Regulatory Roundup — September 2026: AML Enforcement, Sanctions Expansion, and Heightened Crypto & AI Oversight
September 2026 brought a broad wave of regulatory enforcement and supervisory activity across anti-money laundering, sanctions, crypto, and artificial intelligence. AML developments included the FCA's formal investigation into Euro Exchange Securities UK Ltd. following concerns about financial-crime controls, FINTRAC penalties against two Canadian gaming corporations for suspicious transaction reporting failures, and FinCEN's proposed action to restrict Banque Misr UAE's correspondent banking access to U.S. financial institutions. Regulators also continued to emphasize practical controls, customer communications around SAR confidentiality, and awareness of persistent fraud schemes.
Sanctions enforcement remained active across multiple jurisdictions. OFAC expanded its Operation Economic Outcast initiatives targeting Iran's aviation procurement networks and entities supporting terrorist proxy groups, while the UK's OFSI imposed a £4.7 million penalty on Citibank's London branch for sanctions breaches involving frozen funds and a designated person. Canada added eight individuals under its Russia sanctions regime, and Australia opened consultation on a major overhaul of its autonomous sanctions framework.
Crypto and AI oversight also intensified. FinCEN highlighted nearly $13 billion associated with digital-asset investment scams, while AUSTRAC moved toward active supervision of Australia's virtual-asset sector and reported enforcement outcomes under its expanded VASP framework. In the UK, authorities took coordinated action against unregistered peer-to-peer crypto trading venues ahead of the country's broader crypto authorization regime. At the same time, the EU began its first coordinated AI compliance inspections, signaling that regulators are moving from rulemaking and guidance toward active supervision and enforcement. Taken together, September's developments underscore a regulatory focus on demonstrable AML controls, sanctions compliance, and stronger oversight of emerging financial and technology risks.
ANTI-MONEY LAUNDERING
FinCEN Issues Joint Statement on Suspicious Activity Report Confidentiality Regarding Customers
FinCEN has issued a joint statement on suspicious activity report confidentiality considerations regarding communications with customers. In response to a request for information, FinCEN in conjunction with the Federal Reserve and US bank regulators outlined the type of information that can be shared with customers while maintaining SAR confidentiality.
FINRA Releases Investor Insight into Pump and Dump Fraud Schemes
FINRA released an investor insight into pump and dump fraud schemes. Although not a new issue, these types of schemes are still prevalent, especially in a world where a fear of missing out can be a driver to make risky investment choices. The insight provides an overview of the scam and resources for victims.
FinCEN Proposes Rule That Would Revoke Banque Misr’s UAE’s Correspondent Banking Access to US Financial Institutions
Pursuant to Section 311 of the USA PATRIOT Act, FinCEN issues a Notice of Proposed Rulemaking (NPRM) that would revoke Banque Misr UAE’s corresp9ondent banking ace to US financial institutions. The NPRM asserts that Banque Misr in the UAE is a financial institution operating outside the US of primary money laundering concern. The NPRM was released on August 28, 2026 and the comment period closes 30 day after the NPRM was published.
FCA Opens Formal Investigation into Euro Exchange Securities UK Ltd
On September 17, 2026, the FCA opened a formal investigation into Euro Exchange Securities UK Ltd (EES) for suspected breaches of the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017, covering February 2020 to June 2026. The FCA shuttered EES in June, citing "significant risks of financial crime" after the firm reportedly moved over £2 billion for a small set of high-risk clients; alleged failings span customer risk assessment, CDD/EDD, PEP and sanctions screening, and governance. No breach has been concluded.
FINTRAC Fines New Brunswick and Nova Scotia Gaming Crown Corporations
On September 3, 2026, FINTRAC fined two Atlantic Canada Crown gaming corporations tied to Atlantic Lottery Corporation's online casino operations. New Brunswick Lotteries and Gaming Corporation was fined CAD $399,712.50 for failing to file suspicious transaction reports despite reasonable grounds to suspect money laundering. Nova Scotia Gaming Corporation was fined CAD $231,826 for similar STR failures plus inadequate, unapproved compliance policies and a deficient ML/TF risk assessment.
SANCTIONS
OFAC Expands Operation Economic Outcast to Include Iran’s Aviation Sector
Under Operation Economic Outcast, OFAC sanctioned 36 targets for supporting Iran’s aviation sector, which the regime uses to move weapons, personnel, and illicit cargo. This action targeted covert front companies, foreign intermediaries, and deceptive transshipment routes that Iran relies on to obtain U.S.-origin aircraft and sensitive technology. In addition to OFAC’s action, FinCEN issued an Alert asking financial institutions to report procurement networks supporting Iran’s aviation industry.
