Regulator Pulse: AML / Sanctions Events, 2026-02-01 → 2026-04-29¶

This is a CCO/MLRO-facing chronological log of AML, sanctions, and BSA-related regulator actions published between 2026-02-01 and today (2026-04-29). Every event below cites the regulator's primary source — press releases, signed orders, Federal Register notices, Council of the EU press corner, FATF outcomes, FCA final notices, FINTRAC public-notice pages. Industry briefings were used only as navigation aids; they are not cited here. Each entry states what an MLRO needs to do or know differently because of the action — not generic awareness language. If a milestone in the window is part of a longer rulemaking, the entry describes the milestone in the window, not the full history. The window is unusually dense: a joint US AML/CFT NPRM, two reputation-risk rules, SR 26-2, AMLA's first wave of CDD/sanctions RTS consultations, the FATF grey-listing of Kuwait and Papua New Guinea, FinCEN's first Section 311 action in three years, and the EU's 20th Russia sanctions package all landed inside 12 weeks.

1. US Federal Reserve / OCC / FDIC — Model Risk & Reputation Risk¶

2026-02-23 · Federal Reserve — Proposes to codify removal of reputation risk from supervision¶

What it is (1 sentence): The Federal Reserve Board issued an NPRM to formally codify the June 2025 removal of "reputation risk" as a supervisory factor. What changed for AML buyers (2-3 sentences): Examiners can no longer downgrade an institution because a customer base "looks bad" — only material financial risk counts. MLROs whose risk-rating models cite reputation as a factor (e.g. for "high-risk industry" customer segments, crypto, cannabis, MSBs) should re-document those tiers around concrete BSA/sanctions risk drivers before their next exam, because reputation-only rationale is now affirmatively prohibited in the Compliance Manifest if the policy invokes it. Comments closed 2026-04-27. Source: Federal Reserve Press Release, 2026-02-23

2026-04-07 · OCC + FDIC — Final rule prohibiting reputation risk in supervision¶

What it is (1 sentence): The OCC and FDIC jointly issued a final rule prohibiting their examiners from criticizing banks on the basis of reputation risk and from "encouraging" account closures based on lawful but disfavored activity. What changed for AML buyers (2-3 sentences): "Debanking" of legal-but-controversial customers (firearms, crypto, payday, cannabis-adjacent) cannot be ordered or hinted at by examiners — institutions that have used examiner pressure as cover to exit those segments must now document an actual BSA/sanctions risk basis for any exit decision. MLROs running periodic customer-risk reviews should expect challenge if the only documented rationale was "regulatory expectation." Effective 60 days after Federal Register publication. Source: OCC News Release NR-IA-2026-26, 2026-04-07 · FDIC FIL on the final rule

2026-04-17 · Federal Reserve / OCC / FDIC — SR 26-2 Revised Model Risk Management Guidance¶

What it is (1 sentence): The agencies jointly issued revised, interagency model risk management guidance superseding both SR 11-7 and the 2021 BSA/AML-specific SR 21-8. What changed for AML buyers (2-3 sentences): Transaction monitoring, sanctions screening, name-matching, customer risk-rating, and CDD scoring models are now governed under a single MRM framework alongside credit and market models — separate AML-specific MRM guidance no longer exists. Buyers must add SR-26-2-aligned model documentation (purpose statement, conceptual soundness, ongoing monitoring, outcome analysis, tiering) for any rule that scores or categorizes customers; the Compliance Manifest should now carry a model-inventory entry per scenario, not just per system. Generative and agentic AI components are explicitly carved out and require a separate governance regime. Source: SR 26-2, 2026-04-17 · SR 26-2 Attachment (full guidance) · OCC Bulletin 2026-13 · FDIC FIL on SR 26-2

2026-02-19 · OCC — February 2026 enforcement actions (terminations only)¶

What it is (1 sentence): OCC announced five enforcement-action terminations and zero new BSA/AML actions for the month. What changed for AML buyers (2-3 sentences): The five terminated formal agreements (First Federal Savings Bank of Kentucky, Hiawatha National, Minnstar, North Side Federal of Chicago, Unity National of Houston) are useful read-across for community banks under existing BSA orders — they document what "demonstrated compliance" looks like over a 12-30 month remediation cycle. Notably absent from the month: any new public BSA/AML cease-and-desist, consistent with the Treasury "stop measuring paperwork" tone seen in the April NPRM. Source: OCC News Release NR-OCC-2026-8, 2026-02-19

