The Block deferred prosecution agreement: a $964 million AML deal that is not yet signed

The Block deferred prosecution agreement would defer a Bank Secrecy Act charge against the Cash App owner for three years, at about $964 million gross and $764 million net. Block disclosed the agreement in principle with the US Department of Justice in its 3 November 2026 SEC filing. It is not final: final terms and court approval remain outstanding.

• Block says it and the US Department of Justice (DOJ) reached an agreement in principle in October 2026 over an anti-money laundering (AML) programme charge.
• The expected gross amount is about $964 million. The net payment is about $764 million after credit for prior regulatory resolutions.
• Block's accrual rose from $240 million in March to $526 million in June and $764 million in September.
• The filing does not publish a statement of facts, the period of conduct or any monitor requirement.
• State regulators have already documented alert backlogs, late suspicious activity reports (SARs) and repeat-account abuse at Cash App.

What is the Block deferred prosecution agreement?

The Block deferred prosecution agreement is a proposed deal in which the DOJ defers, for three years, one charge about Block's AML programme, subject to a final agreement and court approval. The disclosure appears in Note 16 of the quarterly report filed on 3 November 2026. No DOJ release or court filing was publicly available as of 9 November 2026.

Block's Form 10-Q for the quarter ended 30 September 2026 says the charge is that "the Company failed to maintain an effective anti-money laundering program" in violation of the Bank Secrecy Act. If Block meets every obligation during the term, the DOJ would move to dismiss the deferred charge with prejudice. If the DOJ finds a breach, Block could be prosecuted on the deferred charge.

Block's filing says the SEC and DOJ both opened inquiries shortly after a short seller report in March 2023, and that the SEC followed up in July 2024. SEC staff told Block in March 2026 that they had concluded their investigation without intending to recommend enforcement. The DOJ presented potential terms that same month.

Cash App is the product most closely tied to this history, but the party to the proposed resolution is Block, Inc. A deferred charge is an allegation that has not been adjudicated, and nothing in the filing is a court finding.

How did the Block accrual reach $764 million?

Block raised its DOJ accrual over two quarters, from $240 million at the end of March to $526 million in June and $764 million in September. The increases came as talks moved from a disputed methodology to an agreement in principle in October. The $764 million equals the expected net payment.

The sentence disputing the basis and methodology of the DOJ's assessment appears in the first quarter report and the second quarter report. Block's third quarter report omits it. Dropping a sentence is not an admission, and the filing does not say whether the final papers will contain one.

Block also warns that the final terms could produce losses above the amount accrued. The $764 million is an accounting estimate of a payment that has not been finalised, so it should not be cited as a fine.

What did state regulators already find at Cash App?

State regulators documented alert backlogs, late suspicious activity reports and weak identity controls at Cash App, and penalised Block $120 million across two 2025 actions. New York recorded a backlog passing 169,000 alerts by 2020 and a 129-day average from alert to filing. Those findings are the most detailed public record, but do not define the federal charge.

Forty-eight state financial regulators agreed an $80 million settlement in January 2025, and New York imposed $40 million that April. The New York Department of Financial Services (DFS) consent order traces that backlog from about 18,000 alerts in 2018. The 129-day average covers its review period, and some SARs were filed more than a year after the alert. The average from alert to the start of a case investigation was 70 days.

Restricted Cash App accounts did not require full identity verification, and Block did not stop new restricted accounts sharing an email, phone number, device or financial instrument with denylisted customers. New York's order cites one SAR covering $1.6 million and 91 subjects who held 16,811 accounts. It also records 8,359 accounts opened by roughly 25 to 30 subjects linked to a Russian criminal network, which Block found itself and closed.

Sanctions controls drew similar findings. New York's order describes wallet-exposure thresholds set above zero without a supporting risk analysis. It says mixer exposure was rated medium rather than high. It also found no Office of Foreign Assets Control (OFAC) screening of restricted accounts before 2023. New York credited Block's cooperation and remediation. In the multistate settlement, Block neither admitted nor denied wrongdoing.

How does $964 million compare with earlier US anti-money laundering cases?

At $964 million gross, or $764 million net, the Block deferred prosecution agreement would sit above Western Union's 2017 forfeiture and well below TD Bank's 2024 guilty plea. Its closest precedent is Western Union, also a money services business (MSB) that resolved through deferred prosecution, while TD Bank and OKX ended in guilty pleas.

Western Union admitted criminal violations as part of its resolution, while Block's filing is silent on any admission. On overlapping payments, Western Union's civil penalty of $184 million from the Financial Crimes Enforcement Network (FinCEN) was treated as satisfied by its payment to reimburse fraud victims. Block's credit for prior resolutions would instead reduce the DOJ amount. Civil and state routes run alongside the criminal one, as FinCEN's $1.2 billion Bank of America penalty and the Coinme settlement with 34 state regulators show.

What does this mean for your AML obligations?

The proposed deal creates no new duty, but its charge concerns programme effectiveness, so the practical test is whether controls are risk-based and can be shown to work. A written policy is not enough. For a money services business, the federal rule ties the adequacy of the programme to size, location and the nature and volume of services.

The AML programme rule at 31 CFR 1022.210 requires an effective programme, a designated compliance person, training and independent review. Because adequacy turns on risk, a growth forecast is, in our reading, a compliance input. Teams should be able to show alert capacity against projected volume, for every product line that moves money.