OFAC’s Operation Economic Outcast Initiative Strikes Iran’s Global Terrorist Proxy Network
As part of Operation Economic Outcast, OFAC took action against the networks enabling the Iranian regime to wreak havoc in the Middle East through its terrorist proxies. This action targets entities and individuals that support Kata’ib Hizballah (KH) and Hizballah.
Additionally, OFAC announced an enforcement action against an individual for providing services to companies in Iran, and updated its Iran Statement of Licensing Policy to a presumption of denial except in limited circumstances.
OFSI Imposes a £4.7 million penalty against Citibank N.A., London Branch
OFSI announced September 2 that it imposed a penalty on August 11 in the amount of £4.7 million against the London branch of Citibank N.A. The penalty was a result of dealing with frozen funds and making funds available to a designated person which spanned from February 2022 to July 2025. This is a direct breach under both the Russia Regulations and the Global Anti-Corruption Sanctions Regulations.
Canada Sanctions Eight Individuals for Human Rights Violations in Russia
On September 10, 2026, Global Affairs Canada amended the Special Economic Measures (Russia) Regulations, adding eight individuals to Schedule 1 for their involvement in gross and systematic human rights violations in Russia, with the measures entering into force September 4. Those designated include Emergencies Minister Alexander Kurenkov and Rosmolodyozh youth affairs head Grigory Gurov, alongside other public officials and figures linked to state institutions.
Australia Opens Consultation on Landmark Sanctions Law Overhaul
On September 7, 2026, DFAT opened a four-week public consultation, closing October 2, on an exposure draft of the Autonomous Sanctions Bill 2026 which is the centerpiece of the Australian Sanctions Legislation Amendment (ASLA) reforms and the most significant overhaul of Australia's sanctions framework since the Autonomous Sanctions Act 2011. The new architecture, expected to commence by October 1, 2027, will also include a companion Consequential and Transitional Provisions Bill and new Autonomous Sanctions Rules.
AI & CRYPTO
FinCEN Identifies Nearly $13 Billion Linked to Digital Assets Scams
FinCEN published an analysis and alert to financial institutions to be vigilant to digital asset investment scams perpetrated by overseas scam centers. Digital asset investment scams, often referred to as “pig butchering” or “romance baiting” have been identified as one of the most significant fraud threats. It has become a lucrative international illicit business that exploit both emerging technologies and human vulnerabilities.
AUSTRAC Intensifies Scrutiny of Virtual Asset Sector
AUSTRAC has moved from guidance to active supervision of Australia's virtual asset sector, launching two targeted campaigns in May 2026 covering 36 OTC crypto-to-cash providers and 27 local exchanges. The reviews assess business models, transaction channels, governance, and ML/TF risk management capability under the newly adopted VASP framework, which supersedes the narrower "digital currency exchange" definition and now captures custody and brokerage services. The campaigns have already produced tangible enforcement outcomes, including 45 registration removals in a recent sweep. The initiative reflects AUSTRAC's 2026–27 regulatory posture, released August 2026: reporting entities must demonstrate that AML/CTF controls function in daily operations, not merely exist on paper.
FCA Cracks Down on Unregistered P2P Crypto Trading in London
On September 10, 2026, the FCA, HM Revenue & Customs, and the Metropolitan Police Service carried out coordinated enforcement action against three peer-to-peer crypto trading locations in London, issuing cease-and-desist letters under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. The action reflects a compliance vacuum since no P2P crypto businesses currently hold FCA registration, leaving all such operators exposed to intervention, as unregistered venues bypass mandatory customer due diligence and are viewed by the FCA as prime conduits for laundering. The operation precedes the UK's broader crypto asset authorization regime, with the transitional authorization window opening September 30, 2026 and the full regime taking effect October 2027.
EU AI Act Enforcement Goes Live as National Regulators Launch First Inspections
The EU's "Digital Omnibus on AI" (Regulation (EU) 2026/1744) entered into force July 27, 2026, deferring the compliance deadline for standalone high-risk AI systems from August 2, 2026, to December 2, 2027. However, Article 50 transparency obligations were not delayed and became enforceable on schedule. Throughout September 2026, the European AI Office, working with 24 national market surveillance authorities including France's CNIL, Germany's BfDI, and Spain's AESIA, launched its first coordinated wave of compliance inspections, targeting automated resume-screening tools, algorithmic credit-assessment systems, and AI healthcare triage tools. Non-compliant providers face a 10-business-day correction window before escalation, with penalties reaching €35 million or 3% of global turnover.
