The What and the Why: What’s New in Compliance and Why Does it Matters
This week’s brief leads with the biggest US AML rewrite in roughly 40 years, layered against an escalating run of mid-tier enforcement on three continents, two FinCEN alerts that reset Iran and trafficking typologies, and a Russia sanctions tempo that is now drifting faster between Washington, London, and Brussels than most screening vendors can keep up with.
Top story of the week
FinCEN has proposed the most significant rewrite of US Bank Secrecy Act program rules in roughly 40 years, and the comment window is closing soon. On April 7, FinCEN published a sweeping joint NPRM with the OCC, FDIC, and NCUA (Docket FINCEN 2026 0034)1. The proposal introduces a two-prong framework that separates how an AML program is designed from how it actually performs, requires institutions to incorporate Treasury’s National AML/CFT Priorities into their risk assessments, and shifts examiner focus toward measurable program effectiveness. Comments close June 9, 2026. If your team has ever struggled with an examiner over the gap between policy and execution, this is the one to weigh in on.
Why this matters. This is a fundamental shift from how a program is documented to how it actually performs. US institutions that comment now help shape the standard their next exam is measured against. Non-US institutions should expect the new effectiveness model to influence FATF mutual evaluations and correspondent banking expectations within the year.
Enforcement and penalties
FINTRAC (Canada) fined Alberta-based money services business 13010431 Canada Inc. CA$693,742.50 for failures across core AML obligations2. FINTRAC continues to escalate civil penalties against smaller MSBs that historically flew under the radar.
SRA (UK) fined a Little Sutton law firm £13,901 plus costs for inadequate AML controls3. The pattern from the Solicitors Regulation Authority this year is small fines published with enough detail to become a blueprint for the next sweep.
CySEC (Cyprus) fined Bridge Global Solution Services €40,000 over deficient AML policies and procedures4. Watch for similar findings as ESMA pressure flows into national supervisors ahead of AMLA standing up.
Year-to-date anchor. FinCEN’s record $80M penalty against Canaccord Genuity LLC (March 2026) remains the largest AML enforcement against a broker-dealer in history5. The cited failures were program design and SAR triage, directly aligned with what the new NPRM is trying to fix.
Why this matters. The pattern across FINTRAC, SRA, and CySEC is consistent. Regulators are publishing small and mid-sized fines with enough detail to telegraph the next sweep. Read these as warnings, not isolated cases. The Canaccord penalty also confirms that supervisors are aligning enforcement around program design failures specifically, which is the exact target of the new FinCEN NPRM.
New guidance and rulemaking
FinCEN Alert on Iran procurement networks (May 11). The alert lays out red flags for funding flows and procurement supporting the IRGC6. Update your Iran typology libraries.
FinCEN Notice on 2026 FIFA World Cup human trafficking (May 11). The notice urges heightened vigilance for institutions in and around host cities7. Brief front-line staff on labor and sex trafficking indicators now, not after the tournament starts.
UK OFSI enforcement framework reforms (effective February 9, with continued rollout). Updated guidance doubles the civil monetary penalty cap to the greater of £2 million or 100% of breach value, introduces a four-level seriousness model, and reduces the voluntary disclosure discount from 50% to 30%8. If your UK nexus screening is set-and-forget, revisit.
UK sanctions end-use controls (effective May 13). The Sanctions (EU Exit) (Miscellaneous Amendments) Regulations 2026 give the UK government new authority to impose end-use controls9. Expect dual-use style screening expectations to migrate into financial sanctions practice.
Why this matters. The FinCEN alerts are signals to refresh typologies and brief front-line staff before the threats materialize. The UK changes raise the cost of getting screening wrong. A UK list miss now carries double the penalty exposure it did in January, and end-use controls expand what your screening universe needs to cover.
Sanctions movements (week of May 17 to 24)
May 20. OFAC sanctioned a Sinaloa Cartel money laundering network moving fentanyl proceeds across the US and Mexico border via cryptocurrency10. Refresh cartel and stablecoin on- and off-ramp typologies for your monitoring rules.
May 19 through May 21. Counter-terrorism and Iran-related designations targeting individuals and UAE and Hong Kong entities tied to IRGC oil sales to China11.
May 18. Russia GL 134C authorizes wind-down of crude and petroleum product cargoes loaded on vessels as of April 17, 202612. Review any in-flight Russia origin energy exposure.
May 20. OFAC removed ICC-related designations13. Update screening watchlists; legacy hits will start clearing.
UK packages. May 11 brought 85 designations related to Russia’s forced deportation of Ukrainian children and information warfare networks. May 5 brought 35 designations against Russia’s drone supply chains and migrant trafficking14. Run a fresh UK to US delta on Russia screening.
Why this matters. Three operational themes in one week. OFAC continues to weaponize sanctions against drug cartels using crypto, so transaction monitoring needs cartel and stablecoin typologies live. The UK is moving faster and broader than the US on Russia, which means UK to US delta screening misses are growing every week. ICC delistings need immediate clearing or you carry false positives that flag legitimate counterparties.
Coming up in the next 30 days
- May 30. AUSTRAC deadline for reporting entities to notify AUSTRAC of their AML/CTF compliance officer. Hard transitional rules deadline; missing it is a documented breach.
- June 9. FinCEN AML/CFT Program NPRM comment window closes. Last chance to shape the biggest US AML rewrite in 40 years.
- June 9. AMLA inaugural conference in Frankfurt. First public signal of AMLA’s supervisory tone toward EU obliged entities.
- June 10. AMLA webinar on methodology for identifying directly supervised entities. If you operate in the EU, find out whether you are in scope.
- June (TBA). FATF Plenary, the final session under the Mexican Presidency. Watch for grey list movement and new typology publications.
- July 1. EU MiCA grandfathering period ends. Unregistered VASPs must halt EU activity. Review counterparty exposure now.
Why this matters. Two of these dates carry hard consequences if missed. June 9 is the last formal opportunity to influence the rule that will reshape US AML programs. May 30 is a documented breach if you operate in Australia. The June FATF Plenary and July 1 MiCA cutoff also reshape correspondent and counterparty risk overnight. Block calendar time on these now.
One practical tip for this week
If you handle Russia or Iran exposure, run a delta report between the OFAC SDN list, the UK Consolidated List, and the EU Consolidated List for the past 30 days. The three are drifting apart faster than most screening vendors update, and the UK’s doubled penalty cap means a UK list miss now costs twice what it did in January.
Why this matters. Most screening vendors update list deltas on weekly or monthly cycles. The actual lists are now moving daily, especially around Russia and Iran. Running your own three-way delta closes the gap between when a designation lands and when your screening catches it.
Want more
To go deeper on the topics above or follow current events between briefs, visit the Global RADAR Blog for in-depth analysis, or the Global RADAR Videos page for on-demand video briefings on AML, sanctions, KYC, and emerging compliance topics.
In other news, Global RADAR launched a podcast on May 26, 2026. Episode 1: $3 Billion and 28 Days: FinCEN’s Biggest AML Rewrite in 25 Years. AI Got There First. Listen on Spotify or YouTube.
Want it delivered to your inbox every Wednesday? Subscribe here! No spam, no sales pitch, just the week in compliance.
To schedule a call with a compliance professional and learn more about what Global RADAR can do for your organization, please click here.
Dominic Suszek
Founder and CEO, Global RADAR
globalradar.com
Citations
1. Financial Crimes Enforcement Network (FinCEN), Office of the Comptroller of the Currency, Federal Deposit Insurance Corporation, and National Credit Union Administration. Notice of Proposed Rulemaking: Anti-Money Laundering and Countering the Financing of Terrorism Program Requirements, Docket FINCEN 2026 0034, April 7, 2026. https://www.fincen.gov
2. Financial Transactions and Reports Analysis Centre of Canada (FINTRAC). Public Notice of Administrative Monetary Penalty: 13010431 Canada Inc., 2026. https://www.fintrac-canafe.gc.ca
3. Solicitors Regulation Authority (UK). Decision Notice: Little Sutton firm fined for AML failings, 2026. https://www.sra.org.uk
4. Cyprus Securities and Exchange Commission (CySEC). Decision: Bridge Global Solution Services Ltd, 2026. https://www.cysec.gov.cy
5. Financial Crimes Enforcement Network (FinCEN). Consent Order: Canaccord Genuity LLC, March 2026. https://www.fincen.gov
6. Financial Crimes Enforcement Network (FinCEN). Alert on Islamic Revolutionary Guard Corps Procurement Networks, May 11, 2026. https://www.fincen.gov
7. Financial Crimes Enforcement Network (FinCEN). Notice on Human Trafficking Risks Surrounding the 2026 FIFA World Cup, May 11, 2026. https://www.fincen.gov
8. His Majesty’s Treasury, Office of Financial Sanctions Implementation. OFSI Enforcement and Monetary Penalties for Breaches of Financial Sanctions: Updated Guidance, effective February 9, 2026. https://www.gov.uk/government/organisations/office-of-financial-sanctions-implementation
9. His Majesty’s Government. The Sanctions (EU Exit) (Miscellaneous Amendments) Regulations 2026, in force May 13, 2026. https://www.legislation.gov.uk
10. Office of Foreign Assets Control (OFAC). Treasury Sanctions Sinaloa Cartel Money Laundering Network Tied to Fentanyl and Cryptocurrency, May 20, 2026. https://home.treasury.gov/policy-issues/financial-sanctions
11. Office of Foreign Assets Control (OFAC). Counter-Terrorism and Iran-Related Designations, May 19 to 21, 2026. https://home.treasury.gov/policy-issues/financial-sanctions
12. Office of Foreign Assets Control (OFAC). Russia-Related General License 134C, May 18, 2026. https://home.treasury.gov/policy-issues/financial-sanctions
13. Office of Foreign Assets Control (OFAC). Removal of ICC-Related Designations, May 20, 2026. https://home.treasury.gov/policy-issues/financial-sanctions
14. His Majesty’s Treasury, Office of Financial Sanctions Implementation. UK Sanctions Notices: Russia Designations, May 5 and May 11, 2026. https://www.gov.uk/government/organisations/office-of-financial-sanctions-implementation