People act on what we publish about compliance obligations, so when we get a fact wrong we say so in public rather than editing the page quietly. This log records substantive factual corrections to published articles. How we source and review material in the first place is set out in our editorial policy.
What we log, and what we do not
We log any change that alters what a reader would understand a rule, a date, an obligation or a number to be. That includes a wrong effective date, a rule described as in force when it is a proposal, a misattributed obligation, and any quantified claim we could not substantiate.
We do not log routine editing: typographical fixes, restructured sections, refreshed examples, broken links, or ordinary updates that add newly published information without changing an earlier statement of fact.
How corrections are handled
- Reported or found, then verified. We confirm the position against the primary source before changing anything, including when the report is confidently worded.
- Corrected at the source. The claim is fixed on every page carrying it, not only the page that was reported.
- The argument is rebuilt, not deleted. If a corrected fact was load-bearing, we replace it with an accurate mechanism rather than removing the sentence and leaving a hole.
- Logged here with a date when the change is substantive, stating what was wrong and what the page now says.
Report an error
Send it through our contact page. A link to the page and the sentence in question is enough. If you can point at the primary source, that is faster still. We would rather hear about a mistake than leave it published.
Correction log
The AI compliance agents comparison at /agents/compare, and the note on human approval it shares with the agents overview page
What was wrong: The comparison table said Castellum.AI and Sphinx did not state publicly that their agents give written reasoning for each decision, and the summary said none of Castellum.AI, Bretton and Sphinx publicly addresses Regulation (EU) 2024/1624. Checked again on 1 October 2026, Castellum.AI describes a rationale, data references and a human-readable narrative for every agent decision, Sphinx describes step-by-step reasoning backed by evidence, and Sphinx’s blog discusses the Regulation. Both pages also said that Zyphe returns every case for approval, without saying that Auto-pilot exists.
What it says now: Every competitor cell now links the vendor page it comes from, with the date the facts were checked, and the summary says that none of the vendors compared publicly addresses outsourcing under Article 18 of the Regulation. The approval note now says that by default Zyphe returns every case for approval, that Auto-pilot runs only on categories the customer has validated and switched on, that an agent’s action goes through only if a rule-based check also passes, and that the MLRO keeps final sign-off. WorkFusion was added to the comparison in the same update.
Pages that stated Zyphe’s country coverage, the size of its storage network or what happens to documents after verification: product and industry pages, the Italian, German, Austrian, Swiss and Spanish market pages, the security, GDPR and privacy policy pages, fifty-three blog posts, twenty news articles, three glossary entries, an author profile, and the diagrams and downloadable checklists that accompany nineteen guides
What was wrong: Three statements about Zyphe were wrong. Coverage was given as 213 countries and territories. The storage network was described as 60,000+, or more than 60,000, nodes, and in two articles as sited in 60 countries. And seven articles said that after verification Zyphe deletes, shreds or discards the source documents, describing a “verify-then-shred” model or saying that document images, selfies and biometric templates are deleted once the credential is issued.
What it says now: Coverage now reads 190+ countries (over 190 countries on the market pages); the figure of more than 4,000 identity document versions is unchanged. The storage network is described as thousands of nodes around the world, without a specific count, and the 29-of-100 threshold is unchanged. The seven articles now describe what actually happens: documents and biometrics are processed, then encrypted and split across storage nodes into the user’s own vault, which only a key the user or customer holds can unlock. The business receives verification results and proofs, not copies, and there is no central store of customer PII. Michelangelo Frigo, co-founder and CEO, confirmed all three on 1 October 2026.
Pages that described the IDMerit data exposure: twenty-three blog posts, including the KYC breach tracker and our analysis of the incident, three news articles, including our report on it, eight industry pages, and the IDMerit record in the AML enforcement tracker
What was wrong: Most of the posts stated as fact that IDMerit exposed, leaked or left unprotected about one billion identity records, without attributing the finding to Cybernews, which reported it, and without IDMerit’s response. Several went beyond the Cybernews report. They said IDMerit itself disclosed the leak 99 days after it was found, when the 99 days ran to Cybernews’ own publication and the database was secured the day after it was found. They described the cause as a misconfigured cloud storage layer, listed passport scans, biometric templates, proof-of-address documents and KYC/AML verification logs among the exposed data, and said every bank and fintech that used IDMerit had added its customers’ records to the database. The Cybernews report states none of these.
What it says now: Each passage now attributes the finding to Cybernews, which reported on 18 February 2026 that an unprotected database it linked to IDMerit exposed about one billion personal records across 26 countries, over 203 million of them from the United States, and that the database was found on 11 November 2025 and secured the next day. Where a passage describes the incident in any detail, it also gives IDMerit’s response to Cybernews: that it does not own, control or store customer data or the underlying data maintained by independent data sources. Details the Cybernews report does not contain have been removed.
