New York state’s top financial regulator struck a $40 million settlement Thursday with Block Inc., the parent of Cash App, the popular money transmission service, after having found the company had “serious compliance deficiencies” related to its anti-money laundering program and transaction monitoring processes.

The deficiencies at Block, some involving cryptocurrencies, “created a high-risk environment vulnerable to exploitation by criminal actors,” the New York State Department of Financial Services said in the consent order, noting, for example, that Block’s system did not trigger alarms on bitcoin transactions involving terrorism-connected wallets until that exposure exceeded 10%.

Any exposure to terrorism-connected wallets is illegal, the department said.