Consent Order Imposing Civil Money Penalty on Gyanendra Kumar Asre

UNITED STATES OF AMERICA FINANCIAL CRIMES ENFORCEMENT NETWORK DEPARTMENT OF THE TREASURY IN THE MATTER OF: ) ) Number 2024-01 Gyanendra Kumar Asre ) ) CONSENT ORDER IMPOSING CIVIL MONEY PENALTY The Financial Crimes Enforcement Network (FinCEN) conducted a civil enforcement investigation and determined that grounds exist to impose a Civil Money Penalty on Gyanendra Kumar Asre (Asre) for violations of the Bank Secrecy Act (BSA) and its implementing regulations. 1 Asre admits only to the facts admitted coincident to his guilty plea with the United States Department of Justice (DOJ) and neither admits nor denies the remainder of the facts set forth herein. Asre consents to the issuance of this Consent Order, agrees to pay the civil money penalty imposed in this Consent Order, and agrees to comply with the Undertaking and the other provisions of this Consent Order. I. JURISDICTION Overall authority for enforcement and compliance with the BSA lies with the Director of FinCEN.2 FinCEN has the authority to investigate and impose civil money penalties on financial institutions that willfully violate the BSA and individuals who willfully participate in such violations. 3

1 The BSA is codified at 12 U.S.C. §§ 1829b, 1951-1960, 31 U.S.C. §§ 5311-5314, 5316-5336, and includes other authorities reflected in notes thereto. Regulations implementing the BSA appear at 31 C.F.R. Chapter X. 2 31 C.F.R. § 1010.810(a). 3 31 U.S.C. § 5321(a); 31 C.F.R. §§ 1010.810(d); Treasury Order 180-01 (July 1, 2014, reaff’d January 14, 2020).

2 At all times relevant to this Consent Order, Asre was a partner, director, officer, or employee of the New York State Employees’ Federal Credit Union (NYSEFCU or Credit Union), which was a “credit union” and a “domestic financial institution” as defined by the BSA and its implementing regulations. 4 Asre was also the Chairman and Chief Executive Officer (CEO) of DDH Group LLC (DDH), which was a money services business (MSB) as defined by the BSA and its implementing regulations.5 II. STATEMENT OF FACTS The conduct described below took place from September 1, 2015, through November 14, 2016 (the Relevant Time Period), unless otherwise indicated. A. Bank Secrecy Act The BSA and its implementing regulations (collectively referred to as the BSA) require financial institutions to implement and maintain effective anti-money laundering (AML) programs. 6 Additionally, the BSA imposes certain duties on credit unions such as NYSEFCU, including the duty to identify and report suspicious transactions relevant to a possible violation of law or regulation in suspicious activity reports (SARs) filed with FinCEN. 7 The BSA also imposes requirements on MSBs, such as DDH, including the duty to register with FinCEN.8 The reporting and transparency that financial institutions provide through these reports is essential financial intelligence that FinCEN, law enforcement, and others use to safeguard the U.S. financial system and combat serious threats,

4 31 U.S.C. § 5312(a)(2)(E); 31 C.F.R. § 1010.100(d)(6); 31 C.F.R. § 1010.100(t)(1). 5 31 U.S.C. § 5312(a)(2)(R); 31 C.F.R. § 1010.100(ff). 6 31 U.S.C. § 5318(h); 31 C.F.R. § 1020.210; 31 C.F.R. § 1022.210. 7 31 U.S.C. § 5318(g); 31 C.F.R. § 1020.320. 8 31 U.S.C. § 5330(a); 31 C.F.R. § 1022.380(a); 31 C.F.R. § 1022.320.

3 including money laundering, terrorist financing, organized crime, corruption, drug trafficking, and massive fraud schemes targeting the U.S. government, businesses, and individuals.9 B. FinCEN FinCEN is a bureau within the U.S. Department of the Treasury and is the federal authority that enforces the BSA by investigating and imposing civil money penalties on financial institutions and individuals for willful violations of the BSA. As delegated by the Secretary of the Treasury, FinCEN has “authority for the imposition of civil penalties” and “[o]verall authority for enforcement and compliance, including coordination and direction of procedures and activities of all other agencies exercising delegated authority under this chapter,” including the National Credit Union Administration (NCUA). 10 C. Asre Asre is a citizen of the United States. Before joining NYSEFCU, Asre had approximately 25 years of experience in the financial industry, particularly in wholesale currency trading, including nine years as the Senior Vice President and Regional Head of Wholesale Currency Trading at a large multinational bank. Asre represented to NYSEFCU as part of his pitch to join the Credit Union’s Supervisory Board that he possessed “[e]xtensive hands on expertise in know your client due diligence, documentation, transaction monitoring and AML risk management, including proficiency in Anti Money Laundering and Bank Secrecy Act.” Asre claimed to have completed a “Certified Compliance and Regulatory Professional Program” and obtained numerous anti-money laundering or financial crimes certifications from private organizations in December 2014 and January 2015.

9 FinCEN, FIN-2014-A007, FinCEN Advisory to U.S. Financial Institutions on Promoting a Culture of Compliance (Aug. 11, 2014). 10 31 C.F.R. § 1010.810(a), (d).

