{ "domain_assessments": { "D1_sanctions_architecture_and_evasion": { "severity": "ELEVATED", "summary": "Sanctions enforcement and evasion architecture remains active across the assessed Tier A jurisdictions. The EU continues to expand designations including 41 shadow-fleet vessels in the 18th Russia package (Dec 2025), while the US issued FinCEN advisories on Iranian oil smuggling and shadow banking (June 2025) and an IRGC alert (May 2026). The structural signal is divergence: the US remains the leading global sanctions enforcer (D1) while simultaneously degrading its own beneficial-ownership coverage (D2), producing an enforcer-enabler contradiction within a single jurisdiction.", "key_judgments": [ { "judgment": "EU and US sanctions enforcement against Russian shadow-fleet and Iranian shadow-banking infrastructure is structurally active, but regime divergence between US, EU and UK creates exploitable arbitrage in the evasion architecture.", "confidence": "Assessed" } ], "items": [] }, "D2_beneficial_ownership_and_corporate_transparency": { "severity": "HIGH", "summary": "Two opposing architectural movements define this cycle. The US gutted domestic beneficial-ownership coverage via the FinCEN interim final rule of 26 March 2025, exempting all US-formed entities and US persons from CTA BOI reporting — a deliberate widening of an enabler gap. Conversely, the UK made Companies House identity verification a legal requirement on 18 Nov 2025 and the EU stood up AMLA, both narrowing opacity. The net global trajectory is mixed, with the US moving against the transparency trend.", "key_judgments": [ { "judgment": "The US CTA domestic exemption represents a political-choice enabler shift rather than a capacity deficit, materially increasing US beneficial-ownership opacity at federal level while state-level anonymous LLC formation persists.", "confidence": "High" }, { "judgment": "UK Companies House reform and EU AMLA operationalisation are narrowing opacity, but enforcement follow-through over the 12-month UK transition and AMLA direct supervision deferred to 2028 leave the structural gains unproven.", "confidence": "Assessed" } ], "items": [] }, "D3_enabler_jurisdictions_and_professional_facilitators": { "severity": "ELEVATED", "summary": "Enabler dynamics within Tier A jurisdictions show divergent trajectories. The UK enabler ecosystem (Companies House, property and professional-services laundering) is being addressed through ECCTA but London remains globally systemic. The Netherlands persists as a conduit jurisdiction at scale through trust offices and letterbox companies. France registers as an active enforcer. US state-level incorporation (Delaware, Wyoming) remains a permissive enabler unaddressed by the gutted CTA.", "key_judgments": [ { "judgment": "The fragmented UK supervisory landscape across 25 supervisors remains the core enabler weakness even as Companies House reform advances; enforcement reality lags legal-framework improvement.", "confidence": "Assessed" } ], "items": [] }, "D4_conflict_finance_and_extractive_integrity": { "severity": "MONITORED", "summary": "No discrete conflict-finance material beyond Russian war-economy and shadow-fleet enablement cross-referenced under D1 is present in the provided baseline excerpt. Standing coverage of Russian war-economy financing, Sahel conflict-mineral trade and DRC mining governance remains carried at baseline pending dedicated source material.", "key_judgments": [], "items": [] }, "D5_crypto_digital_assets_and_innovation": { "severity": "MONITORED", "summary": "No discrete crypto or digital-asset enforcement material is present in the provided baseline excerpt beyond the EU AML Package extension of obligations to crypto under AMLR, cross-referenced under D2. Standing coverage of crypto sanctions evasion, DeFi enforcement, MiCA and stablecoin frameworks remains carried at baseline pending dedicated source material.", "key_judgments": [], "items": [] } }, "jurisdiction_risk_tracker": [ { "jurisdiction": "US", "risk_direction": "stable", "enforcement_vs_enablement": "enforcement", "structural_vs_episodic": "structural", "primary_domains": [ "D1", "D3", "D4" ], "key_signal": "OFAC-OFSI comparative overview codifies a managed-divergence posture; FinCEN GTO/CMLN advisory and continued OFAC procurement/TCO/ISIS designations sustain a high-tempo enforcement posture. The structural signal is the bilateral US-UK divergence architecture itself, not the individual designations.", "source_quality": null, "fatf_recommendations": [ "R.20" ] }, { "jurisdiction": "GB", "risk_direction": "stable", "enforcement_vs_enablement": "mixed", "structural_vs_episodic": "structural", "primary_domains": [ "D1", "D6" ], "key_signal": "OFSI co-authored the comparative overview, signalling intent to align rapid-escalation mechanisms with OFAC; the incoming UK FATF Presidency (1 July 2026) reframes priorities around fraud and scam-compound ML/TF. ECCTA failure-to-prevent-fraud enforcement remains untested. 6AMLD is not applicable to GB (non-EEA); transposition status not relevant this cycle.", "source_quality": null, "fatf_recommendations": [ "R.1" ] }, { "jurisdiction": "EEA", "risk_direction": "improving", "enforcement_vs_enablement": "enforcement", "structural_vs_episodic": "structural", "primary_domains": [ "D2" ], "key_signal": "AMLA operationalisation (Frankfurt conference 9 June; direct-supervision methodology 10 June) centralises supervision to close historical regulatory-arbitrage gaps from fragmented national transposition. AMLR (Reg 2024/1624) applies 2027; AMLA direct supervision begins 2028. 6AMLD (Directive (EU) 2024/1640) is transposed per-Member-State and divergent; per-state transposition status not established this cycle and is a collection gap.", "source_quality": null, "fatf_recommendations": [ "R.24", "R.25" ] }, { "jurisdiction": "KH", "risk_direction": "increasing", "enforcement_vs_enablement": "capacity_deficit", "structural_vs_episodic": "structural", "primary_domains": [ "D3", "D5" ], "key_signal": "FBI seizure of Huione cloud infrastructure confirms entrenched scam-compound and laundering ecosystem; the guarantee-marketplace model persists via successor marketplaces (Xinbi). F1 entanglement of scam-compound economy with state-linked corporate conglomerates (Prince Group, Huione) flagged for WDM.", "source_quality": null, "fatf_recommendations": [ "R.15" ] }, { "jurisdiction": "MX", "risk_direction": "increasing", "enforcement_vs_enablement": "mixed", "structural_vs_episodic": "structural", "primary_domains": [ "D3", "D4" ], "key_signal": "Expanded FinCEN GTO and CMLN advisory evidence escalating cartel-finance and TBML pressure; the Mexico-PRC-US laundering corridor links cartel cash, PRC capital-flight demand and US MSB/real-estate exposure into a single architecture. Cartels designated as FTOs/SDGTs under EO 14157 fuse CT and AML authorities.", "source_quality": null, "fatf_recommendations": [ "R.20" ] }, { "jurisdiction": "CO", "risk_direction": "stable", "enforcement_vs_enablement": "capacity_deficit", "structural_vs_episodic": "structural", "primary_domains": [ "D4" ], "key_signal": "UNODC IFF estimates (USD 1.2-8.6bn/yr cocaine inward, 2015-2019) underscore cocaine and illegal-gold laundering architecture exploiting gold's licit-trade status. Colombia remains in FATF follow-up rather than grey-listing; a current NRA citation is a noted collection gap.", "source_quality": null, "fatf_recommendations": [] }, { "jurisdiction": "LA", "risk_direction": "stable", "enforcement_vs_enablement": "capacity_deficit", "structural_vs_episodic": "structural", "primary_domains": [ "D4" ], "key_signal": "Lao PDR remains under FATF increased monitoring following June review; special economic zones host scam-compound infrastructure with weak supervision, linked to the Golden Triangle Prince Group network.", "source_quality": null, "fatf_recommendations": [] } ], "standing_tracker_updates": [ { "tracker_id": "T1", "name": "Russian sanctions-evasion and shadow-fleet architecture", "trajectory": "active_enforcement_expanding", "note": "EU 18th Russia sanctions package designated 41 shadow-fleet vessels in Dec 2025; Netherlands designations linked to shadow-fleet enablers. Enforcement intensity rising against the evasion architecture.", "confidence": "Assessed" }, { "tracker_id": "T2", "name": "US Corporate Transparency Act trajectory", "trajectory": "degrading", "note": "FinCEN interim final rule of 26 March 2025 exempted US-formed entities and US persons from BOI reporting, with Treasury announcing non-enforcement against US citizens and domestic companies. Federal BO coverage materially reduced.", "confidence": "High" }, { "tracker_id": "T3", "name": "UK BO register and Companies House effectiveness", "trajectory": "improving", "note": "Identity verification became a legal requirement 18 Nov 2025; over 1 million voluntary verifications since April 2025; Companies House changed 140,000+ addresses to default and acted against 100,000+ companies. Enforcement follow-through during the 12-month transition remains the open variable.", "confidence": "Assessed" }, { "tracker_id": "T4", "name": "EU AML Package / AMLA operationalisation", "trajectory": "improving", "note": "AMLA legally created 26 June 2024, Executive Board appointed 22 May 2025, operations commenced 2025, first conference 9 June 2026. Direct supervision deferred to 2028 limits near-term enforcement effect.", "confidence": "High" }, { "tracker_id": "T5", "name": "Iranian evasion infrastructure", "trajectory": "active_monitoring", "note": "FinCEN June 2025 advisory on Iranian oil smuggling and shadow banking, plus IRGC alert May 2026, indicate continued US focus on the Iranian evasion architecture.", "confidence": "Assessed" } ], "structured_claims": [ { "claim_id": "fim-2026-W26-001", "entity": "OFAC and OFSI", "predicate": "jointly published", "value": "a Comparative Overview (23 June 2026) documenting structural divergence between OFAC's jurisdiction-based blocking model and OFSI's breach/asset-freeze model, signalling managed-divergence alignment of escalation mechanisms", "evidence_id": "fim-2026-06-25-001", "confidence": "Assessed", "source_module": "weekly briefing", "notes": "Confidence set to Assessed per review f-002: the two T1 sources are co-authors of the same instrument, not independent corroborating sources. The structural significance is the codified bilateral divergence architecture creating an arbitrage surface for cross-jurisdiction intermediaries.", "domain": "D1", "pillar": "cross-pillar", "filters_applied": [ "F2", "F3" ], "source_tier": "1", "quoted_text": "OFSI does not have broad jurisdiction-based sanctions", "affected_firm_types": [ "bank", "payment_company", "cross_sector" ], "obligation_refs": [ { "framework": "OFAC_reg", "citation": "Executive Order 14024", "obligation_type": "screening", "firm_type_lens": [ "bank", "payment_company", "cross_sector" ], "source": "research", "control_gap_signal": "covered" }, { "framework": "OFSI", "citation": "The Russia (Sanctions) (EU Exit) Regulations 2019", "obligation_type": "screening", "firm_type_lens": [ "bank", "payment_company", "cross_sector" ], "source": "research", "control_gap_signal": "covered" } ], "customer_typology": [ "correspondent_bank", "trade_finance" ], "fatf_recommendations": [] }, { "claim_id": "fim-2026-W26-002", "entity": "OFAC", "predicate": "designated", "value": "individuals (Krugovov, Topchi, Puzyrnikova) tied to Serniya Inzhiniring and Majory LLP, dual-use technology procurement conduits for Russia's military-industrial base, under EO 14024 (23 June 2026)", "evidence_id": "fim-2026-06-25-002", "confidence": "Assessed", "source_module": "weekly briefing", "notes": "Single T1 source naming entities; the analytical value is attacking the procurement intermediary node that forms the connective tissue of evasion architecture rather than end-users alone.", "domain": "D1", "pillar": "cross-pillar", "filters_applied": [ "F1", "F2", "F3", "F4" ], "source_tier": "1", "quoted_text": "Linked To: MAJORY LLP; Linked To: OOO SERNIYA INZHINIRING", "affected_firm_types": [ "bank", "payment_company", "cross_sector" ], "obligation_refs": [ { "framework": "OFAC_reg", "citation": "Executive Order 14024", "obligation_type": "screening", "firm_type_lens": [ "bank", "payment_company", "cross_sector" ], "source": "research", "control_gap_signal": "covered" } ], "customer_typology": [ "corporate", "trade_finance", "correspondent_bank" ], "fatf_recommendations": [] }, { "claim_id": "fim-2026-W26-003", "entity": "AMLA", "predicate": "operationalised", "value": "held its first Frankfurt conference (9 June 2026) and published direct-supervision eligibility methodology (10 June); will directly supervise up to 40 high-risk cross-border groups including CASPs from 2028, with AMLR (2024/1624) applying from 2027", "evidence_id": "fim-2026-06-25-003", "confidence": "High", "source_module": "weekly briefing", "notes": "Multiple independent T1 EU first-party publications. Architecture-over-incident: the supervisory-perimeter shift from purely national authorities to a hybrid EU-level regime closes historical regulatory-arbitrage gaps. Note per review f-003: direct supervision begins 2028, distinct from AMLR application in 2027.", "domain": "D2", "pillar": "AML", "filters_applied": [ "F3" ], "source_tier": "1", "quoted_text": "AMLA's first conference took place on 9 June 2026 at Alte Oper, Frankfurt", "affected_firm_types": [ "bank", "crypto_asset_operator", "investment_firm", "cross_sector" ], "obligation_refs": [ { "framework": "EU_AMLR", "citation": "Regulation (EU) 2024/1624 (AMLR)", "obligation_type": "CDD", "firm_type_lens": [ "bank", "crypto_asset_operator", "investment_firm", "cross_sector" ], "source": "research", "citation_stage": "adopted" }, { "framework": "AMLAReg", "citation": "Regulation (EU) 2024/1620 (AMLA Regulation)", "obligation_type": "governance", "firm_type_lens": [ "bank", "crypto_asset_operator", "investment_firm", "cross_sector" ], "source": "research", "citation_stage": "in_force_pending" }, { "framework": "EU_6AMLD", "citation": "Directive (EU) 2024/1640 (AMLD6)", "obligation_type": "governance", "firm_type_lens": [ "cross_sector" ], "source": "research", "citation_stage": "in_force_pending" } ], "customer_typology": [ "fund_structure", "VASP_counterparty", "corporate" ], "fatf_recommendations": [ "R.24", "R.25" ] }, { "claim_id": "fim-2026-W26-004", "entity": "FBI / Huione Group", "predicate": "seized infrastructure of", "value": "FBI seized a cloud computing account used by Huione Group subsidiaries (23 June 2026); the marketplace received over $31bn and the payments arm $103bn in crypto, yet the guarantee-marketplace model persists with Xinbi Guarantee now leading", "evidence_id": "fim-2026-06-25-004", "confidence": "High", "source_module": "weekly briefing", "notes": "T2 forensic (Elliptic) corroborated by T1 FinCEN Section 311 finding. Per review f-005, the FinCEN Section 311 designation is historical background (Oct 2025) and the primary current-cycle source for the seizure is DOJ/FBI; confidence retained High on the multi-source basis. Architecture-over-incident: illicit finance survives node removal, the resilient guarantee-marketplace model is the finding.", "domain": "D3", "pillar": "AML", "filters_applied": [ "F1", "F3" ], "source_tier": "2", "quoted_text": "largest illicit online marketplace ever recorded", "affected_firm_types": [ "crypto_asset_operator", "payment_company", "bank" ], "obligation_refs": [ { "framework": "BSA", "citation": "USA PATRIOT Act Section 311 (31 USC 5318A)", "obligation_type": "screening", "firm_type_lens": [ "bank", "crypto_asset_operator", "payment_company" ], "source": "research", "control_gap_signal": "covered" } ], "customer_typology": [ "VASP_counterparty", "correspondent_bank", "MSB" ], "fatf_recommendations": [ "R.15" ] }, { "claim_id": "fim-2026-W26-005", "entity": "FinCEN", "predicate": "issued", "value": "expanded Southwest Border GTO (7 March - 2 September 2026) lowering the CTR threshold to $1,000 for MSBs in additional AZ/NM counties, plus a CMLN advisory detailing Chinese networks servicing Sinaloa and other cartels via TBML, mirror transfers and underground banking", "evidence_id": "fim-2026-06-25-005", "confidence": "High", "source_module": "weekly briefing", "notes": "Multiple T1 FinCEN publications. The architecture links Mexican cartel cash, PRC capital-flight demand and US MSB/real-estate exposure into a single laundering corridor; the Chinese underground banking system functions as cross-border professional-enabler infrastructure.", "domain": "D3", "pillar": "AML", "filters_applied": [ "F1", "F2", "F3" ], "source_tier": "1", "quoted_text": "CMLNs often utilize trade-based money laundering, money mule, and mirror transaction methodologies", "affected_firm_types": [ "payment_company", "bank", "cross_sector" ], "obligation_refs": [ { "framework": "BSA", "citation": "BSA 31 USC 5326 (Geographic Targeting Order)", "obligation_type": "reporting", "firm_type_lens": [ "payment_company", "bank" ], "source": "research", "control_gap_signal": "covered" }, { "framework": "OFAC_reg", "citation": "Executive Order 14157", "obligation_type": "screening", "firm_type_lens": [ "bank", "payment_company", "cross_sector" ], "source": "research", "control_gap_signal": "covered" } ], "customer_typology": [ "MSB", "trade_finance", "correspondent_bank", "retail" ], "fatf_recommendations": [ "R.20" ] }, { "claim_id": "fim-2026-W26-006", "entity": "Colombia", "predicate": "assessed for illicit financial flows", "value": "UNODC estimates inward IFFs from cocaine at USD 1.2-8.6bn annually (2015-2019), with illegal gold mining a parallel laundering channel exploiting gold's licit-trade status; Colombia remains in FATF follow-up", "evidence_id": "fim-2026-06-25-006", "confidence": "Assessed", "source_module": "weekly briefing", "notes": "T1 UNODC but estimates pre-date the cycle and represent structural standing rather than a new event. The licit-tradability of gold as a laundering vector is the structural finding; current NRA citation is a noted collection gap.", "domain": "D4", "pillar": "AML", "filters_applied": [ "F3", "F4" ], "source_tier": "1", "quoted_text": "inward IFFs acquired by selling cocaine out of Colombia were estimated between 1.2 to 8.6 billion US dollars per year", "affected_firm_types": [ "bank", "cross_sector" ], "obligation_refs": [], "customer_typology": [ "trade_finance", "corporate" ], "fatf_recommendations": [] }, { "claim_id": "fim-2026-W26-007", "entity": "FATF", "predicate": "issued plenary outcomes", "value": "June 2026 Plenary removed Algeria and Namibia from increased monitoring and newly identified Bosnia and Herzegovina and Iraq; incoming UK Presidency (1 July) reframed priorities around the fraud epidemic and scam-compound ML/TF", "evidence_id": "fim-2026-06-25-007", "confidence": "High", "source_module": "weekly briefing", "notes": "T1 FATF plus T2 forensic corroboration on Golden Triangle linkage. Note per review f-001: the plenary involved both removals (Algeria, Namibia) and additions (Iraq, BiH), a mixed grey-list movement not solely a removal narrative.", "domain": "D3", "pillar": "cross-pillar", "filters_applied": [ "F3" ], "source_tier": "1", "quoted_text": "countries had their progress reviewed by the FATF since February 2026: ... Lao PDR", "affected_firm_types": [ "cross_sector" ], "obligation_refs": [ { "framework": "FATF_Rec", "citation": "R.1", "obligation_type": "governance", "firm_type_lens": [ "cross_sector" ], "source": "research", "control_gap_signal": "partial" } ], "customer_typology": [ "corporate", "correspondent_bank" ], "fatf_recommendations": [ "R.1" ] }, { "claim_id": "fim-2026-W26-008", "entity": "FATF", "predicate": "approved", "value": "a seventh targeted update on implementation of FATF standards for virtual assets/VASPs plus a new DeFi report covering ML/TF/PF challenges, for July 2026 publication", "evidence_id": "fim-2026-06-25-008", "confidence": "High", "source_module": "weekly briefing", "notes": "T1 first-party FATF. Sustains the standards-implementation push amid persistent global under-implementation of the travel rule; uneven VASP supervision creates arbitrage jurisdictions.", "domain": "D5", "pillar": "cross-pillar", "filters_applied": [ "F3" ], "source_tier": "1", "quoted_text": "approved a seventh targeted update on the implementation of the FATF Standards on Virtual