Regulator Pulse: AML / Sanctions Events — July 2026 Forward Calendar¶
This is a CCO/MLRO-facing brief covering active regulatory obligations confirmed in the May–June 2026 window that generate compliance deadlines between 2026-07-01 and 2026-09-30. It is a living forward-calendar companion to the June 2026 edition (2026-06-regulator-pulse.md) and the full chronological log in 2026-05-regulator-pulse.md, which covers the 120-day event window 2026-02-01 → 2026-05-31.
Last updated 2026-08-07. Previous edition: 2026-06-regulator-pulse.md. Full chronological log: 2026-05-regulator-pulse.md — 120 days, 33 events.
Active Forward Calendar — July / August / September 2026¶
✓ COMMENT WINDOW CLOSED · 2026-06-09 · FinCEN / OCC / FDIC / NCUA + OFAC — Effectiveness NPRM AND GENIUS Act Stablecoin NPRM comment deadlines (same day)¶
What it was: Two major NPRMs shared a single comment deadline that closed 2026-06-09. The comment window is now closed; FinCEN will consolidate the docket and a final rule is expected late 2026 / early 2027. No final-rule outcome has been published — the rulemakings are pending.
-
AML/CFT Program "Effectiveness" NPRM (Federal Register 2026-07033): FinCEN, OCC, FDIC, and NCUA jointly reframe the BSA program rule around an "effective, risk-based, reasonably designed" standard implementing the AMLA 2020 mandate. A documented enterprise-wide risk assessment becomes a pillar (not just expected practice), and FinCEN national priorities must be incorporated into the program. "Effectiveness" is split into (1) program established and (2) program maintained — distinguishing technical from systemic failure. Proposed implementation period: 12 months after a final rule. Expected final rule late 2026 / early 2027.
-
GENIUS Act PPSI NPRM (Federal Register 2026-06963): FinCEN and OFAC jointly propose treating permitted payment stablecoin issuers (PPSIs) as financial institutions under the Bank Secrecy Act, and — for the first time — imposing mandatory, legally-binding OFAC sanctions compliance programs under new 31 CFR Part 502.
What MLROs need to do now that the window has closed: - The comment window has closed — the work it triggered has not. Firms that filed a comment letter or completed a gap analysis during the window now hold that work as documented evidence of proactive compliance posture. Firms that deferred should complete the gap analysis anyway: the 12-month implementation clock starts at the final rule, and a gap analysis done now is a head start, not a missed deadline. - Complete a gap analysis against the Effectiveness NPRM's risk-assessment and program-structure requirements if not already done. The 12-month implementation clock starts at the final rule — late-2026 gap analyses may not leave enough time. - Stablecoin issuers and banks sponsoring PPSIs: continue assessing BSA-program equivalence and OFAC-sanctions-program gaps against the PPSI NPRM framework while the rulemaking is pending.
Sources: - Federal Register 2026-07033 — Effectiveness NPRM - FinCEN Fact Sheet - Federal Register 2026-06963 — GENIUS Act PPSI NPRM - Treasury Press Release SB0435
✓ IN EFFECT · 2026-07-01 · AUSTRAC — Tranche 2 enforcement now live for Australian DNFBPs (37 days in); enrolment grace period passed 2026-07-29 (9 days ago)¶
What it is: AUSTRAC's Tranche 2 AML/CTF reform brought Australian lawyers, accountants, real-estate agents, and dealers in precious metals and stones (DPMS) under the AML/CTF Act with mandatory enrolment and board-approved AML/CTF programs, enforceable since 2026-07-01 — 37 days in. AUSTRAC opened enrolment 2026-03-31; newly regulated entities providing a designated service since July 1 without having enrolled were required to do so by 2026-07-29 — now 9 days past.
What MLROs need to do:
- Australian DNFBPs must now be enrolled with AUSTRAC and hold a documented, board-approved AML/CTF program — the enrolment-and-program obligation went live July 1 and firms without one are already out of compliance.
- Entities not yet enrolled should treat July 29 as the operative near-term deadline, not July 1 — enrolment is the floor, not the finish line; CDD, sanctions/PEP screening, and SMR capability must already be operating for any designated service provided since July 1.