4 Asre joined NYSEFCU in early 2014 as a credit union member. In November 2014, Asre volunteered to serve as a member of the Credit Union’s Supervisory Committee, established by the Board of Directors. A few months later, NYSEFCU appointed him to the role of BSA Compliance Officer, a volunteer position he held from March 25, 2015, until April 2, 2016. D. NCUA The NCUA is an independent agency that has both delegated authority from FinCEN for BSA examinations and separate authority under Title 12 of the United States Code for compliance and enforcement.11 Under this authority, the NCUA regularly conducts examinations and issues reports assessing a credit union’s compliance with the BSA and other laws and regulations. E. NYSEFCU NYSEFCU (or the Credit Union) was a single branch, not-for-profit, federal credit union located in New York, New York and managed by a volunteer board. Since its original charter in 1935 until April 2014—when Asre joined the Credit Union and caused it to apply for its first ever field of membership expansion—NYSEFCU operated as a “cashless” low-income credit union under single bond common field of membership serving about 1,100 state employees who worked in New York City.12 Prior to Asre’s tenure, in its almost 80 years of operation, NYSEFCU had never serviced any business accounts. In early 2016, the NCUA identified significant deficiencies in NYSEFCU’s compliance with the BSA and its implementing regulations, particularly regarding the entities that Asre brought in as customers. As a result, the NCUA demanded that the Credit Union cease providing services to those

11 12 U.S.C. §§ 1818; 1820(b); 31 C.F.R. § 1010.810(b)(5). 12 The field of membership refers to the group of people eligible to join the credit union as members. The field of membership must be specified in the charter of the credit union and can later be altered. A single common bond field of membership is membership conditional on each eligible member having a common link, such as being employees of the same company. A Multiple Common Bond field of membership allows the credit union to accept members who belong to more than one category.

5 entities by June 17, 2016, and required the Credit Union to hire an independent qualified auditor to determine the adequacy of the Credit Union’s AML program. The auditor found systemic inadequacies in the Credit Union’s compliance programs. As a result, in October 2017, the NCUA liquidated NYSEFCU. Asre’s actions and the resulting BSA violations were a major contributing factor to the dissolution of NYSEFCU. F. NYSEFCU-CUSO The NYSEFCU-CUSO LLC (NYSEFCU-CUSO) was a limited liability company and MSB that self-identified as a special purpose Credit Union Service Organization (CUSO) 13 established in July 2014. NYSEFCU-CUSO purported to provide coin and currency services, commemorative coins, and wire transfers, which specifically, according to a Letter of Intent proposing the creation of the NYSEFCU-CUSO, included “domestic wire transfers and currency and cash orders” for members of NYSEFCU. Asre and another individual controlled the day-to-day business operation of NYSEFCU-CUSO, including the execution of wire transfers. G. IBI IBI Armored Car, Inc. (IBI), was an armored car company that engaged in the international shipment of bulk cash. As reflected in an internal NYSEFCU document, IBI represented to NYSEFCU that it purported to ship “an estimated 70% of all currency leaving the U.S.” H. DDH DDH was a Delaware-based limited liability company that provided check clearing services. During the Relevant Time Period, DDH purported to operate as a CUSO and provided these services

13 Some credit unions operate in conjunction with one or more CUSOs. A CUSO is a separate corporate entity, funded by loans or investments from one or more credit unions that can provide limited banking services to credit unions and their members under appropriate circumstances. The benefits to credit unions in operating with a CUSO include the ability to have a CUSO that might serve a specific purpose—real estate settlement services, for example—that a single credit union may not be equipped to handle. The CUSO may serve multiple credit unions, thus enabling each credit union to streamline its operations. A CUSO may qualify as an MSB under the BSA.

6 exclusively to NYSEFCU. Asre incorporated DDH in February 2014, and he served as Chairman and CEO during the Relevant Time Period. I. USD Repatriation Scheme Asre had decades of experience at complex financial institutions and was a manager of an armored car company when he approached the NYSEFCU in early 2014. During the Relevant Time Period, Asre violated the BSA by, inter alia, transforming NYSEFCU from a one branch, not-for￾profit credit union with a single common bond field of membership serving New York State employees to a conduit for repatriating bulk cash and checks from Mexico, through MSBs that Asre controlled, without any requisite AML oversight of the underlying transactions. In 2014, Asre worked in management positions at several companies that handled the international purchase, sale, and shipment of bulk cash or checks. Asre then used NYSEFCU to expand IBI’s business by facilitating the international transfer of U.S. currency and checks. Specifically, Asre offered to assist in managing NYSEFCU in exchange for NYSEFCU expanding its field of membership to provide banking services for the 150 employees of IBI, and to open a Master Account at the Federal Reserve Bank of New York (FRBNY) that could be used to move IBI’s funds internationally.14 Asre promised the Credit Union increased revenue from expanding these international currency transaction services. In March 2015, after Asre took over as BSA Compliance Officer at NYSEFCU, the Credit Union sought and received approval from NCUA to convert its charter to a multiple common bond charter. NYSEFCU sought this change to enable NYSEFCU to include “the employees of IBI” in its

14 “Master Accounts” are accounts that banks maintain at a Federal Reserve Bank and that allow the account holder to have direct access to the Federal Reserve’s payment systems. Banks that do not have master accounts must access the Federal Reserve’s payment systems indirectly through another financial institution with a Master Account. In other words, a Master Account enables a bank to directly engage in certain banking activity, such as wire transfers, without going through another bank first.

