Compliance Brief - October 9, 2026 - Global RADAR
Subscribe

Compliance Brief – October 9, 2026

  • Home
  • Compliance Brief – October 9, 2026
Edition 19 · Friday, October 9, 2026

What’s new in compliance. Why it matters. What it means for your operations.

In This Edition

UAE fines compliance head personally: AED 300K

From the Founder
A regulator just fined a compliance head personally, not only his bank. Boards that treat the compliance officer as a cost center should expect written resource requests now, and should say yes. Your audit committee should see the risk assessment before an examiner does.
Dominic Suszek · Founder and CEO, Global RADAR
30-Second Read
  • UAE central bank fines a bank branch AED 20 million and its compliance head personally
  • Canaccord’s $80 million penalty shows what one-size-fits-all customer diligence costs
  • Treasury sanctions A7 shadow bank tied to $91.5 billion; FinCEN proposes sub-agent ban

1. Top story of the week

A regulator fined a bank’s compliance head personally for failing to fulfil his role. On June 24, the Central Bank of the UAE fined a foreign bank branch AED 20 million for repeated AML, terrorist financing and sanctions failures. It separately penalized the branch’s Head of Compliance and money laundering reporting officer AED 300,000. One analysis calls it the regulator’s first MLRO penalty as its own category. U.S. courts have allowed the same since the 2016 MoneyGram ruling.

Why This Matters
The fine was small; the precedent is not. The penalty names the role, not just the bank. Where regulators can reach the officer personally, a documented risk assessment is your own protection.
Operational Implications
Three steps by October 21:

  1. Send your board or audit committee a one-page memo listing every resource request you made this year and the answer; if requests are undocumented, start today.
  2. Re-date and sign your enterprise risk assessment and program approvals, and confirm each has a named owner.
  3. Ask your CEO whether D&O coverage and indemnification protect you personally against regulatory penalties; I would not wait for an exam to find out.

2. Enforcement and penalties

  • FinCEN, SEC and FINRA, March 6: Canaccord Genuity paid $80 million, a broker-dealer record, for applying the same basic customer diligence to every client.
  • FinCEN, March 6: Same order found at least 160 unfiled SARs and four reviewers covering over 100 daily surveillance reports.
  • FINTRAC, September 3: Two Canadian gaming corporations penalized CAD 399,712.50 and CAD 231,826 for unfiled suspicious transaction reports.
  • OFAC, September 29: Sinaloa Cartel network, 21 individuals and 25 entities, including Mexicali officials and mirror-transaction launderers.
Why This Matters
Canaccord shows the failure pattern examiners cite: uniform due diligence, unreviewed alerts and untrained staff. None of it required a sophisticated scheme to find.
Operational Implications
Three steps by October 28:

  1. Pull your customer risk rating model and prove high-risk customers get measurably more diligence than low-risk ones; document the difference in a one-page standard.
  2. Count alerts older than 30 days in your monitoring queue and report the number to your compliance committee.
  3. Confirm training dates for every analyst; a program without training records is the first thing I would expect an examiner to cite.

3. New guidance and rulemaking

  • OFAC, October 1: Designated the A7 Network, a Russia-linked shadow bank tied to $91.5 billion in payments, and blocked its A7A5 ruble token.
  • FinCEN, comments due 30 days after Federal Register notice: Proposed rule bars fund transmittals involving A7 Sub-Agents.
  • OFAC, effective immediately: Alert warns foreign banks doing Iran business can be sanctioned, with no advance notice.
  • FinCEN, effective October 5: Unhosted wallet and crypto mixing proposals withdrawn; existing obligations are unchanged.
Why This Matters
A7 settled payments through third-country sub-agents, and foreign banks are warned they can be sanctioned for Iran business. Screening only the named customer leaves the agent and conversion hop unchecked.
Operational Implications
Two steps by October 14:

  1. Add the A7 Network, its Sub-Agents and Old Vector LLC to screening, then rerun correspondent payments back to January 2025.
  2. Document an exit or enhanced due diligence decision for each respondent with Iran exposure; keep voluntary wallet screening despite the withdrawal, because the A7A5 block proves addresses matter.
Theme of the Week
Three cases, one pattern: the failure sat inside the program. A UAE officer was fined for the framework, Canaccord for uniform diligence, A7 users for ignoring agents. Programs that cannot show risk-differentiated diligence, reviewed alerts and documented decisions are structurally exposed, and the officer’s name is now on the exposure.

4. Global watch

  • FCA, September 17: Investigating Euro Exchange Securities UK over customer risk assessment and due diligence gaps.
  • UK OFSI, November 30: Frozen asset review reports due, valuing holdings at September 30.
  • EU 21st package, October 25: Wind-down ends; package also lists 14 crypto platforms and 33 Russian banks.
  • Australia, October: Sanctioned the Akhmat Kadyrov Foundation for supporting Russia’s war on Ukraine.

5. Coming up in the next 30 days

Date Event or deadline
October 19, 2026 Comments close on Treasury’s GENIUS Act stablecoin issuance, offer and sale rulemaking.
October 22, 2026 UK Iran Interim Basic Necessities General Licence expires; OFSI will not renew it.
October 25, 2026 EU 21st package wind-down ends for pre-existing contracts on newly restricted goods.
October 26 to 30, 2026 FATF Plenary and working groups meet in Paris; watch grey list outcomes.
October 29, 2026 OFAC Lukoil General Licenses 128C and 130A expire.
October 30, 2026 Cuba wind-down ends for group educational travel and professional meetings.
Early November, 2026 FinCEN A7 Sub-Agent proposal comments close, 30 days after Federal Register notice.

Next Wednesday

Next Wednesday: another look at where programs fail examiners, ahead of the October 19 stablecoin comment close and FATF’s plenary less than two weeks out.

Want a 30-minute review of your risk-based customer due diligence against what regulators cited in the Canaccord case? Book a call with a Global RADAR compliance specialist.

Forwarded this from a colleague? Subscribe at globalradar.com/subscribe.

Best regards,
Dominic Suszek
Founder and CEO, Global RADAR
globalradar.com