Regulatory Roundup — October 2026: AML Enforcement, Sanctions Expansion, and Heightened Crypto & AI Oversight
October 2026 brought significant regulatory and enforcement activity across anti-money laundering, sanctions, cryptocurrency, and artificial intelligence. AML developments included FinCEN’s warnings about the A7 Network’s money laundering and sanctions-evasion risks, a $1.2 billion penalty against Bank of America for deficiencies in its AML program and suspicious activity reporting, and a FINTRAC penalty against Caisse Alliance for compliance failures. Regulators also highlighted risks involving Iranian charity networks, suspected student-aid fraud, and financial crime controls at higher-risk lending businesses.
Sanctions authorities continued to target networks supporting Iran and other sanctioned actors. OFAC designated the Karnakis and Karnakis law firm and associated maritime interests for allegedly facilitating Iranian petroleum and petrochemical trade, while U.S. actions also targeted Iranian shadow banking networks and foreign financial institutions. The European Union expanded sanctions listings tied to Russia’s military-industrial sector, and Australia designated individuals and entities linked to North Korean fraudulent IT-worker and cybercrime networks. These actions underscore the importance of ownership transparency, counterparty screening, and scrutiny of intermediaries and cross-border transactions.
Crypto and AI oversight remained a prominent theme. FinCEN withdrew proposed rulemakings related to certain digital-asset activities, while EU regulators clarified expectations for crypto platforms offering noncompliant stablecoins. The SEC pursued alleged investment fraud schemes that used AI-powered trading claims and cryptocurrency, and the European Commission sought information from developers following reported incidents involving advanced AI models. Taken together, October’s developments reinforce the need for effective risk-based AML controls, robust sanctions compliance, and continued attention to emerging risks at the intersection of financial services and technology.
ANTI-MONEY LAUNDERING
FinCEN Issues Alert on A7 Network Sanctions Evasion and Money Laundering Risks
FinCEN issued an alert warning financial institutions about the A7 Network, a global shadow banking network with ties to Russia that facilitates sanctions evasion and money laundering for illicit actors, including Iran and its terrorist proxies. The alert highlights the network’s use of foreign companies and digital asset channels to move funds and provides red flags to help institutions identify suspicious activity. FinCEN proposed a rule that would prohibit certain fund transfers involving A7 Network sub-agents, reinforcing regulatory efforts to restrict illicit actors’ access to the U.S. financial system.
FinCEN Assesses $1.2 Billion Penalty Against Bank of America for AML Failures
On October 13, 2026, FinCEN assessed a $1.2 billion penalty against Bank of America, N.A., for willfully violating the Bank Secrecy Act (BSA) and failing to maintain an effective anti-money laundering (AML) program. Regulators determined that the bank failed to timely report more than $5 billion in suspicious transactions, including over $1 billion associated with national security and other priority illicit finance risks, such as Chinese money laundering networks and potential trade-based money laundering along the U.S. southwest border. The enforcement action also cited deficiencies in customer due diligence, foreign correspondent banking oversight, and transaction monitoring, including an overreliance on external inquiries rather than effective internal controls. Separately, the OCC assessed a $750 million civil money penalty, which is credited against FinCEN’s assessment, while OFAC reached an $11.6 million settlement for apparent sanctions violations involving programs targeting Iran, Russia, narcotics, and global terrorism. Bank of America must conduct a retrospective review of previously undetected suspicious activity and undergo independent assessments of its AML controls, underscoring regulators’ continued focus on effective transaction monitoring, timely SAR filing, and accountability for longstanding compliance deficiencies.
Operation Economic Outcast Targets Iranian Regime’s Abuse of Religious Charity Networks
FinCEN issued an alert asking financial institutions to report potential Iranian regime abuse of religious charity networks which included the diversion of religious tithes also know as khums. The alert included guidance and potential red flags to this type of activity.
FinCEN Identifies $270 Million in Suspicious Activity Linked to Federal Student Aid
FinCEN has identified approximately $270 million in suspicious financial activity potentially linked to fraud against federal student aid programs. FinCEN has referred these findings to federal investigators to pursue potential fraud schemes targeting federal student aid programs and help ensure those responsible are held accountable. This can be attributed to the FinCEN alert from July which highlighted this type of fraud thereby requesting financial institutions ensure searching for this and reporting via Suspicious Activity Reports.
FINRA Bars Broker for Misappropriating $1.7 Million from Customers’ Accounts
FINRA has barred Rudy Anguiano of Chino Hills, CA, a former registered representative of LPL Financial LLC, from associating with any FINRA member firm in all capacities for conversion—the intentional and unauthorized taking of another person’s property—of $1,731,000 from two customers’ accounts into an outside business bank account. LPL has since reimbursed both customers in full. Although not cited for money laundering activity, this type of fraud becomes money laundering when moved to other financial institutions to conceal the origin of those funds.
UK FCA Restricts Six Lenders Over AML Control Concerns
The UK Financial Conduct Authority (FCA) announced restrictions on six unregulated lenders after identifying concerns about their anti-money laundering policies, controls and procedures. The restrictions limit the firms’ ability to onboard new customers or enter into new lending arrangements, with some also subject to restrictions on accepting payments from existing customers. Several firms must obtain independent reviews of their AML frameworks. The action highlights the FCA’s heightened scrutiny of higher-risk lending businesses and the importance of demonstrating effective financial crime controls.
