Banks handling pre-released American Depositary Receipts, which U.S. residents use to invest in foreign companies, are taking a risk if they rely on agreements, annual certifications or the word of brokers to ensure that they’re complying with the law.

Case in point: JPMorgan Chase Bank’s more than $135 million settlement reached Dec. 26 with the U.S. Securities and Exchange Commission. The deal resolves charges alleging that the New York-based bank made about $71 million in revenue through abusive ADR practices in thousands of transactions that occurred from November 2011 through early 2015.