Assets", "affected_firm_types": [ "crypto_asset_operator", "cross_sector" ], "obligation_refs": [ { "framework": "FATF_Rec", "citation": "R.15", "obligation_type": "governance", "firm_type_lens": [ "crypto_asset_operator" ], "source": "research", "control_gap_signal": "partial" }, { "framework": "FATF_Rec", "citation": "R.16", "obligation_type": "record_keeping", "firm_type_lens": [ "crypto_asset_operator" ], "source": "research", "control_gap_signal": "partial" } ], "customer_typology": [ "VASP_counterparty" ], "fatf_recommendations": [ "R.15", "R.16" ] }, { "claim_id": "fim-2026-W26-009", "entity": "OFAC", "predicate": "designated", "value": "three individuals and six entities (Syria-based Bitcoin Xchange, Turkish MSBs, three Nigerian BDCs) for moving crypto and cash for ISIS, identifying two TRON wallet addresses (22 June 2026)", "evidence_id": "fim-2026-06-25-009", "confidence": "Assessed", "source_module": "weekly briefing", "notes": "Single T2 vendor characterising an OFAC action; T1 primary not directly captured. The structural finding is the hawala-to-crypto facilitation layer and the on-chain extension of sanctions architecture via attached blockchain identifiers.", "domain": "D5", "pillar": "CTF", "filters_applied": [ "F2", "F3", "F4" ], "source_tier": "2", "quoted_text": "designated three individuals and six entities for facilitating financial transactions on behalf of ... ISIS", "affected_firm_types": [ "crypto_asset_operator", "payment_company", "bank" ], "obligation_refs": [ { "framework": "FATF_Rec", "citation": "R.6", "obligation_type": "screening", "firm_type_lens": [ "crypto_asset_operator", "payment_company", "bank" ], "source": "research", "control_gap_signal": "covered" } ], "customer_typology": [ "MSB", "VASP_counterparty", "correspondent_bank" ], "fatf_recommendations": [ "R.6" ] }, { "claim_id": "fim-2026-W26-010", "entity": "FATF UK Presidency", "predicate": "set priorities and exposed gap", "value": "centred priorities on fraud, scam-compound ML/TF and risk-based supervision, alongside abuse-of-technology work; a documented gap persists between AI/ML monitoring supervisory expectations (model-risk, explainability) and uneven industry practice, with no harmonised global model-risk standard for agentic compliance tooling", "evidence_id": "fim-2026-06-25-010", "confidence": "Assessed", "source_module": "weekly briefing", "notes": "T1 source for the stated priorities; the supervisory-gap characterisation is analytical synthesis. D6 global thesis: the technology paradigm is cross-cutting but its governing guidance is jurisdiction-bound.", "domain": "D6", "pillar": "cross-pillar", "filters_applied": [], "source_tier": "1", "quoted_text": "UK Presidency will focus on stepping up the international response to the fraud epidemic", "affected_firm_types": [ "bank", "payment_company", "cross_sector" ], "obligation_refs": [ { "framework": "BSA", "citation": "BSA 31 USC 5318(h)", "obligation_type": "governance", "firm_type_lens": [ "bank", "cross_sector" ], "source": "research", "control_gap_signal": "partial" }, { "framework": "MLR2017", "citation": "MLR 2017 Reg 18 (risk assessment)", "obligation_type": "governance", "firm_type_lens": [ "bank", "payment_company", "cross_sector" ], "source": "research", "control_gap_signal": "partial" } ], "customer_typology": [ "retail", "corporate" ], "fatf_recommendations": [ "R.1" ] } ], "gaps_register": [ { "gap_id": "fim-int-2026-06-25-G001", "description": "Direct DOJ/FBI primary press release for the 23 June 2026 Huione cloud-infrastructure seizure was not captured; current evidence relies on T2 Elliptic plus historical T1 FinCEN Section 311, weakening current-cycle corroboration for the seizure event." }, { "gap_id": "fim-int-2026-06-25-G002", "description": "T1 OFAC primary press release for the 22 June 2026 ISIS crypto/MSB designations was not directly captured; the claim rests on a single T2 vendor (Chainalysis) characterisation, holding confidence at Assessed." }, { "gap_id": "fim-int-2026-06-25-G003", "description": "No current Colombia National Risk Assessment citation was collected this cycle; UNODC IFF estimates are 2015-2019 historical baseline, limiting a current-cycle risk delta for CO." }, { "gap_id": "fim-int-2026-06-25-G004", "description": "Per-Member-State 6AMLD (Directive (EU) 2024/1640) transposition status for the AMLA-supervision-priority jurisdictions (DE, FR, IE, NL, LU, MT, CY) was not established this cycle; divergent transposition is itself a regime-divergence signal." }, { "gap_id": "fim-int-2026-06-25-G005", "description": "No fresh primary RegTech/model-risk instrument was collected for D6; the supervisory-expectation gap for AI/ML monitoring validation and agentic compliance tooling remains analytical synthesis rather than a documented jurisdiction-bound instrument." }, { "gap_id": "fim-int-2026-06-25-G006", "description": "Pacific and Central Asia coverage remained thin this cycle (Papua New Guinea deferred FATF reporting); regional balance correction incomplete for these under-covered TBML/corruption geographies." } ], "proposed_patches": [ { "patch_id": "fim-2026-06-25-000-d1-sanctions-divergence", "rule_applied": "F2 sanctions-architecture filter; architecture-over-incident", "evidence_ids": [ "fim-2026-06-25-001" ], "confidence": "Assessed", "material_change_justification": "OFAC-OFSI comparative overview codifies a managed-divergence posture creating a persistent cross-jurisdiction arbitrage surface.", "target_kb_path": "domains.D1.sanctions_architecture.us_uk_divergence", "operation": "update", "new_value": "OFAC and OFSI jointly codified structural divergence (jurisdiction-based blocking vs breach/asset-freeze) on 23 June 2026, signalling managed alignment of escalation mechanisms; EU remains outside the bilateral, widening trilateral divergence." }, { "patch_id": "fim-2026-06-25-001-d2-amla-buildout", "rule_applied": "F3 enabler-jurisdiction filter; architecture-over-incident", "evidence_ids": [ "fim-2026-06-25-003" ], "confidence": "High", "material_change_justification": "AMLA moved from establishment to operational supervisory build-out, centralising EU supervision.", "target_kb_path": "domains.D2.eu_aml_package.amla_status", "operation": "update", "new_value": "AMLA operationalised: first Frankfurt conference 9 June 2026 and direct-supervision eligibility methodology 10 June; AMLR (2024/1624) applies 2027, AMLA direct supervision of up to 40 high-risk cross-border groups from 2028." }, { "patch_id": "fim-2026-06-25-002-d3-huione-resilience", "rule_applied": "F1 state-capture filter; architecture-over-incident", "evidence_ids": [ "fim-2026-06-25-004" ], "confidence": "High", "material_change_justification": "FBI seizure confirms the scam-compound laundering ecosystem and its resilience as the guarantee-marketplace model migrates to Xinbi.", "target_kb_path": "domains.D3.enabler_jurisdictions.cambodia_scam_compounds", "operation": "update", "new_value": "FBI seized Huione Group cloud infrastructure (23 June 2026); despite Section 311 designation, Prince Group sanctions and Chen Zhi's arrest, the guarantee-marketplace model persists via Xinbi Guarantee, demonstrating infrastructure resilience to node removal." }, { "patch_id": "fim-2026-06-25-003-d5-fatf-va-defi", "rule_applied": "F3 enabler-jurisdiction filter (VASP arbitrage)", "evidence_ids": [ "fim-2026-06-25-008" ], "confidence": "High", "material_change_justification": "FATF approved a seventh VA/VASP targeted update and a new DeFi report, sustaining the standards-implementation push.", "target_kb_path": "domains.D5.crypto_integrity.fatf_va_standards", "operation": "update", "new_value": "FATF June 2026 Plenary approved a seventh VA/VASP targeted update plus a new DeFi report (ML/TF/PF) for July 2026 publication, amid persistent global under-implementation of the travel rule." } ], "source_register": [ { "evidence_id": "fim-2026-06-25-001", "source_name": "OFAC-OFSI Comparative Overview / GOV.UK / OFSI blog", "source_url": "https://www.gov.uk/government/publications/the-us-and-uk-economic-sanctions-authorities-a-comparative-overview/the-us-and-uk-economic-sanctions-authorities-a-comparative-overview", "source_tier": "1", "claim_ids": [ "fim-2026-W26-001" ] }, { "evidence_id": "fim-2026-06-25-002", "source_name": "OFAC Recent Actions (23 June 2026)", "source_url": "https://ofac.treasury.gov/recent-actions/20260623", "source_tier": "1", "claim_ids": [ "fim-2026-W26-002" ] }, { "evidence_id": "fim-2026-06-25-003", "source_name": "European Commission / AMLA homepage", "source_url": "https://finance.ec.europa.eu/financial-crime/amla_en/", "source_tier": "1", "claim_ids": [ "fim-2026-W26-003" ] }, { "evidence_id": "fim-2026-06-25-004", "source_name": "Elliptic / FinCEN", "source_url": "https://www.elliptic.co/media-center/elliptic-intelligence-used-by-the-fbi-in-action-against-huione-group", "source_tier": "2", "claim_ids": [ "fim-2026-W26-004" ] }, { "evidence_id": "fim-2026-06-25-005", "source_name": "FinCEN expanded Southwest Border GTO / CMLN advisory", "source_url": "https://www.fincen.gov/news/news-releases/fincen-issues-expanded-southwest-border-geographic-targeting-order", "source_tier": "1", "claim_ids": [ "fim-2026-W26-005" ] }, { "evidence_id": "fim-2026-06-25-006", "source_name": "UNODC IFF report (Colombia cocaine/illegal gold)", "source_url": "https://www.unodc.org/documents/data-and-analysis/IFF/5_Colombia_-_IFFs_from_Cocaine_Trafficking_and_Illegal_Gold_Mining.pdf", "source_tier": "3", "claim_ids": [ "fim-2026-W26-006" ] }, { "evidence_id": "fim-2026-06-25-007", "source_name": "FATF Jurisdictions under Increased Monitoring (19 June 2026)", "source_url": "https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-june-2026.html", "source_tier": "1", "claim_ids": [ "fim-2026-W26-007" ] }, { "evidence_id": "fim-2026-06-25-008", "source_name": "FATF Plenary outcomes (June 2026)", "source_url": "https://www.fatf-gafi.org/en/publications/Fatfgeneral/outcomes-fatf-plenary-june-2026.html", "source_tier": "1", "claim_ids": [ "fim-2026-W26-008" ] }, { "evidence_id": "fim-2026-06-25-009", "source_name": "Chainalysis / OFAC ISIS designations", "source_url": "https://www.chainalysis.com/blog/ofac-sanctions-isis-financial-facilitators-june-2026/", "source_tier": "2", "claim_ids": [ "fim-2026-W26-009" ] }, { "evidence_id": "fim-2026-06-25-010", "source_name": "FATF Plenary outcomes (UK Presidency priorities)", "source_url": "https://www.fatf-gafi.org/en/publications/Fatfgeneral/outcomes-fatf-plenary-june-2026.html", "source_tier": "1", "claim_ids": [ "fim-2026-W26-010" ] } ], "run_metadata": { "run_id": "financial-integrity-2026-06-25", "jurisdiction_id": "financial-integrity", "schema_version": "financial-integrity-v1", "run_started_at": "2026-06-25T11:49:20.701120Z", "run_completed_at": "2026-06-25T11:49:20.701120Z", "model_id": "claude-opus-4-8", "run_profile": "periodic_weekly_research", "tools_enabled": [ "web_search" ], "skip_web": false, "retrieval_date": "2026-06-25T00:00:00Z", "web_searches_used": 8, "sources_retrieved": 79, "domains_reached": 18, "t1_source_count": 64, "t2_source_count": 0, "t3_source_count": 15, "egress_probe_results": null }, "weekly_brief": "## Lead Signal\n\nThe most structurally significant development of the cycle is not an enforcement action but a codification of architecture. On 23 June 2026, OFAC and OFSI jointly published a Comparative Overview documenting the fundamental divergence between their two sanctions models: OFAC operates a broad jurisdiction-based blocking regime while OFSI operates a breach-and-asset-freeze model that, as the document states, does not carry broad jurisdiction-based sanctions reach. The joint publication signals an intent to align escalation mechanisms rather than to converge the underlying models, and the analytical consequence is that the divergence is now formally codified rather than merely observed. For cross-jurisdiction intermediaries — correspondent banks, trade-finance houses, payment companies operating across both regimes — the document creates a durable arbitrage surface: an entity or transaction that triggers OFAC blocking obligations may not trigger an equivalent OFSI response, and vice versa. The European Union sits entirely outside this bilateral instrument, widening what is assessed as a trilateral divergence architecture. This is a structural finding under the F2 sanctions-architecture filter: the managed-divergence posture is the product, not the individual designations that accompanied it.\n\nAlso on 23 June, OFAC designated three individuals — Krugovov, Topchi, and Puzyrnikova — linked to Serniya Inzhiniring and Majory LLP, dual-use technology procurement conduits for Russia's military-industrial base under Executive Order 14024. The analytical value of these designations lies not in the individuals themselves but in the node being targeted: procurement intermediaries form the connective tissue of sanctions-evasion architecture, and attacking that layer is structurally more disruptive than designating end-users alone. The Serniya/Majory network remains active in the scheme inventory.\n\n## Other Developments\n\n**AMLA reaches operational milestones.** The Anti-Money Laundering Authority held its first conference in Frankfurt on 9 June 2026 and published its direct-supervision eligibility methodology on 10 June, identifying up to 40 high-risk cross-border obliged entities — including crypto-asset service providers — eligible for direct supervision. The AMLR (Regulation (EU) 2024/1624) applies from 2027; AMLA direct supervision begins in 2028. This is a trajectory-improving structural development: the supervisory perimeter is shifting from fragmented national transposition toward a hybrid EU-level regime, closing historical regulatory-arbitrage gaps that have allowed obliged entities to forum-shop across Member State supervisors. The three instruments of the EU AML Package — the directly applicable AMLR, the per-Member-State sixth AML Directive (6AMLD, Directive (EU) 2024/1640), and the AMLA Regulation (Reg (EU) 2024/1620) establishing the Authority itself — are now all in motion simultaneously, though per-Member-State 6AMLD transposition status remains a noted collection gap this cycle.\n\n**FBI seizes Huione Group cloud infrastructure; the ecosystem persists.** On 23 June 2026, the FBI seized a cloud computing account used by Huione Group subsidiaries. The marketplace had received over USD 31 billion and the payments arm over USD 103 billion in crypto, making it assessed as the largest illicit online marketplace ever recorded. Despite the seizure, a prior FinCEN Section 311 designation, Prince Group sanctions, and the arrest of Chen Zhi, the guarantee-marketplace model has not collapsed: Xinbi Guarantee now leads the successor ecosystem. The architecture-over-incident reading is the finding — illicit finance infrastructure demonstrates resilience to node removal, and the guarantee-marketplace model is the durable structural threat, not any single platform.\n\n**FinCEN expands Southwest Border GTO and issues CMLN advisory.** FinCEN's expanded Southwest Border Geographic Targeting Order, running from 7 March to 2 September 2026, lowers the currency transaction report threshold to USD 1,000 for money services businesses in additional Arizona and New Mexico counties. Simultaneously, a FinCEN advisory on Chinese money-laundering networks details how these networks service the Sinaloa cartel and others via trade-based money laundering, mirror transfers, and the Chinese underground banking system. The structural reading fuses three distinct demand-and-supply dynamics — Mexican cartel cash seeking placement, PRC capital-flight demand seeking outbound channels, and US MSB and real-estate exposure as the laundering surface — into a single corridor architecture.\n\n**FATF June 2026 Plenary: mixed grey-list movements and UK Presidency pivot.** The June Plenary removed Algeria and Namibia from increased monitoring following on-site visits, made substantial-completion determinations for Bulgaria, Cote d'Ivoire, and the DRC, but newly identified Bosnia and Herzegovina and Iraq. The incoming UK Presidency, effective 1 July 2026, reframed FATF priorities around the fraud epidemic, scam-compound ML/TF risk, and risk-based supervision — treating illicit finance as networked infrastructure rather than discrete incidents. Iran and the DPRK remain on the call-for-action list.\n\n**OFAC designates ISIS crypto and MSB facilitators with on-chain identifiers.** On 22 June 2026, OFAC designated three individuals and six entities — including Syria-based Bitcoin Xchange, Turkish MSBs, and three Nigerian bureaux de change — for moving crypto and cash for ISIS, attaching two TRON wallet addresses to the designation. The structural finding is the hawala-to-crypto facilitation layer: the designation extends sanctions architecture on-chain, creating blockchain-native screening obligations for crypto-asset operators alongside the conventional MSB and correspondent-bank screening obligations.\n\n**FATF approves seventh VA/VASP update and DeFi report.** The June Plenary approved a seventh targeted update on implementation of FATF standards for virtual assets and VASPs, alongside a new report on DeFi covering ML/TF/PF challenges, both for July 2026 publication. The sustained standards-implementation push occurs against a backdrop of persistent global under-implementation of the travel rule and uneven VASP supervision that continues to create arbitrage jurisdictions.\n\n**FATF UK Presidency and the compliance-technology gap.** The incoming UK Presidency centred its agenda on fraud, scam-compound ML/TF, and strengthening risk-based supervision, alongside FATF work on abuse of technology. A documented gap persists between supervisory expectations for AI and machine-learning transaction-monitoring validation — covering model-risk and explainability — and uneven industry practice. No harmonised global model-risk standard for agentic compliance tooling exists, leaving the gap as a structural watch signal for D6.\n\n**Colombia IFF architecture: cocaine and illegal gold.** UNODC estimates inward illicit financial flows from Colombian cocaine at USD 1.2 to 8.6 billion annually for the period 2015 to 2019, with illegal gold mining operating as a parallel laundering channel that exploits gold's licit-trade status. Colombia remains in FATF follow-up. These figures represent a structural baseline rather than a current-cycle delta; the absence of a current National Risk Assessment citation is a noted collection gap.\n\n## Cross-Monitor Connections\n\nThis cycle generates cross-monitor signals across five adjacent monitors. For SCEM, the Russian procurement-network designations targeting Serniya and Majory sustain the military-industrial financing thread, while the Golden Triangle scam-compound forced-labour economy across Cambodia, Myanmar, and Laos carries conflict-finance-adjacent implications. For ERM, the OFAC-OFSI Comparative Overview explicitly flags shadow-fleet typologies as a shared concern, and the Lukoil and Sakhalin-2 general licence extensions affect Russian energy revenue channels; illegal gold mining in Colombia adds a commodity-laundering vector. For WDM, the Cambodian scam-compound economy's entanglement with state-linked corporate conglomerates — the Prince Group and Huione — is a state-capture signal that warrants routing to the WDM monitor, as does narco-finance corruption in Colombia. For FCW, pig-butchering and DPRK heist laundering through the Huione ecosystem, and the ISIS crypto and MSB donor networks spanning Europe, MENA, and Africa, are information-operations-adjacent financial channels. For ESA, AMLA operationalisation and the AMLR 2027 application date reshape EU supervisory architecture in ways that carry direct implications for the EU regulatory-gap monitor; the EU's absence from the OFAC-OFSI bilateral instrument widens the trilateral divergence that ESA tracks. For GMM, the Russia energy-sector sanctions and divestment licensing carry macro-financial transmission implications that the Global Macro Monitor should absorb.