|
|
|
In this report
September brought enforcement that tested whether firms had actually fixed known weaknesses, alongside new regulatory infrastructure and sharper measurement of fraud and financial abuse. The common thread is a move from broad expectations toward documented controls, targeted reporting and evidence of outcomes.
- FinCEN imposed a $125 million recidivist BSA penalty on UBS Financial Services for unmonitored foreign-currency wires,
- The UK committed at least £550 million to a new AML and asset-recovery strategy built around NFIS and supervisory consolidation,
- APP reimbursement improved to 88%, but scope exclusions and uneven bank decisions continue to leave hybrid scams outside the scheme,
|
|
|
Enforcement and supervision
FinCEN fines UBSFS $125M for repeat BSA violationsGeneral
FinCEN assessed a $125 million civil penalty against UBS Financial Services after finding that the firm continued operating a deficient foreign-currency wire monitoring programme that it had already agreed to fix in 2018. The case makes remediation failure, not merely the original control gap, the basis for the penalty's scale.
- More than 61,500 foreign-currency wires worth $10.5 billion went unmonitored, alongside late suspicious activity reports and inadequate due diligence for some high-risk clients.
- FinCEN called UBSFS a recidivist; the new penalty is 8.6 times the $14.5 million 2018 settlement, with the consent order recording a wilfulness finding.
What this means for you For bank and fintech financial-crime teams, a prior consent order now carries a sharper evidential burden: showing that remediation changed the operating programme, rather than only producing new documentation, is central to enforcement exposure. |
|
FINMA fines Julius Baer CHF10M over AML failuresGeneral
FINMA fined Julius Baer CHF10 million and restricted new business after identifying AML and risk-management failures in private lending and relationships involving two Russian politically exposed persons. The enforcement keeps remediation, risk appetite and governance in view at the same time.
- Private-loan exposure to a European group exceeded CHF1 billion, while the bank did not sufficiently challenge negative media or suspicious behaviour linked to the PEP relationships.
- FINMA imposed reporting requirements and a CHF250 million capital add-on until Julius Baer completes divestment of assets outside its risk appetite; the case is the lender's fifth enforcement matter in ten years.
What this means for you PEP controls and product-level risk appetite remain inseparable in supervisory reviews, particularly where a new business line creates concentrated exposure that customer-level checks do not contain. |
|
UK commits £550M to a new AML strategyGeneral
The UK Home Office published its 2026–2029 AML and Asset Recovery Strategy with at least £550 million in funding and more than 500 additional specialists. Its planned architecture shifts attention from reporting volume alone toward intelligence integration, specialist capability and higher-harm threats.
- The proposed National Financial Intelligence Service will sit within the National Crime Agency, with AI-supported analysis and intelligence partnerships extending to cryptoasset firms, MSBs and electronic-money institutions.
- The government will examine the SAR suspicion threshold after 866,616 reports in 2024/25, while supervision is planned to consolidate from 25 supervisors to three.
What this means for you UK compliance teams are looking at a future supervisory model that values the quality and connectedness of financial intelligence more heavily than raw SAR throughput, although the implementation details remain open. |
|
OFAC consolidates sanctions penalties in Part 505General
OFAC's final rule created 31 CFR Part 505 as a single location for sanctions penalty provisions. It reorganises the rules rather than changing the underlying penalty framework, so the practical effect is clearer retrieval and cross-reference, not a new penalty standard.
- The rule preserves pre-penalty notice procedures, the halving of base penalties for voluntary self-disclosure and the existing aggravating and mitigating factors.
- The maximum IEEPA civil penalty remains the greater of $377,700 or twice the transaction value; OFAC will replace programme-specific provisions with references to Part 505.
