FinCrime Intelligence Weekly
Treasury sanctions the law firm behind Iran's shadow fleet companies, the FCA rewrites its Financial Crime Guide, a $36.9m USDT route, student aid fraud, and INTERPOL in Africa.
Marco’s Take
Marco Beranzoni
This week’s stories share a cast: the people in the middle.
Treasury sanctioned a law firm this week, alongside the ships. It says Karnakis and Karnakis registered the companies that own Iran’s shadow fleet vessels, and that its employees sat on their boards to hide the real owners. DOJ describes victim money passing through US shell companies and one offshore account before it became USDT. FinCEN’s student aid referrals describe straw students paid for their identities, and school employees who sometimes helped the fraud rings.
In each case, the authorities describe someone who did not run the scheme but made it work.
The UK’s System Priorities 2026 list professional enablers as one of nine priorities, and the FCA now tells firms to show how their controls reflect those priorities. That matters, because enabler risk tends to sit in onboarding files rather than transaction data: in director lists and corporate agent fields that nobody reads twice.
Here is the uncomfortable task for this week. Pick your ten largest corporate customers with shipping, trading, or holding structures. For each, write down who formed the company and who sits on its board. If the same name or the same agent appears more than once, find out why.
See you next Monday.
Marco
Treasury says Karnakis and Karnakis set up shipowning companies and staffed their boards, while FinCEN issued its first subpoena under 31 U.S.C. 5318(k) in a probe of a Greek bank.
CP26/38 sets out good and poor practice on authorised push payment fraud, money mules, the coming crypto regime, trade sanctions and proliferation financing. Feedback is due by 24 December 2026.
Prosecutors say victim money moved from US shell company accounts to a Deltec Bank account, was converted to Tether and sent to a Cambodian wallet. Zheng Zhao is charged and presumed innocent.
Nearly 100 SARs filed after FinCEN's July alert led to more than 20,000 potentially suspicious transactions tied to ghost and straw student schemes, now passed to investigators.
The operation in 20 African countries and the United States targeted cyber-enabled fraud, ransomware and business email compromise, with losses traced above USD 385 million.
What changed this week, why it matters, and what to do about it.
| Region | Update | Why it matters | Action |
|---|---|---|---|
| UK | The National Crime Agency (NCA), the FCA, HM Revenue and Customs, the Home Office, and the Treasury have published System Priorities 2026, nine economic crime priorities for the regulated sector that are treated as equal and not ranked. They cover professional enablers, politically exposed persons, digital assets, criminal cash, international money laundering, international fraud with a focus on scam compounds, money mule herders, fraud enablers, and terrorist financing. | The FCA's CP26/38 says firms should factor in the System Priorities to demonstrate how they counter financial crime risk. Under professional enablers, the document asks for better public-private investigation of front company networks used for sanctions evasion, involving Russia but also Iran and the DPRK. | Map each of the nine priorities to your financial crime risk assessment and record where your controls address it. |
| EU | On 21 October 2026, the EU Anti-Money Laundering Authority (AMLA) and the European Anti-Fraud Office (OLAF) signed a Working Arrangement covering the exchange of operational and strategic information, including criminal patterns, emerging trends, and risk indicators. | The arrangement lets OLAF contribute to joint analyses coordinated by AMLA, subject to the consent of the participating Financial Intelligence Units, to support analysis of money laundering linked to fraud involving EU funds. | If your institution handles EU grant or subsidy flows, review how your monitoring identifies those payments and how suspicious activity on them is escalated. |
| US | On 19 October 2026, OFAC added five entities, including several Beijing Qiji Chuangtan funds and Shanghai Zhisuan Technology Co Ltd, to its Non-SDN Menu-Based Sanctions List under the Protecting American Intellectual Property Act of 2022 (PAIPA). It also issued two general licenses, one authorizing the wind down of transactions involving entities blocked that day. | These entries sit on a menu-based list rather than the SDN List, with measures set entity by entity, such as blocking and limits on loans, foreign exchange, and banking transactions. | Confirm your screening covers OFAC's Non-SDN Menu-Based Sanctions List, and that alert handling applies the specific measures listed for each entity. |
| US | On 22 October 2026, Treasury issued a proposed rule to update the Outbound Investment Security Program under the COINS Act. It would require US persons to notify Treasury of certain transactions involving covered foreign persons in notifiable technologies, and prohibit others. | The sectors named are semiconductors and microelectronics, artificial intelligence systems, quantum information technologies, high-performance computing and supercomputing, and hypersonic systems, with biotechnology added by Treasury. | If your firm invests or advises on investments abroad, check whether any portfolio or pipeline company works in these sectors, and read the official proposal for the comment deadline. |
The National Crime Agency (NCA), the FCA, HM Revenue and Customs, the Home Office, and the Treasury have published System Priorities 2026, nine economic crime priorities for the regulated sector that are treated as equal and not ranked. They cover professional enablers, politically exposed persons, digital assets, criminal cash, international money laundering, international fraud with a focus on scam compounds, money mule herders, fraud enablers, and terrorist financing.
Why it matters:The FCA's CP26/38 says firms should factor in the System Priorities to demonstrate how they counter financial crime risk. Under professional enablers, the document asks for better public-private investigation of front company networks used for sanctions evasion, involving Russia but also Iran and the DPRK.
