FinCrime Intelligence Weekly
FinCEN puts the student aid tell in the ACH reference field, a games supplier settles over third party risk it could not see, and the OCC refuses a charter over the people named to run it.
Marco’s Take
Marco Beranzoni
Welcome to Issue 9 of FinCrime Intelligence Weekly. Facts sourced, actions named, no filler. Here is what changed last week and what to do about it this week.
Five stories this week, and one shape underneath all of them. The thing that failed was rarely the control. It was the perimeter drawn around the control.
Evolution ran diligence on its customers. The Gambling Commission’s 23 July statement puts the gap one layer further out, at its customers’ customers: five genuine Evolution games appeared on six websites operated by two firms holding no Commission licence. Wise paid USD 4.2 million on a multistate consent order in July 2025 and says it has invested heavily since. The OCC still refused the trust charter, and the letter, as reproduced by Banking Dive, weighed the people running the programme as heavily as the programme itself. FinCEN’s student aid fraudsters are not attacking a bank at all. They attack a benefits programme and use the bank as the exit. The Spanish network never hid the cash. It put cash where cash already belongs.
Now the uncomfortable part. Open your business-wide risk assessment and look for the sentence describing who your customers serve. Not who they are. Who they serve. If that sentence is missing, your third-party section is an inventory of your own contracts rather than a risk assessment. Write the sentence this week, honestly, and see what it forces you to add.
See you next Monday.
Marco
Treasury's 24 July alert on ghost and straw student schemes hands monitoring teams a rare string-matching rule they can write this week.
Evolution Malta Holding Limited agreed a GBP 4,750,000 payment in lieu of a penalty after its games reached British consumers through two unlicensed operators.
The regulator refused Wise's trust bank application a year after a multistate AML consent order hit its US arm, and the reasoning reached past the programme to proposed leadership.
Eleven arrests and EUR 1,860,400 in cash seized in an operation the Guardia Civil says ran drug money through leisure, property, tourism, events, and vehicle sales companies.
The FCA says four people were arrested, interviewed under caution, and released on bail, with no charges brought and no further comment offered.
What changed this week, why it matters, and what to do about it.
| Region | Update | Why it matters | Action |
|---|---|---|---|
| US | OFAC (the US Office of Foreign Assets Control) published a Russia-related update to the Specially Designated Nationals list on 20 July 2026. No new parties were designated. Two existing entries were amended to add identifying detail: an ATS Heavy Equipment entity in Dubai gained the alias ALWAHA ALSAFRA GENERAL TRADING L.L.C., and a Saint Petersburg company, PITERSNAB, gained a Cyrillic name and additional address detail. | An alias added to an entry you screened months ago is precisely what defeats name screening. Teams that re-screen only against new designations will never see this change, and the counterparty trading under the newly added alias passes cleanly. | Confirm with your screening vendor and your own operations team that an amendment to an existing SDN entry triggers a full retrospective re-screen of the customer base and payment history, not just a forward-looking filter update. Test it with the two entries above. |
| UK | The FCA (UK Financial Conduct Authority) said on 22 July 2026 that four people were arrested and search warrants executed in Hackney, Beckenham and Slough in a fraud and money laundering investigation, carried out with the police's Eastern Region Special Operations Unit and the South East Regional Organised Crime Unit. The FCA states the suspects were interviewed under caution and released on bail. Nobody has been charged, and the regulator says it cannot comment further. | The joint structure is the signal. Regional organised crime units bring arrest and search powers the FCA does not exercise alone, which shortens the distance between a regulatory suspicion and a door going in. Firms holding records on any party involved can receive a production request long before any charging decision. | Rehearse the process for responding to a law enforcement production order or a court order for customer records, including who authorises disclosure and how you avoid tipping off. Confirm that an arrest, on its own, does not trigger automatic customer exit in your policy, because no charge has been brought. |
