responsibilities should not be treated as substitutes. A sender's bank cannot conclude that its controls are unnecessary because a receiving institution also monitors accounts.
Within an illustrative bank design, useful signals could include a new destination, unusual payment velocity, abrupt beneficiary changes or incoming credits followed by rapid dispersal inconsistent with the known relationship. These are examples for risk assessment, not mandatory universal thresholds or proof of criminal conduct.
Measure control outcomes as well as alert volume. Excessive false positives can delay legitimate payroll or supplier payments; poor detection can permit customer loss. Review confirmed outcomes, missed patterns, data quality and customer friction. A lower alert count is not automatically an improvement if it results from missing input data or disabled scenarios.
6. AML monitoring examines activity and context over time
An AML scenario may identify patterns across accounts, counterparties, channels or periods. Its purpose differs from a real-time fraud decision on a single outgoing payment. The investigation should consider the facts that make activity suspicious rather than treating a scenario threshold as a legal conclusion.
A large payment can be legitimate. Several smaller payments can be suspicious in context. The bank should assess purpose, source and use of funds, relationship information and relevant explanations. Artificially dividing activity into separate rail applications can obscure patterns that cross ACH, wires, cards and cash.
Currency Transaction Reports concern qualifying currency transactions, including applicable aggregation and exemptions; they are not reports of every electronic payment exceeding $10,000. Similarly, a SAR is not automatically required merely because an ordinary transfer is large. The institution must apply the relevant reporting criteria to the actual activity.
Maintain the investigation's scope and evidence lineage. A case may begin with one payment and expand to a relationship or connected population. Staff should be able to explain why the scope changed and which records support the assessment. The payment engine needs appropriate action instructions, not unrestricted access to the full confidential investigation narrative.
7. SAR decisions, timing and confidentiality
Bank SAR requirements include defined reporting criteria, filing periods, retention and confidentiality provisions. Under the ordinary timing rule, filing is due within 30 calendar days after initial detection of facts that may constitute a filing basis. If no suspect is identified, the permitted identification extension cannot take reporting beyond 60 days from that detection. An alert's creation is not automatically the legal detection event in every case; the assessment must be supportable.
Reporting criteria must be mapped to the institution’s applicable rules. For example, the OCC’s national-bank rule separately addresses qualifying insider abuse at any amount, specified suspected criminal violations aggregating at least $5,000 with an identifiable suspect, and at least $25,000 regardless of identification. It also addresses qualifying transactions aggregating at least $5,000 involving potential money laundering or BSA violations. Apply the full conditions and exceptions; these figures are not a universal minimum below which suspicious activity can be ignored.
Keep copies of required SARs and supporting documentation for the applicable five-year period, subject to other retention obligations and legal holds. Access should be limited appropriately. Neither the SAR nor information that would reveal its existence should be disclosed contrary to the confidentiality rules.
A SAR filing does not itself authorize blocking funds or close the customer account. Those actions require their own legal, contractual and risk assessment. The bank should not use a filed-SAR flag as a universal payment prohibition or tell a customer that an account restriction exists because a SAR was filed.
As of October 5, 2026, FinCEN's April 2026 AML/CFT program reform material is proposed rulemaking. The bank can assess potential future changes while continuing to apply currently effective requirements. A reform proposal is not permission to suspend existing monitoring, reporting or governance obligations.
8. Sanctions analysis goes beyond a name-list comparison
A screening engine can identify possible matches to names, addresses, countries or other information. It supports the bank's sanctions compliance; it does not replace the legal analysis of a specific program, prohibited interest, applicable exception or license. A close name match can be false, while an unlisted entity can still be blocked through ownership.
OFAC's 50 Percent Rule addresses entities owned, directly or indirectly, 50 percent or more in aggregate by one or more blocked persons. A simple fictional example is two blocked owners each holding 25 percent of the same entity. Control without that ownership does not automatically trigger blocking under this rule alone, although other designations, restrictions or risks may matter.
Use the actual program and facts. Sanctions are not one universal list of countries through which every transaction is either allowed or forbidden. Licenses and exemptions have scope and conditions. A reviewer should retain the basis for relying on one rather than copying an old clearance from another transaction.
OFAC's compliance framework emphasizes management commitment, risk assessment, internal controls, testing and training. In a bank, these elements should connect to real payment decisions: data coverage, escalation, disposition, reporting and evidence. Purchasing a screening tool is only one part of that operating model.
9. Distinguish a review hold, blocking and rejection
An internal review hold keeps an unresolved item from the next processing step under the bank's supported controls. It is not itself an OFAC determination. Blocking immobilizes property in which a blocked interest exists under the applicable authority; the bank cannot simply send it back as an ordinary failed payment. Rejection concerns prohibited activity without the blocking treatment required for the particular transaction.
