FinCrime Intelligence Weekly
FATF maps scam compounds, FinCEN cuts off MEXC, OFAC hits the Prince Group's offshore shells and eight Canadian MSBs, and Block sets aside $764m for a DOJ deal.
Marco’s Take
Marco Beranzoni
Nearly every story this week involves someone selling a service to criminals.
The FATF describes over-the-counter exchange desks operating inside scam compounds. Treasury’s Prince Group action names shelf companies and a personal assistant who also served as company secretary. FinCEN says MEXC Global processed billions tied to sanctioned parties and cybercrime. OFAC says the Canadian firms it sanctioned turned rials and drug cash into crypto. A Europol-supported operation arrested suspects linked to a company allegedly supplying fake trading websites to criminal groups. AUSTRAC used the phrase directly: crime as a service.
I find that framing useful in practice. A supplier has many customers, and it tends to reuse what it has built: accounts, directors, addresses, wallets. That reuse leaves a trail that a single scam does not.
The difficulty is that most of our controls look at one customer or one alert at a time. The repetition only appears when someone puts the cases side by side.
Here is this week’s task. Take twenty closed fraud or mule cases from last quarter and list every shared detail you can find: receiving account, director, phone number, wallet, address. Count the repeats. Anything that appears in three unrelated cases deserves an investigator’s afternoon.
See you next Monday.
Marco
A section 9714 order finds MEXC Global of primary money laundering concern, citing USD 16.7 billion in likely illicit activity, and bars covered institutions from sending or receiving funds involving it.
A report with almost 120 case studies and good practices finds countries are better at chasing victim payments and proceeds than at disrupting the infrastructure behind the scams.
Treasury designated four individuals and 41 entities across the BVI, Hong Kong, Cambodia, Singapore, Mauritius, and Malaysia for helping the scam organisation hide assets and evade earlier sanctions.
Treasury says the firms exchange rials for digital assets and that several also worked with drug trafficker Ryan Wedding. FINTRAC says it has revoked 161 registrations since the start of 2026.
Its quarterly filing discloses an agreement in principle on a three-year deferred prosecution agreement with a gross figure of about $964 million. Final terms and court approval are still outstanding.
What changed this week, why it matters, and what to do about it.
| Region | Update | Why it matters | Action |
|---|---|---|---|
| UK | The FCA's consultation GC26/7, on non-Handbook guidance for firms providing financial services using decentralised finance (DeFi), closes on 18 November 2026. The draft covers operational resilience and financial crime, including SYSC 6 and the Money Laundering Regulations. The FCA plans to publish the final guidance in January 2027. | The draft says responsibility for financial crime controls may be fragmented across developers, governance participants, and infrastructure providers. It also lists high-risk factors, including exposure to wallets or protocols associated with illicit activity and the use of privacy-enhancing technologies. | If your firm touches DeFi, check whether your systems can identify exposure linked to wallet addresses, smart contracts, or protocols, and decide before 18 November whether to respond. |
| EU | On 5 November 2026, the European Commission hosted the tenth meeting of the High-Level Group on sanctions. Its agenda included the use of crypto assets to circumvent sanctions. The EU Sanctions Envoy also convened a forum with partners including the UK, the US, Japan, and Canada on Russia's financing through payment networks in third countries. | The agenda suggests third-country payment routes and crypto are where EU enforcement attention sits, along with Russia's energy exports and the shadow fleet. | Review payment corridors through third countries for Russia exposure, and confirm that crypto-related circumvention appears in your EU sanctions risk assessment. |
| US | On 6 November 2026, FinCEN and the Federal Reserve Board jointly withdrew a proposed rule that would have amended the Recordkeeping and Travel Rule regarding convertible virtual currencies. It would also have lowered the threshold for funds transfers that begin or end outside the United States. | A withdrawn proposal changes nothing in the current rule, so firms that were preparing for a lower cross-border threshold no longer have a proposal to build against. | Check any project plan or budget line that assumed the proposal would take effect, and re-scope it against the rule as it stands. |
| Global | Treasury's 6 November readout of the October FATF plenary says the planned targeted review of certain jurisdictions with longstanding virtual asset deficiencies will outline decision points for the next plenary. It also says the FATF reminded all jurisdictions to impose countermeasures on Iran. | Treasury describes the goal as accountability for jurisdictions with systemic weaknesses. That suggests the review could lead to consequences for those jurisdictions as early as the next plenary. | Keep your list of virtual asset counterparties by jurisdiction current, so you can respond quickly if the plenary singles out specific markets. |
The FCA's consultation GC26/7, on non-Handbook guidance for firms providing financial services using decentralised finance (DeFi), closes on 18 November 2026. The draft covers operational resilience and financial crime, including SYSC 6 and the Money Laundering Regulations. The FCA plans to publish the final guidance in January 2027.
Why it matters:The draft says responsibility for financial crime controls may be fragmented across developers, governance participants, and infrastructure providers. It also lists high-risk factors, including exposure to wallets or protocols associated with illicit activity and the use of privacy-enhancing technologies.
Action:If your firm touches DeFi, check whether your systems can identify exposure linked to wallet addresses, smart contracts, or protocols, and decide before 18 November whether to respond.
On 5 November 2026, the European Commission hosted the tenth meeting of the High-Level Group on sanctions. Its agenda included the use of crypto assets to circumvent sanctions. The EU Sanctions Envoy also convened a forum with partners including the UK, the US, Japan, and Canada on Russia's financing through payment networks in third countries.
