On 21 October 2026 FinCEN used its 5318(k) foreign bank subpoena power for the first time, in an inquiry into a Greek bank. Why it matters for correspondents.
Table of contents
On 21 October 2026 FinCEN said it had issued its first foreign bank subpoena under 31 U.S.C. 5318(k), to investigate an unnamed Greek bank's potential ties to Iran. The same day Treasury sanctioned a Panama- and Greece-based law firm, a ship manager and two shipping agents. No wrongdoing has been alleged publicly.
- FinCEN described the step as "its first issuance of an administrative subpoena pursuant to 31 U.S.C. § 5318(k)", taken in coordination with European partners, including Greece.
- The statute lets Treasury or the Attorney General demand records of any account at a foreign bank that keeps a US correspondent account, including records held abroad.
- A foreign bank that ignores the subpoena faces up to 50,000 dollars a day, and US banks can be told to close its correspondent accounts within 10 business days.
- OFAC designated four entities and five individuals and identified nine vessels under Executive Order 13902, with wind-down licences running to 20 November 2026.
- FinCEN's implementing rule still carries the pre-2021 wording, so the statute, not the regulation, sets today's penalties.
What did Treasury and FinCEN announce on 21 October?
Treasury paired new Iran sanctions with an investigative first. OFAC designated a law firm, a ship manager and two shipping agents behind Iran's shadow fleet. FinCEN, in parallel, issued its first subpoena under 31 U.S.C. 5318(k) in an inquiry into a Greek bank. It also issued multiple requests for information on banks' ties to OFAC-designated Iranian financial institutions.
The actions sit inside Operation Economic Outcast, the campaign Secretary Scott Bessent announced on 24 August 2026. In the FinCEN news release, the agency says it is acting "in close coordination with European partners, including in Greece". It does not name the bank, describe the records sought or say whether the bank is cooperating.
The sanctions half is fully documented. According to the Treasury press release, Karnakis and Karnakis, a Panama- and Greece-based law firm, registered shipping companies whose vessels moved Iranian steel, petroleum and petrochemicals. Treasury says the firm's staff served as directors and officers of companies they registered "to obfuscate the true beneficial owners".
| Item | Detail |
|---|---|
| Date | 21 October 2026 |
| Agencies | FinCEN and OFAC, US Department of the Treasury |
| FinCEN action | First administrative subpoena under 31 U.S.C. 5318(k) |
| Target of subpoena | An unnamed Greek bank |
| Other FinCEN action | Multiple requests for information on ties to designated Iranian financial institutions |
| OFAC authority | Executive Order 13902 |
| OFAC designations | 4 entities, 5 individuals, 9 vessels identified as blocked property |
| Wind-down licences | General Licenses GG and HH, to 12:01 a.m. EST on 20 November 2026 |
| Legal status | Investigation in progress; no finding against the bank |
The OFAC recent actions notice lists the new SDN entries: Karnakis and Karnakis, Roxette Maritime Shipping and Trading, Amigoz Singapore and Whales Shipping Line, plus five individuals linked to the law firm. The nine blocked vessels carry IMO numbers in the same notice.
How does a 5318(k) foreign bank subpoena work?
A foreign bank subpoena reaches records outside the United States through the bank's US correspondent account. Section 5318(k)(3) lets Treasury or the Attorney General subpoena any foreign bank with such an account. They can request records of that account or of any account at the bank, wherever the records are kept.
The text of 31 U.S.C. 5318(k) ties the power to four kinds of matter: a US criminal investigation, a Bank Secrecy Act investigation, a civil forfeiture action, or a section 5318A special measure investigation. The subpoena names a return date and the judicial district of the investigation. It can be served in person, by mail or fax on a US representative, or abroad through a mutual legal assistance treaty or similar channel.
The bank can petition that district court to modify or quash the foreign bank subpoena before the return date. The statute closes one obvious defence: a conflict with foreign secrecy or confidentiality law "shall not be a sole basis for quashing or modifying the subpoena." Bank staff are also barred from telling account holders about it, and the bank faces a civil penalty of double the suspected criminal proceeds or, if none can be identified, up to 250,000 dollars.
