Western Union AML Enforcement History & Vendor Risk Report

Recommended Actions

Steps to address findings for Western Union

1. 1

   IMMEDIATE (within 5 business days): Conduct a formal legal review of the OFAC enforcement actions database match for 'Western Union Financial Services, Inc.' — retrieve the specific enforcement record from https://ofac.treasury.gov/civil-penalties-and-enforcement-information, determine whether it is historical and resolved or currently active, and document the reviewer's findings in writing before any onboarding decision proceeds.

2. 2

   HIGH PRIORITY (within 10 business days): Request Western Union's current SOC 2 Type II report and bridge letter directly from their enterprise security or compliance team — many financial services vendors provide this under NDA. If they publish a trust center, check for a report request form. This is required to satisfy SOC 2 CC9.2 evidence obligations and to assess whether their controls cover your in-scope data.

   SOC 2 Overview (AICPA)
3. 3

   HIGH PRIORITY (within 15 business days): Request a copy of Western Union's ISO 27001 certificate (if held), PCI DSS compliance attestation (Attestation of Compliance / AoC), and their current Data Processing Agreement (DPA) with subprocessor list. These are standard documents that enterprise financial vendors should be able to provide promptly.

   ISO 27001 StandardPCI DSS StandardsDPA Template (GDPR Art. 28)
4. 4

   MEDIUM PRIORITY (within 20 business days): Ask Western Union's technical or enterprise security contact to confirm the security header configuration on their authenticated payment and API endpoints — specifically Strict-Transport-Security, Content-Security-Policy, and X-Frame-Options — and request their remediation timeline for the public-facing site findings.

   CSP Reference (MDN)
5. 5

   MEDIUM PRIORITY (within 20 business days): Request written documentation from Western Union on their AI data handling practices, specifically whether customer transaction or personal data is used for AI model training, whether an opt-out is available, and which third-party AI model providers (if any) have access to customer data.

6. 6

   ONGOING: Retain this report with a reviewer signature and date in your vendor risk register as evidence of CC9.2 third-party risk assessment. Re-assess Western Union at your standard vendor review cycle (recommended annually or upon any material change in integration scope).

   NIST Risk Assessment (SP 800-30)NIST Supply Chain Risk (SP 800-161)

• Web archive history data was unavailable during this investigation; domain establishment history was corroborated via WHOIS registration records (1995) and certificate transparency logs.
• External cyber risk scoring data was not available for this assessment; infrastructure security was evaluated using direct port scanning, CVE lookup, Malware detection service, and reputation source data.
• Domain threat intelligence data was partially unavailable; the assessment relied on alternative threat intelligence sources including IP reputation scoring, website security scanning, and Safe Browsing checks, all of which returned clean results.
• The SSL/TLS analysis service deep cipher analysis link was provided but detailed graded results were not returned in this assessment cycle; the cipher configuration was separately confirmed as sound via direct TLS inspection (TLS 1.2, ECDHE-RSA-AES128-GCM-SHA256).
• The OFAC enforcement actions database entry for 'Western Union Financial Services, Inc.' does not include a score value in the returned evidence, which limits automated severity calibration; human legal review is required to determine the nature, date, and resolution status of the underlying action.
• No public trust center or compliance page was found for westernunion.com; certification status for SOC 2, ISO 27001, and PCI DSS could not be independently or vendor-attestedly verified through this investigation and must be obtained directly from the vendor.