FinCrime Intelligence Weekly
A section 311 proposal against Banque Misr UAE, five Iranian sectoral determinations, an NCA forfeiture from a grain trader, AUSTRAC tranche 2 notices, and INTERPOL Operation Jackal IV.
Marco’s Take
Marco Beranzoni
Every sanctions programme I have inherited started in the same place: a screening engine, a list refresh schedule, and a slide showing hit rates. That model had a good run. This week it looked thin.
Look at what actually happened. FinCEN (the US Financial Crimes Enforcement Network) proposed cutting Banque Misr UAE out of US correspondent banking, over an estimated $1.8 billion processed between January 2024 and June 2026 for 103 companies Treasury says are potentially part of Iranian shadow banking networks. Then the NCA (UK National Crime Agency) secured forfeiture of more than $5.2 million from ENEX Premium Trading Limited, a grain trading company, where the firms paying into its accounts were designated under US sanctions only after the payments had landed.
That is the pattern. The exposure sat in the relationship and in the sector, not in the name. A clean screening result on the day of the payment told you very little.
So here is the uncomfortable exercise for the week. Pull your correspondent and nested relationship map, then ask which of those relationships carries a material Iran, gold, shipping, aviation, or digital assets nexus. If you cannot produce that map inside a day, that is your finding. Put it in front of your board before somebody outside your institution produces it for you.
See you next Monday. Marco
FinCEN's proposed section 311 special measure would bar US correspondent accounts for one bank's UAE branches, and the de-risking pressure starts during the comment period, not after it.
Treasury's five sectoral determinations under E.O. 13902 shift Iran exposure from a name list to an activity test, and the suspended general licences carry a wind-down that law firms date to 8 September 2026.
ENEX Premium Trading agreed to give up more than $5.2 million after the NCA followed payments through UK e-money firms into crypto and Chinese accounts.
Australia's regulator is asking unenrolled real estate businesses to explain themselves, and the reported enrolment numbers show how wide the coverage gap still is.
INTERPOL says an eight month operation across 22 countries identified 263 suspects, including an alleged crime-as-a-service network selling domains and laundering support to fraud groups.
What changed this week, why it matters, and what to do about it.
| Region | Update | Why it matters | Action |
|---|---|---|---|
| US | On 28 August 2026 FinCEN issued a notice of proposed rulemaking under section 311 of the USA PATRIOT Act finding Banque Misr UAE to be a financial institution of primary money laundering concern, and proposing to bar US financial institutions from opening or maintaining correspondent accounts for it. The public comment period closes 30 days after publication in the Federal Register. | The proposed rule would also require US institutions to take reasonable steps not to process transactions involving Banque Misr UAE through their foreign correspondent accounts, and to apply special due diligence to those accounts. That obligation reaches through nested relationships, so exposure is not limited to firms that bank Banque Misr UAE directly. Treasury states the finding applies only to Banque Misr UAE as defined in the notice, and not to Banque Misr operations in any other country. | Query payment history for Banque Misr UAE as originator, beneficiary, and intermediary, separating the UAE branches from other Banque Misr entities. Identify which of your respondents bank it, and decide now whether you will comment during the 30 day window or simply prepare for the rule. |
| Global | On 24 August 2026 Treasury launched Operation Economic Outcast and issued determinations under Executive Order 13902 covering five sectors of the Iranian economy: digital assets, technology, gold, aviation, and shipping. OFAC, the US Office of Foreign Assets Control, sanctioned nearly 60 entities, individuals, and vessels, suspended several general licences, and issued guidance on sanctions risk in the Strait of Hormuz. | OFAC can now sanction any person operating in those five sectors of the Iranian economy, wherever that person is located. Treasury also said the action expands secondary sanctions exposure for those who continue doing business with the regime. Law firm analysis of the suspension documents records General Licence BB authorising wind-down of activity previously permitted under the suspended general licences until 8 September 2026, subject to conditions. | Screen your book by sector and geography, not only by name, starting with gold dealers, shipping and aviation counterparties, and digital asset service providers with Iran adjacency. Complete or exit any activity relying on the suspended general licences before 8 September 2026, and record the wind-down decision. |