7 field of membership. The same month, Asre induced NYSEFCU to open a Master Account with FRBNY. Thereafter, Asre established the NYSEFCU-CUSO and arranged for it to accept bulk cash deposits from Mexican Bank A, a large bank located in Mexico. At Asre’s direction, IBI accepted bulk cash from Mexican Bank A in Mexico and then deposited this cash by armored car shipment to IBI’s account at NYSEFCU. After receiving the funds in IBI’s account, NYSEFCU internally transferred those funds to the NYSEFCU-CUSO account at NYSEFCU. Finally, NYSEFCU transferred these funds by an international wire transfer, through the NYSEFCU’s Master Account with FRBNY, back to Mexican Bank A. This process functioned as a way for Mexican Bank A to convert bulk cash to electronic deposits. Thereafter, over a period of more than a year, the Credit Union accepted IBI’s bulk cash deposits, processing a total of over $150 million in this manner. For each bulk cash-related transaction, Asre affirmatively took steps to direct the distribution of the funds, sending email instructions to the Credit Union regarding where and how the deposit should be distributed. In early 2015, Asre convinced NYSEFCU’s board of directors to allow a second company, DDH, to provide “check clearing” services by and through the Credit Union. Thereafter, DDH used the Credit Union to clear checks for Mexican Bank B, another large bank located in Mexico. The Credit Union deposited Mexican Bank B’s customers’ checks into DDH’s Credit Union account. The Credit Union then wired these funds back to Mexican Bank B through its Master Account in an arrangement like the purchase of bulk cash through the NYSEFCU-CUSO. Over the course of nine months, NYSEFCU processed a total of over $110 million in this manner. Ultimately, both these arrangements allowed foreign banks (Mexican Bank A and Mexican Bank B) to exchange bulk cash and checks from foreign nationals into electronic deposits that were available to IBI and DDH, the latter being a company under Asre’s control. As a result of Asre’s

8 scheme, NYSEFCU’s business model changed drastically to incorporate bulk currency transactions from Mexico, which ultimately became 99% of NYSEFCU’s revenue before currency repatriation services were ceased. Thereafter, Asre controlled almost the entirety of the Credit Union’s revenue source until the Credit Union ceased operations in October 2017. J. Asre willfully failed to register DDH as an MSB with FinCEN The BSA requires any “person who owns or controls a money transmitting business [to] register the business” with FinCEN “not later than the end of the 180-day period beginning on . . . the date on which the business is established.”15 The term “money services business” is defined to include several types of businesses, including money transmitters.16 The regulations define the term “money transmitter” as a person that either “provides money transmission services” or who is otherwise “engaged in the transfer of funds.”17 As a company that handled check clearing as an intermediary financial institution between two banks, DDH was a “money transmitter” operating in the United States during the Relevant Time Period, within the meaning of the BSA. Asre, as the Chairman and CEO of DDH, “controlled” the MSB within the meaning of the BSA. Further, Asre knew that companies involved in the transfer of funds were MSBs that were required to register with FinCEN, as is evidenced by his BSA training that he touted in working with the Credit Union. In addition, Asre was familiar with the registration requirements: in February 2015, he registered the NYSEFCU-CUSO with FinCEN. DDH first contracted with NYSEFCU on April 24, 2015, and failed to register that business within 180 days (October 21, 2015). Asre continued to operate DDH as an MSB through NYSEFCU (and then later at a bank in Puerto Rico) until at least

15 31 C.F.R. § 1022.380(a), (b). 16 31 C.F.R. § 1010.100(ff). 17 31 C.F.R. § 1010.100(ff)(5).

9 November 14, 2016. Therefore, Asre failed to register DDH from at least October 21, 2015, to November 14, 2016. K. Asre willfully failed to implement and maintain an effective AML program for NYSEFCU In March 2015, NYSEFCU appointed Asre to the position of BSA Compliance Officer—a position he held from March 2015 until April 2016. As an experienced industry professional with relevant education and training in the BSA, he was aware of NYSEFCU’s obligations under the BSA and of the high-risk nature of these funds. Asre also was aware that he was moving these funds through an unsophisticated credit union that was not accustomed to handling such a large volume of transactions. As a member of the Credit Union’s Supervisory Committee, and its BSA Compliance Officer, Asre was responsible for ensuring that NYSEFCU’s AML program met the minimum requirements of the BSA. During Asre’s time as the BSA Compliance Officer for NYSEFCU, credit unions regulated by a Federal functional regulator were required to “implement and maintain an [AML] program” that included, among other requirements, the following components or “pillars”: (1) A system of internal controls to assure ongoing compliance with the BSA; (2) Independent testing for compliance to be conducted by bank personnel or by an outside party; (3) Designation of an individual or individuals responsible for coordinating and monitoring day-to-day compliance; (4) Training for appropriate personnel; and (5) Appropriate risk-based procedures for conducting ongoing customer due diligence, including but not limited to understanding the nature and purpose of customer relationships, and identifying and reporting suspicious transactions.18

18 31 C.F.R. § 1020.210 (2015-16 eds.); 12 C.F.R. § 748.2.

