USAA

In March 2022 USAA Federal Savings Bank paid $140 million - $80M to FinCEN and $60M to the OCC - for WILLFUL failure to maintain an adequate anti-money-laundering program and to file suspicious activity reports. The bank had known about the deficiencies since at least 2017, committed to fixing them by March 2020, then missed that deadline and the extension that followed. FinCEN found that before 2017 the bank's compliance program was 'even more rudimentary due to a lack of financial investment.' Then on December 18, 2024 the OCC issued a new comprehensive cease-and-desist order that replaced BOTH the 2019 and 2022 orders - because USAA had failed to comply with elements of each. Regulators found the failures ran across all three lines of defense at once: the business units, compliance/operations risk, and independent testing - a finding made in FinCEN's 2022 consent order. For an institution whose entire proposition is serving military families, an earlier OCC action (Oct 2020, $85 million civil money penalty) found that the bank's compliance-risk-management failures had led to violations of laws including the Military Lending Act and the Servicemembers Civil Relief Act.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. www.fincen.gov/news/news-releases/fincen-announces-140-million-civil-money-penalty-against-usaa-federal-savings — Verified - primary source confirmed.

Arbitration

Not independently confirmed this pass — standard binding arbitration + class action waiver expected.

Contacts

Privacy contact. Not recorded.

Legal notice. PUBLIC COMPANY (Non-public). Service route: c/o General Counsel / Corporate Secretary, San Antonio, Texas — the corporate address on the SEC Form 10-K cover page is the official address of record. Confirm the exact street address on the current 10-K at sec.gov/edgar, and check the state-of-incorporation registered agent (usually Delaware; most large filers use The Corporation Trust Company or Corporation Service Company) via the Secretary of State business-entity search. A registered agent MUST accept service, which is why it is the reliable channel when a company publishes no privacy address.

Mailing address. Not recorded.