- AUSTRAC's stated first-cycle posture favours enforceable undertakings (EUs) over civil penalties (up to A$36.4M per contravention for a corporation, 100,000 penalty units at the $364 Commonwealth penalty-unit value effective 1 July 2026 — corrected from a A$31.3M figure carried in earlier editions, which used the pre-indexation $313 unit value; see 2026-08-aml-data-problem.md for the correction) — but only for firms with documented good-faith compliance efforts. Firms still building one should treat the gap as live exposure, not a future deadline.
- The AML Open Framework's multi-jurisdiction example pattern (examples/austrac_tranche_2_dnfbp/) can serve as the Compliance Manifest template for a Tranche 2-scoped program with a single PR.
Sources: - AUSTRAC: Regulatory expectations and priorities 2025–26 - AUSTRAC AML/CTF Reform hub - AUSTRAC: How to comply — guidance and resources
✓ DEADLINE PASSED · 2026-07-10 · AMLA — Statutory deadline to submit all final RTS to European Commission¶
What it is: AMLA's statutory deadline to submit final draft regulatory technical standards — including the CDD RTS (AMLR Art. 28(1)), the ongoing-monitoring-of-the-business-relationship RTS (AMLR Art. 26), and the targeted-financial-sanctions-screening RTS (AMLR Art. 20(1)(d)) — to the European Commission passed on 2026-07-10 (28 days ago). No AMLA submission press release has been independently verified for this edition; the statutory deadline itself is treated here as passed, not as a confirmed filing outcome — consistent with this brief's practice of not asserting a regulatory outcome it hasn't confirmed.
What happens next — the Commission's 3-month endorsement clock: Once submitted, the Commission has three months to endorse the RTS before they become binding law: a window running 2026-07-10 → 2026-10-10 (64 days remaining as of this edition). After endorsement, the RTS become binding law and obligations apply from the application date specified in each standard. AMLA's 2027 direct-supervision selection exercise (first ~40 entities selected July 2027) uses the same data period as this submission.
What MLROs need to do: - Treat July 10 as the "locked-in" date for the RTS framework. Post-July amendments require a full new legislative cycle — the window to influence the standard closed with the May consultations (all closed by 2026-05-08). - Institutions operating cross-border EU programs should shift from gap-assessment to implementation planning against the now-locked-in standard; the Commission's endorsement (expected by 2026-10-10) is the next hard date to track. - Cross-border groups operating in 6+ member states should complete data submissions for the AMLA 2027 direct-supervision selection exercise, which uses the same data period.
Sources: - AMLA CDD RTS consultation - AMLA business-relationships RTS consultation - AMLA pecuniary-sanctions RTS consultation - AMLA selection exercise press release
What the Framework Shipped in June 2026¶
Four ML/AI roadmap features delivered 2026-06-04 across v0.1.46 + v0.1.47:
| Feature | Version | SR 26-2 / Effectiveness NPRM relevance |
|---|---|---|
| M1 — Triage Queue dashboard page | v0.1.46 | Advisory priority_score with per-alert explanation panel; deterministic, explainable, off-by-default — satisfies MRM advisory-only requirement for ML-assisted alert ranking |
M2 — aml model-inventory CLI |
v0.1.47 | SR 26-2 model-population inventory covering every rule + every python_ref external model + the N1 prioritization scorer; --markdown table ready for model-risk committee reports |
M3 — champion-challenger priority_outcome.json |
v0.1.47 | Precision@k / recall comparison between champion and challenger weights; temporal-leakage guard enforced at runtime — satisfies SR 26-2's independent-challenger validation requirement |
| M4 — point-in-time effective-dated joins | v0.1.47 | DataContract.effective_dated + aggregation_window.enrich emit as-of SQL JOINs so rules resolve reference state contemporaneous with each transaction; closes Pillar 3 (PARTIAL → COVERED) |
These directly address the SR 26-2 and Effectiveness NPRM controls that are now examination-active (112 days from April 17 as of August 7): demonstrable test coverage of ML scoring logic, deterministic replay of flagged alerts, and a model inventory that can be produced on demand.