10 Additionally, the BSA required credit unions to “implement a written customer identification program . . . appropriate for the [credit union’s] size and type of business that, at a minimum, includes” among other things, certain identity verification and recordkeeping procedures.19 In addition, the BSA requires credit unions to “include procedures for determining whether the customer appears on any list of known or suspected terrorists or terrorist organizations issued by any Federal government agency and designated as such by the Treasury.” 20 a. Internal Controls Under the BSA, the Credit Union was required to “implement a system of internal controls adequate to assure ongoing compliance with the BSA.” 21 Asre willfully failed to implement adequate internal controls. As part of his job duties as NYSEFCU’s BSA Compliance Officer, Asre was responsible for assessing the AML risks posed by the Credit Union’s customers and services. The Credit Union used a risk assessment to assess its risk profile for purposes of implementing its AML program and controls. Asre drafted a risk assessment for NYSEFCU; however, the risk assessment improperly concluded that the Credit Union operated at a low level of risk. Asre came to this conclusion without conducting an adequate risk assessment or providing any supporting documentation or justification. Indeed, the risk assessment failed to risk rate any of the Credit Union’s identified service offerings, failed to provide any explanation of how risks were calculated, failed to provide any details of how the identified risks would be mitigated, and failed to establish a protocol for identifying and reporting unusual, unexplained, and/or suspicious activity. When the NCUA and independent auditors reviewed the NYSEFCU’s risk assessment in June 2016, they found it was not adequate to address the risks associated with the NYSEFCU’s new customer base. Other

19 31 C.F.R. § 1020.220(a)(1); 31 C.F.R. § 1010.100(d)(6) (including “credit union organized under the law of any State or of the United States” under the definition of “Bank”). 20 31 C.F.R. § 1020.220(a)(4). 21 31 C.F.R. § 1020.210(a)(2)(i).

11 internal controls were also lacking; for example, NYSEFCU never filed a SAR while Asre was NYSEFCU’s BSA Compliance Officer and Asre never provided formal BSA training to any NYSEFCU compliance staff. b. Customer Identification Program and Customer Due Diligence Under the BSA, the Credit Union was required to include in its AML program “[a]ppropriate risk-based procedures for conducting ongoing customer due diligence.”22 A Customer Identification Program (CIP) and customer due diligence (CDD) enable a financial institution to understand the nature and purpose of customer relationships and to develop a customer risk profile at the outset of a customer relationship. 23 This information may also be used in subsequent monitoring for suspicious transactions. 24 Asre failed to implement an adequate CIP or CDD program for NYSEFCU. An independent audit of the Credit Union conducted in June 2016 specifically cited deficiencies in NYSEFCU’s CIP, finding that, for the purposes of establishing a customer risk profile, the Credit Union “had not accurately identified the BSA risks associated with the business member accounts of IBI, NYSEFCU-CUSO, DDH, and [another MSB affiliated with Asre] and the BSA exposure these accounts presented to the Credit Union.” In fact, Asre had not required NYSEFCU to generate a customer risk profile for its customers that incorporated the nature and purpose of the customer relationship. 25 Asre also did not require the NYSEFCU to confirm that MSB customers were registered with FinCEN, or in good standing under relevant state laws in the various states in which

22 31 C.F.R. § 1020.210(a)(2)(v). 23 “Requiring financial institutions to perform effective CDD so that they understand who their customers are and what type of transactions they conduct is a critical aspect of combating all forms of illicit financial activity, from terrorist financing and sanctions evasion to more traditional financial crimes, including money laundering, fraud, and tax evasion.” Customer Due Diligence Requirements for Financial Institutions, 81 FR 29398, 29399 (May 11, 2016). See also 31 C.F.R. § 1020.210(a)(2)(v)(A). 24 “Because [monitoring for suspicious transactions] includes transactions that are not of the sort the customer would be normally expected to engage, the customer risk profile information is used (among other sources) to identify such transactions.” Id., at 29398. 25 31 C.F.R. § 1020.210(a)(2)(v)(A)

12 they operated. Asre also did not screen DDH’s account activity against the OFAC Specially Designated Nationals and Blocked Persons List to determine if its customers were subject to sanctions restrictions. c. Training Under the BSA, the Credit Union was required to conduct “training for appropriate personnel.” 26 Asre assumed the responsibility of training NYSEFCU’s staff. In 2014, the NCUA issued a supervisory letter to the Credit Union mandating training on banking high-risk MSBs. In response, after assuming the role of BSA Compliance Officer, Asre drafted a 40-page BSA/OFAC/AML training presentation that contained topics specific to “Identifying and Mitigating Risks of Money Services Businesses.” However, Asre never gave this training presentation to any front-line employee or compliance staff at the Credit Union and did not otherwise provide them with relevant training in BSA/AML compliance for providing banking services to other financial institutions, such as MSBs like DDH, during the Relevant Time period. L. Asre willfully failed to detect and report suspicious activity for NYSEFCU The BSA and its implementing regulations require credit unions to report transactions that involve or aggregate to at least $5,000; are conducted by, at, or through the credit union; and that the credit union “knows, suspects, or has reason to suspect”: (a) involve funds derived from illegal activities, or is conducted to disguise funds derived from illegal activities; (b) are designed to evade the reporting or recordkeeping requirements of the BSA or regulations implementing it; or (c) have no business or apparent lawful purpose or are not the sort in which the customer normally would be expected to engage, and the credit union knows of no reasonable explanation for the transaction after

26 31 C.F.R. § 1020.210(a)(2)(iv).