The Coinbase record in the AML enforcement tracker, and its entries in the CSV, JSON and RSS files
What was wrong: The record put the estimated cost of the May 2025 theft of customer data through paid support staff at about 400 million dollars, and cited a press report. Coinbase’s own filing gave a range, of which 400 million dollars is the top.
What it says now: The record cites Coinbase’s Form 8-K of 15 May 2025 and gives its preliminary estimate of 180 million to 400 million dollars in remediation costs and voluntary customer reimbursements. A count of about 70,000 affected users and the name of a support contractor were taken out of the summary because the filing does not state them. The change is also listed in the tracker’s change history.
The KYC breach tracker and the September 2026 AML enforcement by the numbers post
What was wrong: Both described how the AML enforcement tracker is sourced and updated inaccurately. The by the numbers post said rows are added as the daily regulatory news review confirms them, usually within a week, that each row carries the primary source, and that each carries a US dollar amount at the rate on the record. No row had been added since 27 August 2026, five rows cite a company, researcher or press source rather than the authority, and the conversion rate is not recorded. The breach tracker said every incident links its primary source in its cited sources and has a row in the enforcement tracker, and that the page is reviewed monthly. Coinbase had no entry in the cited sources, most incidents rest on researcher or press reports, and Persona, AU10TIX and Veriff have no row.
What it says now: The by the numbers post now says that rows are added by hand with no fixed schedule, that each row links one source labelled with its type, and that the US dollar figure is an approximate conversion. The breach tracker now says incidents are added by hand with no fixed schedule, cites Discord’s announcement and Coinbase’s filing with the SEC, names the incidents that have tracker rows, and links the tracker’s change history.
The news article on the Zyphe and Supra partnership
What was wrong: The article quoted Philip Kwon, Supra’s Director of Partnerships, as speaking “in a post announcing the partnership”, but only the first sentence of the quotation matched Supra’s post. The rest of the quoted text did not appear there.
What it says now: The quotation now reproduces Supra’s announcement of 8 August 2025 word for word, and the link points to that post.
The money services business (MSB) glossary entry
What was wrong: The entry stated that MSB registration “renewal is required every two years”, and that a registrant must “update registration within 180 days if anything material changes: new ownership, new activities, expansion to new states”. Neither matches the rule. Registration runs in fixed two-calendar-year periods rather than two years from the date of filing, and new activities or expansion into new states are not among the events that require re-registration.
What it says now: The passage now follows 31 CFR 1022.380(b): the renewal form is due on or before the last day of the calendar year preceding the renewal period, and re-registration is required when a change of ownership or control forces re-registration under state law, when more than 10 percent of the voting power or equity interests is transferred, or when the number of agents grows by more than 50 percent during a registration period, with those forms due within 180 days of the event. The entry also now answers the question readers actually ask, whether an “MSB license” exists, and states that FinCEN operates a registration rather than a license, which every money services business must file whether or not it is licensed by any state.
The politically exposed person (PEP) glossary entry
What was wrong: The page published eight frequently asked questions of which two were the same question, “What is the difference between a PEP and a sanctioned person?”, with two differently worded answers. The duplicate was also published inside the page’s FAQPage structured data. Separately, the entry described the treatment of PEPs without citing any primary source, and its account of jurisdictional differences predated both the UK amendment that took effect in January 2024 and the EU AML Regulation that applies from July 2027.
What it says now: The duplicate question is replaced with a distinct one on the UK treatment of domestic PEPs, so the page and its structured data now carry eight different questions. The entry has been rewritten against the rule text rather than secondary summaries, and cites Articles 20 to 23 of Directive (EU) 2015/849, Articles 42, 43, 45 and 90 of Regulation (EU) 2024/1624, regulation 35(3A) of the UK Money Laundering Regulations as inserted by SI 2023/1371, the 2020 FinCEN and federal banking agencies joint statement, and FCA finalised guidance FG25/3.
Twenty-two articles across crypto compliance, decentralised identity, VASP and identity-verification topics
What was wrong: A batch of articles was published with the writing brief’s scaffolding still in the body. Twenty-two carried a visible “Hero / opening” or “Definition snippet (GEO-optimised, 53 words)” heading. Ten stated proprietary Zyphe network statistics that had never been confirmed against production data, several left as unfilled placeholders such as “[X%]”, “[Y per million]”, “[~22%]” and “[USD 0.80 to USD 2.50]”, alongside reader-facing notes asking an editor to confirm them before publishing. Three blocks opened with the words “The proprietary stat the brief asked for.” Ten of the same unconfirmed figures also appeared in FAQ answers, stated there as settled fact rather than as placeholders, and so were published inside the pages’ FAQPage structured data. One article carried a testimonial attributed to a named individual at a named company with the note “confirm naming” attached, and named that company as a reference customer with a second note about public-naming consent. A vendor comparison stated on its face that its scoring was “bracketed for legal review before publishing”.
