BSA travel rule violation: what the enforcement cases show

A travel rule violation is a wire that leaves a bank without the information the BSA travel rule, 31 CFR 1010.410(f), requires: for a US bank sending $3,000 or more, the originator's name, address and account, which an intermediary must then pass on (eCFR). The public enforcement record is short and pointed: the cases that drew the largest penalties involved banks that removed or misstated who was paying, not banks that received an imperfect field. Lloyds forfeited $350 million in 2009 for what it called "repairing" payment messages; in October 2026 the OCC fined Bank of America $750 million for a set of BSA failures that included the travel rule, after the bank sent about 33,300 outgoing wires, some $1 billion, with inaccurate originator information. Botminds' Funds Transfer Recordkeeping & Travel Rule is built around the lesson: it checks the bank's own outbound wires before release, judges inbound fields for meaning, and keeps a cited record of every request and decision about a correspondent.

What does the BSA travel rule regulation require, and who enforces it?

It requires the sending bank to put named information in the payment order and an intermediary to pass it on, for every transmittal of $3,000 or more; the guide on the 31 CFR 1010.410 travel rule in plain words reads it line by line. FinCEN administers the Bank Secrecy Act under authority delegated by the Secretary of the Treasury (FinCEN, 89 FR 65971), and the federal banking agencies examine banks for compliance and can take their own enforcement actions, as the OCC did in 2026 under 12 U.S.C. 1818(i).

In practice the travel rule rarely appears alone. The large wire-data cases of 2009 were brought under sanctions law, because stripping was done to get payments past sanctions filters; the 2026 case bundles the travel rule with program, suspicious activity reporting and correspondent due diligence violations. What the cases share is the conduct regulators react to: party information in a payment message that is missing, altered or wrong because of something the bank did.

What is wire stripping?

Wire stripping is the deliberate removal or alteration of party information in a payment message so that other banks in the chain cannot see who is involved. The Justice Department's account of Lloyds is the standard one: the bank took customer names, bank names and addresses out of payment messages on purpose, so that the wires would pass US banks' filters unseen, and called the practice "repairing" (Justice Department, January 9, 2009; what a wire repair may change in a name quotes the release).

The word "repairing" is the uncomfortable part for operations teams, because repair is a normal and necessary activity: fixing a format error, completing a field from evidence. The line the cases draw is direction and intent. Adding or correcting data from verified evidence is repair; omitting, deleting or altering it so another bank cannot see it is stripping. The industry's 2007 Message Standards, which the Basel Committee and the US agencies endorsed, say it in one sentence: "Financial institutions should not omit, delete or alter information in payment messages or orders for the purpose of avoiding detection of that information by any other financial institution in the payment process" (interagency guidance, 2009).

What did Lloyds do?

According to the court documents described by the Justice Department, from as early as 1995 until January 2007, Lloyds in the United Kingdom and Dubai "falsified outgoing U.S. wire transfers that involved countries or persons on U.S. sanctions lists", removing identifying information so the payments would clear through US correspondent banks. It agreed to forfeit $350 million, split equally between the United States and New York County, under deferred prosecution agreements. The Acting Assistant Attorney General said that "For more than 12 years, Lloyds facilitated the anonymous movement of hundreds of millions of dollars from U.S.-sanctioned nations through our financial system."

OFAC's settlement that December added the operational detail. The policy began in the mid-1990s "at the behest of and with the knowledge of its Iranian bank customers", and OFAC's analysis found that from June 2003 through August 2006 Lloyds "routed at least 4,281 electronic funds transfers totaling nearly $37 million through third-party banks located in the United States in apparent violation" of US sanctions; the $217 million settlement was deemed satisfied by the earlier $350 million payment (OFAC, December 22, 2009). Credit Suisse's case the same month showed the other technique: OFAC said its London affiliate "even utilized code names to disguise the identities of sanctioned entities" (OFAC, December 16, 2009), the practice the travel rule has prohibited since the 1990s.

Has a bank been fined for violating the travel rule?

Yes. In October 2026 the OCC issued a consent order assessing a $750 million civil money penalty against Bank of America, N.A., for BSA/AML deficiencies that it found resulted in violations of law including "31 C.F.R. § 1010.410(f) ('Travel Rule') (required information in transmittal order violation)" (OCC Consent Order AA-ENF-2026-41). The travel rule finding is specific and outbound:

For many years, the Bank sent wires with inaccurate transmittor name information in outgoing wire transfers, potentially harming the ability of law enforcement to know who sent the wires.

OCC, Consent Order AA-ENF-2026-41, Article II

The order adds that the bank self-identified the issue in April 2024 but "does not know how long it had been sending inaccurate wire information before it stopped the practice in 2024", and that "Between November 2021 and October 2024, the Bank processed approximately 33,300 outgoing wires, totaling approximately $1 billion, with inaccurate transmittor information." The bank neither admitted nor denied the findings, and the penalty covers all the violations the order lists, so no part of the $750 million can be attributed to the travel rule alone.