Action:Map each of the nine priorities to your financial crime risk assessment and record where your controls address it.
On 21 October 2026, the EU Anti-Money Laundering Authority (AMLA) and the European Anti-Fraud Office (OLAF) signed a Working Arrangement covering the exchange of operational and strategic information, including criminal patterns, emerging trends, and risk indicators.
Why it matters:The arrangement lets OLAF contribute to joint analyses coordinated by AMLA, subject to the consent of the participating Financial Intelligence Units, to support analysis of money laundering linked to fraud involving EU funds.
Action:If your institution handles EU grant or subsidy flows, review how your monitoring identifies those payments and how suspicious activity on them is escalated.
On 19 October 2026, OFAC added five entities, including several Beijing Qiji Chuangtan funds and Shanghai Zhisuan Technology Co Ltd, to its Non-SDN Menu-Based Sanctions List under the Protecting American Intellectual Property Act of 2022 (PAIPA). It also issued two general licenses, one authorizing the wind down of transactions involving entities blocked that day.
Why it matters:These entries sit on a menu-based list rather than the SDN List, with measures set entity by entity, such as blocking and limits on loans, foreign exchange, and banking transactions.
Action:Confirm your screening covers OFAC's Non-SDN Menu-Based Sanctions List, and that alert handling applies the specific measures listed for each entity.
On 22 October 2026, Treasury issued a proposed rule to update the Outbound Investment Security Program under the COINS Act. It would require US persons to notify Treasury of certain transactions involving covered foreign persons in notifiable technologies, and prohibit others.
Why it matters:The sectors named are semiconductors and microelectronics, artificial intelligence systems, quantum information technologies, high-performance computing and supercomputing, and hypersonic systems, with biotechnology added by Treasury.
Action:If your firm invests or advises on investments abroad, check whether any portfolio or pipeline company works in these sectors, and read the official proposal for the comment deadline.
Typology of the week
A law firm or company formation agent registers companies for a client and fills the boards with its own employees. On paper, the directors and officers are the agent's staff. The person who controls the company, and benefits from it, does not appear. Treasury says Karnakis and Karnakis did this for shipowning companies in Iran's shadow fleet, with employees acting as directors and officers "in order to obfuscate the true beneficial owners." The UK's System Priorities 2026 treat professional enablers of economic crime and sanctions evasion as one of nine priorities.
Example
Treasury's 21 October 2026 action designated Karnakis and Karnakis, a law firm based in Panama and Greece, along with its owners and three employees. Treasury says the firm registered companies including Skyros Maritime and Trading S.A., Corfu Maritime and Trading S.A., and Elias Shipping and Trading Group S.A., all previously designated, and served as corporate agent for many firms in the shipping business of Iranian liquefied petroleum gas trader Seyed Asadoollah Emamjomeh.
Recent actions and the control lessons behind them.
Control failure:DOJ's 23 October 2026 release says ShengSheng He and Jingliang Su each pleaded guilty to conspiracy to operate an unlicensed money transmitting business, in the case where more than $36.9 million in victim funds went to a single account at Deltec Bank in the Bahamas, was converted to USDT, and was sent to a wallet controlled in Cambodia. Eight co-conspirators have pleaded guilty so far.
Lesson:Prosecutors used the unlicensed money transmitting charge against people who moved scam proceeds. For banks, a customer moving other people's money as a business, without a licence, is a reportable pattern in its own right. Look for personal or small business accounts acting as a conduit, with many inbound senders and a small number of outbound beneficiaries.
Treasury's 19 October release on student aid fraud says fraudsters may produce fake documents that blend stolen information with invented details, creating synthetic identities that can pass identity checks. The FCA's CP26/38 lists synthetic identity fraud among the emerging risks its data security guidance should reflect, and names checks to identify synthetic or counterfeit documentation as onboarding good practice. A document check that only asks whether a document looks real will not catch an identity that was never real. Test whether your onboarding cross-checks identity data for internal consistency.
INTERPOL's Serengeti III release says its African Cyber Threat Assessment Report 2026 points to artificial intelligence enabling cybercrime across the continent, with cyber-enabled financial losses continuing to rise. The same operation found two illegal cryptocurrency mining centres in Angola, with more than 2,000 mining devices and six illegal power transformation stations. Fraud teams should expect scripts, documents, and websites that look more convincing, and weight behavioural signals over how professional a message appears.
Career & Skills Corner
Treasury's action against Karnakis and Karnakis turned on a detail that sits in plain sight: the same people appearing as directors and officers of company after company. Being able to spot that pattern is a practical, transferable skill. Pick one corporate customer from your own work. Pull its registry filings and list every director, officer, and the registered agent. Then look up each director's other appointments, which many company registries show. Note any shared addresses, shared agents, or directors holding many similar roles. Finally, write two sentences on what you would ask the customer, and why. Do this for five companies and you will start seeing structures, not names. It is also the kind of work that moves analysts into investigations and enhanced due diligence roles.
This week I'm watching the FATF plenary in Paris, which FATF's calendar lists for 26 to 30 October, and the statements on monitored jurisdictions that follow it. I'm also watching for any sign that FinCEN uses its 5318(k) subpoena power again, because a second use would make it a pattern for every bank with a US correspondent account.
Turn this weekly intelligence into a career. Marco’s AML & Financial Crime course takes you from curious to hireable.
AML & Financial Crime course →