| EU | The Guardia Civil announced on 23 July 2026 that eleven people have been arrested and one more is under investigation over the alleged laundering of drug trafficking money through nightlife, hospitality, real estate, tourism, event organisation and vehicle sales companies in Seville and Cadiz, as reported by Sevilla Actualidad. The force says EUR 1,860,400 in cash was seized during searches on 1 July, alongside vehicles, watches and jewellery, with around twenty bank accounts blocked. All of this is a police allegation, and everyone involved is a suspect. | The alleged structure spans six sectors, which means no single relationship looks abnormal. A hospitality account with heavy cash deposits, a property purchase, and an events company receiving intercompany transfers are each defensible in isolation. | Run a book review for customer clusters that share directors, addresses or beneficial owners across cash-intensive and asset-heavy sectors at once. Where you find them, look at the intercompany flows rather than the individual deposit patterns. |
| Global | FinCEN (the US Financial Crimes Enforcement Network) issued an alert on 24 July 2026 on fraud schemes targeting Federal student aid programmes, per the Treasury press release. It describes fraud rings using stolen and fraudulent identities to enrol at educational institutions and collect aid, and it states that fraudsters may launder the proceeds through money mules, shell companies and fraudulent accounts. The alert carries a SAR key term, which teams should take from the alert document itself. | The predicate offence sits entirely outside the banking system, so a US institution is the cash-out point rather than the target. Institutions outside the US pick up the second leg, once refunds are moved onward through mules or converted. | Read the alert itself before writing any rules, since the practitioner detail sits in the document rather than the press release. Then check whether your mule account typology covers accounts funded solely by government or institutional refund payments. |
OFAC (the US Office of Foreign Assets Control) published a Russia-related update to the Specially Designated Nationals list on 20 July 2026. No new parties were designated. Two existing entries were amended to add identifying detail: an ATS Heavy Equipment entity in Dubai gained the alias ALWAHA ALSAFRA GENERAL TRADING L.L.C., and a Saint Petersburg company, PITERSNAB, gained a Cyrillic name and additional address detail.
Why it matters:An alias added to an entry you screened months ago is precisely what defeats name screening. Teams that re-screen only against new designations will never see this change, and the counterparty trading under the newly added alias passes cleanly.
Action:Confirm with your screening vendor and your own operations team that an amendment to an existing SDN entry triggers a full retrospective re-screen of the customer base and payment history, not just a forward-looking filter update. Test it with the two entries above.
The FCA (UK Financial Conduct Authority) said on 22 July 2026 that four people were arrested and search warrants executed in Hackney, Beckenham and Slough in a fraud and money laundering investigation, carried out with the police's Eastern Region Special Operations Unit and the South East Regional Organised Crime Unit. The FCA states the suspects were interviewed under caution and released on bail. Nobody has been charged, and the regulator says it cannot comment further.
Why it matters:The joint structure is the signal. Regional organised crime units bring arrest and search powers the FCA does not exercise alone, which shortens the distance between a regulatory suspicion and a door going in. Firms holding records on any party involved can receive a production request long before any charging decision.
Action:Rehearse the process for responding to a law enforcement production order or a court order for customer records, including who authorises disclosure and how you avoid tipping off. Confirm that an arrest, on its own, does not trigger automatic customer exit in your policy, because no charge has been brought.
The Guardia Civil announced on 23 July 2026 that eleven people have been arrested and one more is under investigation over the alleged laundering of drug trafficking money through nightlife, hospitality, real estate, tourism, event organisation and vehicle sales companies in Seville and Cadiz, as reported by Sevilla Actualidad. The force says EUR 1,860,400 in cash was seized during searches on 1 July, alongside vehicles, watches and jewellery, with around twenty bank accounts blocked. All of this is a police allegation, and everyone involved is a suspect.
Why it matters:The alleged structure spans six sectors, which means no single relationship looks abnormal. A hospitality account with heavy cash deposits, a property purchase, and an events company receiving intercompany transfers are each defensible in isolation.
Action:Run a book review for customer clusters that share directors, addresses or beneficial owners across cash-intensive and asset-heavy sectors at once. Where you find them, look at the intercompany flows rather than the individual deposit patterns.
FinCEN (the US Financial Crimes Enforcement Network) issued an alert on 24 July 2026 on fraud schemes targeting Federal student aid programmes, per the Treasury press release. It describes fraud rings using stolen and fraudulent identities to enrol at educational institutions and collect aid, and it states that fraudsters may launder the proceeds through money mules, shell companies and fraudulent accounts. The alert carries a SAR key term, which teams should take from the alert document itself.
