AML Enforcement Tracker

OFAC

OFAC designated alleged facilitators of a Tren de Aragua ATM jackpotting scheme, two Mexican companies and a Tren de Aragua leader tied to illegal gold mining. Seven of the SDN entries list a TRON address that Treasury links to laundering the stolen cash. Treasury puts reported US losses from alleged jackpotting at 40.73 million dollars across over 1,500 attacks as of August 2025.

Takeaway: A designation that lists wallet addresses is a screening rule you can run today, on crypto rails as well as on names.

—

Revolut confirmed that it disclosed customer data to a fraudster who sent requests for information from a legitimate government agency email domain. Affected customers were told the data included dates of birth, addresses, phone numbers and copies of passports and driving licences, and may have included verification selfies, statements and transaction histories. Revolut said a limited number of customers were affected and that its systems and customer funds were unaffected.

Takeaway: A request from a real government email domain is not proof of a real government request; disclosure to authorities needs its own verification step.

OFAC

OFAC designated Xinbi Guarantee, a Telegram-based marketplace serving Southeast Asian scam centres, as a transnational criminal organization, together with two app developers. Its SDN entry lists 52 TRON addresses. Treasury says the marketplace processed the equivalent of over 24 billion dollars in digital assets and fiat currency since around 2022.

Takeaway: Scam-centre marketplaces settle in stablecoins on public chains; the listed wallet addresses are the part of a designation a crypto platform can actually screen.

—

IDScan.net said that on or around 1 September 2026 it received information indicating that certain data may have been accessed without authorization, and that it secured its systems and engaged outside experts. It has not confirmed the scale. A dark web service had advertised more than 153 million US and Canadian driver’s license scans, and nine class actions were filed against the company in the Eastern District of Louisiana between 2 and 4 September.

Takeaway: An ID scanning vendor that keeps the scans holds every customer’s identity documents at once; retention is the exposure.

OFSI

OFSI imposed a penalty of 4,732,830.58 pounds on 11 August 2026, published on 2 September, for 970 payments worth 19,720,127.43 pounds that breached UK sanctions. The notice traces the breaches to screening gaps, alert backlogs and an ownership determination OFSI found unreasonable.

Takeaway: Screening that ignores a corporate legal-form prefix misses the sanctioned company it is looking at.

Gambling Commission

QuinnBet agreed to pay 609,104 pounds, including 193,118 pounds of disgorgement, after the Gambling Commission found its anti-money laundering and customer interaction controls were not effective in practice for 29 months. A platform migration had switched off working limits.

Takeaway: A migration that silently drops a control is a control failure from the day it ships.

OFAC

OFAC settled eight apparent violations covering roughly 121,527 dollars of goods, after the company’s Italian subsidiary shipped to Iran through a distributor in the United Arab Emirates.

Takeaway: Sanctions rules bind entities that US persons own or control almost as tightly as the parent itself.

FinCEN

FinCEN imposed a 125 million dollar penalty, its largest ever on a broker-dealer, after more than 61,500 foreign currency wires worth over 10.5 billion dollars went unmonitored between January 2019 and June 2023. The firm admitted it never closed the gaps a 2018 consent order required it to fix.

Takeaway: An unremediated consent order compounds: the second penalty prices in the first.

OCC

The OCC denied Wise a national trust bank charter, ruling it could not confirm an effective anti-money laundering programme while a 2025 multistate order over late suspicious activity reports and transaction monitoring data integrity remained unresolved.

Takeaway: An open AML order is a licensing blocker, not just a remediation project.

BaFin

BaFin ordered Helaba to remedy customer due diligence failures spanning customer identification, verification, updating of customer data, risk analysis and transaction monitoring. It is the second BaFin money laundering measure against the bank in seven months.

Takeaway: A remediation order with no fine still creates a supervisory record that the next measure builds on.

NYDFS

New York’s Department of Financial Services secured a 50 million dollar penalty from Swedbank and its New York branch for withholding information about its Baltic subsidiaries’ links to the Panama Papers, across responses spanning 2016 to 2019.

Takeaway: The concealment was punished on its own, separately from the underlying money laundering.

DNB

De Nederlandsche Bank fined the payment institution 2,656,250 euros after roughly 4,200 merchants sat outside its transaction monitoring system for 23 months, with alerts closed in bulk and no recorded justification. The penalty was raised because CCV had breached the same rule before.

Takeaway: Coverage gaps outrank tuning: a merchant outside the system generates no alerts to calibrate.

—

The Atlanta auto insurer disclosed a breach affecting 6,998,886 people, exposing names, contact details and driver’s license numbers after an employee’s credentials were compromised.

Takeaway: Driver’s license numbers retained after a verification check are a standing liability, not a record.

DNB

De Nederlandsche Bank fined ABN AMRO 8.5 million euros for inadequate due diligence on high-risk customers, finding monitoring insufficiently critical and customer explanations accepted without verification. It follows a 480 million euro criminal settlement five years earlier.

Takeaway: Accepting a customer explanation without verifying it is not ongoing monitoring.

OFAC

OFAC blocked a network that moved more than 30 million dollars of US drug proceeds through cryptocurrency for Brazil’s PCC, designating two Brazilian nationals and four companies. Brazil then froze roughly 2 billion dollars in related assets.

Takeaway: Crypto rails do not remove the sanctions nexus; they only change which intermediary sees the transaction.

