Thomas Haider lost his job, paid a seven-figure penalty, and faced industry exclusion after FinCEN determined he'd failed to implement an effective AML program at MoneyGram. His case marked a turning point: regulators weren't just fining institutions anymore. They were holding individual compliance officers personally accountable for systemic failures.
What Happened
Between 2003 and 2008, Haider served as Chief Compliance Officer at MoneyGram, a money services business specializing in money transfers. During his tenure, thousands of customers reported they'd been defrauded through lottery and pre-payment scams, with fraudsters instructing victims to send money through MoneyGram agents in the US and Canada.
Despite receiving extensive victim complaints, Haider failed to implement an appropriate AML program, conduct effective audits, or terminate known high-risk agents. The failures cascaded: no investigation meant no Suspicious Activity Reports filed. FinCEN pursued personal liability specifically to send a message to the compliance industry.
Timeline
2003-2008: Haider oversees AML compliance and fraud department at MoneyGram while customer fraud complaints accumulate.
During this period: MoneyGram receives thousands of complaints from fraud victims. No SARs filed on the pattern. High-risk agents continue operating.
Post-2008: FinCEN investigation concludes. Haider faces enforcement action.
Enforcement outcome: FinCEN imposes $1 million civil penalty on Haider personally and seeks to bar him from the financial services industry.
This wasn't an isolated pattern. In 2015, FinCEN penalized First National Community Financial $1.5 million for failing to file SARs on accounts controlled by Michael Conahan, a board member and Pennsylvania judge later convicted in a judicial corruption scheme. The institution never filed a single SAR until after Conahan pled guilty, despite significant red flags. In 2018, Capital One paid $100 million after failing to achieve timely compliance with a 2015 order that had identified weaknesses in risk assessment, remote deposit capture, correspondent banking, and SAR filing.
Which Controls Failed
Haider's case exposes three critical control failures:
Transaction monitoring broke down completely. The AML program failed to detect patterns across thousands of fraud complaints. When customers report they're victims and name specific agents, your monitoring system should flag those agents for review. MoneyGram's didn't.
Agent oversight disappeared. High-risk agents remained active despite repeated fraud associations. The Bank Secrecy Act requires money services businesses to maintain effective risk-based procedures, including agent due diligence. Haider's program lacked the audit structure to identify and terminate problematic agents.
SAR filing never occurred. The most visible failure. Once you identify suspicious activity, the Bank Secrecy Act requires SAR filing within 30 calendar days of initial detection. No investigation means no detection, which means no filing. But ignorance isn't a defense when thousands of fraud complaints sit in your system.
What the Standard Requires
The Bank Secrecy Act and FinCEN regulations establish clear obligations for money services businesses:
31 CFR 1022.320 requires every money services business to develop, implement, and maintain an effective AML program. That program must include internal controls, independent testing, designated compliance officers, training, and risk-based procedures.
31 CFR 1022.320(a)(2) specifically mandates independent testing of your AML program. Haider's failure to conduct effective audits violated this requirement directly.
31 USC 5318(g) establishes SAR filing obligations. Financial institutions must file SARs for transactions involving or aggregating at least $5,000 in funds or other assets where the institution knows, suspects, or has reason to suspect the transaction involves illegal funds, is designed to evade BSA requirements, has no business or lawful purpose, or involves the institution in facilitating criminal activity.
The FFIEC BSA/AML Examination Manual clarifies that compliance officers hold personal responsibility for program effectiveness. You can't delegate your way out of accountability. When FinCEN says it pursued Haider to send a message, it's reinforcing that the CCO role carries personal liability for systemic failures.
Lessons and Action Items
Document your escalation attempts. If you identify control gaps and management won't fund remediation, create a written record. Email your concerns to the board. Request budget in writing. If you're overruled, you need evidence you tried. Haider's case doesn't detail whether he escalated, but the outcome suggests he either didn't or couldn't prove it.
Build independent testing into your calendar. 31 CFR 1022.320(a)(2) isn't optional. Schedule external audits annually. Rotate internal audit staff. Test transaction monitoring rules quarterly. If your testing reveals gaps, document the finding, assign remediation owners, and track closure. Your audit trail proves you're managing the program, not ignoring it.
Treat customer complaints as intelligence. When multiple customers report fraud through the same agents or corridors, that's your signal. Build a complaint aggregation process that feeds your transaction monitoring system. If you're seeing patterns in complaints but not in alerts, your monitoring rules are wrong.
Terminate high-risk relationships quickly. Your agent network is your exposure. When an agent appears in multiple fraud complaints, suspend them immediately and investigate. If the investigation confirms the risk, terminate and file a SAR. Keeping a high-risk agent active to preserve revenue will cost you more than the relationship is worth.
Know your personal liability exposure. Read your employment contract. Understand whether your institution carries directors and officers insurance that covers regulatory penalties. If you're a CCO at a money services business, payment processor, or correspondent bank, you're in a high-risk role. FinCEN has established it will pursue individuals. Structure your program defensibly.
The shift toward personal accountability isn't theoretical anymore. Haider paid $1 million personally and lost his career. Your institution's compliance failures can become your personal consequences. Build controls that work, document your efforts, and escalate when you're under-resourced. The standard is clear, and regulators are enforcing it at the individual level.