\n\n## Outlook\n\nThe structural trajectory across this cycle is one of architecture consolidation at the enforcement layer and architecture persistence at the evasion layer. The OFAC-OFSI Comparative Overview codifies a managed-divergence posture that will persist as a cross-jurisdiction arbitrage surface for the foreseeable future; the EU's absence from that bilateral instrument is not an oversight but a structural feature of the trilateral regime landscape. AMLA's operational build-out is the most significant improving signal: the shift from fragmented national supervision toward a hybrid EU-level regime closes gaps that have been analytically visible for years, though the 2027 AMLR application date and 2028 direct-supervision commencement mean the arbitrage window remains open for at least eighteen months. The Huione-to-Xinbi transition illustrates the central challenge: enforcement actions that remove nodes do not remove the underlying infrastructure model, and the guarantee-marketplace architecture will continue to evolve faster than designation cycles. The FinCEN GTO expiry window in September 2026 and the pending FinCEN Section 311 Huione final rule are the two near-term regulatory decision points with the highest operational consequence for compliance functions. The FATF UK Presidency's fraud-and-scam-compound framing signals a thematic reorientation that may reshape supervisory expectations and typology guidance through 2026 and into 2027.", "meta": { "issue": 2, "volume": 1, "week_label": "25 June 2026", "published": "2026-06-25T18:00:00Z", "slug": "2026-06-25", "publish_time_utc": "T18:00:00Z", "editor": "fim-publisher-bot", "schema_version": "2.0", "cycle_disposition": "material_change" }, "cross_monitor_flags": { "updated": "2026-06-25T18:00:00Z", "flags": [], "standing_linkages": [], "version_history": [ { "date": "2026-06-11", "change": "No changes — routine reaffirmation", "reason": "Publisher auto-verification (class-not-instance)" }, { "date": "2026-06-25", "change": "No changes — routine reaffirmation", "reason": "Publisher auto-verification (class-not-instance)" } ] }, "source_url": "https://asym-intel.info/monitors/financial-integrity/2026-06-25-weekly-brief/", "weekly_brief_sources": [], "weekly_developments": [], "grounding": { "content_source": null, "web_searches_used": 8, "sources_retrieved": 79, "domains_reached": 18, "retrieval_date": "2026-06-25T00:00:00Z" }, "domain_tracker": [ { "domain": "D1", "domain_name": "Sanctions Architecture and Evasion", "status": "material_change", "trajectory": "deteriorating", "key_development": "OFAC-OFSI Comparative Overview (23 June 2026) codifies a managed-divergence posture between two structurally distinct sanctions models, while OFAC continued Serniya/Majory procurement-network designations and processed Russia-related delistings.", "developments": [ { "title": "OFAC-OFSI Comparative Overview codifies managed divergence", "summary": "OFAC and OFSI jointly published a comparative overview documenting OFAC's broad jurisdiction-based blocking model against OFSI's breach/asset-freeze model, signalling intent to align escalation mechanisms rather than fully converge. The architecture creates an arbitrage surface for intermediaries operating across both jurisdictions; the EU sits outside the bilateral, widening trilateral divergence.", "jurisdiction": "US", "actor_category": "A1" }, { "title": "OFAC designates Serniya/Majory-linked procurement intermediaries", "summary": "OFAC designated Krugovov, Topchi and Puzyrnikova tied to Serniya Inzhiniring and Majory LLP, attacking the dual-use procurement node of Russia's military-industrial financing architecture rather than end-users alone.", "jurisdiction": "UK", "actor_category": "A2" } ] }, { "domain": "D2", "domain_name": "Beneficial Ownership and Corporate Transparency", "status": "material_change", "trajectory": "improving", "key_development": "AMLA reached operational milestones (first Frankfurt conference 9 June; direct-supervision eligibility methodology 10 June), advancing the EU shift from fragmented national transposition toward centralised supervision; AMLR applies from 2027, AMLA direct supervision from 2028.", "developments": [ { "title": "AMLA operationalises supervisory build-out", "summary": "AMLA moved from establishment to operational supervisory build-out, publishing methodology for identifying up to 40 high-risk cross-border obliged entities (including CASPs) eligible for direct supervision, with BO registry interconnection a core deliverable affecting DE, FR, IE, NL, LU, MT, CY. AMLR (Reg 2024/1624) applies from 2027; direct supervision begins 2028.", "jurisdiction": "EEA", "actor_category": "A1" } ] }, { "domain": "D3", "domain_name": "Enabler Jurisdictions and Professional Facilitators", "status": "material_change", "trajectory": "deteriorating", "key_development": "FATF June Plenary removed Algeria and Namibia from increased monitoring but newly identified Bosnia and Herzegovina and Iraq; FBI seizure of Huione Group cloud infrastructure confirmed Cambodia's scam-compound economy and its resilience as the guarantee-marketplace model migrated to Xinbi; FinCEN GTO/CMLN advisory mapped the Mexico-PRC-US laundering corridor.", "developments": [ { "title": "FATF June 2026 Plenary grey-list movements", "summary": "Algeria and Namibia removed from increased monitoring after on-site visits; Bulgaria, Cote d'Ivoire and DRC reached substantial-completion determinations; Bosnia and Herzegovina and Iraq newly identified. The incoming UK Presidency (from 1 July 2026) reframed priorities around the fraud epidemic, scam-compound ML/TF risk and risk-based supervision, treating illicit finance as networked infrastructure.", "jurisdiction": "Global", "actor_category": "A1" }, { "title": "FBI seizes Huione Group cloud infrastructure; ecosystem persists", "summary": "FBI seized a cloud computing account used by Huione Group subsidiaries (23 June 2026). Despite Huione's collapse, FinCEN Section 311 designation, Prince Group sanctions and Chen Zhi's arrest, the guarantee-marketplace model persists with Xinbi Guarantee now leading, illustrating illicit finance as resilient infrastructure surviving node removal.", "jurisdiction": "KH", "actor_category": "A4" }, { "title": "FinCEN expanded Southwest Border GTO and CMLN advisory", "summary": "FinCEN's expanded Southwest Border GTO (7 March - 2 September 2026) lowers the CTR threshold to $1,000 for MSBs in additional Arizona and New Mexico counties, while the CMLN advisory details Chinese money-laundering networks servicing Sinaloa and other cartels via TBML, mirror transfers and the Chinese underground banking system, fusing PRC capital-flight demand with cartel cash and US MSB/real-estate exposure.", "jurisdiction": "MX", "actor_category": "A4" } ] }, { "domain": "D4", "domain_name": "Conflict Finance and Extractive-Industry Integrity", "status": "material_change", "trajectory": "stable", "key_development": "UNODC IFF estimates underscore Colombia's cocaine and illegal-gold laundering architecture (USD 1.2-8.6bn/yr cocaine inward); Laos remains under FATF increased monitoring with Golden Triangle scam-compound spillover linked to the Prince Group network.", "developments": [ { "title": "UNODC Colombia cocaine and illegal-gold IFF architecture", "summary": "UNODC methodology estimates inward illicit financial flows from Colombian cocaine at USD 1.2-8.6 billion annually (2015-2019), with illegal gold mining adding a parallel laundering channel exploiting gold's licit-trade status. Colombia remains in FATF follow-up; a current NRA citation is a noted collection gap. Estimates are historical baseline, not a current-cycle delta.", "jurisdiction": "CO", "actor_category": "A4" }, { "title": "Laos remains under FATF increased monitoring; Golden Triangle spillover", "summary": "Lao PDR's progress was reviewed at the June Plenary and it remains under increased monitoring. Fraud compounds across Cambodia, Myanmar and Laos linked to the Prince Group network situate the Golden Triangle corridor as conflict-finance-adjacent infrastructure for trafficking and cyber-enabled fraud.", "jurisdiction": "LA", "actor_category": "A4" } ] }, { "domain": "D5", "domain_name": "Crypto, Digital Assets, and Financial Innovation", "status": "material_change", "trajectory": "stable", "key_development": "FATF approved a seventh VA/VASP targeted update and a new DeFi report (July 2026 publication); OFAC's 22 June ISIS designations attached on-chain TRON identifiers across Africa, Europe and the Middle East, extending sanctions architecture on-chain.", "developments": [ { "title": "FATF seventh VA/VASP targeted update and DeFi report", "summary": "The June 2026 Plenary approved a seventh targeted update on implementation of FATF standards for virtual assets/VASPs plus a new DeFi report covering ML/TF/PF challenges, for July publication, sustaining the standards push amid persistent global under-implementation of the travel rule.", "jurisdiction": "Global", "actor_category": "A1" }, { "title": "OFAC designates ISIS crypto/MSB facilitators with on-chain identifiers", "summary": "OFAC designated three individuals and six entities (including Syria-based Bitcoin Xchange, Turkish MSBs and three Nigerian bureaux de change) for moving crypto and cash for ISIS, identifying two TRON wallet addresses, targeting the hawala-to-crypto facilitation layer linking European, MENA and African donor flows.", "jurisdiction": "AFR", "actor_category": "A4" } ] }, { "domain": "D6", "domain_name": "Compliance Technology and Active Defence", "status": "watch", "trajectory": "stable", "key_development": "Incoming UK FATF Presidency prioritises risk-based supervision and abuse-of-technology response; a documented gap persists between supervisory expectations for AI/ML transaction-monitoring validation (model-risk, explainability) and uneven industry practice, with no harmonised global model-risk standard for agentic compliance tooling.", "developments": [ { "title": "FATF UK Presidency tech-abuse and risk-based-supervision priorities", "summary": "The incoming UK FATF Presidency (from 1 July 2026) centred priorities on the fraud epidemic, scam-compound ML/TF risk and strengthening risk-based supervision, alongside FATF work on abuse of technology. The supervisory-expectation gap for AI/ML monitoring validation and the absence of a harmonised model-risk standard for agentic compliance tooling persist as a global thesis.", "actor_category": "A1" } ] } ], "standing_trackers": [ { "tracker_id": "T1", "tracker_name": "Russian Sanctions-Evasion Architecture", "status": "material_change", "trajectory": "stable", "key_development": "OFAC continued procurement-network designations (Serniya/Majory-linked individuals) and processed Russia-related delistings (18/23/24 June), while extending Lukoil/LIG divestment licensing (GL 131F expires 28 June 2026) and Sakhalin-2 GL 55F to December 2026. Houthi/Yemen channels recorded no material change this cycle.", "developments": [] }, { "tracker_id": "T2", "tracker_name": "EU AML Package / AMLA", "status": "material_change", "trajectory": "improving", "key_development": "AMLA reached operational milestones (first Frankfurt conference 9 June; direct-supervision eligibility methodology 10 June). AMLR (2024/1624) applies from 2027; AMLD6 transposition and BO registry interconnection proceed; AMLA Regulation amended by Reg (EU) 2025/2088. Track the three instruments separately (AMLR/6AMLD/AMLAReg).", "developments": [] }, { "tracker_id": "T3", "tracker_name": "FATF Grey List", "status": "material_change", "trajectory": "mixed", "key_development": "June 2026 Plenary removed Algeria and Namibia, made substantial-completion determinations for Bulgaria, Cote d'Ivoire and DRC, and newly identified Bosnia and Herzegovina and Iraq. Canada and Turkiye mutual evaluations adopted; Iran/DPRK remain on the call-for-action list.", "developments": [] }, { "tracker_id": "T4", "tracker_name": "Beneficial-Ownership Register Status", "status": "incremental_development", "trajectory": "improving", "key_development": "EU BO interconnection advances under AMLD6/AMLR (centralised bank-account-register single access point and BO registry access for competent authorities); global picture remains uneven and FATF R.24/R.25 implementation lags in several monitored jurisdictions. No discrete global registry event beyond the AMLA build-out.", "developments": [] }, { "tracker_id": "T5", "tracker_name": "Crypto & Digital-Asset Integrity", "status": "material_change", "trajectory": "stable", "key_development": "FBI seized Huione Group cloud infrastructure (23 June); FATF approved a seventh VA/VASP targeted update plus a DeFi report (July publication); OFAC's 22 June ISIS designations attached on-chain TRON identifiers; the guarantee-marketplace ecosystem (Xinbi) persists post-Huione, demonstrating infrastructure resilience.", "developments": [] }, { "tracker_id": "T6", "tracker_name": "Sanctions Regime Divergence", "status": "material_change", "trajectory": "deteriorating", "key_development": "OFAC and OFSI jointly published a Comparative Overview (23 June) documenting structural divergence (jurisdiction-based blocking versus breach/asset-freeze) and signalling intent to align escalation mechanisms, shadow-fleet typologies and structured regime-dismantling. The EU remains outside the bilateral, widening trilateral divergence.", "developments": [] } ], "active_scheme_inventory": [ { "scheme_id": "huione-guarantee-marketplace", "scheme_name": "Huione/Xinbi guarantee-marketplace laundering infrastructure", "description": "Cambodia-based guarantee-marketplace conglomerate model receiving over $31bn (marketplace) and $103bn (payments arm), laundering cyber-heist and pig-butchering proceeds; persists via successor Xinbi Guarantee despite FBI seizure, FinCEN Section 311 designation and Prince Group sanctions.", "domain": "D3", "pillar": "AML", "actor_category": "A4", "jurisdiction": "KH", "status": "active", "obligation_refs": [ { "framework": "BSA", "citation": "USA PATRIOT Act Section 311 (31 USC 5318A)", "obligation_type": "screening", "firm_type_lens": [ "bank", "crypto_asset_operator", "payment_company" ], "source": "research" } ], "customer_typology": [ "VASP_counterparty", "correspondent_bank", "MSB" ], "red_flag_indicators": [ { "indicator": "Guarantee-marketplace intermediary receiving very high aggregate crypto inflow volumes routed through successor platforms after a primary platform takedown", "observability": "onchain", "linked_customer_typology": [ "VASP_counterparty" ] }, { "indicator": "Payments-arm volumes inconsistent with stated business profile and concentrated counterparties", "observability": "transaction_monitoring", "linked_customer_typology": [ "MSB", "VASP_counterparty" ] } ] }, { "scheme_id": "cmln-cartel-tbml-corridor", "scheme_name": "Chinese money-laundering network / cartel TBML corridor", "description": "Chinese money-laundering networks service Sinaloa and other cartels via TBML, mirror transfers and the Chinese underground banking system, linking Mexican cartel cash, PRC capital-flight demand and US MSB/real-estate exposure into a single corridor.", "domain": "D3", "pillar": "AML", "actor_category": "A4", "jurisdiction": "MX", "status": "active", "obligation_refs": [ { "framework": "BSA", "citation": "BSA 31 USC 5326 (Geographic Targeting Order)", "obligation_type": "reporting", "firm_type_lens": [ "payment_company", "bank" ], "source": "research" } ], "customer_typology": [ "MSB", "trade_finance", "correspondent_bank", "retail" ], "red_flag_indicators": [ { "indicator": "Structured cash transactions between $1,000 and $10,000 by MSBs in designated southwest-border counties", "observability": "transaction_monitoring", "linked_customer_typology": [ "MSB", "retail" ] }, { "indicator": "Mirror-transfer patterns and offsetting trade flows with no apparent economic rationale linking PRC and Mexican counterparties", "observability": "trade_docs", "linked_customer_typology": [ "trade_finance", "correspondent_bank" ] } ] }, { "scheme_id": "serniya-majory-procurement", "scheme_name": "Serniya/Majory dual-use procurement network", "description": "Procurement intermediaries (Serniya Inzhiniring, Majory LLP, Invention Bridge SL) routing dual-use technology to Russia's military-industrial base through third-country conduits.", "domain": "D1", "pillar": "cross-pillar", "actor_category": "A2", "jurisdiction": "RU", "status": "active", "obligation_refs": [ { "framework": "OFAC_reg", "citation": "Executive Order 14024", "obligation_type": "screening", "firm_type_lens": [ "bank", "payment_company", "cross_sector" ], "source": "research" } ], "customer_typology": [ "corporate", "trade_finance", "correspondent_bank" ], "red_flag_indicators": [ { "indicator": "Third-country intermediary entities re-exporting controlled dual-use goods to higher-risk destinations shortly after import", "observability": "trade_docs", "linked_customer_typology": [ "trade_finance", "corporate" ] } ] }, { "scheme_id": "isis-hawala-crypto-facilitation", "scheme_name": "ISIS hawala-to-crypto facilitation layer", "description": "Syria-based crypto exchange, Turkish MSBs and Nigerian bureaux de change moving crypto and cash for ISIS, with donor flows from Norway, Belgium, Netherlands, South Africa and the US, attaching identifiable TRON wallet addresses.", "domain": "D5", "pillar": "CTF", "actor_category": "A6", "jurisdiction": "AFR", "status": "active", "obligation_refs": [ { "framework": "FATF_Rec", "citation": "R.6", "obligation_type": "screening", "firm_type_lens": [ "crypto_asset_operator", "payment_company", "bank" ], "source": "research" } ], "customer_typology": [ "MSB", "VASP_counterparty", "correspondent_bank" ], "red_flag_indicators": [ { "indicator": "Bureau-de-change and MSB transactions to crypto on-ramps with onward transfers to flagged TRON wallet addresses", "observability": "onchain", "linked_customer_typology": [ "MSB", "VASP_counterparty" ] } ] } ], "regulatory_horizon": [ { "horizon_id": "fim-reg-2026-001", "title": "UK ECCTA 2023 failure-to-prevent-fraud offence enforcement maturation", "instrument_type": "enforcement_policy", "stage": "in_force", "expected_date": "2026-Q3", "estimated_impact_date": "2026-Q3", "uncertainty_band": "half_year", "risk_direction_on_implementation": "improving", "affected_jurisdictions": [ "GB" ], "gap_assessment": "Offence in force since 1 September 2025 for large organisations; general industry practice is still maturing reasonable-prevention procedures aligned to Home Office guidance, and first prosecutions/DPA outcomes are pending, leaving the reasonableness benchmark untested.", "what_changes": "Large organisations with a UK nexus face strict-liability corporate exposure where an associated person commits a base fraud offence intending to benefit the organisation; the identification-doctrine reform broadens attribution to senior managers.", "primary_source_url": "https://www.gov.uk/government/publications/offence-of-failure-to-prevent-fraud-introduced-by-eccta", "confidence": "High", "source_tier": "1", "affected_firm_types": [ "cross_sector" ], "obligation_refs": [ { "framework": "ECCTA2023", "citation": "ECCTA 2023 Part 5 (failure to prevent fraud)", "obligation_type": "governance", "firm_type_lens": [ "cross_sector" ], "source": "research", "citation_stage": "in_force" } ], "fatf_recommendations": [] }, { "horizon_id": "fim-reg-2027-001", "title": "EU AML Regulation (2024/1624) / 6AMLD application date", "instrument_type": "regulation", "stage": "adopted", "expected_date": "2027-Q3", "estimated_impact_date": "2027-Q3", "uncertainty_band": "year", "risk_direction_on_implementation": "improving", "affected_jurisdictions": [ "DE", "FR", "IE", "NL", "LU", "MT", "CY" ], "gap_assessment": "Directly applicable single rulebook supersedes divergent national transpositions; general industry readiness varies widely across newly in-scope obliged-entity categories.", "what_changes": "The single AML rulebook (AMLR) becomes directly applicable and 6AMLD transposition deadlines bite across Member States, with AMLA direct supervision of up to 40 high-risk cross-border groups.", "primary_source_url": "https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-eu-level_en", "confidence": "High", "source_tier": "1", "affected_firm_types": [ "cross_sector" ], "obligation_refs": [ { "framework": "EU_AMLR", "citation": "Regulation (EU) 2024/1624 (AMLR)", "obligation_type": "CDD", "firm_type_lens": [ "cross_sector" ], "source": "research", "citation_stage": "adopted" }, { "framework": "EU_6AMLD", "citation": "Directive (EU) 2024/1640 (AMLD6)", "obligation_type": "governance", "firm_type_lens": [ "cross_sector" ], "source": "research", "citation_stage": "adopted" } ], "fatf_recommendations": [ "R.24", "R.25" ] }, { "horizon_id": "fim-reg-2026-050", "title": "AMLA Work Programme / supervisory build-out", "instrument_type": "regulation", "stage": "in_force_pending", "expected_date": "2026-H2", "estimated_impact_date": "2026-H2", "uncertainty_band": "half_year", "risk_direction_on_implementation": "improving", "affected_jurisdictions": [ "DE", "FR", "IE", "NL", "LU", "MT", "CY" ], "gap_assessment": "AMLA moved from establishment to operational supervisory build-out; direct-supervision eligibility methodology published 10 June, with BO registry interconnection a core deliverable.", "what_changes": "AMLA stands up in Frankfurt and publishes its first supervisory methodology, identifying obliged entities eligible for direct supervision.", "primary_source_url": "https://finance.ec.europa.eu/financial-crime/amla_en/", "confidence": "High", "source_tier": "1", "soe_candidate": true, "affected_firm_types": [ "cross_sector" ], "obligation_refs": [ { "framework": "AMLAReg", "citation": "Regulation (EU) 2024/1620 (AMLA Regulation)", "obligation_type": "governance", "firm_type_lens": [ "cross_sector" ], "source": "research", "citation_stage": "in_force_pending" } ], "fatf_recommendations": [ "R.24", "R.25" ] }, { "horizon_id": "fim-reg-2028-001", "title": "AMLA direct supervision of selected obliged entities", "instrument_type": "regulation", "stage": "adopted", "expected_date": "2028-H1", "estimated_impact_date": "2028-H1", "uncertainty_band": "multi_year", "risk_direction_on_implementation": "improving", "affected_jurisdictions": [ "DE", "FR", "IE", "NL", "LU", "MT", "CY" ], "gap_assessment": "General industry readiness for a hybrid EU-level supervisory regime varies; the cohort of high-risk cross-border obliged entities is being defined under the eligibility methodology.", "what_changes": "AMLA begins direct supervision of a first cohort of high-risk cross-border obliged entities, shifting the supervisory perimeter from purely national authorities to a hybrid EU-level regime.", "primary_source_url": "https://finance.ec.europa.eu/financial-crime/amla_en/", "confidence": "High", "source_tier": "1", "soe_candidate": true, "affected_firm_types": [ "cross_sector" ], "obligation_refs": [ { "framework": "AMLAReg", "citation": "Regulation (EU) 2024/1620 (AMLA Regulation)", "obligation_type": "governance", "firm_type_lens": [ "cross_sector" ], "source": "research", "citation_stage": "adopted" } ], "fatf_recommendations": [ "R.24" ] }, { "horizon_id": "fim-reg-2026-002", "title": "FinCEN Southwest Border GTO expiry/renewal window", "instrument_type": "enforcement_policy", "stage": "in_force", "expected_date": "2026-Q3", "estimated_impact_date": "2026-Q3", "uncertainty_band": "quarter", "risk_direction_on_implementation": "uncertain", "affected_jurisdictions": [ "US", "MX" ], "gap_assessment": "Current GTO runs to 2 September 2026 with a $1,000 CTR threshold for MSBs in designated counties; renewal/expansion decisions create recurring compliance-scope uncertainty versus standard $10,000 reporting practice.", "what_changes": "MSBs in covered AZ, CA, NM and TX localities file CTRs for cash transactions $1,000-$10,000; expiry or further expansion alters the reporting perimeter.", "primary_source_url": "https://www.fincen.gov/news/news-releases/fincen-issues-expanded-southwest-border-geographic-targeting-order", "confidence": "High", "source_tier": "1", "affected_firm_types": [ "payment_company", "bank" ], "obligation_refs": [ { "framework": "BSA", "citation": "BSA 31 USC 5326", "obligation_type": "reporting", "firm_type_lens": [ "payment_company", "bank" ], "source": "research", "citation_stage": "in_force" } ], "fatf_recommendations": [ "R.20" ] }, { "horizon_id": "fim-reg-2026-003", "title": "FinCEN Section 311 Huione Group correspondent-account prohibition finalisation", "instrument_type": "regulation", "stage": "consultation", "expected_date": "2026-H2", "estimated_impact_date": "2026-H2", "uncertainty_band": "half_year", "risk_direction_on_implementation": "improving", "affected_jurisdictions": [ "US", "KH" ], "gap_assessment": "The proposed rule would prohibit US institutions from maintaining correspondent/payable-through accounts for Huione Group; final-rule timing and scope relative to successor marketplaces (Xinbi) leave residual exposure-management uncertainty.", "what_changes": "Finalisation would sever Huione Group's US correspondent-banking access; the operating environment shifts as institutions face successor guarantee-marketplace infrastructure.", "primary_source_url": "https://www.fincen.gov/news/news-releases/fincen-finds-cambodia-based-huione-group-be-primary-money-laundering-concern", "confidence": "Assessed", "source_tier": "1", "affected_firm_types": [ "bank", "crypto_asset_operator", "payment_company" ], "obligation_refs": [ { "framework": "BSA", "citation": "USA PATRIOT Act Section 311 (31 USC 5318A)", "obligation_type": "screening", "firm_type_lens": [ "bank", "crypto_asset_operator", "payment_company" ], "source": "research", "citation_stage": "consultation" } ], "fatf_recommendations": [ "R.15" ] }, { "horizon_id": "fim-reg-2026-004", "title": "UK HM Treasury National Risk Assessment refresh window", "instrument_type": "guidance", "stage": "proposed", "expected_date": "2026-2027", "estimated_impact_date": "2026-2027", "uncertainty_band": "year", "risk_direction_on_implementation": "uncertain", "affected_jurisdictions": [ "GB" ], "gap_assessment": "Next UK NRA refresh anticipated 2026-2027; EU SNRA refresh similarly pending. Where jurisdiction-risk rows lack a current NRA citation (e.g. Colombia this cycle), the absence is a noted collection gap.", "what_changes": "Updated UK NRA and EU SNRA will reset national/supra-national risk baselines informing risk-based supervision and obliged-entity risk assessments.", "primary_source_url": "https://www.gov.uk/government/collections/uk-national-risk-assessment-of-money-laundering-and-terrorist-financing", "confidence": "Possible", "source_tier": "1", "affected_firm_types": [ "cross_sector" ], "obligation_refs": [ { "framework": "MLR2017", "citation": "MLR 2017 Reg 18", "obligation_type": "governance", "firm_type_lens": [ "cross_sector" ], "source": "research", "citation_stage": "proposed" } ], "fatf_recommendations": [] }, { "horizon_id": "fim-reg-2026-005", "title": "FATF updated Recommendation 6 humanitarian exemption", "instrument_type": "technical_standard", "stage": "adopted", "expected_date": "2026-H2", "estimated_impact_date": "2026-H2", "uncertainty_band": "half_year", "risk_direction_on_implementation": "improving", "affected_jurisdictions": [ "US", "GB", "DE", "FR" ], "gap_assessment": "R.6 amended to incorporate UNSCR 2664/2761 humanitarian exemptions; national implementation across regimes will lag the standard update.", "what_changes": "Targeted-financial-sanctions frameworks must accommodate humanitarian carve-outs, altering how obliged entities treat exempt flows.", "primary_source_url": "https://www.fatf-gafi.org/en/publications/Fatfgeneral/outcomes-fatf-plenary-june-2026.html", "confidence": "High", "source_tier": "1", "affected_firm_types": [ "bank", "payment_company", "cross_sector" ], "obligation_refs": [ { "framework": "FATF_Rec", "citation": "R.6", "obligation_type": "screening", "firm_type_lens": [ "bank", "payment_company", "cross_sector" ], "source": "research", "citation_stage": "adopted" } ], "fatf_recommendations": [ "R.6" ] } ], "enforcement_actions": [ { "action_id": "fbi-huione-2026-06", "regulator": "US DOJ / FBI", "breach_type": "money-laundering-infrastructure", "date": "2026-06-23", "source_url": "https://www.elliptic.co/media-center/elliptic-intelligence-used-by-the-fbi-in-action-against-huione-group", "source_tier": "2" }, { "action_id": "fincen-sinaloa-casinos-2026-03", "regulator": "FinCEN", "breach_type": "AML-primary-money-laundering-concern", "date": "2026-03-31", "source_url": "https://www.fincen.gov/news/news-releases/fincen-combats-financial-support-sinaloa-cartel-finding-transactions-involving", "source_tier": "1" } ], "sanctions_changes": [ { "issuing_body": "OFAC", "list": "SDN (Russia/EO 14024 procurement network)", "effective_date": "2026-06-23", "source_url": "https://ofac.treasury.gov/recent-actions/20260623", "designation_count": 3, "domain": "D1", "entities": [ "Anton Krugovov", "Tamara Topchi", "Natalya Puzyrnikova", "Serniya Inzhiniring", "Majory LLP", "Invention Bridge SL" ], "source_tier": "1" }, { "issuing_body": "OFAC", "list": "SDN (Russia-related designation removals)", "effective_date": "2026-06-24", "source_url": "https://ofac.treasury.gov/recent-actions/20260624", "domain": "D1", "entities": [ "Belous", "Klyukin", "Kremleva", "Nikolaev" ], "source_tier": "1" }, { "issuing_body": "OFAC", "list": "SDN (Transnational Criminal Organizations / Cuba)", "effective_date": "2026-06-23", "source_url": "https://ofac.treasury.gov/recent-actions/20260623", "domain": "D3", "entities": [ "Grand Legend International Asset Management Group" ], "source_tier": "1" }, { "issuing_body": "OFAC", "list": "SDN (Counter Terrorism / ISIS)", "effective_date": "2026-06-22", "source_url": "https://www.chainalysis.com/blog/ofac-sanctions-isis-financial-facilitators-june-2026/", "designation_count": 9, "domain": "D5", "entities": [ "Bitcoin Xchange (Syria)", "Spider (Turkey)", "Alkaram (Turkey)", "three Nigerian BDCs", "Abderrahmane", "Boukich", "Muhammad" ], "source_tier": "2" }, { "issuing_body": "OFAC", "list": "Russia (general licences GL 55F / GL 131F)", "effective_date": "2026-06-11", "source_url": "https://ofac.treasury.gov/sanctions-programs-and-country-information/russian-harmful-foreign-activities-sanctions", "domain": "D1", "entities": [ "Lukoil International GmbH", "Sakhalin-2" ], "source_tier": "1" } ], "cycle_delta": [ { "delta_id": "fim-delta-2026-06-25-001", "target_kind": "claim", "target_id": "fim-2026-W26-001", "change_type": "new", "new_value": "OFAC-OFSI Comparative Overview codifies managed sanctions divergence (23 June 2026).", "change_reason": "First-party joint publication documenting structural divergence between US/UK sanctions models.", "new_confidence": "Assessed" }, { "delta_id": "fim-delta-2026-06-25-002", "target_kind": "claim", "target_id": "fim-2026-W26-003", "change_type": "updated", "prior_value": "AMLA in establishment phase; supervisory build-out not yet operational.", "new_value": "AMLA operationalised: first Frankfurt conference (9 June) and direct-supervision eligibility methodology (10 June).", "change_reason": "Operational milestones move AMLA from establishment to supervisory build-out.", "new_confidence": "High" }, { "delta_id": "fim-delta-2026-06-25-003", "target_kind": "enforcement_action", "target_id": "fbi-huione-2026-06", "change_type": "new", "new_value": "FBI seized Huione Group cloud infrastructure (23 June 2026); guarantee-marketplace model persists via Xinbi.", "change_reason": "New enforcement action against the Cambodia-based laundering conglomerate.", "new_confidence": "High" }, { "delta_id": "fim-delta-2026-06-25-004", "target_kind": "tracker", "target_id": "T3", "change_type": "updated", "prior_value": "Grey list per February 2026 Plenary.", "new_value": "June Plenary removed Algeria and Namibia; newly identified Bosnia and Herzegovina and Iraq; advanced Bulgaria/Cote d'Ivoire/DRC.", "change_reason": "FATF June 2026 Plenary grey-list movements.", "new_confidence": "High" }, { "delta_id": "fim-delta-2026-06-25-005", "target_kind": "tracker", "target_id": "T6", "change_type": "updated", "prior_value": "US/UK/EU sanctions regimes diverging without a codified comparative instrument.", "new_value": "OFAC-OFSI Comparative Overview formally documents divergence and managed-alignment intent; EU outside bilateral widens trilateral divergence.", "change_reason": "Joint publication codifies the divergence architecture.", "new_confidence": "Assessed" }, { "delta_id": "fim-delta-2026-06-25-006", "target_kind": "jurisdiction", "target_id": "MX", "change_type": "updated", "prior_value": "Cartel-finance pressure tracked; standard GTO scope.", "new_value": "Expanded Southwest Border GTO ($1,000 CTR threshold, AZ/NM counties) and CMLN advisory map PRC-cartel-US laundering corridor.", "change_reason": "FinCEN GTO expansion and CMLN advisory escalate documented cartel-TBML architecture.", "new_confidence": "High" }, { "delta_id": "fim-delta-2026-06-25-007", "target_kind": "horizon", "target_id": "fim-reg-2026-005", "change_type": "new", "new_value": "FATF adopted R.6 humanitarian-exemption update incorporating UNSCR 2664/2761.", "change_reason": "New adopted FATF standard update at June Plenary.", "new_confidence": "High" }, { "delta_id": "fim-delta-2026-06-25-008", "target_kind": "sanctions_change", "target_id": "isis-ofac-2026-06-22", "change_type": "new", "new_value": "OFAC designated ISIS crypto/MSB facilitators with on-chain TRON identifiers (22 June 2026).", "change_reason": "New CTF designation extending sanctions architecture on-chain.", "new_confidence": "Assessed" } ], "weekly_brief_slim": "## Lead Signal\n\nThe most structurally significant development of the cycle is not an enforcement action but a codification of architecture. On 23 June 2026, OFAC and OFSI jointly published a Comparative Overview documenting the fundamental divergence between their two sanctions models: OFAC operates a broad jurisdiction-based blocking regime while OFSI operates a breach-and-asset-freeze model that, as the document states, does not carry broad jurisdiction-based sanctions reach. The joint publication signals an intent to align escalation mechanisms rather than to converge the underlying models, and the analytical consequence is that the divergence is now formally codified rather than merely observed. For cross-jurisdiction intermediaries — correspondent banks, trade-finance houses, payment companies operating across both regimes — the document creates a durable arbitrage surface: an entity or transaction that triggers OFAC blocking obligations may not trigger an equivalent OFSI response, and vice versa. The European Union sits entirely outside this bilateral instrument, widening what is assessed as a trilateral divergence architecture. This is a structural finding under the F2 sanctions-architecture filter: the managed-divergence posture is the product, not the individual designations that accompanied it.\n\nAlso on 23 June, OFAC designated three individuals — Krugovov, Topchi, and Puzyrnikova — linked to Serniya Inzhiniring and Majory LLP, dual-use technology procurement conduits for Russia's military-industrial base under Executive Order 14024. The analytical value of these designations lies not in the individuals themselves but in the node being targeted: procurement intermediaries form the connective tissue of sanctions-evasion architecture, and attacking that layer is structurally more disruptive than designating end-users alone. The Serniya/Majory network remains active in the scheme inventory.\n\n## Other Developments\n\n**AMLA reaches operational milestones.** The Anti-Money Laundering Authority held its first conference in Frankfurt on 9 June 2026 and published its direct-supervision eligibility methodology on 10 June, identifying up to 40 high-risk cross-border obliged entities — including crypto-asset service providers — eligible for direct supervision. The AMLR (Regulation (EU) 2024/1624) applies from 2027; AMLA direct supervision begins in 2028. This is a trajectory-improving structural development: the supervisory perimeter is shifting from fragmented national transposition toward a hybrid EU-level regime, closing historical regulatory-arbitrage gaps that have allowed obliged entities to forum-shop across Member State supervisors. The three instruments of the EU AML Package — the directly applicable AMLR, the per-Member-State sixth AML Directive (6AMLD, Directive (EU) 2024/1640), and the AMLA Regulation (Reg (EU) 2024/1620) establishing the Authority itself — are now all in motion simultaneously, though per-Member-State 6AMLD transposition status remains a noted collection gap this cycle.\n\n**FBI seizes Huione Group cloud infrastructure; the ecosystem persists.** On 23 June 2026, the FBI seized a cloud computing account used by Huione Group subsidiaries. The marketplace had received over USD 31 billion and the payments arm over USD 103 billion in crypto, making it assessed as the largest illicit online marketplace ever recorded. Despite the seizure, a prior FinCEN Section 311 designation, Prince Group sanctions, and the arrest of Chen Zhi, the guarantee-marketplace model has not collapsed: Xinbi Guarantee now leads the successor ecosystem. The architecture-over-incident reading is the finding — illicit finance infrastructure demonstrates resilience to node removal, and the guarantee-marketplace model is the durable structural threat, not any single platform.\n\nSubscribe to our commercial AI monitor [artificial-intelligence.gi](https://artificial-intelligence.gi) for full analysis of AI governance.", "claim_trace": [ { "span": "This is the inaugural establishing brief of the Financial Integrity Monitor, laying down the architecture of the financial-integrity ecosystem as the Interpreter assessed it on the first baseline sweep.", "claim_id": null, "trace_type": "transitional" }, { "span": "the United States remains the leading global sanctions enforcer while simultaneously degrading its own beneficial-ownership coverage, producing an enforcer-enabler contradiction within a single jurisdiction", "claim_id": "fim-2026-W24-001", "trace_type": "claim", "note": "Enforcer-enabler contradiction from D1 domain summary and US jurisdiction tracker; degradation traces to CTA exemption claim." }, { "span": "The United States gutted its domestic beneficial-ownership coverage through the FinCEN interim final rule of 26 March 2025", "claim_id": "fim-2026-W24-001", "trace_type": "claim" }, { "span": "the United Kingdom made Companies House identity verification a legal requirement", "claim_id": "fim-2026-W24-002", "trace_type": "claim" }, { "span": "the European Union stood up its Authority for Anti-Money Laundering", "claim_id": "fim-2026-W24-003", "trace_type": "claim" }, { "span": "The net global trajectory is mixed, with the United States moving against the transparency trend", "claim_id": "fim-2026-W24-001", "trace_type": "claim", "note": "Net mixed trajectory from D2 domain summary." }, { "span": "The sanctions and evasion picture remains active across the assessed Tier A jurisdictions, with European designations expanding against the Russian shadow-fleet architecture and continued US focus on Iranian evasion infrastructure.", "claim_id": "fim-2026-W24-004", "trace_type": "claim" }, { "span": "The reader should hold this orientation before the domain-by-domain treatment that follows: architecture over incident, enablement assessed alongside enforcement, and the structural gains in Europe held as unproven pending enforcement follow-through.", "claim_id": null, "trace_type": "transitional" }, { "span": "Sanctions enforcement and evasion architecture remains active across the assessed Tier A jurisdictions, and the Interpreter assigned this domain a preliminary severity of elevated.", "claim_id": null, "trace_type": "kb_entry", "note": "D1 domain_assessments severity_preliminary ELEVATED and summary." }, { "span": "The European Union designated 41 shadow-fleet vessels in its 18th Russia sanctions package in December 2025, targeting the Russian sanctions-evasion shipping architecture, a finding the Interpreter assessed.", "claim_id": "fim-2026-W24-004", "trace_type": "claim" }, { "span": "the United States issued FinCEN advisories on Iranian oil smuggling and shadow banking in June 2025 and an IRGC alert in May 2026, which the Interpreter assessed as demonstrating continued US enforcement focus on Iranian evasion architecture", "claim_id": "fim-2026-W24-005", "trace_type": "claim" }, { "span": "The structural signal the Interpreter recorded is divergence: the United States remains the leading global sanctions enforcer while simultaneously degrading its own beneficial-ownership coverage.", "claim_id": null, "trace_type": "kb_entry", "note": "D1 domain summary structural signal." }, { "span": "EU and US enforcement against Russian shadow-fleet and Iranian shadow-banking infrastructure is structurally active, but that regime divergence between the United States, the European Union and the United Kingdom creates exploitable