FINTRAC Imposes Administrative Monetary Penalty on Caisse Populaire Alliance Limitée
FINTRAC announced an administrative monetary penalty of C$82,500 against Caisse populaire Alliance limitée, also known as Caisse Alliance, for violations of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act and its associated regulations. The violations included failures to maintain current written compliance policies and procedures, apply required special measures to high-risk activities, and assess and document money laundering and terrorist financing risks. The action reinforces FINTRAC’s expectations for documented, risk-based AML programs and appropriate controls for higher-risk business activities.
SANCTIONS
OFAC Sanctions Kanakis and Karnakis Law Firm for Facilitating Iranian Sanctions Evasion
On October 21, 2026, OFAC sanctioned Panama- and Greece-based law firm Karnakis and Karnakis under Executive Order 13902 for its role in supporting Iran’s petroleum and petrochemical sectors. According to Treasury, the firm helped establish shipping companies and corporate structures used to conceal beneficial ownership and facilitate the transport of hundreds of millions of dollars’ worth of Iranian steel, petroleum, and petrochemicals through shadow fleet networks. OFAC also designated five individuals associated with the firm, along with a maritime company and identified cargo vessels linked to Iranian trade. The action, part of Operation Economic Outcast, underscores regulators’ growing focus on professional service providers, corporate formation agents, and maritime intermediaries that enable sanctions evasion, highlighting the importance of beneficial ownership transparency and enhanced due diligence on shipping and trade-related customers.
U.S. Targets Iranian Shadow Banking Networks and Foreign Financial Institutions
As part of Operation Economic Outcast, the U.S. Treasury announced sanctions targeting Iranian shadow banking networks and financial institutions alleged to facilitate sanctions evasion, including an Iraqi bank accused of supporting Iranian financial activity and designated groups. The action also included the designation of Cuba-based Banco Internacional de Comercio S.A. (BICSA), which Treasury stated had provided services to designated Iranian Karafarin Bank since at least 2022. The measures target offshore banking structures, foreign-exchange intermediaries and shell-company networks used to move funds internationally. The action underscores the importance of assessing correspondent banking relationships, indirect exposure to sanctioned financial institutions, complex ownership structures and transactions involving third-country intermediaries.
EU Adopts Large-Scale Sanctions Listings Against Russia’s Military-Industrial Sector
The European Union adopted additional restrictive measures against 1,569 individuals and entities associated with Russia’s military and industrial complex, including 826 companies and 743 company executives. The listings represent a significant expansion of the EU’s sanctions framework targeting Russia’s ability to sustain its military operations and access critical industrial capabilities. For financial institutions and international businesses, the action reinforces the need to screen legal entities and relevant individuals against updated EU sanctions lists, assess ownership and control relationships, and review supply chains and counterparties for potential exposure to newly designated parties.
Australia Sanctions North Korean IT Worker and Cybercrime Networks
Australia imposed targeted financial sanctions and travel bans on two individuals and two entities linked to North Korea’s efforts to generate revenue for its nuclear weapons and ballistic missile programs. The designated parties were identified as facilitating fraudulent IT worker schemes through which North Korean nationals allegedly obtain remote employment by posing as citizens of other countries. The action, coordinated with international partners including the European Union, highlights the sanctions risks associated with concealed identities, fraudulent employment arrangements and cross-border payments supporting prohibited weapons programs.
OFAC Sanctions Hamas Financing Network Using Charities and Cryptocurrency
OFAC designated a member of Hamas’s military wing, two France-based individuals and two affiliated entities for their alleged roles in financing Hamas through deceptive charitable fundraising and cryptocurrency transfers. The network moved more than $2 million to Hamas over several years, using purported charitable organizations and digital asset channels to collect and transfer funds.
AI & CRYPTO
FinCEN Announced Withdrawals of Digital Asset Related Rulemakings
FinCEN withdrew proposed rules that would have imposed regulatory requirements on financial institutions related to certain digital assets. This included requirements specific to convertible virtual currencies involving unhosted wallets and special measures involving convertible virtual currency mixers.
EU Tightens Expectations for Crypto Platforms Offering Noncompliant Stablecoins
The European Securities and Markets Authority (ESMA) issued guidance clarifying that crypto-asset service providers authorized under the Markets in Crypto-Assets Regulation (MiCA) should cease providing services involving stablecoins that do not comply with EU requirements. National regulators are expected to ensure platforms implement appropriate technical, contractual and organizational controls to prevent customers from acquiring or increasing exposure to these tokens. The guidance has implications for stablecoin listings, custody, transfers and transaction controls across EU-regulated crypto businesses.
US SEC Targets Fraudulent AI-Powered Crypto Investment Schemes
The U.S. Securities and Exchange Commission filed civil fraud actions against four entities over two alleged investment scams that collectively misappropriated more than $15 million from investors. According to the SEC, the schemes used online platforms and WhatsApp groups to promote supposed AI-generated trading signals and artificial intelligence trading bots, while falsely claiming regulatory legitimacy and promising investment returns. The complaints allege that the purported AI trading programs were fraudulent and that investor funds were misappropriated. The cases highlight the use of AI marketing claims, cryptocurrency transfers and impersonated regulatory credentials in investment fraud.
Commission Investigates AI Model Safety Incidents
The European Commission’s AI Office sought information from developers following reported incidents involving advanced AI models that raised concerns about model behavior, monitoring and control. The Office requested serious-incident reports and information about developers’ security practices, with further inquiries being prepared alongside the Commission’s independent Scientific Panel. The Commission has not publicly identified the companies involved or established any breach of the EU AI Act.