The correct action depends on the program, parties, property and any authorization. A reviewer should identify what has already happened financially. If a payment has settled, a control decision cannot pretend that the original account movements never occurred. The bank must handle the property and reporting according to the actual situation.
The diagram separates a possible match from a confirmed legal disposition. A released false match, blocked property and a rejected transaction need different accounting and follow-up. Returning funds without checking the applicable restriction can itself be the wrong action.
Initial blocking reports and reports of rejected transactions generally have ten-business-day filing requirements under the respective Part 501 provisions. Filing procedures and required information must follow the current rules. Do not rely on an old FAQ's informal wording when the operative regulation establishes the exact clock and reporting route.
10. Preserve screening data through files, APIs and transformations
A payment can pass through several data models before reaching the execution service. Mapping must preserve the information required for the bank's controls and applicable transmission obligations. A transformation that discards an address or truncates a party name can create a control gap even if the resulting message passes syntax validation.
Keep source data, normalized values and material enrichment distinguishable. If an operator repairs a name or account field, preserve the original and establish whether the relevant checks must run again. A clearance should be associated with the instruction and information actually assessed, not loosely attached to a payment whose destination later changed.
For covered funds transfers, BSA recordkeeping and Travel Rule requirements concern specified information and roles. The commonly applicable $3,000 threshold has conditions and exclusions; it is not a minimum amount below which sanctions or fraud controls cease to matter. Use the current rule and role-specific requirements rather than copying a threshold into every risk decision.
The bank should be able to demonstrate control coverage over the actual population. Reconcile messages received by the payment application to items evaluated, held, released and failed by the control service. An engine reporting no alerts is not reassuring if a mapping or routing defect prevented half the payments from reaching it.
11. Protect data according to its purpose and sensitivity
Payment systems hold account details, personal information, authentication material and investigation evidence. Limit collection and access to what the process needs, protect data in transit and storage, and use controlled production-support access. A developer investigating a status bug should not need unrestricted access to every customer's complete payment history.
The bank’s information-security obligations extend beyond card standards. The applicable interagency information-security guidelines address protection of customer information through a written program and relevant safeguards. Determine the institution’s governing provisions and service-provider responsibilities. PCI compliance does not replace those bank obligations or the separate privacy rules applicable to disclosure of customer information.
Logs deserve particular attention. Request bodies, screenshots, exported case files and support attachments can expose data even when the primary database is well protected. Masking in the customer interface does not protect an unredacted backend log. The bank should define safe diagnostic fields and a controlled route for exceptional evidence access.
For card-data environments, PCI DSS v4.0.1 is the current published standard at this review, and its formerly future-dated requirements became effective on March 31, 2025. Sensitive authentication data generally must not be stored after authorization, even encrypted, subject to the standard's specific issuer and issuing-service provisions. Tokenization can reduce exposure but does not automatically remove every connected system from scope.
Separate legal retention from indiscriminate data accumulation. Keeping everything forever can create unnecessary exposure; deleting all data quickly can destroy required evidence. The institution needs a record-classification schedule that meets applicable obligations while restricting access and disposing of data when retention is no longer justified.
12. Handle security incidents as payment incidents too
A compromised credential, corrupted payment file or unavailable security service can affect both information and money. Incident response should identify exposed data, affected instructions, possible unauthorized changes and uncertain financial outcomes. Restoring a server is not enough if a malicious instruction remains queued for release.
The federal banking agencies' incident-notification rules require notice of a qualifying notification incident as soon as possible and no later than 36 hours after the banking organization determines that such an incident occurred. This is not a deadline measured from every initial alert or a universal notice rule for every minor outage.
The service-provider provision is different: it addresses notice to affected banking-organization customers when specified services are materially disrupted or degraded for four or more hours, or are reasonably likely to be. The four-hour condition is not a blanket instruction that providers may wait four hours after every incident before notifying a bank.
Coordinate security containment with payments, treasury, compliance and customer support. Suspending a channel can leave scheduled obligations unresolved; credential rotation can strand legitimate integrations. The recovery plan should preserve the original payment population and restore service without silently replaying uncertain transactions.
13. Test controls for coverage, effectiveness and recoverability
Testing should establish that the intended population reaches the control, that relevant scenarios produce the expected decisions and that the disposition affects execution correctly. A test proving that an engine can produce an alert is incomplete if the payment still releases while the alert is pending.