arbitrage in the evasion architecture", "claim_id": null, "trace_type": "kb_entry", "note": "D1 key_judgment, confidence Assessed." }, { "span": "The Interpreter assigned this domain a preliminary severity of high and framed it through two opposing architectural movements.", "claim_id": null, "trace_type": "kb_entry", "note": "D2 severity_preliminary HIGH and summary." }, { "span": "the United States, through FinCEN, exempted US-formed entities and US persons from Corporate Transparency Act beneficial-ownership reporting via an interim final rule issued 26 March 2025, gutting domestic beneficial-ownership coverage; the Interpreter assigned this a high confidence tier and labelled it a deliberate widening of a federal beneficial-ownership-opacity gap by political choice, the most significant negative transparency shift in the cycle", "claim_id": "fim-2026-W24-001", "trace_type": "claim" }, { "span": "the United Kingdom, through Companies House, made identity verification a legal requirement in force 18 November 2025 with a 12-month transition, with over one million voluntary verifications recorded since April 2025; the Interpreter assigned this a high confidence tier", "claim_id": "fim-2026-W24-002", "trace_type": "claim" }, { "span": "The European Union, through AMLA, operationalised the Authority for Anti-Money Laundering, legally created 26 June 2024, with the Executive Board appointed 22 May 2025, operations commenced 2025, the first conference held 9 June 2026, and direct supervision deferred to 2028; the Interpreter assigned this a high confidence tier", "claim_id": "fim-2026-W24-003", "trace_type": "claim" }, { "span": "the US Corporate Transparency Act domestic exemption represents a political-choice enabler shift rather than a capacity deficit, materially increasing US beneficial-ownership opacity at federal level while state-level anonymous LLC formation persists", "claim_id": null, "trace_type": "kb_entry", "note": "D2 key_judgment, confidence High." }, { "span": "the UK Companies House reform and EU AMLA operationalisation are narrowing opacity, but that enforcement follow-through over the 12-month UK transition and the deferral of AMLA direct supervision to 2028 leave the structural gains unproven", "claim_id": null, "trace_type": "kb_entry", "note": "D2 key_judgment, confidence Assessed." }, { "span": "The Interpreter assigned this domain a preliminary severity of elevated and recorded divergent trajectories within Tier A jurisdictions.", "claim_id": null, "trace_type": "kb_entry", "note": "D3 severity_preliminary ELEVATED and summary." }, { "span": "The Netherlands functions as a conduit jurisdiction for corporate layering at scale through trust offices, holding companies and tax-treaty structures used for global profit-shifting and layering, which the Interpreter assessed as an enabler-by-design conduit risk that persists independent of enforcement record and despite strong supervision.", "claim_id": "fim-2026-W24-006", "trace_type": "claim" }, { "span": "The United Kingdom retains a fragmented AML supervisory architecture, with supervision fragmented across 25 supervisors and the historic persons-of-significant-control register unverified until November 2025, which the Interpreter assessed as the core enabler weakness in this domain where enforcement reality lags legal-framework improvement under ECCTA.", "claim_id": "fim-2026-W24-007", "trace_type": "claim" }, { "span": "the fragmented UK supervisory landscape across 25 supervisors remains the core enabler weakness even as Companies House reform advances, with enforcement reality lagging legal-framework improvement", "claim_id": null, "trace_type": "kb_entry", "note": "D3 key_judgment, confidence Assessed." }, { "span": "The Interpreter assigned this domain a preliminary severity of monitored. No discrete conflict-finance material beyond Russian war-economy and shadow-fleet enablement, cross-referenced under D1, is present in the baseline excerpt. Standing coverage of Russian war-economy financing, Sahel conflict-mineral trade and DRC mining governance remains carried at baseline pending dedicated source material.", "claim_id": null, "trace_type": "kb_entry", "note": "D4 severity_preliminary MONITORED and summary." }, { "span": "This domain is established here as scaffolding so that future periodic briefs can read against it.", "claim_id": null, "trace_type": "transitional" }, { "span": "The Interpreter assigned this domain a preliminary severity of monitored. No discrete crypto or digital-asset enforcement material is present in the baseline excerpt beyond the EU AML Package extension of obligations to crypto under the AMLR, cross-referenced under D2. Standing coverage of crypto sanctions evasion, DeFi enforcement, MiCA and stablecoin frameworks remains carried at baseline pending dedicated source material.", "claim_id": null, "trace_type": "kb_entry", "note": "D5 severity_preliminary MONITORED and summary." }, { "span": "The Interpreter assessed the trajectory as active enforcement expanding. The EU 18th Russia sanctions package designated 41 shadow-fleet vessels in December 2025, with Netherlands designations linked to shadow-fleet enablers, and the Interpreter recorded enforcement intensity rising against the evasion architecture. The confidence tier is assessed.", "claim_id": null, "trace_type": "kb_entry", "note": "standing_tracker_updates T1, trajectory active_enforcement_expanding, confidence Assessed; vessel count corroborated by fim-2026-W24-004." }, { "span": "This tracker establishes the present state against which future dark-fleet, technology-procurement and commodity-rerouting movements will be read.", "claim_id": null, "trace_type": "transitional" }, { "span": "The Interpreter assessed the trajectory as degrading. The FinCEN interim final rule of 26 March 2025 exempted US-formed entities and US persons from BOI reporting, with Treasury announcing non-enforcement against US citizens and domestic companies, materially reducing federal beneficial-ownership coverage. The confidence tier is high.", "claim_id": null, "trace_type": "kb_entry", "note": "standing_tracker_updates T2, trajectory degrading, confidence High; corroborated by fim-2026-W24-001." }, { "span": "This is the most material negative transparency movement in the baseline and anchors the increasing US risk direction.", "claim_id": "fim-2026-W24-001", "trace_type": "claim", "note": "Most significant negative transparency shift and increasing US risk direction from claim notes and US jurisdiction tracker." }, { "span": "The Interpreter assessed the trajectory as improving. Identity verification became a legal requirement 18 November 2025, with over one million voluntary verifications since April 2025, and Companies House changed more than 140,000 addresses to default and acted against more than 100,000 companies. Enforcement follow-through during the 12-month transition remains the open variable. The confidence tier is assessed.", "claim_id": null, "trace_type": "kb_entry", "note": "standing_tracker_updates T3, trajectory improving, confidence Assessed; corroborated by fim-2026-W24-002." }, { "span": "The Interpreter assessed the trajectory as improving. AMLA was legally created 26 June 2024, the Executive Board was appointed 22 May 2025, operations commenced 2025, and the first conference was held 9 June 2026. Direct supervision deferred to 2028 limits the near-term enforcement effect. The confidence tier is high.", "claim_id": null, "trace_type": "kb_entry", "note": "standing_tracker_updates T4, trajectory improving, confidence High; corroborated by fim-2026-W24-003." }, { "span": "The Interpreter assessed the trajectory as active monitoring. The FinCEN June 2025 advisory on Iranian oil smuggling and shadow banking, together with the IRGC alert of May 2026, indicate continued US focus on the Iranian evasion architecture. The confidence tier is assessed.", "claim_id": null, "trace_type": "kb_entry", "note": "standing_tracker_updates T5, trajectory active_monitoring, confidence Assessed; corroborated by fim-2026-W24-005." }, { "span": "The enabler picture in this baseline is defined less by failures of capacity than by structural design and political choice.", "claim_id": null, "trace_type": "structural" }, { "span": "the most significant non-enforcement movement is in the United States, where the FinCEN interim final rule of 26 March 2025 exempted US-formed entities and US persons from Corporate Transparency Act reporting, a deliberate widening of a federal beneficial-ownership-opacity gap by political choice rather than a capacity deficit", "claim_id": "fim-2026-W24-001", "trace_type": "claim" }, { "span": "The Interpreter assessed that US beneficial-ownership opacity increased at federal level while state-level anonymous LLC formation persists.", "claim_id": null, "trace_type": "kb_entry", "note": "D2 key_judgment and US jurisdiction tracker assessment_note." }, { "span": "This is the analytically central case where non-enforcement is itself the signal.", "claim_id": null, "trace_type": "structural" }, { "span": "The Interpreter assessed the Netherlands as functioning as a conduit jurisdiction for corporate layering at scale, through trust offices, holding companies and tax-treaty structures used for global profit-shifting and layering, and recorded this as an enabler-by-design conduit risk that persists independent of enforcement record despite strong supervision.", "claim_id": "fim-2026-W24-006", "trace_type": "claim" }, { "span": "The structural feature here is that a well-supervised centre can remain a systemic enabler through the architecture of its corporate-structuring offering.", "claim_id": null, "trace_type": "structural" }, { "span": "The Interpreter assessed the United Kingdom as retaining a fragmented AML supervisory architecture across 25 supervisors, with the historic persons-of-significant-control register unverified until November 2025, even as Companies House identity verification became a legal requirement on 18 November 2025.", "claim_id": "fim-2026-W24-007", "trace_type": "claim", "note": "Companies House legal requirement date also traces to fim-2026-W24-002." }, { "span": "The standing tension is that legal-framework improvement under ECCTA has advanced while enforcement reality lags, leaving the improving trajectory dependent on follow-through rather than on enacted law.", "claim_id": "fim-2026-W24-007", "trace_type": "claim" }, { "span": "The baseline concentrates its enforcement and transparency content in the AML pillar, consistent with the structural bias whereby AML generates more enforcement volume than counter-terrorist-financing or counter-proliferation-financing.", "claim_id": null, "trace_type": "structural" }, { "span": "The beneficial-ownership and enabler-jurisdiction findings, the US Corporate Transparency Act exemption, the UK Companies House reform and the EU AMLA standup are all weighted to the AML pillar.", "claim_id": null, "trace_type": "kb_entry", "note": "Pillar assignment AML on claims fim-2026-W24-001, 002, 003." }, { "span": "The CTF pillar is represented in this baseline through the US FinCEN advisories on Iranian oil smuggling and shadow banking and the IRGC alert, which the Interpreter assigned to the CTF pillar and assessed as demonstrating continued US enforcement focus on Iranian evasion architecture.", "claim_id": "fim-2026-W24-005", "trace_type": "claim", "note": "Pillar CTF on claim fim-2026-W24-005." }, { "span": "Surfacing this explicitly corrects for the AML-volume bias, since the Iranian evasion findings are the principal CTF-weighted signal in the present sweep.", "claim_id": null, "trace_type": "structural" }, { "span": "The EU shadow-fleet designation was recorded as cross-pillar.", "claim_id": "fim-2026-W24-004", "trace_type": "claim", "note": "Pillar cross-pillar on claim fim-2026-W24-004." }, { "span": "The CPF pillar carries no discrete dedicated material in this baseline excerpt, a structural under-representation that future periodic briefs should be read against rather than treated as an absence of underlying activity.", "claim_id": null, "trace_type": "structural" }, { "span": "The baseline picture establishes several standing cross-monitor edges.", "claim_id": null, "trace_type": "transitional" }, { "span": "The Russian sanctions-evasion and shadow-fleet architecture under D1 and tracker T1 connects to SCEM on conflict finance, since the EU designation of 41 shadow-fleet vessels and the Netherlands designations linked to shadow-fleet enablers sit on the financing of the Russian war economy.", "claim_id": "fim-2026-W24-004", "trace_type": "claim", "note": "Designation facts from claim; cross-monitor edge to SCEM is structural per identity card." }, { "span": "The same evasion and commodity-rerouting architecture connects to ERM on commodity and extractive flows, given that the shadow fleet is a mechanism for rerouting sanctioned oil trade.", "claim_id": null, "trace_type": "structural", "note": "Cross-monitor edge to ERM per identity card." }, { "span": "The enabler-jurisdiction findings under D3, the Netherlands conduit exposure and the fragmented UK supervisory landscape, connect to WDM on state capture where opaque corporate structuring intersects with kleptocratic flows.", "claim_id": null, "trace_type": "structural", "note": "Enabler facts trace to fim-2026-W24-006 and fim-2026-W24-007; cross-monitor edge to WDM per identity card." }, { "span": "The Iranian evasion infrastructure under tracker T5 and the CTF-weighted FinCEN advisories connect to the information-operations edge with FCW where illicit-finance channels are obscured.", "claim_id": "fim-2026-W24-005", "trace_type": "claim", "note": "Iranian advisory facts from claim; cross-monitor edge to FCW per identity card." }, { "span": "These edges are laid down here so that subsequent periodic briefs can reference them as standing connections rather than re-establishing them.", "claim_id": null, "trace_type": "transitional" }, { "span": "In Europe, the standing trackers point in an improving direction, with AMLA operationalising and the UK Companies House regime strengthening, but the Interpreter assessed both gains as unproven pending enforcement follow-through, with AMLA direct supervision deferred to 2028 and the UK 12-month transition leaving enforcement reality as the open variable.", "claim_id": null, "trace_type": "kb_entry", "note": "T3 and T4 trajectories improving, D2 key_judgment on unproven gains; corroborated by fim-2026-W24-002 and fim-2026-W24-003." }, { "span": "The improving European trajectory therefore rests on institutional standup and enacted law rather than on demonstrated enforcement output.", "claim_id": null, "trace_type": "kb_entry", "note": "D2 key_judgment Assessed." }, { "span": "In the United States, the direction of travel is the inverse: a degrading Corporate Transparency Act trajectory after the March 2025 exemption, set against continued and leading sanctions enforcement, sustains the enforcer-enabler contradiction as the central standing tension the periodic cadence will track.", "claim_id": "fim-2026-W24-001", "trace_type": "claim", "note": "Degrading CTA trajectory and enforcer-enabler contradiction from claim and US jurisdiction tracker." }, { "span": "The Interpreter assessed regime divergence between the United States, the European Union and the United Kingdom as creating exploitable arbitrage in the evasion architecture, and that arbitrage is the principal watch-point for D1 and tracker T1.", "claim_id": null, "trace_type": "kb_entry", "note": "D1 key_judgment Assessed." }, { "span": "The watch-points the periodic cadence will track against this baseline are therefore the enforcement follow-through behind the European transparency gains, the scale of the US opacity increase, the continued expansion of enforcement against the Russian shadow-fleet architecture, and the development of dedicated D4 conflict-finance and D5 crypto material that the baseline excerpt carried at standing coverage only.", "claim_id": null, "trace_type": "kb_entry", "note": "Watch-points derived from gaps_register G001, G002, G003, G004 and D4/D5 summaries." } ], "weekly_brief_long": "## Establishing Picture\n\nThis is the inaugural establishing brief of the Financial Integrity Monitor, laying down the architecture of the financial-integrity ecosystem as the Interpreter assessed it on the first baseline sweep. The dominant structural feature of this baseline is not any single enforcement action but a divergence inside the leading centres themselves: the United States remains the leading global sanctions enforcer while simultaneously degrading its own beneficial-ownership coverage, producing an enforcer-enabler contradiction within a single jurisdiction. That contradiction is the analytical spine of the present picture.\n\nTwo opposing architectural movements define the transparency landscape. The United States gutted its domestic beneficial-ownership coverage through the FinCEN interim final rule of 26 March 2025, while the United Kingdom made Companies House identity verification a legal requirement and the European Union stood up its Authority for Anti-Money Laundering. The net global trajectory is mixed, with the United States moving against the transparency trend even as European frameworks narrow opacity. The standing tension across this baseline is therefore between centres that enforce and centres that enable, and in the US case both postures coexist within one framework.\n\nThe sanctions and evasion picture remains active across the assessed Tier A jurisdictions, with European designations expanding against the Russian shadow-fleet architecture and continued US focus on Iranian evasion infrastructure. The reader should hold this orientation before the domain-by-domain treatment that follows: architecture over incident, enablement assessed alongside enforcement, and the structural gains in Europe held as unproven pending enforcement follow-through.\n\n## Domain Architecture\n\n**D1 — Sanctions Architecture and Evasion.** Sanctions enforcement and evasion architecture remains active across the assessed Tier A jurisdictions, and the Interpreter assigned this domain a preliminary severity of elevated. The European Union designated 41 shadow-fleet vessels in its 18th Russia sanctions package in December 2025, targeting the Russian sanctions-evasion shipping architecture, a finding the Interpreter assessed. In parallel, the United States issued FinCEN advisories on Iranian oil smuggling and shadow banking in June 2025 and an IRGC alert in May 2026, which the Interpreter assessed as demonstrating continued US enforcement focus on Iranian evasion architecture. The structural signal the Interpreter recorded is divergence: the United States remains the leading global sanctions enforcer while simultaneously degrading its own beneficial-ownership coverage. The Interpreter recorded one key judgment at the assessed tier, that EU and US enforcement against Russian shadow-fleet and Iranian shadow-banking infrastructure is structurally active, but that regime divergence between the United States, the European Union and the United Kingdom creates exploitable arbitrage in the evasion architecture.\n\n**D2 — Beneficial Ownership and Corporate Transparency.** The Interpreter assigned this domain a preliminary severity of high and framed it through two opposing architectural movements. On the enabling side, the United States, through FinCEN, exempted US-formed entities and US persons from Corporate Transparency Act beneficial-ownership reporting via an interim final rule issued 26 March 2025, gutting domestic beneficial-ownership coverage; the Interpreter assigned this a high confidence tier and labelled it a deliberate widening of a federal beneficial-ownership-opacity gap by political choice, the most significant negative transparency shift in the cycle. On the narrowing side, the United Kingdom, through Companies House, made identity verification a legal requirement in force 18 November 2025 with a 12-month transition, with over one million voluntary verifications recorded since April 2025; the Interpreter assigned this a high confidence tier. The European Union, through AMLA, operationalised the Authority for Anti-Money Laundering, legally created 26 June 2024, with the Executive Board appointed 22 May 2025, operations commenced 2025, the first conference held 9 June 2026, and direct supervision deferred to 2028; the Interpreter assigned this a high confidence tier. The Interpreter recorded two key judgments. The first, at the high tier, holds that the US Corporate Transparency Act domestic exemption represents a political-choice enabler shift rather than a capacity deficit, materially increasing US beneficial-ownership opacity at federal level while state-level anonymous LLC formation persists. The second, at the assessed tier, holds that the UK Companies House reform and EU AMLA operationalisation are narrowing opacity, but that enforcement follow-through over the 12-month UK transition and the deferral of AMLA direct supervision to 2028 leave the structural gains unproven.