2026-03-18 · OCC — March 2026 enforcement actions (one prohibition, four terminations)¶

What it is (1 sentence): OCC's March release included one new Order of Prohibition (a former Old National Bank teller, ~$19K unauthorized withdrawals) and four formal-agreement terminations. What changed for AML buyers (2-3 sentences): No new bank-level BSA/AML enforcement was published for the month, continuing the 2026 pattern of supervisory rather than punitive activity at the OCC. MLROs with insider-risk programs should note the ongoing pattern of low-dollar insider cases driving prohibition orders even where dollar-impact is small. Source: OCC News Release NR-OCC-2026-15, 2026-03-18

2. FinCEN — Effectiveness Rule, Section 311, GTOs, Whistleblower¶

2026-02-13 · FinCEN — Launches public Whistleblower webpage¶

What it is (1 sentence): FinCEN launched a confidential "Office of the Whistleblower" portal accepting tips on BSA, sanctions, and related national-security violations. What changed for AML buyers (2-3 sentences): Employees, contractors, and third parties now have a one-click route to report perceived AML or sanctions failures to Treasury, with awards of 10–30% of monetary penalties payable from the $300M Financial Integrity Fund once the implementing rule lands. Internal escalation paths and non-retaliation policies should be re-tested now — by the time a tip is filed externally, the audit ledger needs to show the firm took the original internal report seriously. Source: FinCEN Whistleblower Office page · Treasury press release on whistleblower portal launch

2026-02-26 · FinCEN — Section 311 NPRM against MBaer Merchant Bank AG (Switzerland)¶

What it is (1 sentence): Treasury found Swiss-based MBaer Merchant Bank a "primary money laundering concern" and proposed Special Measure Five — full prohibition of US correspondent accounts. What changed for AML buyers (2-3 sentences): This is the first new Section 311 action in roughly three years and revives a tool many programs had treated as dormant; correspondent banking teams must add a Section 311 monitoring control to their nested-account screening, not just SDN. Covered institutions are required to (a) close any direct MBaer correspondent account, (b) take reasonable steps not to process transactions flowing through any third-party foreign bank's correspondent account if MBaer is involved, and (c) apply enhanced due diligence on all foreign correspondent accounts to detect MBaer exposure. Comment period closed 2026-04-01. Source: Treasury Press Release SB0408, 2026-02-26 · Federal Register notice 2026-04033, published 2026-03-02 · MBaer NPRM PDF

2026-02-27 · FinCEN — Exemptive Relief for Minnesota fraud GTO¶

What it is (1 sentence): FinCEN narrowed its January 2026 Minnesota benefits-fraud GTO so banks need not file on transactions originated by the 16 categories of CDD-exempt entities or (temporarily, until 2026-05-13) by their own account-holder customers. What changed for AML buyers (2-3 sentences): Banks operating in Hennepin and Ramsey counties get breathing room to update systems but the $3,000 threshold and base reporting obligation remain. MSBs are explicitly not covered by this relief. MLROs at MN-footprint banks should treat this as a temporary scoping change, not a wind-down. Source: Original Minnesota GTO Order, 2026-01-09 · Minnesota GTO FAQs

2026-03-10 · FinCEN — Expanded Southwest Border Geographic Targeting Order¶

What it is (1 sentence): FinCEN expanded its Southwest border GTO to additional New Mexico and Arizona counties, requiring MSBs to file CTRs on cash transactions between $1,000 and $10,000. What changed for AML buyers (2-3 sentences): The reduced $1,000 threshold survives unchanged from prior rounds and applies through 2026-09-02; newly-covered MSBs had a 30-day onboarding window ending 2026-04-06. MLROs of bank holding companies with MSB customers in those counties should expect a sharp increase in the volume of upstream alert review and document custodian-bank dependency on MSB CTR filings before any 314(a) request. Source: FinCEN news release on expanded Southwest Border GTO, 2026-03-10 · Southwest Border GTO FAQs (issued 2026-03-19)

