What the OCC's CFSB Consent Order Says About BSA/AML Risk in Fintech Payment Partnerships

The OCC made public its consent order against Community Federal Savings Bank on May 21, 2026 (the order itself is dated April 24, 2026). It would be easy to frame it as a digital asset story.

That framing is wrong, and it’s dangerous for institutions that take it at face value.

The OCC explicitly said the findings are “based on concerns largely unrelated to customers involved in digital assets activities.” According to the consent order, the bank “has significantly grown its payment processing line, relative to its size” since 2020, and “has failed to develop and maintain controls and risk management processes commensurate with its risk and growth.” The bank neither admitted nor denied the OCC’s findings. The general lesson: when payment volume grows and controls don’t, BSA/AML failures follow.

That’s an operational risk lesson every institution growing through fintech partnerships needs to sit with.

TL;DR

• The OCC’s consent order against Community Federal Savings Bank (dated April 24, 2026; made public May 21, 2026) cited BSA/AML deficiencies tied to the growth of its payment processing line; the OCC said its findings are “based on concerns largely unrelated to customers involved in digital assets activities”
• Core deficiencies the OCC identified: alerting thresholds not adequately tuned to the risk profile of the payment processing line; an ineffective CDD program; and weak independent testing and BSA staffing
• The order requires an independent SAR look-back to determine whether SARs should be filed for previously unreported suspicious activity—a significant operational burden
• The operational risk lesson: controls that were adequate when the payment processing line launched may not be adequate now, and the gap between “adequate at launch” and “adequate today” is exactly what regulators are examining

Who Is Community Federal Savings Bank?

Community Federal Savings Bank is a federal savings association in Woodhaven, New York, chartered and examined by the OCC. According to the consent order, “Since 2020, the Bank has significantly grown its payment processing line, relative to its size, resulting in significant annual wire and ACH activity, including cross-border activity involving foreign financial institutions.”

This growth model—a small institution with a large payment processing operation—isn’t unusual. The fintech banking-as-a-service wave created a cohort of community banks and savings associations that grew their balance sheets and fee income through fintech partnerships, processing payment volumes far exceeding what their retail deposit franchise would suggest. The OCC found that, despite the growing volume of transactions through its payment processing line, CFSB “failed to develop and maintain controls and risk management processes commensurate with its risk and growth.”

The consent order, docket AA-ENF-2025-21, is dated April 24, 2026, and was made public by the OCC on May 21, 2026. It is a cease-and-desist order issued with the bank’s consent under 12 U.S.C. § 1818(b); the bank neither admitted nor denied the OCC’s findings. It does not include a monetary penalty. That doesn’t make the order light. A consent order is still a public document and a matter of regulatory record.

The Three Operational Failures the OCC Found

1. Alert Auto-Closing That Was Suppressing the Signal

Most transaction monitoring systems are designed to generate alerts when transactions match risk patterns. Banks then triage alerts: some are investigated and filed as SARs, others are closed after review as benign. Alert “auto-closing” refers to system logic that closes certain alerts automatically—based on thresholds, customer type, prior transaction history, or other criteria—without requiring a human to review them.

Auto-closing is not inherently problematic. High-volume monitoring environments generate enormous alert counts, and some automated triage logic is necessary. The problem is when the triage criteria are calibrated for a risk profile that no longer matches the institution’s actual business.

The OCC found that CFSB’s automated suspicious activity alerting system’s “filtering criteria and thresholds had not been adequately tuned to the risk profile of the Bank’s payment processing line, the significant increases in higher risk products and services, and international exposures.” Deficiencies in the bank’s automated alert triage system “resulted in the system auto-closing alerts that should have been escalated for further review,” and “the system auto-closed a very high percentage of all ingested alerts.”

Think about what that means operationally. The bank had a system generating alerts. A triage system then closed alerts automatically, and according to the OCC, some of those alerts should have been escalated for further review.

The consent order requires a SAR look-back to “determine whether SARs should be filed for any previously unreported suspicious activity” and to review the quality and accuracy of previous SAR filings. Look-backs are operationally expensive, and any previously unreported suspicious activity they identify must then be reported.