\n\n**D3 — Enabler Jurisdictions and Professional Facilitators.** The Interpreter assigned this domain a preliminary severity of elevated and recorded divergent trajectories within Tier A jurisdictions. The Netherlands functions as a conduit jurisdiction for corporate layering at scale through trust offices, holding companies and tax-treaty structures used for global profit-shifting and layering, which the Interpreter assessed as an enabler-by-design conduit risk that persists independent of enforcement record and despite strong supervision. The United Kingdom retains a fragmented AML supervisory architecture, with supervision fragmented across 25 supervisors and the historic persons-of-significant-control register unverified until November 2025, which the Interpreter assessed as the core enabler weakness in this domain where enforcement reality lags legal-framework improvement under ECCTA. The Interpreter recorded one key judgment at the assessed tier, that the fragmented UK supervisory landscape across 25 supervisors remains the core enabler weakness even as Companies House reform advances, with enforcement reality lagging legal-framework improvement.\n\n**D4 — Conflict Finance and Extractive-Industry Integrity.** The Interpreter assigned this domain a preliminary severity of monitored. No discrete conflict-finance material beyond Russian war-economy and shadow-fleet enablement, cross-referenced under D1, is present in the baseline excerpt. Standing coverage of Russian war-economy financing, Sahel conflict-mineral trade and DRC mining governance remains carried at baseline pending dedicated source material. This domain is established here as scaffolding so that future periodic briefs can read against it.\n\n**D5 — Crypto, Digital Assets, and Financial Innovation.** The Interpreter assigned this domain a preliminary severity of monitored. No discrete crypto or digital-asset enforcement material is present in the baseline excerpt beyond the EU AML Package extension of obligations to crypto under the AMLR, cross-referenced under D2. Standing coverage of crypto sanctions evasion, DeFi enforcement, MiCA and stablecoin frameworks remains carried at baseline pending dedicated source material.\n\n## Standing Trackers\n\n**T1 — Russian Sanctions-Evasion Architecture.** The Interpreter assessed the trajectory as active enforcement expanding. The EU 18th Russia sanctions package designated 41 shadow-fleet vessels in December 2025, with Netherlands designations linked to shadow-fleet enablers, and the Interpreter recorded enforcement intensity rising against the evasion architecture. The confidence tier is assessed. This tracker establishes the present state against which future dark-fleet, technology-procurement and commodity-rerouting movements will be read.\n\n**T2 — US Corporate Transparency Act trajectory.** The Interpreter assessed the trajectory as degrading. The FinCEN interim final rule of 26 March 2025 exempted US-formed entities and US persons from BOI reporting, with Treasury announcing non-enforcement against US citizens and domestic companies, materially reducing federal beneficial-ownership coverage. The confidence tier is high. This is the most material negative transparency movement in the baseline and anchors the increasing US risk direction.\n\n**T3 — UK BO register and Companies House effectiveness.** The Interpreter assessed the trajectory as improving. Identity verification became a legal requirement 18 November 2025, with over one million voluntary verifications since April 2025, and Companies House changed more than 140,000 addresses to default and acted against more than 100,000 companies. Enforcement follow-through during the 12-month transition remains the open variable. The confidence tier is assessed.\n\n**T4 — EU AML Package and AMLA operationalisation.** The Interpreter assessed the trajectory as improving. AMLA was legally created 26 June 2024, the Executive Board was appointed 22 May 2025, operations commenced 2025, and the first conference was held 9 June 2026. Direct supervision deferred to 2028 limits the near-term enforcement effect. The confidence tier is high.\n\n**T5 — Iranian evasion infrastructure.** The Interpreter assessed the trajectory as active monitoring. The FinCEN June 2025 advisory on Iranian oil smuggling and shadow banking, together with the IRGC alert of May 2026, indicate continued US focus on the Iranian evasion architecture. The confidence tier is assessed.\n\n## Enabler Jurisdictions and the Enablement Map\n\nThe enabler picture in this baseline is defined less by failures of capacity than by structural design and political choice. Applying the enablement-as-signal principle, the most significant non-enforcement movement is in the United States, where the FinCEN interim final rule of 26 March 2025 exempted US-formed entities and US persons from Corporate Transparency Act reporting, a deliberate widening of a federal beneficial-ownership-opacity gap by political choice rather than a capacity deficit. The Interpreter assessed that US beneficial-ownership opacity increased at federal level while state-level anonymous LLC formation persists. This is the analytically central case where non-enforcement is itself the signal.\n\n**The Netherlands as conduit.** The Interpreter assessed the Netherlands as functioning as a conduit jurisdiction for corporate layering at scale, through trust offices, holding companies and tax-treaty structures used for global profit-shifting and layering, and recorded this as an enabler-by-design conduit risk that persists independent of enforcement record despite strong supervision. The structural feature here is that a well-supervised centre can remain a systemic enabler through the architecture of its corporate-structuring offering.\n\n**The United Kingdom as a strengthening but still fragmented enabler.** The Interpreter assessed the United Kingdom as retaining a fragmented AML supervisory architecture across 25 supervisors, with the historic persons-of-significant-control register unverified until November 2025, even as Companies House identity verification became a legal requirement on 18 November 2025. The standing tension is that legal-framework improvement under ECCTA has advanced while enforcement reality lags, leaving the improving trajectory dependent on follow-through rather than on enacted law.\n\n## Three-Pillar Posture\n\nThe baseline concentrates its enforcement and transparency content in the AML pillar, consistent with the structural bias whereby AML generates more enforcement volume than counter-terrorist-financing or counter-proliferation-financing. The beneficial-ownership and enabler-jurisdiction findings, the US Corporate Transparency Act exemption, the UK Companies House reform and the EU AMLA standup are all weighted to the AML pillar.\n\nThe CTF pillar is represented in this baseline through the US FinCEN advisories on Iranian oil smuggling and shadow banking and the IRGC alert, which the Interpreter assigned to the CTF pillar and assessed as demonstrating continued US enforcement focus on Iranian evasion architecture. Surfacing this explicitly corrects for the AML-volume bias, since the Iranian evasion findings are the principal CTF-weighted signal in the present sweep. The EU shadow-fleet designation was recorded as cross-pillar. The CPF pillar carries no discrete dedicated material in this baseline excerpt, a structural under-representation that future periodic briefs should be read against rather than treated as an absence of underlying activity.\n\n## Cross-Monitor Connections\n\nThe baseline picture establishes several standing cross-monitor edges. The Russian sanctions-evasion and shadow-fleet architecture under D1 and tracker T1 connects to SCEM on conflict finance, since the EU designation of 41 shadow-fleet vessels and the Netherlands designations linked to shadow-fleet enablers sit on the financing of the Russian war economy. The same evasion and commodity-rerouting architecture connects to ERM on commodity and extractive flows, given that the shadow fleet is a mechanism for rerouting sanctioned oil trade.\n\nThe enabler-jurisdiction findings under D3, the Netherlands conduit exposure and the fragmented UK supervisory landscape, connect to WDM on state capture where opaque corporate structuring intersects with kleptocratic flows. The Iranian evasion infrastructure under tracker T5 and the CTF-weighted FinCEN advisories connect to the information-operations edge with FCW where illicit-finance channels are obscured. These edges are laid down here so that subsequent periodic briefs can reference them as standing connections rather than re-establishing them.\n\n## Outlook\n\nThe trajectory the Interpreter assessed across the ecosystem is one of structural divergence rather than uniform movement. In Europe, the standing trackers point in an improving direction, with AMLA operationalising and the UK Companies House regime strengthening, but the Interpreter assessed both gains as unproven pending enforcement follow-through, with AMLA direct supervision deferred to 2028 and the UK 12-month transition leaving enforcement reality as the open variable. The improving European trajectory therefore rests on institutional standup and enacted law rather than on demonstrated enforcement output.\n\nIn the United States, the direction of travel is the inverse: a degrading Corporate Transparency Act trajectory after the March 2025 exemption, set against continued and leading sanctions enforcement, sustains the enforcer-enabler contradiction as the central standing tension the periodic cadence will track. The Interpreter assessed regime divergence between the United States, the European Union and the United Kingdom as creating exploitable arbitrage in the evasion architecture, and that arbitrage is the principal watch-point for D1 and tracker T1.\n\nThe watch-points the periodic cadence will track against this baseline are therefore the enforcement follow-through behind the European transparency gains, the scale of the US opacity increase, the continued expansion of enforcement against the Russian shadow-fleet architecture, and the development of dedicated D4 conflict-finance and D5 crypto material that the baseline excerpt carried at standing coverage only.", "domain_carry_forward": { "D1": { "sanctions_architecture": { "us_uk_divergence": "OFAC and OFSI jointly codified structural divergence (jurisdiction-based blocking vs breach/asset-freeze) on 23 June 2026, signalling managed alignment of escalation mechanisms; EU remains outside the bilateral, widening trilateral divergence." } }, "D2": { "eu_aml_package": { "amla_status": "AMLA operationalised: first Frankfurt conference 9 June 2026 and direct-supervision eligibility methodology 10 June; AMLR (2024/1624) applies 2027, AMLA direct supervision of up to 40 high-risk cross-border groups from 2028." } }, "D3": { "enabler_jurisdictions": { "cambodia_scam_compounds": "FBI seized Huione Group cloud infrastructure (23 June 2026); despite Section 311 designation, Prince Group sanctions and Chen Zhi's arrest, the guarantee-marketplace model persists via Xinbi Guarantee, demonstrating infrastructure resilience to node removal." } }, "D5": { "crypto_integrity": { "fatf_va_standards": "FATF June 2026 Plenary approved a seventh VA/VASP targeted update plus a new DeFi report (ML/TF/PF) for July 2026 publication, amid persistent global under-implementation of the travel rule." } } }, "feed_freshness": { "ofac_sdn": "2026-06-25T13:39:42.779353+00:00", "ofac_cons": "2026-06-25T13:39:45.439321+00:00", "ofsi_cons": "2026-06-25T13:39:48.526995+00:00", "eu_fsf": "2026-06-25T13:40:06.385917+00:00" }, "briefs_index": [ { "slug": "2026-06-25", "issue": 2, "volume": 1, "week_label": "25 June 2026", "published": "2026-06-25T18:00:00Z", "path": "data/briefs/2026-06-25.json" }, { "slug": "2026-06-11", "issue": 1, "volume": 1, "week_label": "11 June 2026", "published": "2026-06-11T18:00:00Z", "path": "data/briefs/2026-06-11.json" } ], "changed_this_cycle": { "derived_by": "cycle_delta[] (Interpreter native — tools/build_surface.py Wave 2, cutover complete U8)", "count": 8, "ids": [ "MX", "T3", "T6" ], "items": [ { "id": "fim-delta-2026-06-25-001", "kind": "claim", "tag": "NEW", "label": "fim-2026-W26-001", "note": "First-party joint publication documenting structural divergence between US/UK sanctions models." }, { "id": "fim-delta-2026-06-25-002", "kind": "claim", "tag": "UPDATED", "label": "fim-2026-W26-003", "note": "Operational milestones move AMLA from establishment to supervisory build-out." }, { "id": "fim-delta-2026-06-25-003", "kind": "enforcement_action", "tag": "NEW", "label": "fbi-huione-2026-06", "note": "New enforcement action against the Cambodia-based laundering conglomerate." }, { "id": "fim-delta-2026-06-25-004", "kind": "tracker", "tag": "UPDATED", "label": "T3", "note": "FATF June 2026 Plenary grey-list movements." }, { "id": "fim-delta-2026-06-25-005", "kind": "tracker", "tag": "UPDATED", "label": "T6", "note": "Joint publication codifies the divergence architecture." }, { "id": "fim-delta-2026-06-25-006", "kind": "jurisdiction", "tag": "UPDATED", "label": "MX", "note": "FinCEN GTO expansion and CMLN advisory escalate documented cartel-TBML architecture." }, { "id": "fim-delta-2026-06-25-007", "kind": "horizon", "tag": "NEW", "label": "fim-reg-2026-005", "note": "New adopted FATF standard update at June Plenary." }, { "id": "fim-delta-2026-06-25-008", "kind": "sanctions_change", "tag": "NEW", "label": "isis-ofac-2026-06-22", "note": "New CTF designation extending sanctions architecture on-chain." } ] }, "headline_posture": { "level": "HIGH", "direction": "=", "as_of": "2026-06-25T18:00:00Z" }, "_surface_meta": { "schema": "sentinel-surface", "version": "1.2", "assembled_at": "2026-08-05T08:16:50Z", "assembled_from": [ "static/monitors/financial-integrity/data/report-latest.json (verbatim, all sections)", "static/monitors/financial-integrity/data/persistent-state.json (claim_trace + accumulating arrays)", "site/data/briefs/ (archive index)", "site/data/sentinel-roles-mapping.v1.0.json (role→domain relevance config; Wave 4.3)" ], "tier_filter": "none — all tiers surfaced, labels visible (operator 2026-06-11)", "kinds": { "persistent": "claim_trace + persistent{...} — accumulates across cycles", "weekly": "report sections — replaced each cycle; changed_this_cycle derives the delta", "brief": "weekly_brief (current) + briefs_index/site briefs archive" }, "headline_posture_rule": "most-severe-wins across D1-D5; qualitative only; no numeric score (BRIEF-2026-06-12)", "role_slice_rule": "role_views select domain_sub_briefs by role-relevance not recency; facts identical across slices; nothing silently dropped (Wave 4.3)", "evidence_resolution": { "resolved": 10, "dangling": 0, "kb_prefix": 0 } }, "domain_sub_briefs": [ { "domain_ref": "D1", "domain_name": "Sanctions Architecture and Evasion", "content": "## Sanctions Architecture and Evasion\n\nThe defining development of this cycle for D1 is not a designation but a document. On 23 June 2026, OFAC and OFSI jointly published a Comparative Overview that formally codifies the structural divergence between the two principal Anglophone sanctions regimes. OFAC operates a broad jurisdiction-based blocking model: any US person, anywhere, is bound by its prohibitions, and the blocking obligation attaches to property in which a designated person has any interest. OFSI operates a breach-and-asset-freeze model: the obligation is to freeze assets within the UK's reach and not to make funds available, but, as the document itself states, OFSI does not have broad jurisdiction-based sanctions reach. The joint publication signals an intent to align escalation mechanisms — the two authorities describe evaluating parallel mechanisms to enable rapid increases in sanctions pressure — rather than to converge the underlying legal architectures. The analytical consequence is significant: the divergence is now formally codified rather than merely observed by practitioners, and the arbitrage surface it creates for cross-jurisdiction intermediaries is now documented in a first-party instrument.\n\nFor correspondent banks, trade-finance houses, and payment companies operating across both regimes, the Comparative Overview crystallises a compliance challenge that has existed structurally for years. A transaction or entity that triggers OFAC blocking obligations — because a US person is involved, or because the property transits the US financial system — may not trigger an equivalent OFSI response, and vice versa. Intermediaries that calibrate their screening to the lower of the two thresholds face competitive disadvantage; those that calibrate to the higher face residual exposure in the other jurisdiction. The EU sits entirely outside this bilateral instrument, and the absence of a trilateral alignment mechanism widens the divergence architecture further. The F2 sanctions-architecture filter assessment is that the managed-divergence posture is the structural product of this cycle, not the individual designations that accompanied it.\n\nOn the designation side, OFAC's 23 June action targeted three individuals — Krugovov, Topchi, and Puzyrnikova — linked to Serniya Inzhiniring and Majory LLP under Executive Order 14024. These entities are assessed as dual-use technology procurement conduits for Russia's military-industrial base. The analytical value of this action lies in the node being targeted: procurement intermediaries form the connective tissue of sanctions-evasion architecture, routing controlled goods through third-country conduits to reach sanctioned end-users. Attacking the intermediary layer is structurally more disruptive than designating end-users alone, because it degrades the logistics infrastructure that makes evasion scalable. The Serniya and Majory network remains active in the scheme inventory, and the designation of associated individuals rather than only corporate entities signals an intent to impose personal liability on the human operators of the procurement network.\n\nAlso within the D1 perimeter this cycle, OFAC processed Russia-related designation removals on 24 June — Belous, Klyukin, Kremleva, and Nikolaev — and extended general licences GL 131F (Lukoil International GmbH divestment, expiring 28 June 2026) and GL 55F (Sakhalin-2, extended to December 2026). These licensing actions reflect the ongoing management of legacy energy-sector exposure within the Russia sanctions architecture, creating time-bounded compliance windows that require active monitoring. The FATF June Plenary adopted an update to Recommendation 6 incorporating UNSCR 2664 and 2761 humanitarian exemptions, which will require national implementation across regimes and alters how obliged entities treat exempt flows within targeted-financial-sanctions frameworks.\n\nThe standing tracker for sanctions regime divergence (T6) moves to deteriorating trajectory this cycle, driven by the codification of the bilateral divergence architecture and the EU's continued absence from it. The Russian evasion architecture tracker (T1) remains stable: procurement-network designations continue at a sustained tempo, but the underlying evasion infrastructure — third-country intermediaries, dual-use goods routing, shell-company conduits — remains operationally active.