2026-03-30 · FinCEN — Whistleblower Incentives & Protections NPRM¶

What it is (1 sentence): FinCEN issued the rulemaking that operationalizes its February whistleblower portal, setting award criteria, claim process, and anti-retaliation protections. What changed for AML buyers (2-3 sentences): Awards of 10–30% of collected sanctions create a strong financial incentive for current and former employees to report — particularly at firms with active SAR backlogs or sanctions-screening tuning gaps. Compliance teams should review their internal reporting channel KPIs (median triage time, attribution to outcome) and ensure escalation paths to the Board's audit committee are documented in the audit ledger. Comments due 2026-06-01. Source: Federal Register: Whistleblower Incentives and Protections, published 2026-04-01

2026-04-07 · FinCEN + OCC + FDIC + NCUA — AML/CFT Program NPRM (the "Effectiveness Rule")¶

What it is (1 sentence): A coordinated NPRM from FinCEN with parallel proposals from OCC, FDIC, and NCUA reframes the BSA program rule around an explicit "effective, risk-based, reasonably designed" standard implementing the AMLA 2020 mandate. What changed for AML buyers (2-3 sentences): A documented enterprise-wide AML/CFT risk assessment becomes a pillar (not just expected practice), and FinCEN national priorities must be incorporated into the program; "effectiveness" is split into (1) program established and (2) program maintained, distinguishing technical from systemic failure. MLROs should kick off a gap analysis now — comments are due 2026-06-09 and the proposed implementation period is 12 months after a final rule. Expected final rule late 2026 / early 2027. Source: Federal Register notice 2026-07033, published 2026-04-10 · FinCEN Fact Sheet PDF · Key Changes summary PDF · OCC Bulletin 2026-11 · Joint OCC/FDIC/NCUA news release NR-IA-2026-25

3. EU AMLA — Single Rulebook in Motion¶

2026-02-09 · AMLA — Three draft RTS consultations open (CDD, occasional/linked transactions, pecuniary sanctions)¶

What it is (1 sentence): AMLA opened simultaneous public consultations on three core draft RTS implementing AMLR Articles 28(1) and 19(9) and AMLD6 Article 53(10). What changed for AML buyers (2-3 sentences): The CDD RTS sets EU-wide minimum data points and verification methods that will replace each member-state's local list — non-EU firms with EU subsidiaries must align before AMLR application date 2027-07-10. The pecuniary-sanctions RTS will determine how breaches are scored across member states, ending the current dispersion in fine levels; consultation closed 2026-03-09 with the others closing 2026-05-08, and AMLA must submit final drafts to the Commission by 2026-07-10. Source: AMLA consultation: CDD RTS · AMLA consultation: Business relationships and linked transactions · AMLA consultation: Pecuniary sanctions and administrative measures

2026-03 · AMLA — Data-collection exercise begins for direct-supervision selection methodology¶

What it is (1 sentence): AMLA opened the data-collection phase used to calibrate the methodology by which the first 40 directly-supervised obliged entities will be selected in 2027. What changed for AML buyers (2-3 sentences): Cross-border financial groups operating in 6+ member states should treat the data submission as the input that determines whether they are selected for direct AMLA supervision starting January 2028 — incomplete or inconsistent data raises selection-risk. The first selection exercise itself runs from 2027-07-01 over six months; firms have ~14 months to align their group-level AML reporting to AMLA's expected risk-profile structure. Source: AMLA press release: AMLA advances preparations for the 2027 selection exercise · AMLA Single Programming Document 2026-2028 explainer (PDF)

2026-02 · AMLA — Final report on RTS for risk-profile assessment and selection methodology¶

What it is (1 sentence): AMLA published its final reports on draft RTS under AMLAR Art. 12(7) (selection methodology) and AMLD Art. 40(2) (inherent and residual risk-profile assessment of obliged entities). What changed for AML buyers (2-3 sentences): The risk-profile RTS standardizes how supervisors compute inherent and residual risk for each obliged entity — internally, MLROs should ensure their own risk-rating taxonomy can be expressed in the AMLA-defined categories or expect noise in dual reporting. The selection methodology RTS now sits with the European Commission for adoption. Source: AMLA Regulatory Instruments page