13 examining the available facts, including background and possible purpose of the transaction.27 A credit union is generally required to file a SAR no later than 30 calendar days after the initial detection by the credit union of the facts that may constitute a basis for filing a SAR.28 To obtain the necessary transparency into potentially illicit activity, FinCEN, law enforcement, and other regulators rely on financial institutions’ accurate and timely filing of SARs. To accurately and completely prepare a SAR, known subjects involved in the suspicious activity should be identified in the appropriate fields on the SAR form.29 Investigators use these names and other identifiers to retrieve relevant records related to the subjects of an investigation. Failure to file a SAR can hamper an investigator’s ability to identify relevant records. Additionally, filing SARs without properly identifying the subjects (i.e., failing to identify all subjects connected to the conduct) can obfuscate the true nature of the activity and those involved, and otherwise hinder law enforcement investigations. Asre did not undertake any steps to modify NYSEFCU’s suspicious activity monitoring to detect and report activity specific to its MSB customers, or for bulk cash or checks, after he changed NYSEFCU’s business model to focus on bulk cash imports and international check clearance. As a result of the inadequate AML monitoring procedures that Asre oversaw, hundreds of millions of dollars in high-risk funds moved through the Credit Union without any proper monitoring. In fact, NYSEFCU filed no SARs while Asre was the BSA Compliance Officer. In early 2016, the NCUA mandated a suspicious activity lookback, which concluded that during Asre’s tenure NYSEFCU failed to file dozens of SARs on the MSBs associated with Asre.

27 31 C.F.R. § 1020.320(a)(2)(i)-(iii). 28 31 C.F.R. § 1020.320(b)(3). 29 FinCEN, FinCEN Suspicious Activity Report (FinCEN SAR) Electronic Filing Instructions, Version 1.2 (Oct. 2012) available at https://www.fincen.gov/sites/default/files/shared/FinCEN%20SAR%20ElectronicFilingInstructions- %20Stand%20Alone%20doc.pdf.

14 These suspicious transactions included over $100,000,000 deposited into banks in Mexico by DDH, and over $150,000,000 of cash which had been transported by IBI into the United States and subsequently repatriated to Mexico by wire transfer. The total unreported suspicious transaction volume associated with Asre’s scheme that should have been reported in SARs is over $940,000,000. III. VIOLATIONS Asre, as an employee of financial institutions subject to the BSA, willfully violated, or willfully participated in violating, the BSA and its implementing regulations. Specifically, FinCEN has determined that Asre is liable for the following violations of the BSA:

1. Willfully failing to register DDH as an MSB with FinCEN, in violation of 31 U.S.C. § 5330 and 31 C.F.R. § 1022.380 from October 21, 2015, to November 14, 2016;
2. Willfully participating in NYSEFCU’s failure to implement and maintain an effective AML program for in violation of 31 U.S.C. § 5318(h)(1) and 31 C.F.R. § 1020.210 from September 1, 2015, to April 2, 2016; and
3. Willfully participating in NYSEFCU’s failure to file SARs, in violation of 31 U.S.C. § 5318(g) and 31 C.F.R. § 1020.320 from September 1, 2015, to April 2, 2016. IV. ENFORCEMENT FACTORS FinCEN considered all of the factors outlined in the Statement on Enforcement of the BSA, issued August 18, 2020, when deciding whether to impose a civil money penalty in this matter. 30 The following factors were particularly relevant to FinCEN’s evaluation of the appropriate disposition of this matter, including the decision to impose a civil money penalty and the size of the penalty.  Nature and seriousness of the violations, including the extent of possible harm to the public and the amounts involved. Asre recruited several high-risk customers to a small, unsophisticated Credit Union. He assumed the role of BSA Compliance Officer and, in so doing, purported to the Credit Union that he would ensure its compliance with the BSA.

30 FinCEN, Statement on Enforcement of the BSA (Aug. 18, 2020), https://www.fincen.gov/sites/default/files/shared/FinCEN%20Enforcement%20Statement_FINAL%20508.pdf.

15 However, Asre failed to design, implement, and maintain an adequate AML program, and accordingly failed to detect and report hundreds of millions of dollars in suspicious activity. As a result, law enforcement was deprived of key information concerning the movement of hundreds of millions of dollars in suspicious funds through the U.S. financial system. Ultimately, the systemic failure of the Credit Union’s compliance program was a major contributing factor in the NCUA determining that the Credit Union was insolvent with no prospect of viable operations, and closing and liquidating the Credit Union. Consequently, longstanding state employee customers were forced to change depository institutions to other credit unions or banks that could provide them with banking services.  Impact or harm of the violations on FinCEN’s mission to safeguard the financial system from illicit use, combat money laundering, and promote national security. Asre’s conduct led to hundreds of millions of dollars in bulk cash and checks from Mexico being processed through the U.S. financial system. Such funds are higher risk by their nature, as the international origin of bulk cash is difficult to trace and bulk checks are associated with a higher risk for illicit activity. As a consequence, the movement of such funds needs to be properly monitored. Where such activity is suspicious, that activity needs to be promptly reported to FinCEN, so that law enforcement can act on it quickly. The sheer volume of transactions and the amounts involved were far beyond the Credit Union’s ability to properly manage. Asre intentionally leveraged this lack of experience to use this small financial institution to facilitate high risk transactions and likely money laundering activities, without implementing any controls to address these heightened risks. These likely money laundering activities included several instances where sequentially ordered checks for hundreds of thousands of dollars were originated at U.S. banks and deposited in accounts at banks in