2. CDD Gaps on the Payment Processing Line

Customer due diligence at its core requires that a bank understand who its customers are and what transactions to expect from them. For a payment processor relationship, that means understanding: who is this fintech’s customer base? What business do they conduct? What kinds of transactions—volume, frequency, geography, counterparties—are normal for this relationship?

The OCC found that CFSB’s customer due diligence program “is ineffective” and that, as a result, the bank “does not understand the nature of certain of its customers’ businesses and the purpose of the transactions in the payment processing line, including risks related to foreign financial institutions.”

This isn’t a paperwork deficiency. A bank that doesn’t understand what’s flowing through its payment processing line cannot set meaningful monitoring thresholds, cannot identify when a customer’s transactions deviate from expected patterns, and cannot make a defensible SAR decision. CDD is the foundation of the transaction monitoring program—without it, you’re generating alerts from a baseline you’ve never validated.

The foreign financial institution angle is worth particular attention. The OCC found that “in various instances, the Bank failed to determine whether it had correspondent accounts for foreign financial institutions to ensure compliance with due diligence requirements under section 312 of the USA PATRIOT Act.” Under section 312, banks that hold correspondent accounts for foreign financial institutions have specific due diligence obligations, so determining whether such an account exists is the threshold step. Separately, the consent order cites a violation of 31 CFR 1010.520(b)(3), the information sharing requirement under section 314(a) of the USA PATRIOT Act.

3. Independent Testing and Staffing That Didn’t Scale

The OCC found that CFSB had “weak independent testing” and “weak BSA staffing.”

BSA/AML independent testing—sometimes called the BSA audit function—is one of the four pillars of a BSA compliance program under 12 CFR 21.21. It requires periodic testing by a party independent of the BSA function (internal audit or an outside consultant) to verify that the transaction monitoring system is working, that SAR decisions are sound, and that the CDD program is adequate.

When payment processing volume grows significantly, the independent testing program should reflect that growth—in frequency, in scope, and in the expertise of testers. According to the order, the bank’s internal auditor “failed to identify BSA/AML program weaknesses” and “failed to scope in its audit work and effectively test high-risk areas of the Bank’s BSA/AML program.”

Consider a hypothetical institution that built a BSA program for a small community bank, then added a payment processing line with far larger wire and ACH volume. It may never revisit whether its BSA team headcount and its testing budget match its current risk profile. The question to ask directly: does your staffing reflect the volume and complexity of your current business?

The SAR Look-Back Problem

The OCC’s requirement that CFSB hire a SAR look-back consultant is worth dwelling on because it illustrates how operational failures compound.

A look-back is not a prospective fix. It’s a retroactive investigation of whether the bank missed reportable suspicious activity over some historical period. The scope is determined by when the monitoring failures began and how far back the OCC needs to go to have confidence in the institution’s historical SAR filing record.

For CFSB, the order states that the payment processing line has grown significantly since 2020. The order leaves the look-back’s methodology, scope, and timeline to be proposed by the bank’s consultant and subject to OCC no-objection, and it lets the OCC expand the scope at its discretion. In any look-back, the transactions in scope must be re-evaluated, and where the re-evaluation reveals reportable activity, a SAR must be filed.

This is the cost of letting monitoring gaps accumulate. Fixing the monitoring program prospectively is manageable. The retroactive look-back—which can require months of consultant time—is the cost of not catching the gap sooner.

The Operational Risk Frame Most Institutions Are Missing

Most BSA/AML compliance programs are managed by the BSA officer, not by operational risk. That’s appropriate for day-to-day program management. But the failures in the CFSB consent order are operational risk failures—and they need to be visible to the risk function, not just the BSA team.