What this means for you Sanctions governance now has one canonical penalty location, while the substantive exposure associated with wilful or reckless conduct and missed self-disclosure remains unchanged. |
|
|
Targeted controls and illicit finance
FinCEN expands southwest-border reporting for MSBsGeneral
FinCEN's September Geographic Targeting Order adds transaction reporting, recordkeeping and identity-verification requirements for covered money services businesses in specified southwest-border zip codes. It is a targeted control, not a replacement for existing BSA reporting.
- The order covers cash transactions from $1,000 through $10,000 in parts of Texas, Arizona and California, with newly covered businesses required to comply by October 3.
- CTR obligations above $10,000 and SAR duties remain in place, and the order can run for up to 180 days unless renewed.
What this means for you MSB and bank compliance coverage at the southwest border now includes a lower transaction-reporting threshold in defined locations, making geography and product-channel mapping part of the control boundary. |
|
DOJ seeks forfeiture of $61M in Iranian oil cryptoGeneral
The Southern District of New York filed a civil forfeiture complaint against approximately $61 million in cryptocurrency allegedly linked to sanctioned Iranian oil sales and IRGC financing. The case shows how sanctions evasion can combine crypto addresses, overseas exchanges and access to the US financial system, but the forfeiture remains pending.
- The complaint attributes the funds to two Chinese companies and trading accounts at the UAE-based Binance exchange, within a broader address network that received and distributed about $1.5 billion.
- SDNY alleges that the network routed value to IRGC-linked money services businesses, addresses and an Iranian exchange, while the named companies used the US financial system for tens of millions of dollars in transfers.
What this means for you Sanctions and crypto investigations increasingly meet at the intersection of on-chain tracing, exchange exposure and fiat access, rather than within a single screening workflow. |
|
|
Fraud losses, reimbursement and detection
UK police report £101M in payment-diversion lossesGeneral
City of London Police reported £101 million stolen through payment-diversion fraud in 2025/26, with criminals extending familiar invoice tactics into booking platforms, pension accounts and increasingly convincing impersonation. The number of reports rose while the total stolen fell, so the signal is about changing attack surfaces as well as aggregate loss.
- Report Fraud received 3,657 reports, including 813 invoice-fraud cases; individuals made up 63% of reports and organisations 35%.
- Police highlighted AI-assisted phishing, writing-style imitation and voice or video impersonation, with construction recording the highest number of business reports.
What this means for you Payment-diversion controls are being tested beyond classic supplier-invoice workflows, while synthetic communication makes the reliability of familiar human cues a weaker fraud signal. |
|
APP reimbursement reaches 88% but leaves gapsGeneral
Which?'s review of the mandatory APP reimbursement scheme found reimbursement rates had risen from 61% to 88% in its first 18 months. The improvement is real, but it sits alongside broad out-of-scope decisions and inconsistent treatment of claims between firms.
- Only 2% of claimants were judged to have failed the consumer standard of caution, but around 30% of claims were rejected as out of scope.
- International transfers, card payments, crypto transactions and money-transfer apps remain outside the scheme, while the £85,000 cap has not followed the FSCS limit to £120,000.
What this means for you APP outcomes are improving inside the scheme's boundary, but fraud teams and policy owners still face material exposure where a scam crosses payment rails or is classified as a civil dispute. |
|
Nature study maps financial abuse in banking dataGeneral
A Nature study used anonymised banking data to show that financial abuse leaves measurable, time-ordered traces before formal disclosure. It is evidence of an observable pattern, not a tested detection model, which keeps the finding useful without turning it into a claim about production performance.
- Researchers compared 5,428 female victim-survivors with 15,602 matched controls across seven years and 373 transactional and non-transactional outcomes.
- The victim-survivor group showed depleted savings, rising debt, missed payments, lower credit scores, more cash withdrawals, address and password changes, and higher transport and legal costs.
What this means for you Banking data can support earlier evidence of financial abuse, but the study does not establish how those signals should be operationalised or how detection would affect customers. |
|
How Iris covered your topics this month Every topic you track was searched over the last month. | Topic | Sources found | In this briefing | | General | 39 | 9 stories |
|
|