What the Framework Shipped in May 2026 (Operational Context)¶
The May 31, 2026 security hardening sprint (PRs H0–H6) directly addresses compliance-critical controls that regulators now examine under SR 26-2 and the Effectiveness NPRM:
| PR | Area | What it fixed | SR 26-2 / Effectiveness NPRM relevance |
|---|---|---|---|
| H0 | CI coverage gate | Enforced the 98% floor for real — the gate was non-enforcing (pytest-cov exits 0 on Linux below threshold) | Outcome-analysis discipline: model-risk MRM requires demonstrated test coverage of scoring logic |
| H2 | SQL injection in data sources | _assert_safe_sql_identifier() + _sql_str_literal() validate/escape all table identifiers and file paths interpolated into SQL |
Data-integrity requirement: the audit ledger's hash chain is only meaningful if the underlying data cannot be tampered |
| H4 | Zip-slip in audit packs | _safe_zip_segment() + _assert_safe_zip_path() sanitise all case-id-derived ZIP entry paths against directory traversal |
Regulator-evidence integrity: the ZIP the examiner receives must contain only the intended evidence |
| H5/H6 | Engine correctness | Freshness tz-by-instant (aware datetimes now converted to UTC before comparison, not wall-clock stripped); matched-row observability (lineage-lookup failures now logged with rule_id, not silently swallowed) | Conceptual soundness: SR 26-2 requires demonstrated correctness of staleness logic and lineage chain |
| Audit det. | Audit pack determinism | _audit_trail_verification no longer embeds datetime.now() — same inputs → identical output bytes |
Deterministic-rerun guarantee: the central SR 26-2 challenger-model requirement |
These are not operational niceties — they are the controls regulators will inspect when applying SR 26-2's MRM framework to the framework itself as a challenger model.
Looking Ahead: Q3 2026¶
FinCEN Effectiveness NPRM final rule (expected late 2026 / early 2027). The comment window closed June 9; the rulemaking is pending. Once finalised, the 12-month implementation clock starts. Firms that completed gap analyses during the comment window (pre-June 9) have a head start; firms that deferred will find themselves in implementation under time pressure.
AMLA direct-supervision selection (2027-07-01 → 2027-12-31). AMLA will select its first 40 directly-supervised obliged entities from July 2027. The data-collection exercise now underway feeds the selection methodology. Groups operating in 6+ EU member states with significant AML risk profiles are the highest-exposure segment.
AUSTRAC Tranche 2 first enforcement cycle (2026-07-01 onward). Tranche 2 is now live, 37 days in, and the enrolment grace period has passed (2026-07-29, 9 days ago). AUSTRAC's first-cycle posture will be clarified in H2 2026 through its inspection and EU program. First-mover documented programs will be the benchmark.
New this edition — two enforcement actions landed inside the Tranche 2 window, but against pre-existing registrants, not new DNFBPs. AUSTRAC finalised its enforceable undertaking with wagering operator Sportsbet on 2026-07-03 (independent audit confirmed remediation across five required compliance areas) and entered a fresh enforceable undertaking with bet365 days later (audit found gaps in risk-assessment methodology and suspicious-matter reporting; bet365 must file a progress report by December 2026 and complete a final compliance audit by mid-2027). Both operators were already AUSTRAC-regulated wagering-sector entities under the pre-Tranche-2 scope — these are not enforcement outcomes against the newly regulated Tranche 2 DNFBP population (lawyers, accountants, real-estate agents, DPMS) this section tracks, and no such outcome has been independently confirmed as of this edition. Read together with AUSTRAC's stated good-faith posture toward newly regulated entities, the signal is a regulator actively exercising its enforcement powers during the same window Tranche 2 commenced, not evidence about how it will treat the new DNFBP population specifically. — AUSTRAC: Sportsbet enforceable undertaking finalised · AUSTRAC: bet365 enforceable undertaking
FinCEN Whistleblower final rule. Expected late 2026 / early 2027. The March 30 NPRM's comment period closed 2026-06-01. Once finalised, the 10–30% award structure becomes operational. Firms with unresolved SAR-backlog or screening-gap issues face heightened exposure from insider tips.
Last updated: 2026-08-07 · Previous edition: 2026-06-regulator-pulse.md. Full chronological log: 2026-05-regulator-pulse.md — 2026-02-01 → 2026-05-31, 120 days, 33 events.