FinCrime Intelligence Weekly
FATF clears four from the grey list, FinCEN flags $8bn in foreign-agent MSB payments, The Star's A$260m penalty, North Korea's crypto cash-out network, and Extreme Networks.
Marco’s Take
Marco Beranzoni
Every story this week turns on the same gap: the party behind the payment is different from the party on the paperwork.
At Extreme Networks, the purchase orders named one Russian company while the email addresses belonged to another, a blocked missile maker. FinCEN’s new alert describes foreign agents directing US money transmitters to pay trading companies and newly formed firms that the transmitter’s bank knew little about. At The Star, third parties paid in for customers and their identities were not recorded. Treasury says North Korea’s IT workers are hired under stolen identities and fabricated personas, so the salary lands with someone other than the person doing the job.
In the Extreme case, the signal was in plain view. OFAC says seven of the nine orders carried the blocked company’s email addresses or its Moscow address. What was missing was someone who treated the contradiction as unfinished business and went looking for evidence the counterparty had not supplied.
That is a habit, and teams can train it. Here is this week’s task. Take five recent alerts or reviews your team closed after a customer explained away an inconsistency. Read each explanation again, and ask whether anyone checked it against a source the customer did not provide. If the answer is no more than once, you have found your next control improvement.
See you next Monday.
Marco
The October plenary removed Bulgaria, Côte d'Ivoire, the DRC, and Monaco from increased monitoring, warned Vietnam, and agreed a targeted review of virtual asset rules.
A new alert says foreign agents are using US money transmitters' bank accounts to pay unrelated third parties abroad, often with little or no documentation behind the payment.
The Federal Court found the casino group let high-risk customers gamble without establishing where their money came from, including through junkets and unrecorded third-party deposits.
Treasury designated 10 people and one entity, including two Russian nationals it says converted millions of dollars in cryptocurrency for North Korean officials and a sanctioned IT worker company.
OFAC says orders named one Russian company as end user while emails and delivery addresses pointed to a blocked missile maker, and Extreme accepted a distributor's explanation for the mismatch.
What changed this week, why it matters, and what to do about it.
| Region | Update | Why it matters | Action |
|---|---|---|---|
| UK | On 29 October 2026, the FCA announced it had secured High Court undertakings from Huobi Global S.A., in its case against the HTX crypto exchange (formerly Huobi), that it will not knowingly promote cryptoasset services unlawfully to UK consumers. The two sides reached a confidential settlement, with no admission of liability. HTX no longer accepts deposits or new users from the UK. | The FCA says crypto remains largely unregulated in the UK, except for anti-money laundering and financial promotions, until October 2027. For now, financial promotion rules are one of the few levers it has against overseas exchanges. | If you bank UK retail customers, review payments still going to offshore exchanges that have exited the UK or appear on the FCA Warning List, and treat them as a consumer harm and fraud indicator. |
| EU | The EU Anti-Money Laundering Authority (AMLA) holds a public hearing on 3 November 2026 on draft regulatory technical standards for an EU-wide AML/CFT database. The database will be the single point for supervisors to report and retrieve information on obliged entities and on their own supervisory activity. | The draft standards set the materiality threshold above which a breach must be reported to the database. That suggests a significant breach found by one supervisor will be visible to supervisors across the EU. | If your group has entities in several EU member states, check how breaches and supervisory findings are logged centrally, so you know what each supervisor will see. |
| US | On 28 October 2026, OFAC sanctioned Rwanda's Ministry of Defence and Zigama Credit and Savings Society, a Rwandan financial institution that Treasury says operates on behalf of Rwanda's security services and facilitated transactions for M23 and the Congo River Alliance amounting to tens of millions of dollars. | Treasury says a Zigama branch enabled the transport of gold from M23-controlled territory in eastern Democratic Republic of the Congo to Kigali, and that Zigama facilitated payments to entities in China and other countries for weapons and military equipment. | Screen correspondent and trade flows for Zigama, and review clients that trade gold or other minerals with exposure to the Great Lakes region. |
| US | On 30 October 2026, FinCEN issued FIN-2026-NTC2, a notice on the use of charities and non-profit organisations for terrorist financing, fraud, and other illicit activity, with the SAR key term "FIN2026NPO". | The notice says the vast majority of US-based non-profits present a low risk, and that the US government does not view the sector as uniformly high risk. It asks institutions to assess each organisation individually. | Add the key term to your SAR templates and check that non-profit customers are risk-rated individually, with no blanket sector rating. |
On 29 October 2026, the FCA announced it had secured High Court undertakings from Huobi Global S.A., in its case against the HTX crypto exchange (formerly Huobi), that it will not knowingly promote cryptoasset services unlawfully to UK consumers. The two sides reached a confidential settlement, with no admission of liability. HTX no longer accepts deposits or new users from the UK.
Why it matters:The FCA says crypto remains largely unregulated in the UK, except for anti-money laundering and financial promotions, until October 2027. For now, financial promotion rules are one of the few levers it has against overseas exchanges.