Use fictional or appropriately protected test data and controlled expected outcomes. Include material field changes, missing information, delayed responses, duplicate callbacks and outages. These cases test the bank's implementation rather than assume that a vendor's certification proves every local integration behaves correctly.
The diagram also closes the feedback loop. Confirmed fraud, false positives, missed data and operational overrides should inform reviewed changes. Tuning should have an owner and evidence; reducing alert volume by suppressing a difficult population without assessment is not demonstrated effectiveness.
Where analytical models are used, governance should address purpose, data, limitations, validation and ongoing performance as applicable to the institution. A model recommendation must not be presented as an infallible legal determination. Operators need an intelligible reason and a supported escalation path, particularly when a decision affects customer access to funds.
14. Reconcile dispositions, funds and records
The bank needs to reconcile more than payment totals. Every held item should have an owner and current basis; every released item should have the required decisions; blocked property and rejected transactions should have the appropriate financial and reporting treatment. An aging queue is both an operational population and a potential source of customer harm.
A blocked balance is not ordinary payment income. A fraud-loss provision, consumer reimbursement, recovery receivable and sanctions-related liability are different accounting matters. Finance should use the actual legal and financial position, with original postings and subsequent adjustments retained rather than erased by a generic failed status.
OFAC's general recordkeeping rule now uses a ten-year period. Records concerning blocked property remain required while it is blocked and for the prescribed period after unblocking. That differs from the five-year SAR retention rule and demonstrates why one payment-wide retention number is inadequate.
Management reporting should show exposure, aging, control coverage, decision quality and unresolved dependencies. Staff should be able to trace a reported number to its underlying population without exposing confidential SAR material in general dashboards. The right report informs the right audience at the necessary level of detail.
15. Worked cases and implementation decisions
Sanctions clears the name but fraud remains unresolved
The supplier's name match is false. The beneficiary account nevertheless changed through an unverified email immediately before a large payment. The release service treats sanctions clearance as full approval.
Preserve the separate fraud hold and identify the verification needed. Explain why one control's completed decision cannot silently satisfy another control's purpose. Show the evidence that permits eventual release of the exact instruction.
Incoming credits are dispersed rapidly
A recently active account receives credits from unrelated parties and quickly sends funds onward. The bank has limited information about the senders' initiation sessions.
Assess the receiving bank's available evidence and applicable monitoring duties. Identify legitimate explanations as well as suspicious indicators. Do not infer criminal conduct solely from speed or assume that originating-bank controls remove the receiving bank's responsibilities.
Two blocked owners are below 50 percent individually
Two blocked persons each own 25 percent of an entity receiving funds. The entity's name does not appear as an exact list match, and the screening tool proposes release.
Apply the aggregate ownership analysis and refer the actual transaction to the sanctions specialist. Distinguish that case from control without the relevant ownership. Document the applicable program and any authorization rather than relying only on a numeric score.
A control outage looks like no match
An API timeout is translated into an empty list of alerts. The payment application interprets the empty list as a completed clear response and releases the instruction.
Separate unavailable, incomplete and completed outcomes. Define the supported contingency decision and prevent uncertainty from becoming clearance. Reconcile the affected population to determine which instructions require investigation or other action.
A SAR flag causes an automatic customer message
A case system sends an account-restriction notice containing the text SAR filed. The payment decision and confidential reporting decision have been combined in one template.
Remove the disclosure from the customer communication path and assess the incident through the appropriate specialists. Establish the independent basis for any restriction and provide only permitted, accurate information about the customer's service.
The support export defeats database protection
A production database encrypts payment data, but a troubleshooting export contains unmasked card information and unrestricted investigation notes. The export is copied into a broadly accessible support ticket.
Identify the exposed record classes, access and retention requirements, and incident response. Design a safer diagnostic extract. The exercise tests the entire evidence journey, not only whether the original database has encryption enabled.
16. Role checklist and learning closure
Fraud teams should assess deception and unauthorized activity. AML teams should investigate relevant patterns and make supportable reporting decisions. Sanctions specialists should determine legal restrictions and required dispositions. Security teams should protect data and system integrity. Payment operations should enforce decisions against the actual instruction state. Finance should reconcile the resulting balances, and assurance should test coverage and outcomes rather than rely on tool installation as proof of compliance.
The learner should now be able to explain why a payment can be authenticated, suspicious, legally restricted or technically compromised in different combinations. Chapter 59 brings these outcomes into the bank's daily monitoring, reconciliation, accounting and reporting model.
Authoritative references
Sources checked on October 5, 2026. Specific sanctions programs, filing requirements and standard applicability must be assessed using current operative material.
This application uses JavaScript for the full interactive experience. This text summary is served for accessibility and search indexing.