16 Mexico, then sent as cash to NYSEFCU to be deposited. Asre also failed to report any of this suspicious activity.  Financial gain or other benefit resulting from, or attributable to, the violations. Asre’s financial gain from his misconduct included the profit he received through the MSBs he owned, controlled, or with which he was otherwise affiliated. He was a volunteer employee at the NYSEFCU, and so did not collect any compensation as BSA Compliance Officer or as a member of the Supervisory Committee. However, Asre derived benefits from his work at the NYSEFCU because he was able to use the NYSEFCU’s access to the United States financial system to provide the infrastructure necessary for his MSBs to perform their cash and check financial repatriation services.  Pervasiveness of wrongdoing within the institution, including management’s complicity in, condoning or enabling of, or knowledge of the conduct underlying the violations. NYSEFCU was a small, local credit union before Asre’s tenure. From 2015 to 2016, Asre was concurrently NYSEFCU’s BSA Compliance Officer and a member of the Credit Union’s Supervisory Committee. In his role as BSA Compliance Officer, he oversaw compliance staff and was responsible for providing BSA training. Asre was also the Chairman and CEO of DDH. By virtue of Asre’s managerial positions and oversight, and his personal involvement in the wrongdoing, it is fair to say that at least some management of the Credit Union and DDH was complicit in the wrongdoing.  Presence or absence of prompt, effective action to terminate the violations upon discovery, including self-initiated remedial measures. The NCUA shuttered NYSEFCU in October 2017. A major contributing factor to this action was the systemic compliance failures caused by Asre’s involvement as BSA Compliance Officer and member of the Supervisory Committee of the Board. This termination came after more than a year of attempts by the

17 NCUA to bring NYSEFCU into compliance with the provisions of the BSA. Thus, the violations were remediated promptly, but by the NCUA’s actions and not Asre’s.  Timely and voluntary disclosure of the violations to FinCEN. Asre did not timely or voluntarily disclose these violations to FinCEN.  Quality and extent of cooperation with FinCEN and other relevant agencies, including as to potential wrongdoing by its directors, officers, employees, agents, and counterparties. Asre signed agreements tolling the statute of limitations for conduct occurring during the Relevant Time Period described in this order.  Systemic nature of the violations. Considerations include, but are not limited to, the number and extent of violations, failure rates (e.g., the number of violations out of total number of transactions), and duration of violations. Before Asre’s appearance, the NYSEFCU was a small credit union with approximately 1,100 members and only $2 million under management. Promising increased fees to this struggling financial institution, Asre effectively took it over by using his authority as BSA Compliance Officer and member of the Supervisory Committee to direct and oversee what ultimately became 99% of its business by volume by the end of the Relevant Time Period. At times, the Credit Union processed millions of dollars a day in high risk, bulk U.S. currency and/or negotiable instruments transfers from Mexico. This pervasive activity occurred over a period of 18 months, until the NCUA ended the activity by closing the institution. But for the actions of the NCUA, there is every indication that Asre would have continued in his conduct and that the Credit Union would have continued to process high risk transactions without adequate compliance measures. NYSEFCU should have filed SARs on most, if not all, IBI transactions due to the foreign source of the funds, the funds being entirely in cash, and the lack of information on the origin of the funds.

18  Whether another agency took enforcement action for related activity. FinCEN will consider the amount of any fine, penalty, forfeiture, and/or remedial action ordered. DOJ indicted Asre in the U.S. District Court for the Eastern District of New York on March 30, 2021, charging criminal violations of the BSA. V. CIVIL PENALTY FinCEN may impose a Civil Money Penalty of up to $69,733 per day for willful violations of the requirement to implement and maintain an effective AML program occurring after November 2, 2015. For violations occurring on or before November 2, 2015, FinCEN may impose a Civil Money Penalty of up to $25,000.31 For each willful violation of a SAR reporting requirement occurring after November 2, 2015, FinCEN may impose a Civil Money Penalty not to exceed the greater of the amount involved in the transaction (capped at $270,180) or $69,733. For violations occurring on or before November 2, 2015, FinCEN may imposed a Civil Money Penalty not to exceed the greater of the amount involved in the transaction (capped at $100,000) or $25,000. 32 FinCEN may impose a Civil Monetary Penalty of up to $10,289 per day for violations of the requirement to register an MSB occurring after November 2, 2015. For violations occurring on or before November 2, 2015, FinCEN may impose a Civil Money Penalty of up to $5,000 a day. 33 After considering all the facts and circumstances, as well as the enforcement factors discussed above, FinCEN is imposing a Civil Money Penalty of $100,000 in this matter. Accordingly, Asre

31 31 U.S.C. § 5321(a)(1). The penalty amount for violations occurring after November 2, 2015, has been adjusted from $25,000 to $67,544 pursuant to the Federal Civil Penalties Inflation Adjustment Act of 1990 and 31 C.F.R. § 1010.821. 32 Id. The penalty amount for violations occurring after November 2, 2015, has been adjusted from $25,000 and $100,000 to $67,544 and $270,180, respectively, pursuant to the Federal Civil Penalties Inflation Adjustment Act of 1990 and 31 C.F.R. § 1010.821. 33 31 U.S.C. § 5330(e)(1). The penalty amount for violations occurring after December 31, 2015, has been adjusted from $5,000 to $9,966 pursuant to the Federal Civil Penalties Inflation Adjustment Act of 1990 and 31 C.F.R. § 1010.821.

