Contracts that allocate compliance duties
Banks and other financial institutions covered by the Bank Secrecy Act must maintain anti-money laundering programs, and that duty generally stays with the regulated institution even when it relies on a partner. When a bank works with a fintech, payment processor, or program manager, the agreement typically spells out who verifies customer identity, who monitors transactions, who escalates suspicious activity, and who has audit rights. Regulators have scrutinized these partnerships closely, and gaps in the contract often surface in enforcement actions. Suspicious activity reports are confidential by law, so contracts should not promise information-sharing that the law prohibits. The contract should also give the bank the information it needs to oversee the partner's program.
Agreements that resolve an enforcement matter
AML agreements also include settlements with regulators and prosecutors, such as consent orders with the New York State Department of Financial Services or federal banking regulators, and deferred or non-prosecution agreements with the Department of Justice. These agreements often require remediation, independent reviews or monitors, and regular reporting. Failing to meet the terms can lead to further penalties or prosecution. Monitorships in particular can be costly and long-running, so the monitor's mandate and the conditions for ending it deserve close attention. Negotiating the scope of remediation and what counts as compliance can matter as much as the penalty amount.
Reviewing or negotiating the terms
We compare the allocation of responsibilities with what each party can actually do with its systems and staff. For companies under a regulatory agreement, we look at reporting obligations and how progress will be documented. In commercial deals, representations about compliance, indemnities for regulatory penalties, and termination rights deserve attention. If an AML agreement is being negotiated because problems have already surfaced, we consider whether disclosure to regulators is required or advisable. In each setting, the agreement is worth as much as the controls behind it.