SAR timing is the most measurable duty. Under 31 CFR 1022.320, an MSB generally reports suspicious transactions of at least $2,000 within 30 calendar days of initial detection of facts that may support a filing. It keeps the SAR and supporting records for five years. The rule runs from detection of facts, so in our reading an alert alone does not start the clock, but an alert left unreviewed for months is hard to defend. Banks have a parallel duty under 31 CFR 1020.320, with a $5,000 threshold. Track the age of every open suspicious activity report case and transaction monitoring alert.

For an MSB, the federal hook for customer due diligence is the programme rule's requirement to verify customer identification, to the extent applicable. New York applied its own know-your-customer (KYC) requirements. Its consent order treated a per-account limit as ineffective where one person could open many accounts, and faulted the absence of a formal KYC refresh. Its re-entry findings suggest low-tier accounts need the same denylist checks as fully verified ones.

For sanctions, New York's order shows what an examiner tests. Any threshold above zero on exposure to terrorism-connected wallets needs a documented risk rationale. New York also faulted the lack of rescreening for existing staff and service providers against updated lists. Rejected transactions must reach OFAC within 10 business days under 31 CFR 501.604, and the order records fifteen late reports in 2021.

What is still uncertain about the Block deferred prosecution agreement?

The final text, the statement of facts, the compliance undertakings and the make-up of the implied $200 million credit all remain unknown. Block itself says no final agreement is assured, and that the DOJ could take legal action if talks fail. Readers should treat every DOJ figure as provisional until a court filing appears.

The implied credit of about $200 million in the Block deferred prosecution agreement, the gap between gross and net, is the sharpest open question. Block's two state AML settlements total $120 million. The Consumer Financial Protection Bureau (CFPB) order added a $55 million penalty, which brings the total to $175 million. Adding its full $120 million of possible redress gives $295 million. Neither total equals $200 million. One combination does, the $80 million multistate penalty plus the full $120 million of redress, but it omits New York's $40 million and relies on a fraud-handling action. The filing does not say which resolutions earn credit or in what amounts.

Court approval is a formal condition. Under 18 USC 3161(h)(2), a period of deferred prosecution is excluded from the speedy trial clock only with the court's approval, and Block has not said which court will review the agreement.

Note 16 gives no period of conduct, names no DOJ office and does not mention a monitor. New York already required an independent monitor and the states an independent consultant, so a further federal layer could overlap with both. Note 16 also mentions no separate FinCEN penalty, though silence does not rule one out.

The state findings should not be read across to the federal charge, because the DOJ's facts are not public. Civil exposure also continues: the same note describes a putative securities class action filed on 17 January 2025 that includes allegations about Block's AML statements.

How should compliance teams respond?

Compliance teams should treat this as a capacity and evidence exercise, testing whether monitoring, identity and sanctions controls kept pace with volume. The first step is measurement, because an unmeasured backlog is the kind of weakness New York's order describes. These actions apply whether or not the Block deferred prosecution agreement is finalised.

Start by modelling alert volume per analyst against the product roadmap, and report aged alerts to the board monthly. Measure elapsed days from alert to case opening and from detection to filing, and set escalation points well inside 30 days.

Next, close re-entry paths. Link low-tier sign-ups to denylisted devices, phone numbers, emails and payment instruments, and apply limits per person. Add event-driven KYC refresh triggers. Then revisit blockchain analytics settings, including mixer risk ratings, and write down why each threshold exists.

Finally, if more than one authority is examining you, have counsel track what each resolution covers, because Block's filing shows how much can turn on credit for earlier resolutions.

Zyphe works on the identity layer of this problem. Users verify once with an NFC chip read to ICAO 9303 and two-step liveness, and re-present a reusable credential. Businesses receive results and proofs, with no central store of customer PII. To check how that fits your programme, see our AML software or book a demo.

The bottom line

The Block deferred prosecution agreement is a pending resolution rather than a finished enforcement outcome. Its numbers are provisional and its facts are unpublished. The public state record already shows what regulators test: whether alerts are cleared in time, whether one person can return under another account, and whether risk thresholds have a written reason. Teams that can evidence those answers today will start from a stronger position when the final papers appear.

Cited sources

• Block, Inc. Form 10-Q for the quarter ended 30 September 2026, Note 16
• Block, Inc. Form 10-Q for the quarter ended 30 June 2026
• Block, Inc. Form 10-Q for the quarter ended 31 March 2026
• New York DFS consent order with Block, Inc., 10 April 2025
• Multistate settlement agreement and consent order with Block, Inc., January 2025
• CSBS announcement of the $80 million multistate penalty
• CFPB order against the operator of Cash App, January 2025
• DOJ release on the Western Union resolution, January 2017
• Western Union Form 10-Q for the quarter ended 31 March 2017
• DOJ release on the TD Bank guilty pleas, October 2024
• US Attorney SDNY release on the OKX guilty plea, February 2025
• 31 CFR 1022.210, AML programmes for money services businesses
• 31 CFR 1022.320, suspicious transaction reports by money services businesses
• 31 CFR 1020.320, suspicious activity reports by banks
• 31 CFR 501.604, reports of rejected transactions
• 18 USC 3161, Speedy Trial Act time limits and exclusions