Why it matters:The agenda suggests third-country payment routes and crypto are where EU enforcement attention sits, along with Russia's energy exports and the shadow fleet.
Action:Review payment corridors through third countries for Russia exposure, and confirm that crypto-related circumvention appears in your EU sanctions risk assessment.
On 6 November 2026, FinCEN and the Federal Reserve Board jointly withdrew a proposed rule that would have amended the Recordkeeping and Travel Rule regarding convertible virtual currencies. It would also have lowered the threshold for funds transfers that begin or end outside the United States.
Why it matters:A withdrawn proposal changes nothing in the current rule, so firms that were preparing for a lower cross-border threshold no longer have a proposal to build against.
Action:Check any project plan or budget line that assumed the proposal would take effect, and re-scope it against the rule as it stands.
Treasury's 6 November readout of the October FATF plenary says the planned targeted review of certain jurisdictions with longstanding virtual asset deficiencies will outline decision points for the next plenary. It also says the FATF reminded all jurisdictions to impose countermeasures on Iran.
Why it matters:Treasury describes the goal as accountability for jurisdictions with systemic weaknesses. That suggests the review could lead to consequences for those jurisdictions as early as the next plenary.
Action:Keep your list of virtual asset counterparties by jurisdiction current, so you can respond quickly if the plenary singles out specific markets.
Typology of the week
A vessel needs flag registration to meet international requirements and to receive services. OFAC's 4 November 2026 alert says Iranian shadow fleet operators now rely on fraudulent registries that operate without the host country's recognition or impersonate a legitimate registry. These registries issue flags and documents through websites that can be sophisticated forgeries using incorrect domain names. Other vessels simply claim a flag with no supporting registration. Either way, the flag gives a sanctioned ship a veneer of legitimacy that insurers, banks, and port service providers may accept at face value.
Example
Treasury says the India-based network of Suniel Kumar Sharma and Jaspreet Preeti Shahid, designated on 4 November 2026, purchased web domains and built websites claiming to offer flagging services for countries that had not authorised them. Sites purported to act for Aruba, Guyana, Mali, Mozambique, Malawi, Sint Maarten, and Timor-Leste, among others. On 22 April 2026, the falsely Guyana-flagged MAJESTIC X was seized while carrying Iranian oil.
Recent actions and the control lessons behind them.
An unnamed company allegedly operating from Cyprus and Israel
Control failure:Europol says the company is suspected of supplying fraudulent trading websites to criminal groups, in a crime-as-a-service model. Deceptive adverts drew people in through affiliate marketing, and their personal data was sold to call centres. Victims made a small transfer first and then saw fictitious profits. The case began in 2022 after a German couple could not withdraw their money.
Lesson:A small first payment followed by much larger ones is the pattern to monitor. For retail banks, a customer's sudden run of escalating transfers to a new trading platform merits a conversation before the next payment.
An alleged transnational money laundering network, not named
Control failure:AUSTRAC says the group allegedly converted criminal cash into cryptocurrency and moved funds offshore through shell companies operating as corporate money mules, for multiple organised crime syndicates. AUSTRAC supported the Australian Federal Police-led Taskforce Avarus and calls the case an example of crime as a service.
Lesson:Mule monitoring should cover business accounts as well as personal ones. Look for recently formed companies whose account activity is limited to cash in, crypto purchases, and offshore transfers.
The Associated Press reports that prosecutors in New York have indicted three people on wire fraud and aggravated identity theft charges, with money laundering also charged, over a scheme that allegedly stole about $129 million. According to court documents, the group emailed accounting departments posing as the CEO, then used AI on phone or video calls to mimic the executive's voice and sometimes image. A supposed lawyer then told staff to wire large payments, which were allegedly converted into cryptocurrency. These are allegations. Payment teams should require a call-back to a known number for any confidential request, even after a convincing video call.
The FATF's new report highlights Scam Signals, which covers 85% of UK mobile users and gives banks privacy-preserving mobile-network risk indicators in real time when a customer authorises a payment. The FATF says use of the signal has been associated with a 41% reduction in people scammed and a 44% decrease in fraud losses. It is a useful example for any fraud team building a case for telecoms data in payment decisions.
Career & Skills Corner
Treasury's Prince Group action is a free practice file. It says Qiu Yong ultimately owns the Hong Kong lender Premium Financial through the British Virgin Islands company Sun Speed Holdings, and it names a personal assistant who serves as company secretary and co-director. Take that paragraph and draw it on one page: each person and company in a box, each link labelled with its type, such as owner, director, or secretary. Then mark where each link came from. Now do the same for one corporate customer you have reviewed recently, using only the evidence in the file. The gaps you find are the questions you should have asked. Being able to walk a colleague or a regulator through that page in two minutes is a skill that moves people from alert review into investigations and enhanced due diligence.
This week I'm reading the verdict in Nordea's Danish case over its anti-money laundering controls from 2012 to 2015. Nordea said on 9 November that the court acquitted it on five of seven counts and fined it DKK 155 million, against the DKK 6.6 billion prosecutors sought. I want to see the court's reasoning and whether either side appeals. I'm also watching for the MEXC order in the Federal Register, which starts the 30-day clock, and the 18 November deadline on the FCA's DeFi guidance.
Turn this weekly intelligence into a career. Marco’s AML & Financial Crime course takes you from curious to hireable.
AML & Financial Crime course →