The New York State Department of Financial Services imposed a $40 million civil monetary penalty on Block, Inc., parent company of Cash App, on 10 April 2025, citing serious deficiencies in the company's anti-money laundering and Bank Secrecy Act compliance programme during the period from 2018 to 2021. The action by NYDFS, which regulates Block under New York's money transmission laws, covers failures across multiple components of the company's financial crime controls at a time when Cash App was growing rapidly as a consumer payments platform.
The NYDFS findings identified deficient know-your-customer procedures and inadequate transaction monitoring protocols as central failures. The regulator also found that Block had accumulated a backlog of Suspicious Activity Reports during the covered period, meaning that transactions potentially indicative of money laundering, fraud, or sanctions violations were not reported to federal authorities within the required timeframes. Insufficient screenings against Office of Foreign Assets Control watchlists and ineffective customer due diligence policies compounded the compliance shortfalls.
STATE PENALTIES ADD TO EARLIER ENFORCEMENT ACTION
The NYDFS action follows a separate enforcement settlement announced in January 2025, in which Block agreed to pay $80 million to a coalition of eight state money transmission regulators for related BSA and AML programme failures. The two actions, combined, bring Block's total state-level penalty exposure to $120 million across a period of less than four months. The sequence underscores the extent to which multiple regulators were examining the same underlying compliance deficiencies from different supervisory angles.
Block has not contested the factual basis of the regulatory findings in its public statements, acknowledging that its compliance infrastructure did not keep pace with the growth of Cash App during the period under review. The platform scaled dramatically between 2018 and 2021, adding tens of millions of users in the United States, and Block's internal controls — including the technology systems and staffing dedicated to financial crime compliance — proved insufficient for the volume and risk profile of transactions being processed.
Consumer payment platforms have faced heightened regulatory scrutiny in recent years as authorities concluded that many fintech companies treated compliance as a secondary concern during phases of rapid growth. The BSA requires money service businesses, including those operating money transmission licences like Cash App, to maintain written AML programmes, conduct customer due diligence, file SARs, and screen customers and transactions against federal watchlists. NYDFS has made clear it expects New York-licensed entities to meet those standards regardless of their corporate structure or technology model.
REMEDIATION AND COMPLIANCE PROGRAMME EXPECTATIONS
As part of enforcement resolutions of this type, regulators typically require the penalised institution to implement specific remediation measures, including enhancements to AML technology systems, increases in compliance staffing, and improved oversight processes. Block has invested in expanding its compliance team and technology platform in recent years, though NYDFS did not detail the specific remediation commitments required as part of the April 2025 penalty in the initial announcement.
The $40 million NYDFS penalty is a material financial consequence, but the reputational and operational implications may carry equal weight. Cash App competes in a market where consumer trust and regulatory standing matter to partnership opportunities with banks, card networks, and corporate clients. Repeated enforcement actions create a record that counterparties consider when assessing the risks of maintaining or expanding commercial relationships with Block.
NYDFS has emerged as one of the most active state-level financial regulators in the United States, particularly in the fintech and cryptocurrency sectors. Its enforcement actions frequently serve as a signal to other state regulators about the standards it expects from entities operating at the intersection of technology and financial services. The Block penalty reinforces the department's message that compliance obligations apply with full force to platforms that process payments at scale, irrespective of their origins as technology rather than banking companies.