Consider what a rigorous RCSA—a risk and control self-assessment—of a BSA function facing these kinds of deficiencies might document (bracketed items are placeholders):

• The transaction monitoring system has not been recalibrated since [year]. The auto-closure rate has not been validated against current business mix. Control: not effective.
• CDD documentation for payment processing customers does not include expected transaction patterns. The baseline for what’s “normal” is not documented. Control: not effective.
• BSA staffing is [X] FTEs against a transaction volume of [Y] wires and [Z] ACH transactions annually. Staffing has not increased since [year] despite volume growing [%]. Control gap identified.
• Independent testing was last conducted [date]. The scope did not include the payment processing line, which now represents [%] of total transaction volume. Control: insufficient.

None of those findings require a regulatory examination to surface. They require someone to ask the question.

Running an RCSA that covers your BSA/AML risks isn’t a box to check for the examiner. It’s how you find out whether the controls that were adequate when the program was built still match the risk you’re actually running today. For institutions that have grown payment volume through fintech partnerships, that question has likely never been formally asked. Our RCSA template is a firm-wide workbook, not a BSA-specific tool: 141 fintech risks across 21 categories (BSA/AML among them) with mapped controls, a 97-question self-assessment, a control testing plan, and a second-line challenge log. For the BSA/AML risk assessment itself, see the AML/BSA Risk Assessment Template.

What the Consent Order Means for the Broader Sponsor Bank Ecosystem

CFSB is not an outlier in the sponsor bank space. Since 2020, the OCC has intensified scrutiny of fintech-bank partnership models—not because fintech partnerships are inherently problematic, but because rapid growth in these models has repeatedly outpaced the compliance and risk infrastructure that should scale alongside them.

Other regulators have issued orders in this space too. The FDIC issued consent orders against Cross River Bank (March 2023, fair lending compliance in its marketplace lending program), Choice Financial Group (December 2023, jointly with the North Dakota Department of Financial Institutions, Bank Secrecy Act violations), Lineage Bank (January 2024, its third-party risk management program and fintech partners), and Piermont Bank (February 2024, internal controls for its third-party relationships, plus BSA and consumer compliance violations). The Federal Reserve, in conjunction with the Arkansas State Bank Department, issued an enforcement action against Evolve Bank & Trust (June 2024) for deficiencies in its anti-money laundering, risk management, and consumer compliance programs, including its risk management framework for fintech partnerships.

According to the OCC, CFSB’s payment processing line grew significantly, while its alerting thresholds were not adequately tuned to that business, its CDD program was ineffective, its independent testing was weak, and its BSA staffing was weak.

For every institution operating in this space, the relevant question is not “is CFSB’s situation unusual?” It’s: “if an OCC examiner ran a transaction monitoring calibration review against our current payment processing mix tomorrow, what would they find?”

If the BSA/AML KRI metrics you’re tracking don’t include auto-closure rate, alert-to-SAR conversion rate, and CDD documentation rate for payment processing customers, you’re not measuring the controls that matter most for this risk.

So What?

The CFSB consent order is worth reading even if you’re not a sponsor bank, not a community bank, and not in the payment processing business. The operational risk pattern it documents—controls built for one risk profile, business grown into a different one, gap never formally assessed—shows up across BSA/AML, third-party risk, model risk, and virtually every other risk domain in financial services.

The detection mechanism is an RCSA that asks, genuinely, whether controls are effective for the business you’re running today—not the business you were running when the program was built. An RCSA that documents control gaps with specificity, assigns owners, and drives remediation creates a paper trail that demonstrates the institution is managing its risks. One that hasn’t been updated since the business model changed doesn’t.

The OCC found the gap at CFSB. The question for every other institution is whether they find it first.

Sources:

• OCC Announces Enforcement Actions for May 2026
• OCC Consent Order, Community Federal Savings Bank, AA-ENF-2025-21
• OCC cites AML deficiencies at NY bank that partners with fintechs — Banking Dive
• CFSB Hit With BSA/AML Enforcement Action — Fintech Business Weekly
• The OCC’s Recent Consent Order Is a Warning for Community Banks in the Fintech Partnership Space — National Law Review
• OCC Orders Community Federal Savings Bank to Address BSA/AML Compliance Deficiencies — ACAMS