The current wording dates from the Anti-Money Laundering Act of 2020. The statutory notes record that Public Law 116-283, section 6308, replaced the old paragraph on foreign bank records. That rewrite widened the reach from records about deposits into the bank to any account at the bank, and set the penalties below.
| Consequence | Who bears it | Statutory limit |
|---|---|---|
| Failure to comply with the subpoena | Foreign bank | Up to 50,000 dollars per day |
| Continued failure after 60 days | Foreign bank | Further penalties and court enforcement |
| Tipping off an account holder | Foreign bank | Double the suspected proceeds, or up to 250,000 dollars if none are identified |
| Notice to close the relationship | US correspondent bank | Close within 10 business days |
| Failure to close after notice | US correspondent bank | Up to 25,000 dollars per day |
| Unpaid penalties | Foreign bank | Funds in its US correspondent account can be seized |
How does it compare with FinCEN's other tools?
The 5318(k) subpoena is an evidence tool, not a sanction. A section 311 special measure, codified at 5318A, can cut a bank off from the US system after a finding. An OFAC designation blocks property at once. The subpoena sits earlier: it gathers records that could later support either step, or neither.
That distinction matters for anyone reading the 21 October release as a verdict. FinCEN's proposal against the A7 Network's sub-agents, which we covered in our A7 Network sanctions article, rested on a published finding and a proposed rule. Nothing comparable has been published about the Greek bank.
| Tool | Legal basis | Effect | Public finding required |
|---|---|---|---|
| Foreign bank subpoena | 31 U.S.C. 5318(k)(3) | Compels records held abroad | No |
| 120-hour rule | 31 U.S.C. 5318(k)(2) | US bank produces records to its regulator within 120 hours | No |
| Request for information | Not stated in the release | Asks institutions for information | No |
| Special measure | 31 U.S.C. 5318A | Restricts or prohibits correspondent accounts | Yes, primary money laundering concern |
| OFAC designation | Executive orders, such as E.O. 13902 | Blocks property and prohibits dealings | Yes, designation criteria met |
What does this mean for your obligations?
For US banks with foreign correspondents, the 5318(k) regime already puts statutory clocks on existing records. Owner records and agent-for-service details must reach law enforcement within 7 days of a written request. After a closure notice, the correspondent account must be shut within 10 business days. Both are the levers a foreign bank subpoena pulls.
Under the statute and 31 CFR 1010.630, a covered financial institution must keep in the United States records of each foreign bank's owners and a US agent for service of process. The statute says owners of record and beneficial owners; the regulation exempts publicly traded banks and FR Y-7 filers. Check that the certifications are current; the safe harbour requires recertification at least every three years.
Correspondent due diligence under 31 CFR 1010.610 asks you to weigh each foreign bank's markets, its home regime and information reasonably available about its AML record. A public Treasury inquiry into a Greek bank is relevant context for those factors, and a prompt to refresh risk ratings on Greek respondents and to document the review, not grounds to exit them. Our guide to correspondent banking due diligence sets out the wider framework.
Sanctions screening changes the same day. The new names and IMO numbers belong in screening lists, and OFAC's 50 percent rule extends blocking to entities owned 50 percent or more, directly or indirectly and alone or together, by those persons. General Licenses GG and HH allow wind-down to 20 November 2026, with any payment to a blocked person going into a blocked account. Our OFAC check explainer covers the screening mechanics.
The Karnakis designation is also a KYB lesson. Treasury describes a law firm acting as corporate agent and placing its own staff as directors to hide owners. Nominee officers appear on the register, so relying on the officer list alone returns the nominees, not the owners. Treat formation-agent employees serving as officers as a red flag, and corroborate ownership with shareholder registers, owner declarations and supporting documents. See our ultimate beneficial owner entry.
What is still uncertain?
The biggest unknown is the bank itself. Treasury has not named it, described the records sought or alleged a violation. The four risks below concern the rulebook, conflict of laws, contagion across Greek banking and the scope of the inquiry, not any finding.
First, the regulation lags the statute. 31 CFR 1010.670 still sets a 10,000 dollar daily penalty for failing to close a correspondent relationship and describes records "relating to the deposit of funds". It also triggers closure on a failure to start court proceedings. The amended statute sets 25,000 dollars, covers any account at the bank and speaks of a failure to prevail. Where they conflict the statute controls, but procedures written from the regulation will understate the exposure.
Second, EU data protection law pulls the other way. Article 48 GDPR says a third-country authority's order to disclose personal data may only be recognised if based on an international agreement such as a mutual legal assistance treaty, without prejudice to the other transfer grounds in Chapter V. The statute offers treaty service as one route but does not require it. A Greek bank could face a foreign bank subpoena that a US court will not quash on secrecy grounds alone, and an EU rule under which the US order alone is not a lawful basis for transfer, so the bank needs a separate GDPR ground.
Third, termination risk spreads. If Treasury or the Attorney General finds the bank has failed to comply, or has lost a court challenge, and gives written notice, US correspondents must close its accounts within 10 business days. Banks that clear payments for Greek institutions may tighten terms across the market before any outcome.
Fourth, scope. FinCEN says it issued multiple requests for information about relationships with designated Iranian financial institutions. The release does not say who received them, how many there are or what they ask.
Why does a first use matter now?
FinCEN has now used a power Congress widened nearly six years ago, in January 2021. The Anti-Money Laundering Act of 2020 rewrote the foreign bank subpoena. FinCEN's first issuance lands in a sanctions campaign that has already produced FinCEN's charity alert of 15 October.
Secretary Bessent put it bluntly in the press release: "if you are supporting the Iranian regime, we will find you and sanction you." The subpoena belongs to the fact-finding stage, gathering records abroad that any later action would need. Any foreign bank with a US correspondent account holds records the US can demand, and since 2021 that reach covers every account at the bank, with daily penalties and account closure behind the demand.
How should compliance teams respond?
Confirm every foreign bank certification and US agent, rehearse a 10-business-day closure, load the 21 October names and IMO numbers into screening and diarise 20 November 2026. Most of this needs no new policy, only evidence that existing controls work at the speed a foreign bank subpoena assumes.
US correspondent banks should make the 7-day law enforcement response the job of a named person, not a mailbox, and test a 10-business-day closure run, including in-flight payments. Procedures that quote the 10,000 dollar figure should be corrected to the statutory 25,000 dollars.
Non-US banks with US correspondents should map where account records for each business line sit and who can authenticate them. Legal teams should decide in advance how they would weigh a 5318(k) subpoena against Article 48 GDPR and domestic secrecy law, and when they would seek treaty service.
KYB teams should flag customers whose directors work for their formation agent. Zyphe's KYB software resolves beneficial ownership recursively across 240+ corporate registries at a 25% default threshold, configurable per risk tier, with an exportable audit trail and no central store of customer PII. To see it on your own corporate portfolio, book a demo.
The bottom line
FinCEN's first use of the 5318(k) power matters beyond one unnamed Greek bank. Any bank with a US correspondent account holds records Washington can demand, on a short clock, with a closure order behind it. Banks on both sides should settle where those records sit and how US demands fit EU law before a subpoena arrives.
Cited sources
- FinCEN news release, Operation Economic Outcast Targets Iran's Shadow Fleet Networks, 21 October 2026
- US Treasury press release sb0664, 21 October 2026
- OFAC recent actions, Iran-related designations and General Licenses GG and HH, 21 October 2026
- OFAC Iran General License GG, wind down of transactions involving Karnakis and Karnakis
- OFAC Iran General License HH, wind down and cargo offloading for vessels blocked on 21 October 2026
- 31 U.S.C. 5318, including subsection (k)(3) and statutory notes, Cornell LII
- 31 CFR 1010.670, summons or subpoena of foreign bank records
- 31 CFR 1010.630, records of foreign bank owners and agents for service
- 31 CFR 1010.610, due diligence for correspondent accounts
- GDPR Article 48, transfers or disclosures not authorised by Union law
Michelangelo Frigo (Co-Founder at Zyphe) Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.