19 shall make a payment of $100,000 to the U.S. Department of the Treasury pursuant to the payment instructions that will be transmitted to Asre upon execution of this Consent Order. VI. REMEDIAL UNDERTAKING FINANCIAL SERVICES INDUSTRY BAN Asre agrees to not participate, directly or indirectly, in the conduct of the affairs of any “financial institution,” as the term is defined in the BSA,34 that is located within the United States or does business in the United States, for a period of five years following the execution of this Consent Order. Asre agrees that if FinCEN files a complaint against him seeking injunctive relief to enforce compliance with this undertaking, he will consent to an order requiring him to comply with this undertaking.35 VII. CONSENT AND ADMISSIONS To resolve this matter and only for that purpose, Asre admits to the Statement of Facts and Violations set forth in this Consent Order to the extent coincident with his guilty plea. Asre consents to the use of the Statement of Facts, determinations, and conclusions of law set forth in the Consent Order in this proceeding and in any other proceeding brought by or on behalf of FinCEN, or to which FinCEN is a party or claimant, and, for those limited purposes only, agrees that they shall be taken as true and correct and be given preclusive effect therein, without further proof. Asre understands and agrees that in any administrative or judicial proceeding brought by or on behalf of FinCEN against him in connection with this proceeding, including any proceeding in which FinCEN (or the United States on FinCEN’s behalf) seeks civil money penalties or equitable remedies, Asre will be precluded from disputing the facts set forth in the Statement of Facts and any other determination in the Consent Order.

34 See 31 U.S.C. § 5312(a)(2); 31 C.F.R. § 1010.100(t). 35 The BSA authorizes courts to impose equitable remedies for violations of the BSA. 31 U.S.C. § 5320.

20 To resolve this matter, and only for that purpose, Asre agrees to and consents to the issuance of this Consent Order and all terms herein and agrees to make a payment of $100,000 to the U.S. Department of the Treasury pursuant to the payment instructions that will be transmitted to Asre upon execution of this Consent Order. If timely payment is not made, Asre agrees that interest, penalties, and administrative costs will accrue.36 Asre understands and agrees that he must treat the Civil Money Penalty paid under this Consent Order as a penalty paid to the government and may not claim, assert, or apply for a tax deduction, tax credit, or any other tax benefit for any payments made to satisfy the Civil Money Penalty. Asre understands and agrees that any acceptance by or on behalf of FinCEN of any partial payment of the Civil Money Penalty obligation will not be deemed a waiver of Asre’s obligation to make further payments pursuant to this Consent Order, or a waiver of FinCEN’s right to seek to compel payment of any amount assessed under the terms of this Consent Order, including any applicable interest, penalties, or other administrative costs. Asre affirms that he agrees to and approves this Consent Order and all terms herein freely and voluntarily and that no offers, promises, or inducements of any nature whatsoever have been made by FinCEN or any employee, agent, or representative of FinCEN to induce Asre to agree to or approve this Consent Order, except as specified in this Consent Order. Asre understands and agrees that this Consent Order implements and embodies the entire agreement between Asre and FinCEN, and its terms relate only to this enforcement matter and any related proceeding and the facts and determinations contained herein. Asre further understands and agrees that there are no express or implied promises, representations, or agreements between Asre and FinCEN other than those expressly set forth or referred to in this Consent Order and that nothing

36 31 U.S.C. § 3717; 31 C.F.R. § 901.9.

21 in this Consent Order is binding on any other law enforcement or regulatory agency or any other governmental authority, whether foreign, Federal, State, or local. Asre understands and agrees that nothing in this Consent Order may be construed as allowing Asre, or his agents, to violate any law, rule, or regulation. Asre consents to the continued jurisdiction of the courts of the United States over him and waives any defense based on lack of personal jurisdiction or improper venue in any action to enforce the terms and conditions of this Consent Order or for any other purpose relevant to this enforcement action. Solely in connection with an action filed by or on behalf of FinCEN to enforce this Consent Order or for any other purpose relevant to this action, Asre authorizes and agrees to accept all service of process and filings through the Notification procedures below and to waive formal service of process. VIII. COOPERATION Asre shall fully cooperate with FinCEN in any and all matters within the scope of or related to the Statement of Facts. Asre understands that his cooperation pursuant to this paragraph shall include, but is not limited to, truthfully disclosing all factual information with respect to his activities. This obligation includes providing to FinCEN, upon request, any document, record, or other tangible evidence in his possession, custody, or control, about which FinCEN may inquire of Asre. Asre’s cooperation pursuant to this paragraph is subject to applicable laws and regulations, as well as valid and properly documented claims of attorney-client privilege or the attorney work-product doctrine. IX. RELEASE Execution of this Consent Order and compliance with all of the terms of this Consent Order settles all claims that FinCEN may have against Asre for the conduct described in this Consent Order during the Relevant Time Period. Execution of this Consent Order, and compliance with the terms of this Consent Order, does not release any claim that FinCEN may have for conduct by Asre other

22 than the conduct described in this Consent Order during the Relevant Time Period, or any claim that FinCEN may have against any agent of Asre, or any other individual or entity other than those named in this Consent Order. In addition, this Consent Order does not release any claim or provide any other protection in any investigation, enforcement action, penalty assessment, or injunction relating to any conduct that occurs after the Relevant Time Period as described in this Consent Order. X. WAIVERS Nothing in this Consent Order shall preclude any proceedings brought by, or on behalf of, FinCEN to enforce the terms of this Consent Order, nor shall it constitute a waiver of any right, power, or authority of any other representative of the United States or agencies thereof, including but not limited to the Department of Justice. In consenting to and approving this Consent Order, Asre stipulates to the terms of this Consent Order and waives: A. Any and all defenses to this Consent Order, the Civil Money Penalty imposed by this Consent Order, and any action taken by or on behalf of FinCEN that can be waived, including any statute of limitations or other defense based on the passage of time; B. Any and all claims that FinCEN lacks jurisdiction over all matters set forth in this Consent Order, lacks the authority to issue this Consent Order or to impose the Civil Money Penalty, or lacks authority for any other action or proceeding related to the matters set forth in this Consent Order; C. Any and all claims that this Consent Order, any term of this Consent Order, the Civil Money Penalty, or compliance with this Consent Order, or the Civil Money Penalty, is in any way unlawful or unenforceable, or violates the Constitution of the United States of America or any provision thereof;