What it says now: Every scaffolding heading and editor note is removed, in article bodies and in FAQ answers alike. Every unconfirmed proprietary statistic is removed rather than replaced with an estimate, and the surrounding passages now make the qualitative point without a number attached; where a passage existed only to carry such a number, it is gone. The unattributed testimonial is removed and the reference deployment is described without naming the company. The vendor comparison keeps its caveat that readers should run their own diligence, without the internal note. Separately, forty FAQ answers had been written with markdown links, which the FAQ renderer does not parse, so readers saw the raw “[text](url)” markup; those now read as plain prose.
The KYC vs KYB guide
What was wrong: An FAQ answer stated that combined KYC and KYB verification on the Zyphe network takes “approximately under 24 hours” against an industry baseline of “4-7 business days”, and carried the internal note “Numbers bracketed for editor confirmation against current production telemetry” in the reader-facing text. The same unconfirmed figures were published inside the page’s FAQPage structured data.
What it says now: The unconfirmed performance claim and the editor note are gone from both the page and its structured data. The page also now cites Sumsub’s own advisory for the intrusion it describes, and states the timeline correctly: the intrusion dated to July 2024, was found during a January 2026 review and was disclosed on 4 February 2026.
The adverse media screening guide
What was wrong: The article carried a Zyphe network false-positive rate of “roughly 35 to 45 percent” that had never been confirmed against production telemetry, alongside the internal editor note asking for that confirmation, both visible to readers. It also attributed an 85 to 95 percent screening false-positive range to LexisNexis Risk Solutions, and its FAQ credited FATF Recommendation 12 with making adverse media screening mandatory. Recommendation 12 covers politically exposed persons.
What it says now: The unconfirmed proprietary figure and the editor note are gone. The 85 to 95 percent range is attributed to its actual source, Facctum’s AML false positive report, and is now stated as covering AML screening generally rather than adverse media specifically; LexisNexis Risk Solutions is cited only for the “95 percent or more” figure it actually publishes, itself sourced to KPMG. The regulatory framing now says that no single statute names the control verbatim, and points to FATF Recommendations 10 and 12, the FFIEC examination manual and Regulation (EU) 2024/1624 as the risk-based basis. The TD Bank resolution is now explicitly flagged as a transaction-monitoring case rather than an adverse media enforcement action.
Six industry pages covering AML for banking, crypto, fintech, government and neobanks, and KYC for banking
What was wrong: The pages stated that a FinCEN “AML/CFT Program Rule” took effect on 1 January 2026 and introduced a new “reasonably designed and risk-based” standard. Neither half was correct.
What it says now: FinCEN’s programme modernisation proposal is described as a proposal, issued as a notice of proposed rulemaking on 7 April 2026, with nothing yet binding. The separate investment-adviser AML rule is dated to its actual application date of 1 January 2028. The “reasonably designed and risk-based” wording is attributed to its real source, the Anti-Money Laundering Act of 2020 at 31 U.S.C. 5318(h)(2)(B)(iv), rather than to a 2026 rule.
Two industry pages, AML for fintech and AML for neobanks
What was wrong: The pages dated the EU Instant Payment Regulation (Regulation (EU) 2024/886) to January 2026, and stated that it made batch-only transaction monitoring non-compliant.
What it says now: The euro-area deadlines are stated correctly as 9 January 2025 for receiving instant credit transfers and 9 October 2025 for sending them, with payment service providers outside the euro area following in 2027. The monitoring claim was removed: the Regulation makes no such requirement, and on sanctions its Article 5d runs the other way, prohibiting per-transaction screening during execution and instead requiring customer-base screening at least once each calendar day and immediately after any listing change.
Coverage and ownership figures used across product and blog pages
What was wrong: Two quantified claims were in circulation that no Zyphe measurement supported: an ownership-tracing figure expressed as a precise percentage, and a corporate-registry count described as European.
What it says now: The ownership claim is stated qualitatively, as support for low ownership thresholds configurable per risk tier. The registry count is stated as the canonical figure of 240+ corporate registries worldwide, without the European qualifier. Both retired figures were removed from the claims registry so they cannot reappear.