Why it matters:The predicate offence sits entirely outside the banking system, so a US institution is the cash-out point rather than the target. Institutions outside the US pick up the second leg, once refunds are moved onward through mules or converted.
Action:Read the alert itself before writing any rules, since the practitioner detail sits in the document rather than the press release. Then check whether your mule account typology covers accounts funded solely by government or institutional refund payments.
Typology of the week
An organised group builds a cluster of legal entities across sectors that are individually unremarkable: nightlife venues, restaurants, event promotion, vehicle sales, tourism services, and property holding companies. Criminal cash is introduced at the businesses where physical cash is genuinely expected, so the deposit itself never looks out of place. Takings are inflated against real trading activity, which means the bank sees a plausible business with a plausible cash cycle. The cluster then moves value between its own entities through intercompany invoices, loans and service fees, which does the real laundering work. Each transfer has a commercial story attached and each entity has a different bank. Value finally settles in assets that hold price and are easy to justify: property, high-value vehicles, watches, and equity stakes in event or leisure companies. The equity stake matters, because a shareholding in an operating business converts laundered funds into an income stream with a clean origin story. The perimeter problem is that every entity passes review on its own terms. The abnormality only appears when the cluster is looked at as one economic unit.
Example
The following is an illustrative composite of a documented method, not an account of any specific real case, investigation or firm. A bank holds accounts for a bar, a small restaurant, a car sales business and a property company. Each was onboarded separately, over two years, by different relationship managers. Each passes review: the bar's cash is consistent with a licensed venue, the restaurant's turnover is modest, the car business shows the payment sizes a dealer would show, and the property company is quiet. What the bank does not see is that two directors sit across all four, that the bar and restaurant transfer roughly the same amount to the car business every month as marketing services, and that the property company's deposits arrive from the car business within days of each vehicle sale. No single account breaches a threshold. The cluster, viewed as one unit, has a cash cycle that no legitimate group of that size would produce.
Recent actions and the control lessons behind them.
Evolution Malta Holding Limited
Control failure:The Gambling Commission's public statement of 23 July 2026 found that Evolution's 2024 business-wide money laundering and terrorist financing risk assessment did not meet minimum requirements on third-party risk, and that its AML policies, procedures and controls lacked detail on due diligence and ongoing monitoring for sub-licensees, including enhanced measures for high risk. The Commission found the assessment was not appropriate between April 2024 and January 2025, and that the gap left Evolution unable to see that two of its customers were supplying its games to the Great Britain market without a Commission licence. Five genuine Evolution games were found on six websites operated by those two unlicensed operators, with what the Commission describes as large volumes of visits by UK consumers between December 2023 and November 2024. Evolution geo-blocked the games after being notified in December 2024, and the Commission recorded early acceptance of the failings and full co-operation as mitigating factors.
Lesson:A business-wide risk assessment that maps your own customers is only half a risk assessment if your product travels onward through them. The Commission's own good practice questions are the test to apply: have you identified the third-party risks and put mitigating policies in place, what proactive measures reduce the chance of your product reaching the illegal market, and do you actually know every site or channel where your product appears. Answer the third one first, because most firms cannot. Note also what this outcome is: a regulatory settlement and a payment in lieu of a financial penalty, not a fine.
Wise US, on the application to establish Wise National Trust
Control failure:The OCC (the US Office of the Comptroller of the Currency) denied Wise's application to establish a national trust bank, in a letter signed by Stephen Lybarger, senior deputy comptroller for chartering, organization and structure, reported by Banking Dive on 24 July 2026. In the passages Banking Dive quotes, the letter says the application presents significant supervisory and compliance concerns, that organizers did not demonstrate sufficient familiarity with federal banking laws and regulations, and that Wise US has been in continuing noncompliance with federal AML and CFT requirements. The letter goes further than the programme itself. It says organizers failed to select appropriate directors and management officials with sufficient experience with AML and CFT requirements or with fiduciary activities, and that proposed leaders have demonstrated a persistent inability to sufficiently manage money laundering and illicit finance risks associated with the proposed bank's activities. In July 2025, less than a month after the application was submitted, Wise US agreed a multistate consent order over Bank Secrecy Act, AML and CFT programme deficiencies, paying USD 4.2 million and committing to increased compliance investment.