23 D. Any and all rights to judicial review, appeal or reconsideration, or to seek in any way to contest the validity of this Consent Order, any term of this Consent Order, or the Civil Money Penalty arising from this Consent Order; E. Any and all claims that this Consent Order does not have full force and effect, or cannot be enforced in any proceeding, due to changed circumstances, including any change in law; and F. Any and all claims for fees, costs, or expenses related in any way to this enforcement matter, Consent Order, or any related administative action, whether arising under common law or under the terms of any statute, including, but not limited to, under the Equal Access to Justice Act. Asre agrees to bear his own costs and attorneys’ fees. XI. VIOLATIONS OF THIS CONSENT ORDER Determination of whether Asre has failed to comply with this Consent Order, or any portion thereof, and whether to pursue any further action or relief against Asre, shall be in FinCEN’s sole discretion. If FinCEN determines, in its sole discretion, that a failure to comply with this Consent Order, or any portion thereof, has occurred, or that Asre has made any misrepresentations to FinCEN or any other government agency related to the underlying enforcement matter, FinCEN may void any and all releases or waivers contained in this Consent Order; reinstitute administrative proceedings; take any additional action that it deems appropriate; and pursue any and all violations, maximum penalties, injunctive relief, or other relief that FinCEN deems appropriate. FinCEN may take any such action even if it did not take such action against Asre in this Consent Order and notwithstanding the releases and waivers herein. In the event FinCEN takes such action under this paragraph, Asre expressly agrees to toll any applicable statute of limitations and to waive any defenses based on a statute of limitations or the passage of time that may be applicable to the Statement of Facts in this Consent Order, until a date 180 days following Asre’s receipt of notice of FinCEN’s determination

24 that a misrepresentation or breach of this agreement has occurred, except as to claims already time barred as of the Effective Date of this Consent Order. In the event that FinCEN determines that Asre has made a misrepresentation or failed to comply with this Consent Order, or any portion thereof, all statements made by or on behalf of Asre to FinCEN, including the Statement of Facts, whether prior or subsequent to this Consent Order, will be admissible in evidence in any and all proceedings brought by or on behalf of FinCEN. Asre agrees that he will not assert any claim under the Constitution of the United States of America, Rule 408 of the Federal Rules of Evidence, or any other law or federal rule that any such statements should be suppressed or are otherwise inadmissible. Such statements will be treated as binding admissions, and Asre agrees that he will be precluded from disputing or contesting any such statements. FinCEN shall have sole discretion over the decision to impute conduct or statements of any person or entity acting on behalf of, or at the direction of, Asre in determining whether Asre has violated any provision of this Consent Order. XII. PUBLIC STATEMENTS Asre expressly agrees that he shall not, nor shall agents or any other person authorized to speak on his behalf or within his authority or control, take any action or make any public statement, directly or indirectly, contradicting his admissions and acceptance of responsibility or any terms of this Consent Order, including any fact finding, determination, or conclusion of law in this Consent Order.FinCEN shall have sole discretion to determine whether any action or statement made by Asre, or by any person under the authority, control, or speaking on behalf of Asre contradicts this Consent Order, and whether Asre has repudiated such statement. XIII. SEVERABILITY Asre agrees that if a court of competent jurisdiction considers any of the provisions of this Consent Order unenforceable, such unenforceability does not render the entire Consent Order

25 unenforceable. Rather, the entire Consent Order will be construed as if not containing the particular unenforceable provision(s), and the rights and obligations of FinCEN and Asre shall be construed and enforced accordingly. XIV. MODIFICATIONS AND HEADINGS This Consent Order can only be modified with the express written consent of FinCEN and Asre. The headings in this Consent Order are inserted for convenience only and are not intended to affect the meaning or interpretation of this Consent Order or its individual terms. XV. NOTIFICATION Unless otherwise specified herein, whenever notifications, submissions, or communications are required by this Consent Order, they shall be made in writing and sent via first-class mail and simultaneous email, addressed as follows: To FinCEN: Associate Director, Enforcement and Compliance Division Financial Crimes Enforcement Network P.O. Box 39, Vienna, Virginia 22183 To Asre: Gyanendra Kumar Asre c/o Gary A. Farrell, Esq. 40 Exchange Place, Suite 1800 New York, NY 10005 Notices submitted pursuant to this paragraph will be deemed effective upon receipt unless otherwise provided in this Consent Order or approved by FinCEN in writing. XVI. COUNTERPARTS This Consent Order may be signed in counterpart and electronically. Each counterpart, when executed and delivered, shall be an original, and all of the counterparts together shall constitute one and the same fully executed instrument. XVII. EFFECTIVE DATE AND CALCULATION OF TIME This Consent Order shall be effective upon the date signed by FinCEN. Calculation of deadlines and other time limitations set forth herein shall run from the effective date (excluding the

26 effective date in the calculation) and be based on calendar days, unless otherwise noted, including intermediate Saturdays, Sundays, and legal holidays. By Order of the Director of the Financial Crimes Enforcement Network. /s/ . Jimmy Kirby Date: Deputy Director Consented to and Approved By: /s/ . Gyanendra Kumar Asre Date: