FinCrime Intelligence Weekly
The OCC fines Amex's bank $350 million, Pegasus screens only a supplier's new name, the UK lists crypto platforms, FinCEN drops two crypto rules, and BaFin resets Deutsche Bank deadlines.
Marco’s Take
Marco Beranzoni
Four of this week’s five stories share a pattern. The control existed. It was aimed at the wrong thing.
Pegasus’s policy told staff to screen the party’s name, address, email, phone, and other information against OFAC’s Specially Designated Nationals (SDN) List. An employee screened only the new name. The sanctioned supplier had renamed itself, but its phone number and email were unchanged. The OCC found that American Express National Bank’s risk assessment focused on its relatively narrow demand deposit products and paid insufficient attention to its more dominant credit and charge card products. The UK notice lists Cryptomus, Heleket, and Certa Payments Ltd as name variations of one entity, Xeltox Enterprises Ltd. BaFin’s Deutsche Bank order is a looser fit: transaction monitoring needed realigning after technical requirements changed.
The TD Bank case in Enforcement Watch is the human version of the same problem: an employee unblocked debit cards the bank had restricted over potential fraud. FinCEN’s withdrawal of two proposed crypto rules is a change of direction, not a control failure, and the week’s lesson does not apply to it.
Here is the uncomfortable task for this week. Take your latest risk assessment and find your largest product or channel by volume. Then check how much of the assessment is actually about it. If the answer is a few lines, you have found your own version of this week’s pattern.
See you next Monday.
Marco
The OCC cites a risk assessment that gave too little weight to card products and about $13 billion of suspected trade-based money laundering, while the Federal Reserve issued a parallel order against the parent.
The US freight forwarder checked the renamed supplier but not its unchanged phone number and email, then corrected a certified subpoena response six months late.
The UK Sanctions Notice of 8 October 2026 records 38 additions, including crypto and payment platforms, with asset freezes and payment prohibitions for UK firms to apply.
Two pending digital asset proposals are gone, and firms that built controls in anticipation of them now need to decide what to keep.
The 15 September order updates earlier remediation orders from April 2021 and November 2023, and BaFin attributes the reset to changed technical requirements.
What changed this week, why it matters, and what to do about it.
| Region | Update | Why it matters | Action |
|---|---|---|---|
| US | Treasury announced on 7 October 2026 a $200,000 civil penalty against Amidi, LLC, issued in July 2026, which Treasury describes as the first civil penalty under the Outbound Investment Security Program. Amidi failed to submit a required notification after its Chinese fund subsidiary invested approximately $92,478 on 19 April 2025 in a Chinese company developing artificial intelligence, robotics, and embodied intelligence. | Treasury says it identified the transaction through its regular and ongoing compliance and market monitoring efforts. The program requires US persons to notify Treasury of certain investments, including transactions by controlled foreign entities that would be notifiable if made by a US person. | Confirm that foreign subsidiaries and funds you control report investment activity to whoever owns the notification decision, and test that the route works. |
| Global | On 8 October 2026, under Operation Economic Outcast, OFAC designated 17 shadow fleet vessels carrying Iranian crude, petroleum, and petrochemicals mainly to South and East Asia. It also designated 17 companies under Executive Order 13902, 13 for the petroleum sector and 5 for the petrochemical sector, with Brich Shipping listed under both. | Treasury's release says the shadow fleet moves "billions of dollars' worth" of petroleum. OFAC also removed two vessels after they left the shadow fleet and were sold to non-sanctioned operators, so list changes run in both directions. | Refresh vessel and company screening data, including the two removals, and review recent trade and payment activity for links to the newly listed vessels and companies. |
| US | On 9 October 2026, OFAC added the International Criminal Court to the SDN List and issued General Licenses 13, 14, 15, and 16. Their titles cover certain transactions involving the ICC, certain transactions related to telecommunications and enterprise software involving the ICC, transactions related to pension payments involving the ICC, and certain transactions related to certain ICC detainees. | The OFAC page gives only the license titles. The scope and expiry of each authorization sit in the licenses themselves, so a title alone is not enough to rely on. | Add the new SDN entry to screening, read all four licenses in full before relying on any of them, and check whether any customer, vendor, or payment touches the ICC. |