4. FATF — Plenary Outcomes¶

2026-02-13 · FATF — Plenary outcomes published (Mexico City, 11–13 Feb)¶

What it is (1 sentence): FATF adopted assessment reports for Austria, Italy, and Singapore under the new round; added Kuwait and Papua New Guinea to the grey list; flagged Algeria and Namibia for on-site re-assessment; and approved publications on cyber-enabled fraud and offshore VASPs. What changed for AML buyers (2-3 sentences): MLROs at firms with Kuwait or PNG exposure must apply enhanced due diligence to natural- and legal-person customers from those jurisdictions, and update screening lists and country-risk scoring tables now (not when MERs publish). The assessment-round reports for AT/IT/SG are scheduled for publication in April–May 2026 after the global QC review — country-risk teams should expect to refresh inherent-risk scoring for those three within the next 60 days. Source: FATF Outcomes of the Plenary, 11-13 February 2026 · FATF Jurisdictions under Increased Monitoring, 13 February 2026

2026-02-13 · FATF — Giles Thomson (UK) appointed as next FATF President¶

What it is (1 sentence): FATF members appointed Giles Thomson, Director of the UK's Office of Financial Sanctions Implementation, as FATF President for a two-year term beginning 2026-07-01. What changed for AML buyers (2-3 sentences): A UK-sanctions-led presidency signals continued FATF emphasis on sanctions-evasion typologies, beneficial ownership, and Russia-related illicit-finance work. UK firms in particular should expect tighter operational alignment between OFSI guidance and FATF outputs over the two-year term. Source: FATF Plenary Outcomes, 11-13 February 2026

5. UK FCA — Annex 1 Supervision and Final Notices¶

2026-02-23 · FCA — Final Notice issued to Stallion Money Limited¶

What it is (1 sentence): FCA published a Final Notice in respect of Stallion Money Limited following a Decision Notice dated 2026-01-20. What changed for AML buyers (2-3 sentences): One of several enforcement endpoints the FCA has produced for small payment/MSB-style firms during the window — useful as a comparative baseline if your firm operates near that segment. MLROs should not extrapolate read-across to large-bank policy, but the cancellation pattern reinforces FCA willingness to remove permission rather than fine when control failings persist at small Annex 1-adjacent firms. Source: FCA Final Notice: Stallion Money Limited (2026)

2026-03-09 · FCA — Final Notice cancelling Taj Exchange Ltd registration¶

What it is (1 sentence): FCA cancelled Taj Exchange Ltd's registration after the Tribunal struck out the firm's reference, formalising removal from the register. What changed for AML buyers (2-3 sentences): Confirms the FCA's pattern of using registration cancellation as a primary AML tool against small MSBs and currency exchanges, ahead of fines. Firms relying on similar registration permissions should pre-emptively confirm their MLR-2017 registration data is current and that Tribunal-disclosable matters are documented. Source: FCA Decision Notice: Taj Exchange Ltd (2026)

2026-03-20 · FCA — Statement on financial crime risks when dealing with Annex 1 firms¶

What it is (1 sentence): FCA published a statement reminding regulated firms of obligations to perform proper due diligence on unregulated lenders, safe-custody providers, money brokers, and financial-leasing firms ("Annex 1 firms") that they bank or service. What changed for AML buyers (2-3 sentences): MLROs at FCA-regulated banks must explicitly extend their EDD frameworks to Annex 1 counterparties — onboarding controls, periodic reviews, and trigger-event reviews need an "Annex 1 customer" tag. The statement follows the FCA's direct engagement with ~300 firms in late 2025 and signals enforcement readiness; expect supervisors to ask for evidence of post-March 2024 governance-control improvements at next inspection. Source: FCA statement: Risks for firms dealing with unregulated lenders, 2026-03-20

