NYDFS Fines ICBC New York Branch $30 Million Over Confidential Supervisory Information Breach and AML Failures

The New York State Department of Financial Services announced on 19 January 2024 a consent order, executed on 17 January, with Industrial and Commercial Bank of China Ltd. and its New York Branch, imposing a civil monetary penalty of $30 million. The violations centred on the unauthorised disclosure of confidential supervisory information to a third party — a breach that occurred after Federal Reserve staff had confirmed to the bank that the proposed communication contained confidential supervisory information and would require the Board's prior approval — as well as deficiencies in the branch's Bank Secrecy Act, anti-money-laundering and OFAC compliance programmes.

SUPERVISORY INFORMATION DISCLOSURE

Federal Reserve staff had confirmed to ICBC that the proposed disclosure to an overseas regulator would require a waiver from the Board, and the bank proceeded regardless. Confidential supervisory information — which encompasses examination reports, supervisory correspondence and related materials — is treated under US law as privileged.

The Federal Reserve Board separately issued a consent cease-and-desist order arising from the same disclosure, imposing an additional civil penalty of $2.4 million. That action, effective 16 January and announced on 19 January 2024, means the combined regulatory penalty across the two orders totals approximately $32.4 million.

BSA/AML AND OFAC DEFICIENCIES

Alongside the CSI violation, the NYDFS found that ICBC's New York Branch had failed to maintain an effective BSA/AML compliance programme, had allowed deficiencies in its OFAC sanctions screening programme to persist over several examination cycles, and had failed to report the backdating of compliance documents in a timely manner.

Under the terms of the consent order, ICBC and its New York Branch are required to undertake remediation measures to address each area of non-compliance identified by the NYDFS. The bank did not contest the findings as part of the consent order process and is required to report regularly to the regulator on the progress of its remediation efforts.