DOJ

EagleBank agreed to pay 9,057,821 dollars in fines plus 736,515 dollars in forfeiture under a non-prosecution agreement, admitting it wilfully failed to run an anti-money laundering programme from 2010 to 2021 while executives overrode compliance staff.

Takeaway: Where senior management overrides compliance, the programme on paper counts for nothing.

SEC

The SEC fined Merrill 7.5 million dollars because its transaction monitoring system only investigated alerts scoring 20 or higher, after Merrill’s own analysis showed lower-scoring events would have produced suspicious activity reports. It took about three years to fix.

Takeaway: A monitoring threshold you know is miscalibrated is a documented failure, not a tuning decision.

FCA

The FCA publicly censured CACEIS UK for weak financial crime controls that let the collapsed wealth manager WealthTek hold client assets it was never permitted to hold. It avoided a financial penalty that the FCA put at about 23.1 million pounds after a 30 percent settlement discount, and agreed a voluntary payment of 31,714,068 pounds to affected clients.

Takeaway: Redress paid to clients is not a penalty, but the permission-scope check that failed is exactly what onboarding due diligence exists to catch.

CBUAE

The Central Bank of the UAE fined a foreign bank branch 20 million dirhams for repeated anti-money laundering and sanctions control failures, and separately fined its head of compliance 300,000 dirhams.

Takeaway: Personal liability for the compliance officer is now a live tool, not a theoretical one.

OFAC, FinCEN

Treasury widened its action against the Cambodian scam conglomerate, adding 9 individuals and 26 entities, while FinCEN moved to sever the renamed Huione affiliate H-Pay from the US financial system.

Takeaway: Designated networks rename and re-form. Screening against a static entity list misses the successor.

Finansinspektionen

Sweden’s financial supervisor fined Ikano Bank 140 million kronor and issued a formal remark for failing to assess how its corporate products could be used to fund crime. No laundering case was alleged.

Takeaway: The general risk assessment is itself an enforceable obligation, independent of whether any transaction went wrong.

Garante per la protezione dei dati personali

Italy’s data protection authority fined Poste Italiane 6,624,000 euros and Postepay 5,877,000 euros for embedding device-surveillance software in banking apps and making consent to it a condition of account access.

Takeaway: A fraud-prevention purpose does not by itself satisfy the GDPR necessity test if a less intrusive control would have worked.

PRA

The PRA fined Bank of London Group £2 million for integrity failings and inadequate cooperation over misrepresenting its capital position.

Takeaway: Regulators want the data trail behind the numbers: source, calculation, sign-off, validation date.

SRA

The SRA fined Ranson Houghton LLP for AML failures, signalling AML enforcement expanding beyond banks into legal services.

Takeaway: AML obligations now bite professional-services firms, not just financial institutions.

EDPB / 25 EU DPAs

25 EU regulators launched a coordinated GDPR transparency enforcement sweep affecting how KYC flows present data processing.

Takeaway: KYC data-collection transparency is now a coordinated enforcement priority.

FinCEN

FinCEN assessed an 80 million dollar penalty, its largest ever against a broker-dealer, for years of gamed trade surveillance and at least 160 suspicious activity reports that were never filed.

Takeaway: Regulators judge an AML programme by what it catches, not by what the written policy says it should catch.

—

Cybernews reported an unsecured database it linked to IDMerit that exposed about one billion personal records across 26 countries, over 203 million of them from the United States. IDMerit told Cybernews it does not own, control or store the underlying data. The database was found on 11 November 2025 and secured the next day.

Takeaway: A large central store of identity records is a target in itself; Cybernews describes this one as unprotected rather than broken into.

—

A breach via a malicious attachment on a third-party support platform went undetected for 18 months (Jul 2024–Jan 2026).

Takeaway: A centralised KYC provider is only as secure as its weakest integration; 18-month dwell time is a monitoring failure.

—

A third-party customer service vendor was compromised, exposing roughly 70,000 government ID photos that the vendor held to review age-related appeals.

Takeaway: Age assurance built on stored ID images moves the honeypot to whichever vendor reviews the appeals.

—

Coinbase disclosed that a threat actor had paid contractors or employees in support roles outside the United States to collect customer data from internal systems, including names, contact details, masked Social Security and bank account numbers, government ID images and balance snapshots, then demanded money not to publish it. Coinbase refused to pay and estimated the cost at about 180 million to 400 million dollars.

Takeaway: An insider/controls failure, not a hack. Privileged access to a central PII store is the attack surface.

DOJ, FinCEN, OCC, Federal Reserve

TD Bank pleaded guilty and paid about $3 billion for Bank Secrecy Act and money-laundering failures — the largest bank ever to plead guilty to conspiracy to commit money laundering. ~$1.8B DOJ, $1.3B FinCEN, $450M OCC, $123.5M Federal Reserve.

Takeaway: More than 90% of transaction volume was never fed into automated monitoring — a coverage gap, not a tuning problem.

DOJ, FinCEN, OFAC, CFTC

Binance agreed to pay more than $4.3 billion to US authorities; founder CZ pleaded guilty, paid a $50M personal fine and stepped down. FinCEN $3.4B civil penalty + 5-year monitorship; OFAC $968M.

Takeaway: Compliance-light by design is now treated as a federal crime, not a growth tactic.