Banks are carrying the risk of America’s foreign policy

The Treasury Department wants banks to act like national security agencies. But the infrastructure isn’t there, the guidance doesn’t arrive fast enough and the priorities shift too quickly for institutions to keep up.

In theory, a risk-based approach to anti-money laundering and sanctions enforcement is supposed to make compliance smarter. In practice, it’s become a liability. Banks are being held responsible for foreign policy pivots they didn’t cause, can’t predict and are rarely equipped to manage.

Take Syria. The sanctions shift in June caught everyone off guard. One day, hundreds of blacklisted entities were just gone — no heads-up, no pattern. And oddly, many also stayed sanctioned with no explanation.

Inside banks, it wasn’t clear what to do. Teams were yanking controls, second-guessing everything, hoping they weren’t missing something that would blow back later. No safe harbor was granted. No transition period was offered. It wasn’t guidance — it was whiplash.

In May, the Trump administration secured $600 billion in Saudi investment pledges, arms agreements with Riyadh, and commercial pacts with the United Arab Emirates and Qatar, jurisdictions with known financial crime vulnerabilities. The United Arab Emirates was only removed from international watch lists in 2024. 

Weeks later, the Financial Crimes Enforcement Network designated three Mexican financial institutions as primary money laundering concerns under new fentanyl-related authorities, cutting off U.S. correspondent access without warning or transition. Institutions with exposure had to unwind positions and coordinate emergency legal reviews in hours. 

As policy swings between high-dollar engagement and abrupt enforcement, banks are expected to interpret shifting national priorities without reliable guidance, safe harbors or regulatory infrastructure.

This pattern is now familiar: Foreign policy decisions are made quickly, implemented aggressively and left for the private sector to decode. And that decoding process isn’t theoretical, it’s budgeted, resourced and internalized by banks with finite headcount and finite patience.

Meanwhile, the Financial Crimes Enforcement Network’s beneficial ownership registry remains structurally hollow. As of March, U.S. companies are no longer required to report ownership data, leaving financial institutions without access to the very information they were promised. 

The database, once intended to illuminate shell structures and illicit ownership chains, is still cited in federal guidance but remains effectively unusable. With access restricted to a phased rollout and core data now absent, institutions are being held to standards they cannot operationalize.

On the sanctions front, Russia enforcement has resulted in over 2,500 designations since 2022. These include banks, oligarchs, industrial sectors, shipping entities and digital asset infrastructure. 

The scale of enforcement has been unmatched, but typology guidance often lags weeks behind. General licenses arrive late. Enforcement FAQs change midstream. Risk modeling is updated in arrears, not in anticipation.

In the United Kingdom, 82 percent of banks admitted to skipping basic verification checks on new customers, and 94 percent do not run daily screenings on existing clients, a worrying number given the rapid changes in sanctions. 

While these findings reflect U.K. institutions, they offer a stark warning: Even in highly regulated markets, the infrastructure banks rely on isn’t scaling with enforcement expectations.

In this environment, institutions are penalized not just for doing the wrong thing, but for failing to predict the next shift. They’re expected to interpret national security posture in real time, while receiving no classified insight, no operational roadmap and no consistency in enforcement tone. 

The result? They preempt. They freeze accounts on speculation. They sever correspondent relationships on rumor. 

This isn’t just frustrating, it’s structurally unsound. Banks are now de-risking entire regions not because of active sanctions, but because of anticipated volatility. They’re refusing transactions not because they’re prohibited, but because they might become politically radioactive later.

Compliance programs weren’t built to carry this weight, and the government isn’t helping them do it. Funding is flat. Tools are inconsistent. And regulators still expect real-time decisions in a system designed for after-the-fact review.

The message to financial institutions is clear: Enforce foreign policy priorities. The infrastructure, stability and liability protections? Those are still pending.

This isn’t a partisan problem. It’s a systemic one. Democratic and Republican administrations alike have made aggressive use of Treasury authorities to pursue foreign policy goals. But neither has addressed the operational burden left behind. 

Anti-money laundering compliance and sanctions enforcement have quietly become tools of statecraft, handed off to private institutions that cannot absorb the complexity, ambiguity and legal risk of that delegation.

The result is a landscape defined by fragmentation, second-guessing and exposure. Institutions that get it right see no reward. Institutions that guess wrong face enforcement, reputational fallout, and program overhauls. 

Risk-based compliance only works when the risk is defined, the expectations are stable and the information flow is reciprocal.

That’s not what banks are getting today. They’re being asked to manage not just compliance, but also geopolitical unpredictability. They are, functionally, the operational front line of an outsourced enforcement system.

This is not sustainable, scalable or safe.

Brett Erickson is managing principal at Obsidian Risk Advisors and an advisory board member at the Loyola University Chicago Law’s Center for Compliance Studies and DePaul University Driehaus College of Business.