Bank may not be an US entity is what it appears. Also the bank is supposed to do due diligence. Careful reading of the judgement, indicate that none of the liabilities from the transaction are possibly active, ie, all payments have been made and the matter closed, with no issue of defaults, etc. The question being considered is the 'risk of reputational damage to the bank', which does it sound like a criminal matter?