Payoneer · Governance finding · severity 3 of 5
Per a 2 November 2023 NYDFS consent order, Payoneer's sanctions compliance program failed because of "weak algorithms that allowed close matches to SDN List entries to evade Payoneer's sanctions filter", no screening of Business Identifier Codes, and flagged or pending payments being "automatically released without review during backlog periods". NYDFS said Payoneer processed 2,220 transactions from 2013 through 2018 involving sanctioned countries, regions or listed persons, worth $793,950.70. Payoneer, which self-reported to OFAC in 2016 and settled with OFAC in July 2021 for $1,385,901.40, agreed to a $1.25 million NYDFS penalty; the regulator credited its cooperation and remediation. No public statement from Payoneer was found. The screening was automated and not described as AI.
Record last reviewed Oct 22, 2026 · Markdown
Date
Institution
Country
United States
AI system
Automated sanctions-screening filter (name-matching algorithms) and payment-release process; not described as AI
AI?
Automated system not described as AI
The system was automated, but neither the institution nor a regulator described it as AI; it is listed because it is routinely discussed as an AI failure.
Category
Status
Settled
Severity
3 of 5
Impact
$1.25 million NYDFS civil monetary penalty, after a $1,385,901.40 OFAC settlement in 2021 · ≈ $1.3 million · 2,220 prohibited transactions worth $793,950.70 processed from 2013 through 2018, less than 1% of Payoneer's transaction volume. No customer loss is described.
What happened?
Payoneer, a New York-licensed money transmitter that provides cross-border payout services to more than two million customers in over 190 countries and territories, is required to screen payments against U.S. sanctions, including OFAC's Specially Designated Nationals (SDN) List. In February 2016 a payments partner told Payoneer it had processed a payment to a bank in Crimea; Payoneer made a voluntary self-disclosure to OFAC, temporarily suspended bank transfers to Russia and updated its OFAC screening tool, according to the NYDFS order.[1]
A lookback completed in February 2018 found that Payoneer had processed 2,220 commercial transactions from 2013 through 2018 in apparent violation of several sanctions programmes, letting people in Iran, Sudan, Syria and Crimea, and persons on the SDN List, carry out $793,950.70 of transactions. They were less than 1% of Payoneer's volume.[1][3]
NYDFS found the compliance control breakdowns included "(a) weak algorithms that allowed close matches to SDN List entries to evade Payoneer's sanctions filter, (b) failure to screen for Business Identifier Codes even when SDN List entries contained them, and (c) allowing flagged and pending payments to be automatically released without review during backlog periods." IP and mailing addresses in sanctioned locations such as Crimea were also not properly flagged. NYDFS found unsafe and unsound conduct under New York Banking Law § 44 and a failure to maintain an effective OFAC compliance program.[1][2]
When did it happen?
- Feb 2016
A payments partner notifies Payoneer of a payment to a Crimean bank; Payoneer self-discloses to OFAC and updates its screening tool.[1]
- Feb 2018
Payoneer completes its lookback, identifying 2,220 apparent violations from 2013 through 2018.[1]
- Jul 23, 2021
OFAC announces a settlement in which Payoneer agrees to remit $1,385,901.40 for 2,220 apparent violations.[3]
- Nov 2, 2023
NYDFS issues a consent order with a $1,250,000 civil monetary penalty.[1][2]
What was the impact?
- Financial: $1.25 million NYDFS civil monetary penalty, after a $1,385,901.40 OFAC settlement in 2021 · ≈ $1.3 million[1][3]
- Other: 2,220 prohibited transactions worth $793,950.70 processed from 2013 through 2018, less than 1% of Payoneer's transaction volume. No customer loss is described.[1][3]
Severity 3 of 5: Rubric 3 (regulatory finding): an NYDFS consent order with a $1.25m penalty, following a 2021 OFAC settlement of about $1.39m, for 2,220 prohibited transactions worth about $794,000; no customer harm.
How did Payoneer respond?
No public statement found as of 2026-10-22 (checked the NYDFS and OFAC releases and press coverage of the order). The NYDFS order records that Payoneer fully cooperated, voluntarily remediated, migrated its sanctions screening tool to a customised platform, significantly increased sanctions-compliance resources and enhanced staff training.[1]
What was the outcome, and did regulators act?
Payoneer agreed to pay a $1,250,000 civil monetary penalty to NYDFS, without tax deduction or indemnification, and NYDFS said it would take no further action on the disclosed conduct provided Payoneer complies with the order. NYDFS gave substantial weight to its cooperation and remediation. OFAC had settled its own case over the same 2,220 apparent violations in July 2021.[1][3]
- NY DFS Consent Order against Payoneer Inc. (Nov 2, 2023, penalty $1.3 million)
Was Payoneer's sanctions filter an AI system?
No. NYDFS describes an automated sanctions-screening filter whose name-matching algorithms were too weak to catch close variants of names on the SDN List, plus a process that automatically released flagged or pending payments without review during backlogs. NYDFS did not describe any of it as AI.
What payments got through Payoneer's screening?
Per NYDFS, 2,220 commercial transactions from 2013 through 2018, worth $793,950.70, involving sanctioned locations such as Iran, Sudan, Syria and Crimea and persons on the SDN List. They were less than 1% of Payoneer's transaction volume.
Did regulators penalise Payoneer?
Yes, twice for the same transactions. OFAC settled with Payoneer in July 2021 for $1,385,901.40 after the company self-disclosed, and NYDFS imposed a $1.25 million civil monetary penalty in a consent order dated 2 November 2023, crediting its cooperation and remediation.
What did Payoneer change?
According to the NYDFS order, Payoneer migrated its sanctions screening tool to a customised platform that allows improved screening, significantly increased the resources dedicated to sanctions compliance, and enhanced training for staff handling sanctions tasks. No separate public statement from Payoneer on the order was found.
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning