On June 18, New York announced an agreement with a bank consulting firm in connection with the firm’s work for a state-regulated bank alleged to have engaged in deceptive and fraudulent misconduct on behalf of client Iranian financial institutions in violation of anti-money laundering and sanctions rules. An investigation conducted by the New York Department of Financial Services (DFS) found that the consultant (i) failed to demonstrate autonomy and removed a recommendation aimed at rooting out money laundering from a written final report submitted to the DFS, and (ii) violated New York Banking Law § 36.10 by disclosing confidential information of other consulting firm clients to the bank. To resolve that investigation, the consulting firm agreed to (i) a voluntary one-year suspension from consulting work at any DFS-regulated institution, (ii) pay a $10 million penalty, and (iii) adopt a new code of conduct. The DFS intends for the code of conduct to serve as “a new model that will govern independent consulting firms that seek to be retained or approved by DFS.” The code of conduct states, among other things: (i) the financial institution and consultant must disclose all prior work by the consultant for the institution in the previous three years, (ii) the engagement letter must require that the ultimate conclusions and judgments will be that of the consultant based upon the exercise of its own judgment, (iii) the consultant and institution must submit a work plan for the engagement and timeline for completion of work, (iv) the DFS and the consultant must have ongoing communication, including outside the presence of the institution, and (v) the consultant must implement numerous record keeping, training, reporting, and other policies and procedures.