Compliance Brief - September 11, 2026 - Global RADAR
Subscribe

Compliance Brief – September 11, 2026

  • Home
  • Compliance Brief – September 11, 2026
Edition 16 · Friday, September 11, 2026

What’s new in compliance. Why it matters. What it means for your operations.

In This Edition

OFSI Puts a £4.73 Million Price on 970 Late Sanctions Alerts

From the Founder
The Citi penalty was earned by 970 alerts that sat in a queue while payments went out, not by a missed Russian name. OFSI has priced alert latency, and the UK is doubling the ceiling to 100 percent of breach value. Every board should ask its compliance officer one number this month: median hours from hit to decision.
Dominic Suszek · Founder and CEO, Global RADAR
30-Second Read
  • OFSI fines Citibank London £4.73 million; 970 payments, delayed alert escalation, 40 percent discount
  • OFAC and DOJ hit Xinbi Guarantee, the scam marketplace; $52 million in crypto restrained
  • Regulators clear mobile driver’s licenses for CIP; FCA takes UK professional AML by 2028

1. Top story of the week

A slow sanctions alert queue cost Citibank London £4.73 million. On September 2, OFSI published its penalty for 970 payments worth £19.7 million that reached designated Russian banks, including Alfa-Bank, Gazprombank and Credit Bank of Moscow. OFSI found no intent but cited delays in reviewing and escalating alerts, plus human error, across payments, correspondent banking and account restrictions. Voluntary disclosure and settlement cut the penalty 40 percent; OFSI’s ceiling is heading to 100 percent of breach value.

Why This Matters
OFSI said Citi should have known or suspected every one of the 970 breaches. That is the standard for a correspondent bank: a hit that waits in a queue while the payment settles is treated as a breach, not a near miss. Latency is now the expensive failure.
Operational Implications
Three steps for this week:

  1. Pull the sanctions alert aging report for the last 90 days and put median hours from hit to decision in front of the COO by September 18.
  2. Rewrite the escalation path so any alert on a correspondent or restricted account older than 24 hours auto-routes to a named senior analyst; a shared inbox is not an escalation.
  3. Test account restrictions the way Citi’s failed: pick ten restricted accounts and confirm outbound payments block, not just flag.

2. Enforcement and penalties

  • OFAC and DOJ, September 9: Designated scam marketplace Xinbi Guarantee and two supporting technology firms as a transnational criminal organization; DOJ restrained $52 million in crypto.
  • AUSTRAC, September 1: Opened an enforcement investigation into Western Union Australia over high-risk payment channels, transaction monitoring and head-office governance, after a 2025 audit.
  • Europol, September 9: Spanish-led operation against underground bankers financing drug trafficking produced 21 arrests, including four in the UAE.
Why This Matters
Xinbi is the “guarantee marketplace” FinCEN described a week earlier: escrow, mule accounts and cash-out services sold to scam compounds and settled in USDT. Designating the market rather than the scammer is the same move OFSI made with Citi: go after the infrastructure that lets the money move.
Operational Implications
Three steps for this week:

  1. Screen for Xinbi Guarantee, Anwen Technology and SafeW Technology today, and add TRON USDT flows to your crypto exposure review; most banks have never looked.
  2. Ask remittance and MSB partners in writing this month what AUSTRAC’s Western Union findings would surface at their shop; the answer decides the relationship.
  3. Brief investigators on the Europol case: hawala now settles through fintech accounts and virtual IBANs, so trade and MSB alerts need one shared queue.

3. New guidance and rulemaking

  • Issued September 8: FinCEN, OCC, Fed, FDIC and NCUA FAQs confirm banks may accept mobile driver’s licenses and verifiable digital credentials under the CIP rule.
  • Issued September 3: FinCEN’s scam-center analysis covers 33,904 reports and $12.7 billion; the companion alert adds red flags and urges 314(b) sharing.
  • Published September 3: FATF’s underground banking report finds 80 percent of jurisdictions rank hawala among principal professional laundering channels; “digital hawala” settles in stablecoins.
Why This Matters
Identity went digital at the front door while the typologies went digital at the back. A mobile driver’s license is a cryptographically signed credential, stronger than a photocopy; FinCEN’s scam data shows the fraud now arrives through mule accounts opened with valid identities. Onboarding is not where you catch this.
Operational Implications
Three steps for this week:

  1. Update the CIP procedures to name verifiable digital credentials as an accepted document by month-end, and document how you verify the issuer’s signature; accepting a screenshot of an mDL is worse than paper.
  2. Map the FinCEN scam-center red flags to existing rules by September 18 and log the gaps; the stablecoin off-ramp to foreign exchanges is usually uncovered.
  3. Register for 314(b) if you have not; examiners will ask why you declined.
Theme of the Week
Speed is the control regulators are measuring. OFSI priced Citi’s delayed alert escalation at £4.73 million on £19.7 million of payments and is raising its ceiling to 100 percent of breach value; DOJ restrained $52 million at Xinbi the day OFAC designated it. A screening program that finds the name after the payment settles is one that never found it.

4. Global watch

  • UK, September 7: FCA takes over AML supervision of lawyers, accountants and TCSPs from end-2028.
  • UK, August 31: First industry-wide alert on Russia’s A7 evasion network; OFSI’s maximum penalty doubles.
  • EU, September 15: Russia individual listings under Regulation 269/2014 reach their renewal date.
  • FATF, September to October: Canada and Türkiye mutual evaluation reports due for publication.

5. Coming up in the next 30 days

Date Event or deadline
September 15, 2026 EU Russia individual listings under Regulation 269/2014 reach their six-month renewal date.
September 23, 2026 OFAC wind-down General Licenses DD and 37 for last week’s aviation designations expire.
September 30, 2026 OFAC Annual Report of Blocked Property due; late filing risks an enforcement referral.
October 1, 2026 Comments close on FinCEN’s section 311 proposal against Banque Misr UAE.
October 19, 2026 Comments close on Treasury’s GENIUS Act stablecoin issuance rulemaking.
October 26, 2026 FATF plenary week opens in Paris, the first under the UK presidency, through October 30.
October 29, 2026 OFSI general licence covering Lukoil Bulgaria expires.

Next Wednesday

Next Wednesday: the EU’s September 15 renewal decision will be in and the September 30 blocked property filing will be two weeks out; we will cover both, plus any FATF mutual evaluation releases.

Want a 30-minute review of your sanctions alert aging and escalation path against the failures OFSI penalized at Citibank London? Book a call with a Global RADAR compliance specialist.

Forwarded this from a colleague? Subscribe at globalradar.com/subscribe.

Best regards,
Dominic Suszek
Founder and CEO, Global RADAR
globalradar.com