| Other | AUSTRAC, the Australian Transaction Reports and Analysis Centre, has begun issuing section 167 notices to businesses that appear to provide designated services but have not enrolled, after a tranche 2 enrolment deadline of 29 July 2026. Real Estate Business reported on 27 August 2026 that, as of 20 August 2026, 17,970 real estate agencies had registered out of approximately 45,000 offices nationwide. | A section 167 notice is an information gathering tool, not an enforcement action, but failing to respond can result in criminal penalties and providing false or misleading information carries more serious consequences. The notices ask for enrolment records, business structure, operations, services, payment methods, brokering agreements, cash handling policies, and transaction records for deals involving cash or virtual assets. AUSTRAC chief executive Brendan Thomas said the regulatory focus would be on businesses that are complicit in criminal exploitation, or those that fail to meet fundamental requirements. | If you serve Australian real estate, legal, accountancy, conveyancing, precious metals, or trust and company service provider clients, confirm their enrolment status and treat non enrolment as a risk factor in your own onboarding. Firms in scope should assemble the notice response pack now rather than after a notice lands. |
| EU | Europol and Eurojust published the SIRIUS Electronic Evidence Situation Report on 27 August 2026. It examines the growing number of requests for electronic data, the legal and operational challenges of obtaining electronic evidence across borders, and looks ahead to the EU e-Evidence legislative package. | Financial crime investigations depend on data held by service providers in other jurisdictions, and the speed of that access sets the speed of asset recovery. If the e-Evidence package shortens those timelines, institutions receiving production and preservation requests should expect more of them, on tighter clocks. That is a resourcing question for legal and financial intelligence teams, not only a law enforcement one. | Read the report and map who in your firm receives, triages, and answers cross border evidence requests, including out of hours. Time your current turnaround on a preservation request and judge whether it would survive a shorter statutory deadline. |
On 28 August 2026 FinCEN issued a notice of proposed rulemaking under section 311 of the USA PATRIOT Act finding Banque Misr UAE to be a financial institution of primary money laundering concern, and proposing to bar US financial institutions from opening or maintaining correspondent accounts for it. The public comment period closes 30 days after publication in the Federal Register.
Why it matters:The proposed rule would also require US institutions to take reasonable steps not to process transactions involving Banque Misr UAE through their foreign correspondent accounts, and to apply special due diligence to those accounts. That obligation reaches through nested relationships, so exposure is not limited to firms that bank Banque Misr UAE directly. Treasury states the finding applies only to Banque Misr UAE as defined in the notice, and not to Banque Misr operations in any other country.
Action:Query payment history for Banque Misr UAE as originator, beneficiary, and intermediary, separating the UAE branches from other Banque Misr entities. Identify which of your respondents bank it, and decide now whether you will comment during the 30 day window or simply prepare for the rule.
On 24 August 2026 Treasury launched Operation Economic Outcast and issued determinations under Executive Order 13902 covering five sectors of the Iranian economy: digital assets, technology, gold, aviation, and shipping. OFAC, the US Office of Foreign Assets Control, sanctioned nearly 60 entities, individuals, and vessels, suspended several general licences, and issued guidance on sanctions risk in the Strait of Hormuz.
Why it matters:OFAC can now sanction any person operating in those five sectors of the Iranian economy, wherever that person is located. Treasury also said the action expands secondary sanctions exposure for those who continue doing business with the regime. Law firm analysis of the suspension documents records General Licence BB authorising wind-down of activity previously permitted under the suspended general licences until 8 September 2026, subject to conditions.
Action:Screen your book by sector and geography, not only by name, starting with gold dealers, shipping and aviation counterparties, and digital asset service providers with Iran adjacency. Complete or exit any activity relying on the suspended general licences before 8 September 2026, and record the wind-down decision.
AUSTRAC, the Australian Transaction Reports and Analysis Centre, has begun issuing section 167 notices to businesses that appear to provide designated services but have not enrolled, after a tranche 2 enrolment deadline of 29 July 2026. Real Estate Business reported on 27 August 2026 that, as of 20 August 2026, 17,970 real estate agencies had registered out of approximately 45,000 offices nationwide.