Action:If you bank UK retail customers, review payments still going to offshore exchanges that have exited the UK or appear on the FCA Warning List, and treat them as a consumer harm and fraud indicator.
The EU Anti-Money Laundering Authority (AMLA) holds a public hearing on 3 November 2026 on draft regulatory technical standards for an EU-wide AML/CFT database. The database will be the single point for supervisors to report and retrieve information on obliged entities and on their own supervisory activity.
Why it matters:The draft standards set the materiality threshold above which a breach must be reported to the database. That suggests a significant breach found by one supervisor will be visible to supervisors across the EU.
Action:If your group has entities in several EU member states, check how breaches and supervisory findings are logged centrally, so you know what each supervisor will see.
On 28 October 2026, OFAC sanctioned Rwanda's Ministry of Defence and Zigama Credit and Savings Society, a Rwandan financial institution that Treasury says operates on behalf of Rwanda's security services and facilitated transactions for M23 and the Congo River Alliance amounting to tens of millions of dollars.
Why it matters:Treasury says a Zigama branch enabled the transport of gold from M23-controlled territory in eastern Democratic Republic of the Congo to Kigali, and that Zigama facilitated payments to entities in China and other countries for weapons and military equipment.
Action:Screen correspondent and trade flows for Zigama, and review clients that trade gold or other minerals with exposure to the Great Lakes region.
On 30 October 2026, FinCEN issued FIN-2026-NTC2, a notice on the use of charities and non-profit organisations for terrorist financing, fraud, and other illicit activity, with the SAR key term "FIN2026NPO".
Why it matters:The notice says the vast majority of US-based non-profits present a low risk, and that the US government does not view the sector as uniformly high risk. It asks institutions to assess each organisation individually.
Action:Add the key term to your SAR templates and check that non-profit customers are risk-rated individually, with no blanket sector rating.
Typology of the week
A US money transmitter works through agents abroad. Its agreement with a foreign agent lets the agent instruct it to pay third parties, described as suppliers or partners. The transmitter then wires money from its own bank account to a trading company or exchange house in another country. FinCEN says the foreign agents in these cases appeared to be using the transmitter's bank account as their own, while the transmitter and its bank received little information about the recipient or the purpose. Its analysis of BSA reporting found more than $8 billion in suspicious foreign-agent-directed payments between 2021 and 2025.
Example
FinCEN's 30 October 2026 alert describes foreign agents characterising payments as settlement for goods and services, and directing US money transmitters to pay importers, exporters, and other non-financial businesses in third countries. It names recurring recipients including foreign exchange houses in the UAE, Chinese commercial banks and trading companies, and recipients across East Africa.
Recent actions and the control lessons behind them.
An unnamed branch of a foreign bank licensed in the UAE
Control failure:The Central Bank of the UAE (CBUAE) says its examinations found significant, repeated failures in the branch's AML/CFT, governance and compliance management, and sanctions framework. It fined the two individuals for failing to fulfil their responsibilities, ordered a mandatory remediation programme under independent validation, and required a fit and proper reassessment of the CEO and chief compliance officer.
Lesson:Personal penalties on the MLRO and the CEO put individual accountability next to the institutional fine. If you hold a senior compliance role, make sure your escalations, and management's responses to them, are on the record.
Treasury's 28 October release says the networks it sanctioned used cryptocurrency transactions, money laundering techniques, and artificial intelligence tools to generate and transfer millions of dollars. It says workers at one designated centre in Russia use "Super Intelligence (SI) tools" alongside complex cryptocurrency transfers. For hiring and onboarding teams, a polished application and a convincing interview prove less than they used to. Identity checks need to tie the person doing the work to the person being paid.
The FATF agreed a targeted review of jurisdictions with materially important virtual asset sectors, with results to be published in June and October 2027. Firms with exchange or custodian counterparties should know which of those counterparties' home jurisdictions are likely to be reviewed, and how their own risk ratings would change if a jurisdiction fell short.
Career & Skills Corner
In the Extreme Networks case, a distributor twice sent the website of a blocked Russian missile maker when asked for the end user's details. When challenged, it said that was a mistake, and the orders were approved on the strength of its own end-user statement. Every investigator meets this moment, and handling it well is a skill that gets noticed. When a customer or counterparty explains away an inconsistency, write down the claim in one sentence. Then ask what evidence would prove it, and whether any of that evidence comes from someone other than the person explaining. A registry record, a delivery confirmation, or an email domain all count. The explanation itself does not. Practise this on your next five cases with an inconsistency. Analysts who can show how they tested an explanation are the ones trusted with complex investigations and quality assurance roles.
This week I'm reading the FATF report on illicit financial flows from scam compounds, which the FATF said it would publish this week. I want to see which payment patterns it attributes to the compounds, because those will shape fraud typologies for the next year. I'm also following AMLA's public hearing on 3 November on its EU-wide supervisory database, and what it says about the threshold for reporting breaches.
Turn this weekly intelligence into a career. Marco’s AML & Financial Crime course takes you from curious to hireable.
AML & Financial Crime course →