On October 19, 2023, at the conclusion of a coordinated investigation into Metropolitan Commercial Bank of New York, New York (“MCB”), the US Federal Reserve and the New York State Department of Financial Services (“NYDFS”) imposed monetary penalties of $14.5 million and $15 million, respectively, upon the bank for anti-money laundering (“AML”) deficiencies. The investigation, which was conducted jointly by the Board of Governors of the Federal Reserve System, the Federal Reserve Bank of New York and the NYDFS, revealed that MCB’s deficient third-party risk management practices enabled prepaid card accounts to be opened without sufficiently verifying each applicant’s true identify – a practice that violated the Customer Identification Program (“CIP”) rule under the Bank Secrecy Act. According to investigators, deficiencies in the AML compliance program at MovoCash, Inc., a third party that formerly managed MCB’s prepaid cards program, and MCB’s deficient oversight of that vendor ultimately enabled fraudulent actors to exploit the prepaid card program. As a result, illicit actors were able to illegally obtain $300 million in pandemic unemployment benefits in New York, $200 million of which has not been recovered.
According to details provided in the NYDFS’s consent order, illicit actors began opening MovoCash card accounts with fraudulently-obtained personal identifying information as early as January 2020. Following the passage of the CARES Act in March of 2020, which expanded unemployment insurance for millions of Americans, the bank experienced a surge of fraudulent card account openings – accounts that were subsequently used to collect New York state unemployment insurance benefits. Despite receiving reports of the widespread fraud in the Movo program, MovoCash continued to issue new accounts while MCB bank executives only contemplated the implementation of more stringent CIP controls. In July of 2020, federal law enforcement informed the bank that at least 60,000 – 80,000 fraudulent accounts were being opened each week and not a single unemployment claim paid by the State of New York to MovoCash accounts was legitimate. Within days of receiving this information, MCB halted the creation of new Movo card accounts, and, in August 2020, MCB terminated its relationship with MovoCash. While MCB was ultimately able to block or close a third of fraudulent accounts, investigators determined that MCB’s unsafe and unsound banking practices made initial efforts to manage the fraudulent card crisis largely ineffective.
In addition to the fine, the Federal Reserve issued an enforcement action against the bank for its deficient third-party risk management practices and CIP rule violations. Both the NYDFS’s consent order and Federal Reserve’s cease-and-desist order also require the MCB to improve its customer identification program, customer due diligence, and third-party risk management programs in a manner that the Federal Reserve and NYDFS find acceptable. The NYDFS additionally requires the MCB to provide the Department with written reports on its progress every six months for a period of two years.
Federal Reserve Press Release | Federal Reserve Order | NYDFS Press Release | NYDFS Order