| EU | AMLA's press release of 7 October 2026 opens a consultation on draft standards for a central EU AML/CFT (anti-money laundering and countering the financing of terrorism) database that supervisors will use to report and retrieve information. The draft covers data on individual obliged entities and on supervisors and their activities, a materiality threshold for reporting breaches, and conditions for AMLA information requests. | AMLA says the draft draws first on data supervisors already hold or will collect, so the database adds no new reporting costs for obliged entities. Some requirements enter into force in stages. | Read the draft before the public hearing on 3 November 2026, 14:00 to 16:00 CET, and decide whether anyone on your team should attend. |
Treasury announced on 7 October 2026 a $200,000 civil penalty against Amidi, LLC, issued in July 2026, which Treasury describes as the first civil penalty under the Outbound Investment Security Program. Amidi failed to submit a required notification after its Chinese fund subsidiary invested approximately $92,478 on 19 April 2025 in a Chinese company developing artificial intelligence, robotics, and embodied intelligence.
Why it matters:Treasury says it identified the transaction through its regular and ongoing compliance and market monitoring efforts. The program requires US persons to notify Treasury of certain investments, including transactions by controlled foreign entities that would be notifiable if made by a US person.
Action:Confirm that foreign subsidiaries and funds you control report investment activity to whoever owns the notification decision, and test that the route works.
On 8 October 2026, under Operation Economic Outcast, OFAC designated 17 shadow fleet vessels carrying Iranian crude, petroleum, and petrochemicals mainly to South and East Asia. It also designated 17 companies under Executive Order 13902, 13 for the petroleum sector and 5 for the petrochemical sector, with Brich Shipping listed under both.
Why it matters:Treasury's release says the shadow fleet moves "billions of dollars' worth" of petroleum. OFAC also removed two vessels after they left the shadow fleet and were sold to non-sanctioned operators, so list changes run in both directions.
Action:Refresh vessel and company screening data, including the two removals, and review recent trade and payment activity for links to the newly listed vessels and companies.
On 9 October 2026, OFAC added the International Criminal Court to the SDN List and issued General Licenses 13, 14, 15, and 16. Their titles cover certain transactions involving the ICC, certain transactions related to telecommunications and enterprise software involving the ICC, transactions related to pension payments involving the ICC, and certain transactions related to certain ICC detainees.
Why it matters:The OFAC page gives only the license titles. The scope and expiry of each authorization sit in the licenses themselves, so a title alone is not enough to rely on.
Action:Add the new SDN entry to screening, read all four licenses in full before relying on any of them, and check whether any customer, vendor, or payment touches the ICC.
AMLA's press release of 7 October 2026 opens a consultation on draft standards for a central EU AML/CFT (anti-money laundering and countering the financing of terrorism) database that supervisors will use to report and retrieve information. The draft covers data on individual obliged entities and on supervisors and their activities, a materiality threshold for reporting breaches, and conditions for AMLA information requests.
Why it matters:AMLA says the draft draws first on data supervisors already hold or will collect, so the database adds no new reporting costs for obliged entities. Some requirements enter into force in stages.
Action:Read the draft before the public hearing on 3 November 2026, 14:00 to 16:00 CET, and decide whether anyone on your team should attend.
Typology of the week
A designated supplier changes its name but keeps its phone number, email, and other contact details. A counterparty that screens only the new name against the SDN List gets a null result, unless the listing already records the new name. The shipment, payment, or contract then proceeds with a party that is still blocked. The weakness sits in the gap between what the policy tells staff to screen and what the screener actually enters.