Three lessons carry beyond the case. The failure was on the bank's own outbound wires, where it was the originator's bank and the data was its own. It persisted because nothing checked what left the bank against what the bank knew about its customer. And the bank could not say how long it had gone on, which is a retrieval problem as much as a data problem. The guide on who owes which field explains why outbound gaps are always the sending bank's own.

What do examiners test for the travel rule?

The FFIEC examination procedures for funds transfers ask examiners to verify that the bank keeps the required records and sends the information the travel rule requires (31 CFR 1010.410, read in plain words), to test a sample of transfers from each of the bank's three roles, and to form a conclusion about whether the bank's policies and processes meet the requirements (FFIEC examination procedures). For cross-border work, the 2009 interagency guidance adds that examiners should be "satisfied that originators' banks include complete customer information in cross-border funds transfers."

The Bank of America order shows what else examiners look at around the rule. It records that "the Bank's BSA Officer and the Bank's independent testing, managed by Corporate Audit, failed to identify these significant deficiencies." A travel rule control is examined together with the people and the testing that are supposed to catch its failures.

What if a correspondent keeps sending incomplete wires?

Ask, count, and decide at a defined point what the relationship can bear, writing down why. The Basel Committee's 2009 paper, which the US agencies circulated with their own guidance, lists the responses: where fields are manifestly meaningless or incomplete, "responses could include, for example, (i) contacting the originator's bank or precedent cover intermediary bank in order to clarify or complete the information received in the required fields; (ii) considering (in the case of repeated incidents involving the same correspondent or in the case where a correspondent declines to provide additional information) whether or not the relationship with the correspondent or the precedent cover intermediary bank should be restricted or terminated" (BCBS, May 2009, paragraph 30). It adds that "banks should report such situations to their supervisor", that a suspicious activity report should be filed where local rules require it, and that "The reasons for decisions taken should be documented."

The paper does not say how many incidents make a pattern, and no US rule does. That is a policy each bank has to set and be able to defend. The sample bank in the solution writes its rule as a setting the BSA Officer approves: a correspondent goes over the repeat-offender line at a 2% gap rate with at least ten gaps in a quarter, at which point the Trend agent drafts a cited input to its due diligence review and proposes an earlier review date. People decide whether to restrict or end anything.

Should repeat offenders be reported?

To the supervisor, in the Basel Committee's view, and to FinCEN through a suspicious activity report when the facts meet the reporting standard; to the correspondent, never in a way that reveals a report. US rules make a suspicious activity report confidential, together with anything that would show one exists (31 CFR 1020.320(e)). A request for a missing originator name must therefore ask for the data and nothing else.

The solution separates the two tracks on the screen. When the analyst holds a wire and requests the missing data, she can also refer the pattern to transaction monitoring for the BSA Officer's team to decide; the referral stays inside the bank, the request goes out on the approved template with no mention of it, and the relationship manager who is asked to raise data quality with the correspondent sees the data record, never the referral.

A request out, a referral in: the two tracks kept apart when the analyst signs

Every request, hold, approval and export on one trail, kept five years

None of this replaces judgment about a correspondent; it makes the judgment visible and dated. For the cover payment chains where correspondents' data quality matters most, see cover payments and where the originator data goes, or start from Funds Transfer Recordkeeping & Travel Rule.

Questions people ask

Is wire stripping illegal?

Stripping to evade sanctions is: Lloyds was charged with violating the International Emergency Economic Powers Act. Removing or misstating required originator information on a US bank's outgoing wire also breaches the travel rule, as the OCC's 2026 order shows, whatever the motive.

Can a bank repair the party data in a payment?

It can add or correct data from verified evidence, such as its own customer file on an outbound wire, with a second person approving the change. It must not omit, delete or alter information so that another bank cannot see it; that is the line the 2007 Message Standards draw and the 2009 cases enforced.

Does cooperating with regulators reduce the penalty?

The agencies say so in their own releases. OFAC said Credit Suisse's penalty "would have assuredly been higher" had it not stopped the business and cooperated, and the Justice Department said it would recommend dismissing the Lloyds charge after two years in light of the bank's remedial actions and its willingness to acknowledge responsibility, provided it kept cooperating.

What does "neither admits nor denies" mean in the 2026 order?

The OCC states its findings and the bank consents to the order without admitting or contesting them. The findings are the OCC's account of what happened, which is why they are cited here as findings rather than as established facts about the bank.

Should a bank tell a correspondent that it reported one of its wires?

No. A SAR and any information that would reveal one are confidential under 31 CFR 1020.320(e). A request to a correspondent should ask only for the missing data, on a template that contains nothing about a referral or a report.

How many incomplete wires from one correspondent are too many?

No rule sets a number; the Basel Committee speaks of "repeated incidents" without defining them. A bank should set its own threshold as written policy, apply it to every correspondent the same way, and record the reasons for each decision it takes when a correspondent crosses it.