On November 4, the Federal Reserve and the New York DFS announced a combined $258 million penalty against a global bank for “violations in connection with transactions on behalf of countries and entities subject to U.S. sanctions.” According to the Fed’s cease and desist order, the bank failed to implement adequate risk management and compliance policies and procedures to “ensure that activities conducted at offices outside the United States complied with applicable OFAC Regulations and were timely reported in response to inquiries by the Federal Reserve Bank of New York.” Specifically, the Fed alleged that, from November 2001 to January 2006, foreign offices of the bank processed funds transfers with parties subject to OFAC Regulations through the bank’s New York-based subsidiary and other unaffiliated U.S. financial institutions without having the information necessary to determine that the transactions were consistent with U.S. law. The Fed’s order requires the bank to develop a compliance program that establishes (i) policies and procedures to ensure compliance with applicable OFAC regulations; (ii) an OFAC compliance reporting system; and (iii) requirements for employee training in OFAC-related issues. Under the terms of the DFS consent order, the bank agreed to hire an independent monitor to conduct a comprehensive review of its BSA/AML and OFAC sanctions compliance program, policies, and procedures.