2026-04-01 · FCA — New Skilled Person Panel takes effect (12 lots, 4-year term)¶

What it is (1 sentence): The FCA's revised Skilled Person Panel — the pool of firms appointed under FSMA s. 166 to conduct Skilled Person reviews — became effective 2026-04-01 and runs to 2030-03-31. What changed for AML buyers (2-3 sentences): Section 166 reviews remain the FCA's primary AML enforcement-precursor tool (used in over half of recent enforcement matters). MLROs should maintain a "ready-for-s.166" dossier — control inventory, BWRA, MI samples, training logs — because once a notice issues, the panel firm has a 4-week cold start and the firm pays. Source: FCA Skilled Person Reviews page

6. Canada FINTRAC — AMP Penalties¶

2026-02-05 · FINTRAC — AMP against Commerciale I.C. – Pacific Inc. ($224,235)¶

What it is (1 sentence): FINTRAC imposed an AMP of $224,235 on Montréal-based MSB Commerciale I.C. – Pacific Inc. for five violations. What changed for AML buyers (2-3 sentences): The penalty has been appealed to Federal Court — appeals from the Tutus Money / 2024 cohort show a multi-year tail. MLROs at Canadian MSBs should treat 5-violation AMPs in the $200K range as the new floor for material PCMLTFA non-compliance. Source: FINTRAC public notice: Commerciale I.C. – Pacific Inc., 2026-02-05

2026-02-05 · FINTRAC — AMP against TreasureMeta Corporation ($24,750)¶

What it is (1 sentence): FINTRAC imposed an AMP of $24,750 on Markham, Ontario MSB TreasureMeta Corporation (registered as Cappo FX Inc.) for one violation. What changed for AML buyers (2-3 sentences): Single-violation AMPs in the $25K range typically reflect reporting-form or registration deficiencies; the case stays open with no appeal filed. Useful baseline for benchmarking corrective-action expectations on small Canadian MSBs. Source: FINTRAC public notice: TreasureMeta Corporation, 2026-02-05

2026-02-10 · FINTRAC — AMP against Century 21 Heritage Group Ltd. ($148,912.50)¶

What it is (1 sentence): FINTRAC imposed an AMP of $148,912.50 on real-estate broker Century 21 Heritage Group Ltd. for one violation. What changed for AML buyers (2-3 sentences): Real-estate sector continues to draw AMPs concentrated on a single high-impact violation type (typically receipt-of-funds records or record-keeping). The penalty has been appealed to Federal Court. Compliance teams covering real-estate originators should verify that their receipt-of-funds and unrepresented-party records meet PCMLTFA evidentiary standards. Source: FINTRAC public notice page (search "Century 21 Heritage Group")

2026-02-12 · FINTRAC — AMP against Manor Windsor Realty Ltd. ($107,250)¶

What it is (1 sentence): FINTRAC imposed an AMP of $107,250 on Manor Windsor Realty Ltd. for four violations; the penalty has been appealed. What changed for AML buyers (2-3 sentences): Second real-estate AMP in the same week reinforces the sectoral focus. Compliance leads at Canadian real-estate firms should compare their own STR/LCTR/receipt-of-funds compliance evidence against the Manor Windsor and Century 21 cases — they suggest FINTRAC is now scoring on completeness of records, not just submission. Source: FINTRAC public notice page (search "Manor Windsor Realty")

2026-03-26 · FINTRAC — AMP against Northern Isga Foundation ($91,162.50)¶

What it is (1 sentence): FINTRAC imposed an AMP of $91,162.50 on Northern Isga Foundation for four violations; case remains open. What changed for AML buyers (2-3 sentences): First non-MSB / non-real-estate AMP of the window. The case underlines FINTRAC's expanded enforcement posture across reporting entity types. Charity-adjacent and foundation-structure customers should be re-tested against PCMLTFA reporting-trigger logic. Source: FINTRAC public notice page (search "Northern Isga Foundation")

7. OFAC — Sanctions Designations¶

2026-04-15 · OFAC — Major Iran/Hizballah designation under "Economic Fury" campaign¶