Example
In the Pegasus Worldwide Logistics case, OFAC announced on 9 October 2026 a $175,015 settlement with the California freight forwarder. In 2023 Pegasus arranged shipment of a $5,950 sugar packet-filling machine from Youli Technology Development Co., Ltd., a China-based supplier OFAC had designated on 30 May 2023. Youli had renamed itself Huizhou Youli Fushi Co., Ltd. but kept its phone number and email, and Pegasus screened only the new name just before shipment, with a null result. OFAC found the machine's purpose was legitimate commercial activity. This is a civil settlement, not a criminal case.
Recent actions and the control lessons behind them.
TD Bank
Control failure:According to the US Department of Justice release of 6 October 2026, one insider overrode a restriction and opened accounts in volume. From April 2022 to November 2023, Gerardo Aquino, 40, of Hollywood, Florida, unblocked debit cards that TD Bank had restricted over potential fraud, opened fraudulent accounts, and issued hundreds of debit cards to co-conspirators. He opened 86 individual customer accounts using the same commercial address in Miami, and those accounts alone laundered over $3 million to Colombia. Approximately $4.8 million was funneled out of the US to Colombia, and he received more than $8,000 in bribes paid in cash and through a peer-to-peer digital payment network. He pleaded guilty to conspiracy to launder monetary instruments (maximum 20 years) and receipt of bribes by a bank employee (maximum 30 years). The DEA, IRS Criminal Investigation, and the FDIC Office of Inspector General investigated. The release does not say how the scheme was detected.
Lesson:Treat the ability to lift a restriction as a privileged action. Log every unblocking of a card or account, require a second approver, and review the log for repeat users and patterns. Add address concentration analytics, because 86 individual accounts at one commercial address is the kind of pattern a routine query can surface without waiting for a tip. Because the release is silent on detection, do not assume your own detection route; test whether an insider doing this at your institution would trigger an alert.
On 5 October 2026 FinCEN announced the withdrawal of two proposed rules, one on recordkeeping, verification, and reporting for certain convertible virtual currency (CVC) and unhosted wallet transactions, and one on a special measure for CVC mixing. FinCEN cited its consideration of comments and the Administration's deregulatory agenda. Withdrawing a proposal does not change the rules already in force, so keep your unhosted wallet and mixer exposure analytics, transaction recordkeeping, and chain analytics monitoring running. The UK listings of crypto and payment platforms this week are a reminder that sanctions exposure in crypto sits under separate obligations.
The UK notice lists Cryptomus, Heleket, and Certa Payments Ltd as name variations of one listed entity, Xeltox Enterprises Ltd, along with the websites cryptomus.com and heleket.com. The UK says its aim in this package is to stop Russian oil companies rebadging oil under unsanctioned entity names, and the same logic applies to platforms that trade under several brands. Screening should resolve brands, domains, and names to the legal entity. Test it by running all three names and both domains through your screening and confirming each one reaches the same alert.
Career & Skills Corner
Pegasus gave OFAC a certified subpoena response on 1 February 2024 denying it had responsive information. That answer was wrong, as OFAC showed with an arrival notice, and a revised response followed only on 8 August 2024, about six months later. OFAC's settlement records six reporting violations. Treat any regulator or law enforcement request as a bounded project with five steps. First, define the search terms from every identifier in the request: names, name variations, phone numbers, and email addresses. Second, search every repository, including email, shared drives, operational systems, and archives. Third, give counsel everything you find, including the unhelpful items. Fourth, record what was searched, with which terms, by whom, and when. Fifth, certify only what was searched, and word the certification to say exactly that. A narrow answer backed by a documented search beats a confident denial you later have to revise.
Next week I'm watching for registration details ahead of AMLA's 3 November public hearing on the central database standards, and for the comment window on the FinCEN A7 Sub-Agents proposal, which runs 30 days from Federal Register publication. Both are chances for practitioners to shape rules rather than react to them.
Turn this weekly intelligence into a career. Marco’s AML & Financial Crime course takes you from curious to hireable.
AML & Financial Crime course →