\n\n## Outlook\n\nThe OFAC-OFSI managed-divergence posture is now a durable feature of the sanctions landscape rather than a transitional state. The bilateral instrument creates a stable reference point for intermediaries seeking to arbitrage the gap between the two regimes, and the EU's absence from the bilateral means that trilateral divergence will widen as the EU develops its own autonomous sanctions practice. The near-term watch points for D1 are the GL 131F Lukoil divestment deadline (28 June 2026, immediately following this cycle), the Sakhalin-2 GL 55F window through December 2026, and the trajectory of OFAC procurement-network designations as Russia's military-industrial base continues to adapt its evasion architecture. The FATF R.6 humanitarian-exemption update will require implementation across national regimes and may create short-term compliance uncertainty for obliged entities managing humanitarian carve-outs within Russia and other sanctions programmes.", "typology_refs": [], "word_count": 712, "limited_signal_flag": false, "cumulative_content": "## Sanctions Architecture and Evasion — Cumulative Analysis\n\nThe sanctions-architecture domain entered the current monitoring period defined by a structural tension that has now been formally codified: the divergence between the OFAC jurisdiction-based blocking model and the OFSI breach-and-asset-freeze model is no longer merely a practitioner observation but a documented bilateral reality. On 23 June 2026, OFAC and OFSI jointly published a Comparative Overview that crystallises this divergence in a first-party instrument. OFAC's reach extends to any US person anywhere and to any property in which a designated person holds an interest; OFSI's reach is bounded by UK territorial and legal jurisdiction, and the document itself states that OFSI does not have broad jurisdiction-based sanctions reach. The joint publication signals an intent to align escalation mechanisms — the two authorities describe evaluating parallel mechanisms to enable rapid increases in sanctions pressure — without converging the underlying legal architectures. The analytical consequence is that the arbitrage surface created by this divergence is now formally codified, making it available as a reference point for cross-jurisdiction intermediaries seeking to calibrate their exposure to the lower of the two thresholds.\n\nFor the institutions most exposed to this divergence — correspondent banks, trade-finance houses, and payment companies operating across both regimes — the Comparative Overview crystallises a compliance challenge that has existed structurally for years. A transaction or entity that triggers OFAC blocking obligations may not trigger an equivalent OFSI response, and vice versa. The EU sits entirely outside this bilateral instrument, and the absence of a trilateral alignment mechanism widens the divergence architecture further. The F2 sanctions-architecture filter assessment is that the managed-divergence posture is the structural product of this period, not the individual designations that accompanied it. The standing tracker for sanctions regime divergence (T6) carries a deteriorating trajectory, driven by the codification of the bilateral divergence architecture and the EU's continued absence from it.\n\nOn the designation side, the cycle has sustained a high tempo of procurement-network targeting under the Russia sanctions programme. OFAC's 23 June action designated three individuals — Krugovov, Topchi, and Puzyrnikova — linked to Serniya Inzhiniring and Majory LLP under Executive Order 14024. These entities are assessed as dual-use technology procurement conduits for Russia's military-industrial base, routing controlled goods through third-country conduits to reach sanctioned end-users. The analytical value of this action lies in the node being targeted: procurement intermediaries form the connective tissue of sanctions-evasion architecture, and attacking the intermediary layer is structurally more disruptive than designating end-users alone because it degrades the logistics infrastructure that makes evasion scalable. The designation of associated individuals rather than only corporate entities signals an intent to impose personal liability on the human operators of the procurement network. The Serniya and Majory network remains active in the scheme inventory, and the underlying evasion infrastructure — third-country intermediaries, dual-use goods routing, shell-company conduits — remains operationally active despite sustained designation pressure.\n\nAlso within the D1 perimeter, OFAC processed Russia-related designation removals on 24 June — Belous, Klyukin, Kremleva, and Nikolaev — and extended general licences GL 131F (Lukoil International GmbH divestment, expiring 28 June 2026) and GL 55F (Sakhalin-2, extended to December 2026). These licensing actions reflect the ongoing management of legacy energy-sector exposure within the Russia sanctions architecture, creating time-bounded compliance windows that require active monitoring. The FATF June Plenary adopted an update to Recommendation 6 incorporating UNSCR 2664 and 2761 humanitarian exemptions, which will require national implementation across regimes and alters how obliged entities treat exempt flows within targeted-financial-sanctions frameworks.\n\nThe Russian evasion architecture tracker (T1) remains stable: procurement-network designations continue at a sustained tempo, but the underlying evasion infrastructure adapts faster than designation cycles. The OFAC-OFSI managed-divergence posture is now a durable feature of the sanctions landscape rather than a transitional state. The bilateral instrument creates a stable reference point for intermediaries seeking to arbitrage the gap between the two regimes, and the EU's absence from the bilateral means that trilateral divergence will widen as the EU develops its own autonomous sanctions practice.\n\nThe near-term watch points for D1 are the GL 131F Lukoil divestment deadline (28 June 2026, immediately following this cycle), the Sakhalin-2 GL 55F window through December 2026, and the trajectory of OFAC procurement-network designations as Russia's military-industrial base continues to adapt its evasion architecture. The FATF R.6 humanitarian-exemption update will require implementation across national regimes and may create short-term compliance uncertainty for obliged entities managing humanitarian carve-outs within Russia and other sanctions programmes. The structural outlook for D1 is one of managed divergence at the regime level and sustained evasion-architecture adaptation at the network level — a combination that will continue to generate compliance complexity for cross-jurisdiction institutions through 2026 and beyond.\n\n## Outlook\n\nThe OFAC-OFSI Comparative Overview has shifted the D1 baseline from observed divergence to codified divergence. This is a durable structural change: the bilateral instrument will serve as a reference point for intermediaries, regulators, and courts for years, and its absence of EU participation means the trilateral gap will widen as EU autonomous sanctions practice matures independently. Procurement-network designation pressure on the Russia programme will continue, but the evasion architecture's demonstrated resilience — third-country routing, shell-company conduits, dual-use goods intermediaries — means that designation tempo alone is insufficient to degrade the network. The compliance-function priority for D1 through the remainder of 2026 is calibrating screening and blocking obligations across the OFAC-OFSI divergence architecture, monitoring the GL 131F and GL 55F licensing windows, and tracking national implementation of the FATF R.6 humanitarian-exemption update.", "cumulative_word_count": 862, "cumulative_through_issue": 26 }, { "domain_ref": "D2", "domain_name": "Beneficial Ownership and Corporate Transparency", "content": "## Beneficial Ownership and Corporate Transparency\n\nThe EU AML Package constitutes the most significant structural reform of European financial-crime supervision in a generation, and its architecture must be understood as three distinct instruments operating on different legal bases and timelines. The AML Regulation (AMLR, Regulation (EU) 2024/1624) is directly applicable across all EU Member States without national transposition — it will function as a single AML rulebook, superseding the divergent national implementations that have historically enabled regulatory arbitrage across the single market. The sixth AML Directive (6AMLD, Directive (EU) 2024/1640) requires transposition by each Member State and governs the institutional and supervisory framework at national level; per-Member-State transposition status is divergent and remains a noted collection gap this cycle. The AMLA Regulation (Regulation (EU) 2024/1620) establishes the Anti-Money Laundering Authority itself, creating the institutional architecture for a hybrid EU-level supervisory regime that will sit alongside — and in some cases above — national competent authorities. These three instruments are the standing backdrop against which all D2 signal is read.\n\nThis cycle's D2 signal is the most operationally significant since the EU AML Package was adopted. AMLA has moved from establishment to operational supervisory build-out. On 9 June 2026, AMLA held its first conference at the Alte Oper in Frankfurt — the city where it is headquartered — and on 10 June published materials on identifying obliged entities eligible for direct supervision. The direct-supervision eligibility methodology identifies up to 40 high-risk cross-border obliged entities, including crypto-asset service providers, that will fall under AMLA's direct supervisory perimeter. The AMLR applies from 2027; AMLA direct supervision of the selected cohort begins in 2028. The distinction between these two dates is analytically important: the single rulebook becomes binding in 2027, but the shift in supervisory authority — from purely national competent authorities to a hybrid EU-level regime — does not complete until 2028.\n\nThe supervisory-perimeter shift is the architecture-over-incident finding of this cycle for D2. Historically, the fragmentation of AML supervision across Member State authorities has created regulatory-arbitrage opportunities: obliged entities could structure their EU presence to fall under the supervision of the most permissive national authority, a dynamic that has been documented in multiple FATF mutual evaluations and EU SNRA assessments. AMLA's direct-supervision methodology closes this gap for the highest-risk cross-border groups. The affected jurisdictions — DE, FR, IE, NL, LU, MT, CY — include several that have historically attracted cross-border financial-services activity precisely because of their supervisory environments. The BO registry interconnection is a core deliverable of the AMLA build-out, and its implementation will affect how competent authorities across the EU access beneficial-ownership information for the entities in AMLA's supervisory perimeter.\n\nThe FATF dimension of D2 this cycle is carried by the June Plenary's sustained attention to R.24 and R.25 implementation. The AMLA build-out directly advances R.24 and R.25 compliance for EU Member States by creating a centralised supervisory mechanism for BO registry access and verification. However, global implementation of R.24 and R.25 remains uneven, and the FATF grey-list movements — including the newly identified Bosnia and Herzegovina and Iraq — signal that BO transparency deficits remain a driver of increased-monitoring determinations in multiple jurisdictions outside the EU perimeter.\n\nThe compliance-function implication of the AMLA build-out is a two-phase readiness requirement. By 2027, obliged entities across the EU must be aligned with the AMLR single rulebook — a directly applicable instrument that will override divergent national implementations. By 2028, the cohort of up to 40 high-risk cross-border groups must be prepared for direct AMLA supervision, which will involve a supervisory relationship with a EU-level authority rather than solely with national competent authorities. For CASPs in particular, the inclusion in the direct-supervision perimeter represents a significant regulatory step-change: crypto-asset service providers have historically operated under fragmented national supervision, and AMLA direct supervision will impose a uniform EU-level supervisory standard.\n\n## Outlook\n\nThe AMLA operational build-out is the most significant improving signal in the D2 domain and across the FIM monitor as a whole this cycle. The trajectory from fragmented national supervision toward a hybrid EU-level regime is now operationally underway rather than merely legislated. The 2027 AMLR application date and 2028 direct-supervision commencement create a defined readiness timeline for obliged entities, but the arbitrage window remains open for at least eighteen months. The near-term watch points for D2 are the publication of AMLA's first supervisory methodology in 2026-H2, the per-Member-State 6AMLD transposition trajectory (a noted collection gap), and the BO registry interconnection deliverable. The FATF UK Presidency's emphasis on risk-based supervision may generate additional pressure on BO transparency standards globally, reinforcing the EU's structural direction of travel.", "typology_refs": [], "word_count": 762, "limited_signal_flag": false, "cumulative_content": "## Beneficial Ownership and Corporate Transparency — Cumulative Analysis\n\nThe EU AML Package constitutes the most significant structural reform of European financial-crime supervision in a generation, and its architecture must be understood as three distinct instruments operating on different legal bases and timelines. The AML Regulation (AMLR, Regulation (EU) 2024/1624) is directly applicable across all EU Member States without national transposition — it will function as a single AML rulebook, superseding the divergent national implementations that have historically enabled regulatory arbitrage across the single market. The sixth AML Directive (6AMLD, Directive (EU) 2024/1640) requires transposition by each Member State and governs the institutional and supervisory framework at national level; per-Member-State transposition status is divergent and remains a noted collection gap. The AMLA Regulation (Regulation (EU) 2024/1620) establishes the Anti-Money Laundering Authority itself, creating the institutional architecture for a hybrid EU-level supervisory regime that will sit alongside — and in some cases above — national competent authorities. These three instruments are the standing structural backdrop against which all D2 signal is read, and their simultaneous operation on different timelines is the defining feature of the current EU AML landscape.\n\nThe most operationally significant D2 development to date is AMLA's transition from establishment to operational supervisory build-out. On 9 June 2026, AMLA held its first conference at the Alte Oper in Frankfurt — the city where it is headquartered — and on 10 June published materials on identifying obliged entities eligible for direct supervision. The direct-supervision eligibility methodology identifies up to 40 high-risk cross-border obliged entities, including crypto-asset service providers, that will fall under AMLA's direct supervisory perimeter. The AMLR applies from 2027; AMLA direct supervision of the selected cohort begins in 2028. The distinction between these two dates is analytically important: the single rulebook becomes binding in 2027, but the shift in supervisory authority — from purely national competent authorities to a hybrid EU-level regime — does not complete until 2028.\n\nThe supervisory-perimeter shift is the architecture-over-incident finding for D2. Historically, the fragmentation of AML supervision across Member State authorities has created regulatory-arbitrage opportunities: obliged entities could structure their EU presence to fall under the supervision of the most permissive national authority, a dynamic documented in multiple FATF mutual evaluations and EU SNRA assessments. AMLA's direct-supervision methodology closes this gap for the highest-risk cross-border groups. The affected jurisdictions — DE, FR, IE, NL, LU, MT, CY — include several that have historically attracted cross-border financial-services activity precisely because of their supervisory environments. The BO registry interconnection is a core deliverable of the AMLA build-out, and its implementation will affect how competent authorities across the EU access beneficial-ownership information for the entities in AMLA's supervisory perimeter.\n\nThe FATF dimension of D2 is carried by sustained attention to R.24 and R.25 implementation. The AMLA build-out directly advances R.24 and R.25 compliance for EU Member States by creating a centralised supervisory mechanism for BO registry access and verification. However, global implementation of R.24 and R.25 remains uneven, and the FATF grey-list movements — including the newly identified Bosnia and Herzegovina and Iraq — signal that BO transparency deficits remain a driver of increased-monitoring determinations in multiple jurisdictions outside the EU perimeter. The FATF UK Presidency's emphasis on risk-based supervision may generate additional pressure on BO transparency standards globally, reinforcing the EU's structural direction of travel.\n\nThe compliance-function implication of the AMLA build-out is a two-phase readiness requirement. By 2027, obliged entities across the EU must be aligned with the AMLR single rulebook — a directly applicable instrument that will override divergent national implementations. By 2028, the cohort of up to 40 high-risk cross-border groups must be prepared for direct AMLA supervision, which will involve a supervisory relationship with a EU-level authority rather than solely with national competent authorities. For CASPs in particular, the inclusion in the direct-supervision perimeter represents a significant regulatory step-change: crypto-asset service providers have historically operated under fragmented national supervision, and AMLA direct supervision will impose a uniform EU-level supervisory standard.\n\nThe AMLA Regulation was amended by Regulation (EU) 2025/2088, and the three instruments are tracked separately in the standing tracker (T2) to preserve analytical clarity across their distinct application timelines. The trajectory for D2 is improving: the supervisory architecture is advancing from legislative adoption toward operational reality, and the arbitrage window created by fragmented national supervision is narrowing. The near-term watch points are the publication of AMLA's first supervisory methodology in 2026-H2, the per-Member-State 6AMLD transposition trajectory, and the BO registry interconnection deliverable.\n\n## Outlook\n\nThe AMLA operational build-out is the most significant improving signal in the D2 domain. The trajectory from fragmented national supervision toward a hybrid EU-level regime is now operationally underway rather than merely legislated. The 2027 AMLR application date and 2028 direct-supervision commencement create a defined readiness timeline for obliged entities, but the arbitrage window remains open for at least eighteen months. The structural outlook for D2 is one of progressive convergence at the EU level against a backdrop of continued global unevenness in BO transparency implementation — a combination that will continue to generate compliance complexity for cross-border institutions operating across both EU and non-EU jurisdictions.", "cumulative_word_count": 826, "cumulative_through_issue": 26 }, { "domain_ref": "D3", "domain_name": "Enabler Jurisdictions and Professional Facilitators", "content": "## Enabler Jurisdictions and Professional Facilitators\n\nThe D3 domain carries the highest volume of material signal this cycle, and the analytical thread connecting its three principal developments is the same: illicit finance infrastructure demonstrates resilience to enforcement pressure, and the enabler-jurisdiction and professional-facilitator ecosystems that sustain it adapt faster than the regulatory and enforcement responses directed at them.