What it is (1 sentence): OFAC designated more than two dozen individuals, entities, and vessels in a network led by Mohammad Hossein Shamkhani for moving multi-billion-dollar Iranian and Russian petroleum sales, plus a separate Iran-gold/Hizballah-financing network. What changed for AML buyers (2-3 sentences): Sanctions and trade-finance teams must immediately ingest the new SDN entries and re-screen letters of credit, vessel-tracking, bunker payments, and gold-trade counterparties; ownership-chain dragnet (≥50% rule) should be re-run against any joint-stock counterparty in the petrochemical or precious-metals trade. Secondary-sanctions exposure is real: non-US banks that maintain correspondent relationships with the named designees risk being added to the SDN list themselves. Source: Treasury Press Release SB0492, 2026-04-15

2026-04-23 · OFAC — Iran EO 13902 designations of 19 entities and 19 vessels¶

What it is (1 sentence): OFAC added 19 entities and 19 vessels to the SDN List under Executive Order 13902 for petrochemical-sector activity, spanning China, Hong Kong, Panama, Marshall Islands, Liberia, and Vietnam. What changed for AML buyers (2-3 sentences): Trade-finance and shipping-finance teams must update vessel sanctions screening (IMO numbers, prior names) and re-run letters of credit, charter-party agreements, and P&I cover decisions. Multi-jurisdictional flag-of-convenience patterns are clearly the OFAC focus — country-risk scoring for Marshall Islands and Liberia flagged tonnage should be reviewed. Source: Federal Register: Notice of OFAC Sanctions Actions, 2026-04-23 · OFAC Recent Actions page

8. EU Council — Sanctions Packages¶

2026-03-16 · EU Council — Iran human-rights sanctions: 16 persons + 3 entities listed¶

What it is (1 sentence): The Council adopted restrictive measures against 16 additional individuals and 3 entities (including the IRGC's Mohammad Rasulullah and Imam Reza Corps) for serious human-rights violations in connection with the January 2026 protests in Iran. What changed for AML buyers (2-3 sentences): EU-regulated firms must immediately freeze any funds and economic resources belonging to the new listings and treat them as full-blockable persons. The total under the EU Iran human-rights regime is now 263 individuals and 53 entities — sanctions screening teams should validate that the EU consolidated list refresh was ingested within 24 hours of publication. Source: EU Council press release, 2026-03-16

2026-04-23 · EU Council — 20th sanctions package against Russia¶

What it is (1 sentence): The Council adopted the EU's 20th sanctions package: 120 new individual/entity listings, 20 additional Russian banks excluded from EU markets (bringing total to 70), a sectoral ban on transactions with any Russian crypto-asset service provider, and prohibitions targeting RUBx and the digital rouble. What changed for AML buyers (2-3 sentences): The crypto-sector ban materially extends EU sanctions reach into stablecoin and CBDC-adjacent payment rails — EU-regulated CASPs must now block any onboarding or service relationship with Russian-CASP counterparties and review historical correspondent or VASP-to-VASP exposure. Banks already under correspondent-banking pressure on Russia must extend the screening to four newly-listed banks in Kyrgyzstan, Laos, and Azerbaijan, where the anti-circumvention tool is now active. 36 energy-sector listings and the shadow-fleet additions mean fresh re-screening of vessels and energy-trade counterparties. Source: EU Council press release, 2026-04-23 · European Commission summary, 2026-04-23 · EU Sanctions Helpdesk on the 20th package

2026-04-23 · EU Council — Belarus listings under Decision 2026/503¶

What it is (1 sentence): Adopted concurrently with the 20th Russia package, Council Implementing Decision (CFSP) 2026/503 added three new listings tied to the Belarusian military-industrial complex and the Lukashenka regime. What changed for AML buyers (2-3 sentences): Sanctions teams must update Belarus-specific screening lists alongside the Russia package — the two regimes operate as a coordinated unit but use distinct legal bases, and AML teams sometimes miss the Belarus delta. Trade-finance for dual-use machinery and metals to Belarusian end-users requires renewed end-user attestations. Source: EU Council 20th package press release (covers Belarus listings)

9. Australia AUSTRAC — Tranche 2 Implementation¶

2026 · AUSTRAC — Regulatory expectations for 2025–26 published; Tranche 2 enforceable from 2026-07-01¶