Lesson:This is an application decision, not an enforcement action, and it carries no penalty. That is exactly why it should worry compliance leaders more, not less. A consent order that is paid and worked through does not close: it becomes a standing fact about the firm that every future licence, charter or authorisation application is read against. The second lesson sits in the personnel language. Carl Goss, a partner at Hunton Andrews Kurth and a former OCC lawyer, told Banking Dive that the decision is a message to future applicants that people are important. Before any authorisation filing, assess whether your named directors and senior officers can individually evidence relevant regulatory and AML experience, because the regulator will assess them individually whether or not you do.
FinCEN's 24 July alert states that fraudsters may use artificial intelligence or other tools to overcome identity verification by generating fraudulent documents that combine stolen personally identifiable information with fabricated details, which it describes as synthetic identities. That combination breaks the assumption underneath most document checks, which is that a document either matches a real person or it does not. Here the name, date of birth and identifier belong to a real victim, often someone who will never notice, including minors. The fabricated elements are the ones the checking process is least able to verify against an authoritative source. Onboarding controls that pass a document because the PII validates against a bureau will keep passing these. The practical shift is to score the linkage rather than the document: how long the identity elements have existed together, whether the combination of attributes has any history, and whether the address, device and contact details have any independent trail.
Most regulatory guidance describes behaviour and leaves the detection engineering to the firm. The FinCEN alert does something rarer. It states that student aid refund payments made by contracted intermediaries typically occur via ACH (Automated Clearing House) transfers, and that the associated transaction references may include the word refund plus the educational institution's name or abbreviation, giving Local Community College Refund and LCC REFUND as examples, with the stated recipient sometimes appearing too. That is a rule a monitoring team can build this week, on a data field most institutions already retain and rarely mine. Build it as an enrichment tag rather than a standalone alert: mark the inbound payment, then let the existing mule and layering scenarios inherit the tag, so the alert fires on what happens after the refund lands rather than on the refund itself. The wider point for detection teams is that free-text payment reference data is an underused source.
Career & Skills Corner
Most compliance leaders pitch remediation as a risk of penalty. The board discounts it, because a penalty is a one-off number that can be provisioned and moved past. The stronger argument is that unremediated findings become permanent facts about the firm. The Wise case is the evidence to put in front of them. In July 2025, Wise US agreed a multistate consent order over Bank Secrecy Act, AML and CFT programme deficiencies, paid USD 4.2 million, and committed to increased compliance investment. Wise says it has strengthened its US programme since. A year later, the OCC denied its national trust bank charter application, and the letter reported by Banking Dive states that Wise US has been in continuing noncompliance and that organizers are part of long-standing AML and CFT deficiencies at Wise US. The consent order did not stay in the past. It sat in the file when a growth decision was made. Translate that into your own firm's terms before you present. Name the specific corporate actions in the next thirty-six months that require a regulator to look at your compliance history: a licence in a new market, an acquisition, a banking or payments authorisation, a change in control approval, a listing. Then attach the open finding to each one and give a plain estimate of the delay a fresh look would cost. Two habits make this credible over time. First, keep a written record of what you asked for, when, and what was funded, because the value of that record is in the meeting where nobody remembers the trade-off being made. Second, never inflate. A leader who asks for the amount the work actually costs, and who comes back with the finding closed, is the one who gets funded next time.
I am watching four things. Evolution has agreed a licence condition requiring an independent audit of its policies, procedures and controls within 12 months of the licence review concluding, and audits attached to settlements are where you find out whether a firm rebuilt its third-party risk view or just geo-blocked the sites it was told about. On Wise, I want to see whether it does refile under a Genius Act framework, how soon, and whose names appear as proposed directors and management, because the OCC letter made the people a stated reason for refusal. I will be checking whether the FCA investigation behind the 22 July arrests in Hackney, Beckenham and Slough produces any charge, since four people were released on bail and nobody has been charged. And I will follow the Spanish case as it proceeds before investigating court number 5 in El Puerto de Santa Maria, where the allegations of bribery, embezzlement of public funds and influence peddling sitting alongside the money laundering count are the part with the furthest to run.
Turn this weekly intelligence into a career. Marco’s AML & Financial Crime course takes you from curious to hireable.
AML & Financial Crime course →