Why it matters:A section 167 notice is an information gathering tool, not an enforcement action, but failing to respond can result in criminal penalties and providing false or misleading information carries more serious consequences. The notices ask for enrolment records, business structure, operations, services, payment methods, brokering agreements, cash handling policies, and transaction records for deals involving cash or virtual assets. AUSTRAC chief executive Brendan Thomas said the regulatory focus would be on businesses that are complicit in criminal exploitation, or those that fail to meet fundamental requirements.
Action:If you serve Australian real estate, legal, accountancy, conveyancing, precious metals, or trust and company service provider clients, confirm their enrolment status and treat non enrolment as a risk factor in your own onboarding. Firms in scope should assemble the notice response pack now rather than after a notice lands.
Europol and Eurojust published the SIRIUS Electronic Evidence Situation Report on 27 August 2026. It examines the growing number of requests for electronic data, the legal and operational challenges of obtaining electronic evidence across borders, and looks ahead to the EU e-Evidence legislative package.
Why it matters:Financial crime investigations depend on data held by service providers in other jurisdictions, and the speed of that access sets the speed of asset recovery. If the e-Evidence package shortens those timelines, institutions receiving production and preservation requests should expect more of them, on tighter clocks. That is a resourcing question for legal and financial intelligence teams, not only a law enforcement one.
Action:Read the report and map who in your firm receives, triages, and answers cross border evidence requests, including out of hours. Time your current turnaround on a preservation request and judge whether it would survive a shorter statutory deadline.
Typology of the week
Value leaves a sanctioned economy disguised as ordinary commodity trade, usually bulk agricultural or energy cargo where price, quality, and quantity are genuinely variable and hard to challenge from a payment message alone. A layer of front companies pays into a trading entity that has a real commercial story, real logistics, and a plausible website. Funds enter through electronic money institutions rather than through a traditional correspondent chain, which shortens onboarding, thins the payment narrative, and reduces the chance that a full trade file is ever assembled. Value is then converted into cryptocurrency and settled into accounts in a third country, often at a scale far above the working capital the stated trading activity would need. The feature that matters most to a compliance team is timing. The paying counterparties are designated months after the transactions clear, so the screening result on the day of payment is clean and stays clean until a list update or an investigation reaches back into the history.
Example
The National Crime Agency announced on 27 August 2026 that ENEX Premium Trading Limited agreed to forfeit more than $5.2 million (£3.84 million) following a civil recovery investigation into suspected money laundering and sanctions evasion. ENEX describes itself as an independent agricultural trading and logistical company dedicated to the handling, transportation and financing of grains, oilseeds and oilseed meals. It is owned by Nadir Valiyev, an Azerbaijan national, and registered in St Kitts and Nevis. The funds were transferred between July and September 2024, and the NCA obtained an Account Freezing Order in November 2024. Payments entered UK accounts via electronic money institutions, and the NCA identified a network of suspected front companies and bank accounts being used to facilitate transactions through UK electronic money institutions to be converted into cryptocurrency. The funds frozen in the UK were traced to bank accounts in China held by ENEX, which had received funds from suspected front companies and held tens of millions of pounds. According to the NCA, the companies that made payments into those Chinese accounts have since been designated under US sanctions for their involvement in facilitating illicit Iranian oil sales and revenue, and sending funds to the Iranian Qods Force. Valiyev denied criminal activity but agreed to forfeit the funds. The settlement does not constitute an admission of unlawful conduct or evidence of criminal activity.
Recent actions and the control lessons behind them.
ENEX Premium Trading Limited, resolved with the UK National Crime Agency
Control failure:Payments reached UK accounts through electronic money institutions from a network of suspected front companies, converted into cryptocurrency, with onward tracing to ENEX accounts in China holding tens of millions of pounds. The paying companies were designated under US sanctions only afterwards, so nothing in that population would have produced a name match while the funds moved between July and September 2024.
Lesson:A screening programme that only looks forwards will keep missing this shape. What would have caught it is proportionality of turnover to the stated trade, evidence of the underlying cargo, and a live process for rescreening historical payments whenever a designation lands. Build the backward look, and give one named person the job of running it.