What it is (1 sentence): AUSTRAC's published 2025–26 regulatory expectations confirm Tranche 2 (lawyers, accountants, real-estate agents, dealers in precious metals and stones) will be enforceable from 2026-07-01 with enrolment expected in advance. What changed for AML buyers (2-3 sentences): Australian DNFBPs need to be enrolled and have a documented AML/CTF program, board-approved, before 2026-07-01 — that deadline falls outside the research window but the operational deadline for "ready" is now. Enforceable undertakings remain AUSTRAC's primary tool: firms should expect EUs rather than fines for first-cycle non-compliance. Source: AUSTRAC: Regulatory expectations and priorities 2025–26 · AUSTRAC AML/CTF Reform hub

10. NY DFS — Industry Letters¶

2026-04-22 · NY DFS — Industry letter reminding banks of fair-lending obligations under Exec. Law 296-a¶

What it is (1 sentence): DFS issued an industry letter reminding all New York Banking Law-regulated entities that disparate-impact lending may constitute unlawful discriminatory practice under Executive Law Section 296-a. What changed for AML buyers (2-3 sentences): While not strictly AML, this letter signals DFS's intent to police credit-decisioning models — and in 2026 those models increasingly share infrastructure with AML risk-rating engines. Firms running unified customer-risk-scoring platforms should ensure model-fairness testing is documented in the same Compliance Manifest the AML team uses. Source: NY DFS Industry Letter on Fair Lending, 2026-04-22

Themes (last 90 days)¶

1. Enforcement softens, rulemaking accelerates. New BSA/AML cease-and-desist orders are absent from OCC's Feb–Mar releases, while the FinCEN/OCC/FDIC/NCUA joint Effectiveness NPRM, the SR 26-2 model-risk rewrite, and the reputation-risk final rule represent the largest US AML-program reset since the AMLA 2020. The Treasury narrative ("stop measuring paperwork") is consistent across all four federal agencies.

2. Models are now first-class compliance citizens. SR 26-2 collapsed the BSA/AML-specific model-risk regime (SR 21-8) into the general MRM framework. Combined with the Effectiveness NPRM's emphasis on documented, risk-based program design, examiners will expect a model inventory that treats TM, sanctions screening, name-matching, and CDD scoring identically to credit and market models.

3. Sanctions reach deeper into crypto and correspondent banking. OFAC's Iran "Economic Fury" actions and the EU's 20th-package crypto-sector ban represent a structural shift: CASP-level transaction prohibitions, RUBx and CBDC bans, and Section 311 against MBaer all extend sanctions into the rails AML programs depend on. Correspondent-bank EDD frameworks need a Section 311 control, and crypto VASPs need a Russia-sectoral block.

4. EU AMLA shifts from talking to building. Three RTS consultations, two final reports, and the data-collection-for-selection exercise all happened inside ten weeks. By 2026-07-10, AMLA must submit final RTS to the Commission; obliged entities operating in 6+ member states should treat 2026 H2 as the last preparation window before AMLA's 2027 selection of its first 40 directly-supervised firms.

Sources Index (Primary URLs by Regulator)¶

US — Federal Reserve / OCC / FDIC / NCUA¶

https://www.federalreserve.gov/newsevents/pressreleases/bcreg20260223a.htm
https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm
https://www.federalreserve.gov/supervisionreg/srletters/SR2602a1.pdf
https://www.occ.gov/news-issuances/news-releases/2026/nr-ia-2026-26.html
https://www.occ.gov/news-issuances/news-releases/2026/nr-ia-2026-25.html
https://www.occ.treas.gov/news-issuances/news-releases/2026/nr-occ-2026-8.html
https://www.occ.treas.gov/news-issuances/news-releases/2026/nr-occ-2026-15.html
https://www.occ.treas.gov/news-issuances/bulletins/2026/bulletin-2026-13.html
https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-11.html
https://www.fdic.gov/news/financial-institution-letters/2026/agencies-revise-interagency-model-risk-management-guidance
https://www.fdic.gov/news/financial-institution-letters/2026/agencies-issue-final-rule-prohibit-use-reputation-risk