INTERPOL coordinated operation against West African organised crime groups, with participants including Nigeria, South Africa, Cote d'Ivoire, France, the United States, and the United Kingdom
Control failure:The South African figures point straight at the account layer. One syndicate held 257 bank accounts before they were blocked, which suggests mule account detection across those institutions ran slower than the network could open and use accounts.
Lesson:Count your own equivalent. If a single fraud network can hold hundreds of live accounts across a market, the useful metric is not how many mule accounts you close in a quarter. It is how long an account survives between the first suspicious inbound payment and closure. Measure that interval, publish it internally, and drive it down.
The determinations issued on 24 August 2026 under Executive Order 13902 cover five sectors of the Iranian economy, and digital assets is one of them. Treasury's release states that the Iranian regime is turning to cryptocurrency as a tool of choice for sanctions evasion. The practical shift is that OFAC can now sanction any person operating in that sector regardless of location, so a virtual asset service provider's exposure no longer depends on a listed wallet or a listed counterparty name. The work is sectoral. Identify customers and counterparties whose activity carries an Iran nexus, extend chain analytics lookback windows across whatever that surfaces, and make sure the analytics output ties back to a named customer instead of sitting in a separate tool nobody reads.
INTERPOL reported that in Argentina 196 people were identified as allegedly connected to a crime as a service network that provided website domains and money laundering support to the organised crime groups, and 17 of them were arrested. That is a supplier layer rather than a fraud gang, and it helps explain how romance and investment scams scale across markets: the operators buy infrastructure and laundering capacity instead of building it. Fraud teams should treat domain and hosting intelligence as a financial crime data source, feeding newly registered domains linked to your brand or to customer loss reports into the same case management as payment alerts. When one supplier serves many networks, a single supplier level indicator can light up victims across several unrelated investigations.
Career & Skills Corner
The section 311 proposal against Banque Misr UAE asks a question most institutions answer badly. Not "do we bank this entity", but "which of our relationships can reach this entity, through whom, and how fast can we prove it". If you can answer that in an afternoon, you are close to indispensable. Most teams cannot, and that gap is a career opportunity sitting in plain sight. Here is how to build it, and it needs no project budget. Start with your list of correspondent and respondent relationships. For each one, record the countries it settles in, the currencies it clears, the sectors its customer base concentrates in, and whether it permits nested or downstream relationships. Then pull the last twelve months of payment data and extract every institution that appears as an intermediary rather than as your direct counterparty. That intermediary list is usually the part nobody has looked at, and it is where the surprises live. Now layer this week's sectors on top: digital assets, technology, gold, aviation, and shipping, plus any Iran nexus. Score each relationship as direct exposure, one hop away, or no visible link, and write down the evidence behind each score. Keep the evidence. A score without evidence is only an opinion. Finish with a one page output. Ten to fifteen lines, each naming a relationship, the exposure route, and the single control you rely on. Take it to your money laundering reporting officer or head of sanctions and ask one question: which of these would you defend to a regulator. You will learn more in that conversation than in another certification, and you will have produced a document your institution needs and does not have. Refresh it quarterly, and refresh it immediately after any sectoral determination or section 311 action. Over two or three cycles this becomes the work colleagues come to you for, which is how a compliance career actually compounds.
I am watching two dates. The first is 8 September 2026, when the wind-down authorised under General Licence BB expires, because that is the point where residual activity under the suspended Iran general licences stops being a transition and starts being an exposure. The second is Federal Register publication of the Banque Misr UAE notice, which starts the 30 day comment clock and will show how the industry argues about the reach of the nested account obligation. Alongside those, I want to see whether AUSTRAC's section 167 notices stay an information gathering exercise or become the first tranche 2 enforcement action, and I will read the SIRIUS Electronic Evidence Situation Report properly rather than the summary. If your book touches an Iran adjacent sector, the next fortnight is the one that matters.
Turn this weekly intelligence into a career. Marco’s AML & Financial Crime course takes you from curious to hireable.
AML & Financial Crime course →