US — FinCEN / Treasury¶

https://www.fincen.gov/contact/office-whistleblower
https://home.treasury.gov/news/press-releases/sb0322
https://home.treasury.gov/news/press-releases/sb0408
https://home.treasury.gov/news/press-releases/sb0492
https://www.fincen.gov/system/files/2026-02/MBaer-NPRM.pdf
https://www.federalregister.gov/documents/2026/03/02/2026-04033/proposal-of-special-measure-regarding-mbaer-merchant-bank-ag-as-a-financial-institution-operating
https://www.fincen.gov/system/files/2026-01/Minnesota-Fraud-GTO-Order.pdf
https://www.fincen.gov/system/files/2026-01/Minnesota-Fraud-GTO-FAQs.pdf
https://www.fincen.gov/news/news-releases/fincen-issues-expanded-southwest-border-geographic-targeting-order
https://www.fincen.gov/system/files/2026-03/SWB-GTO-FAQs.pdf
https://www.federalregister.gov/documents/2026/04/01/2026-06271/whistleblower-incentives-and-protections
https://www.federalregister.gov/documents/2026/04/10/2026-07033/anti-money-laundering-and-countering-the-financing-of-terrorism-programs
https://www.fincen.gov/system/files/2026-04/Program-NPRM-FactSheet.pdf
https://www.fincen.gov/system/files/2026-04/Key-Changes-Program-NPRM.pdf

US — OFAC¶

https://www.federalregister.gov/documents/2026/04/23/2026-07897/notice-of-ofac-sanctions-actions
https://ofac.treasury.gov/recent-actions

US — NY DFS¶

https://www.dfs.ny.gov/industry_guidance/industry_letters/il20260422_fair_lending

EU — AMLA¶

https://www.amla.europa.eu/policy/regulatory-instruments_en
https://www.amla.europa.eu/policy/public-consultations/consultation-draft-rts-customer-due-diligence_en
https://www.amla.europa.eu/policy/public-consultations/consultation-draft-rts-criteria-identifying-business-relationships-occasional-and-linked_en
https://www.amla.europa.eu/policy/public-consultations/consultation-draft-rts-pecuniary-sanctions-administrative-measures-and-periodic-penalty-payments_en
https://www.amla.europa.eu/amla-advances-preparations-2027-selection-exercise_en
https://www.amla.europa.eu/document/download/002fd9dd-9d75-4675-be3c-c1a2da5ced83_en?filename=SPD+2026-2028+Explainer.pdf

EU — Council¶

https://www.consilium.europa.eu/en/press/press-releases/2026/03/16/iran-council-sanctions-an-additional-16-persons-and-three-entities-over-serious-human-rights-violations/
https://www.consilium.europa.eu/en/press/press-releases/2026/04/23/russia-s-war-of-aggression-against-ukraine-20th-round-of-stern-eu-sanctions-hits-energy-military-industrial-complex-trade-and-financial-services-including-crypto/
https://finance.ec.europa.eu/news/eu-adopts-20th-package-sanctions-against-russia-2026-04-23_en
https://eu-sanctions-compliance-helpdesk.europa.eu/20th-package-sanctions-against-russia_en

FATF¶

https://www.fatf-gafi.org/en/publications/Fatfgeneral/outcomes-FATF-plenary-february-2026.html
https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-february-2026.html

UK FCA¶

https://www.fca.org.uk/publication/final-notices/stallion-money-limited-2026.pdf
https://www.fca.org.uk/publication/decision-notices/taj-exchange-ltd-2026.pdf
https://www.fca.org.uk/news/statements/firms-must-do-proper-checks-when-dealing-unregulated-lenders
https://www.fca.org.uk/about/how-we-regulate/supervision/skilled-persons-reviews

Canada — FINTRAC¶

https://fintrac-canafe.canada.ca/new-neuf/nr/2026-02-05-eng
https://fintrac-canafe.canada.ca/new-neuf/nr/2026-02-05-1-eng
https://fintrac-canafe.canada.ca/pen/4-eng

Australia — AUSTRAC¶

https://www.austrac.gov.au/amlctf-reform/austrac-regulatory-expectations-and-priorities-2025-26
https://www.austrac.gov.au/amlctf-reform