\n\nThe FATF June 2026 Plenary produced a mixed grey-list outcome that resists a simple narrative. Algeria and Namibia were removed from increased monitoring following on-site visits confirming sufficient progress, and substantial-completion determinations were made for Bulgaria, Cote d'Ivoire, and the DRC. However, Bosnia and Herzegovina and Iraq were newly identified for increased monitoring, reflecting persistent AML/CFT framework deficiencies in both jurisdictions. The incoming UK Presidency, effective 1 July 2026, reframed FATF's thematic priorities around the fraud epidemic, scam-compound ML/TF risk, and risk-based supervision — a framing that treats illicit finance as networked criminal infrastructure rather than a collection of discrete enforcement incidents. This thematic pivot is analytically significant: it signals that the FATF standards-setting agenda for the UK Presidency period will be shaped by the Southeast Asian scam-compound economy and its global financial-crime implications, including the guarantee-marketplace laundering model that this cycle's Huione developments illustrate. Iran and the DPRK remain on the call-for-action list, sustaining the highest-risk tier of the FATF monitoring architecture.\n\nThe FBI's seizure of a cloud computing account used by Huione Group subsidiaries on 23 June 2026 is the most operationally significant D3 development of the cycle, but its analytical significance lies not in the seizure itself but in what the seizure reveals about the resilience of the underlying infrastructure. The Huione marketplace received over USD 31 billion and the payments arm received over USD 103 billion in crypto — making it assessed as the largest illicit online marketplace ever recorded. Despite the seizure, a prior FinCEN Section 311 designation, Prince Group sanctions, and the arrest of Chen Zhi, the guarantee-marketplace model has not collapsed. Xinbi Guarantee now leads the successor ecosystem. The architecture-over-incident reading is the finding: the guarantee-marketplace model is a durable infrastructure pattern, not a single-platform phenomenon. Cambodia's risk direction is assessed as increasing, with the scam-compound economy entangled with state-linked corporate conglomerates in a manner that implicates the F1 state-capture filter and warrants routing to the WDM monitor.\n\nFinCEN's expanded Southwest Border Geographic Targeting Order and the accompanying CMLN advisory map a third enabler-jurisdiction architecture: the Mexico-PRC-US laundering corridor. The expanded GTO, running from 7 March to 2 September 2026, lowers the currency transaction report threshold to USD 1,000 for money services businesses in additional Arizona and New Mexico counties. The CMLN advisory details how Chinese money-laundering networks service the Sinaloa cartel and others via trade-based money laundering, mirror transfers, and the Chinese underground banking system. The structural reading fuses three distinct demand-and-supply dynamics: Mexican cartel cash seeking placement, PRC capital-flight demand seeking outbound channels, and US MSB and real-estate exposure as the laundering surface. The Chinese underground banking system functions as cross-border professional-enabler infrastructure, providing the connective tissue between the cartel and PRC demand sides of the corridor. Cartels designated as foreign terrorist organisations and SDGTs under Executive Order 14157 fuse counter-terrorism and AML authorities in a single enforcement framework.\n\nThe F3 enabler-jurisdiction filter assessment across these three developments is consistent: Cambodia, the jurisdictions hosting Chinese underground banking networks, and the US-Mexico border corridor all function as enabler environments — not because of a single regulatory failure but because of structural features of their legal, financial, and political economies that make them attractive to illicit finance at scale. The absence of enforcement action in permissive jurisdictions is itself analytically significant, and the Huione-to-Xinbi transition illustrates that enforcement actions directed at individual nodes do not degrade the underlying infrastructure model.\n\n## Outlook\n\nThe D3 trajectory is assessed as deteriorating this cycle, driven by the persistence of the guarantee-marketplace model post-Huione, the newly identified grey-list additions (Bosnia and Herzegovina and Iraq), and the documented scale of the Mexico-PRC-US laundering corridor. The near-term watch points are the FinCEN GTO expiry on 2 September 2026 — which will determine whether the expanded reporting perimeter is renewed, expanded, or allowed to lapse — and the finalisation of the FinCEN Section 311 Huione Group correspondent-account prohibition, which remains in consultation and whose scope relative to successor marketplaces such as Xinbi leaves residual exposure-management uncertainty. The FATF UK Presidency's fraud-and-scam-compound framing will shape typology guidance and supervisory expectations through 2026 and into 2027, potentially generating new red-flag indicators and risk-assessment obligations for institutions exposed to the guarantee-marketplace and CMLN corridor architectures.", "typology_refs": [], "word_count": 793, "limited_signal_flag": false, "cumulative_content": "## Enabler Jurisdictions and Professional Facilitators — Cumulative Analysis\n\nThe D3 domain has carried the highest volume of material signal across the current monitoring period, and the analytical thread connecting its principal developments is consistent: illicit finance infrastructure demonstrates resilience to enforcement pressure, and the enabler-jurisdiction and professional-facilitator ecosystems that sustain it adapt faster than the regulatory and enforcement responses directed at them. This is not a cycle-specific observation but a structural feature of the D3 landscape that the current period has documented with unusual clarity.\n\nThe FATF June 2026 Plenary produced a mixed grey-list outcome. Algeria and Namibia were removed from increased monitoring following on-site visits confirming sufficient progress, and substantial-completion determinations were made for Bulgaria, Cote d'Ivoire, and the DRC. However, Bosnia and Herzegovina and Iraq were newly identified for increased monitoring, reflecting persistent AML/CFT framework deficiencies in both jurisdictions. The incoming UK Presidency, effective 1 July 2026, reframed FATF's thematic priorities around the fraud epidemic, scam-compound ML/TF risk, and risk-based supervision — a framing that treats illicit finance as networked criminal infrastructure rather than a collection of discrete enforcement incidents. This thematic pivot signals that the FATF standards-setting agenda for the UK Presidency period will be shaped by the Southeast Asian scam-compound economy and its global financial-crime implications. Iran and the DPRK remain on the call-for-action list, sustaining the highest-risk tier of the FATF monitoring architecture.\n\nThe FBI's seizure of a cloud computing account used by Huione Group subsidiaries on 23 June 2026 is the most operationally significant D3 development of the current period, but its analytical significance lies not in the seizure itself but in what the seizure reveals about the resilience of the underlying infrastructure. The Huione marketplace received over USD 31 billion and the payments arm received over USD 103 billion in crypto — making it assessed as the largest illicit online marketplace ever recorded. Despite the seizure, a prior FinCEN Section 311 designation, Prince Group sanctions, and the arrest of Chen Zhi, the guarantee-marketplace model has not collapsed. Xinbi Guarantee now leads the successor ecosystem. The architecture-over-incident reading is the finding: the guarantee-marketplace model is a durable infrastructure pattern, not a single-platform phenomenon. Cambodia's risk direction is assessed as increasing, with the scam-compound economy entangled with state-linked corporate conglomerates in a manner that implicates the F1 state-capture filter and warrants routing to the WDM monitor.\n\nFinCEN's expanded Southwest Border Geographic Targeting Order and the accompanying CMLN advisory map a third enabler-jurisdiction architecture: the Mexico-PRC-US laundering corridor. The expanded GTO, running from 7 March to 2 September 2026, lowers the currency transaction report threshold to USD 1,000 for money services businesses in additional Arizona and New Mexico counties. The CMLN advisory details how Chinese money-laundering networks service the Sinaloa cartel and others via trade-based money laundering, mirror transfers, and the Chinese underground banking system. The structural reading fuses three distinct demand-and-supply dynamics: Mexican cartel cash seeking placement, PRC capital-flight demand seeking outbound channels, and US MSB and real-estate exposure as the laundering surface. The Chinese underground banking system functions as cross-border professional-enabler infrastructure, providing the connective tissue between the cartel and PRC demand sides of the corridor. Cartels designated as foreign terrorist organisations and SDGTs under Executive Order 14157 fuse counter-terrorism and AML authorities in a single enforcement framework.\n\nThe F3 enabler-jurisdiction filter assessment across these developments is consistent: Cambodia, the jurisdictions hosting Chinese underground banking networks, and the US-Mexico border corridor all function as enabler environments — not because of a single regulatory failure but because of structural features of their legal, financial, and political economies that make them attractive to illicit finance at scale. The absence of enforcement action in permissive jurisdictions is itself analytically significant, and the Huione-to-Xinbi transition illustrates that enforcement actions directed at individual nodes do not degrade the underlying infrastructure model.\n\nThe OFAC designation of Grand Legend International Asset Management Group under the Transnational Criminal Organizations programme on 23 June 2026 adds a further data point to the D3 picture: TCO-linked financial infrastructure continues to attract OFAC enforcement attention across multiple geographic corridors simultaneously, reflecting the networked rather than siloed nature of professional-facilitator ecosystems.\n\nThe D3 trajectory is assessed as deteriorating, driven by the persistence of the guarantee-marketplace model post-Huione, the newly identified grey-list additions, and the documented scale of the Mexico-PRC-US laundering corridor. The near-term watch points are the FinCEN GTO expiry on 2 September 2026 and the finalisation of the FinCEN Section 311 Huione Group correspondent-account prohibition, which remains in consultation and whose scope relative to successor marketplaces such as Xinbi leaves residual exposure-management uncertainty. The FATF UK Presidency's fraud-and-scam-compound framing will shape typology guidance and supervisory expectations through 2026 and into 2027.\n\n## Outlook\n\nThe structural outlook for D3 is one of infrastructure persistence against a backdrop of sustained but insufficient enforcement pressure. The guarantee-marketplace model will continue to evolve through successor platforms; the CMLN corridor architecture is deeply embedded in the structural demand-and-supply dynamics of PRC capital flight and cartel cash placement; and the FATF grey-list additions signal that new jurisdictions will continue to be identified as AML/CFT framework deficiencies are documented. The compliance-function priority for D3 through the remainder of 2026 is monitoring the GTO expiry and Section 311 finalisation windows, updating screening and transaction-monitoring parameters for the Xinbi successor ecosystem, and calibrating CMLN corridor exposure across MSB, trade-finance, and correspondent-bank customer segments.", "cumulative_word_count": 862, "cumulative_through_issue": 26 }, { "domain_ref": "D4", "domain_name": "Conflict Finance and Extractive-Industry Integrity", "content": "## Conflict Finance and Extractive-Industry Integrity\n\nThe D4 signal this cycle is structural rather than event-driven, and it is read against a backdrop of two standing architectures: the Colombia cocaine and illegal-gold laundering corridor, and the Golden Triangle scam-compound and conflict-finance-adjacent economy across Cambodia, Myanmar, and Laos.\n\nUNODC methodology estimates inward illicit financial flows from Colombian cocaine at USD 1.2 to 8.6 billion annually for the period 2015 to 2019. These figures represent a structural baseline rather than a current-cycle delta — the UNODC estimates pre-date the cycle and the absence of a current National Risk Assessment citation is a noted collection gap. The structural finding is the parallel laundering channel created by illegal gold mining: gold's licit-trade status makes it an effective vehicle for obscuring the origin of illicit proceeds, because the commodity can be introduced into legitimate supply chains at the point of sale without triggering the same documentary scrutiny applied to cash or financial transfers. Colombia remains in FATF follow-up rather than grey-listing, which reflects a judgment that its AML/CFT framework is improving but not yet at the level required for removal from the follow-up process. The cocaine and illegal-gold IFF architecture is conflict-finance-adjacent: revenue from both activities funds armed-group activity in conflict-affected departments, connecting the D4 domain to the SCEM monitor's conflict-finance tracking.\n\nThe Golden Triangle dimension of D4 this cycle is carried by the FATF June Plenary's continued increased monitoring of Lao PDR. Laos remains under increased monitoring following the June review, and the special economic zones that host scam-compound infrastructure across the Golden Triangle corridor — spanning Cambodia, Myanmar, and Laos — operate with weak supervision and documented linkages to the Prince Group network. The scam-compound economy is conflict-finance-adjacent in a specific sense: it relies on forced labour, generates revenue that flows through the same guarantee-marketplace infrastructure documented in D3, and operates in jurisdictions where state capacity to regulate or enforce against the infrastructure is limited or compromised. The F4 conflict-finance filter assessment is that the Golden Triangle corridor represents a sustained conflict-finance-adjacent risk that warrants continued monitoring alongside the D3 enabler-jurisdiction assessment.\n\nThe D4 domain this cycle does not carry a discrete new enforcement action or regulatory development — the signal is the persistence and structural depth of the two standing architectures. The Colombia IFF estimates, though historical, underscore the scale of the laundering challenge: at the upper end of the UNODC range, cocaine inward IFFs alone represent a flow comparable to significant portions of Colombia's formal export economy. The illegal-gold channel adds a commodity-laundering dimension that is structurally difficult to address because it exploits the licit-trade status of a globally traded commodity with deep integration into formal financial systems.\n\n## Outlook\n\nThe D4 trajectory is assessed as stable this cycle, reflecting the absence of a new discrete development rather than an improvement in the underlying risk architecture. The Colombia cocaine and illegal-gold laundering corridor remains a structural feature of the D4 landscape, and the absence of a current NRA citation limits the ability to assess whether the risk trajectory has changed since the 2015-2019 UNODC baseline. The Golden Triangle scam-compound corridor will remain a D4 watch signal as long as Lao PDR remains under FATF increased monitoring and the Prince Group-linked infrastructure continues to operate across the Cambodia-Myanmar-Laos corridor. The FATF UK Presidency's emphasis on scam-compound ML/TF risk may generate additional typology guidance relevant to the D4-D3 intersection, particularly for institutions with correspondent-banking or trade-finance exposure to the affected jurisdictions.", "typology_refs": [], "word_count": 572, "limited_signal_flag": false, "cumulative_content": "## Conflict Finance and Extractive-Industry Integrity — Cumulative Analysis\n\nThe D4 domain is defined by two standing structural architectures that have been documented across the current monitoring period: the Colombia cocaine and illegal-gold laundering corridor, and the Golden Triangle scam-compound and conflict-finance-adjacent economy across Cambodia, Myanmar, and Laos. Neither architecture has produced a discrete new enforcement action or regulatory development in the current cycle, but both represent durable structural risks that warrant sustained monitoring.\n\nUNODC methodology estimates inward illicit financial flows from Colombian cocaine at USD 1.2 to 8.6 billion annually for the period 2015 to 2019. These figures represent a structural baseline rather than a current-cycle delta — the UNODC estimates pre-date the cycle and the absence of a current National Risk Assessment citation is a noted collection gap. The structural finding is the parallel laundering channel created by illegal gold mining: gold's licit-trade status makes it an effective vehicle for obscuring the origin of illicit proceeds, because the commodity can be introduced into legitimate supply chains at the point of sale without triggering the same documentary scrutiny applied to cash or financial transfers. Colombia remains in FATF follow-up rather than grey-listing, which reflects a judgment that its AML/CFT framework is improving but not yet at the level required for removal from the follow-up process. The cocaine and illegal-gold IFF architecture is conflict-finance-adjacent: revenue from both activities funds armed-group activity in conflict-affected departments, connecting the D4 domain to the SCEM monitor's conflict-finance tracking.\n\nThe Golden Triangle dimension of D4 is carried by the FATF June Plenary's continued increased monitoring of Lao PDR. Laos remains under increased monitoring following the June review, and the special economic zones that host scam-compound infrastructure across the Golden Triangle corridor — spanning Cambodia, Myanmar, and Laos — operate with weak supervision and documented linkages to the Prince Group network. The scam-compound economy is conflict-finance-adjacent in a specific sense: it relies on forced labour, generates revenue that flows through the same guarantee-marketplace infrastructure documented in D3, and operates in jurisdictions where state capacity to regulate or enforce against the infrastructure is limited or compromised. The F4 conflict-finance filter assessment is that the Golden Triangle corridor represents a sustained conflict-finance-adjacent risk that warrants continued monitoring alongside the D3 enabler-jurisdiction assessment.\n\nThe D4 domain does not carry a discrete new enforcement action or regulatory development in the current period — the signal is the persistence and structural depth of the two standing architectures. The Colombia IFF estimates, though historical, underscore the scale of the laundering challenge: at the upper end of the UNODC range, cocaine inward IFFs alone represent a flow comparable to significant portions of Colombia's formal export economy. The illegal-gold channel adds a commodity-laundering dimension that is structurally difficult to address because it exploits the licit-trade status of a globally traded commodity with deep integration into formal financial systems.\n\nThe ERM cross-monitor connection is relevant here: illegal gold mining in Colombia is flagged as a commodity-laundering vector for the ERM monitor, and the shadow-fleet typologies flagged in the OFAC-OFSI Comparative Overview add a further commodity-flow dimension to the D4-ERM intersection. The SCEM cross-monitor connection is carried by the Russian procurement-network designations, which sustain the military-industrial financing thread that SCEM tracks, and by the Golden Triangle forced-labour economy, which is conflict-finance-adjacent in the SCEM sense.\n\nThe D4 trajectory is assessed as stable, reflecting the absence of a new discrete development rather than an improvement in the underlying risk architecture. The Colombia cocaine and illegal-gold laundering corridor remains a structural feature of the D4 landscape, and the absence of a current NRA citation limits the ability to assess whether the risk trajectory has changed since the 2015-2019 UNODC baseline. The Golden Triangle scam-compound corridor will remain a D4 watch signal as long as Lao PDR remains under FATF increased monitoring and the Prince Group-linked infrastructure continues to operate across the Cambodia-Myanmar-Laos corridor.\n\n## Outlook\n\nThe structural outlook for D4 is one of persistent risk at the intersection of commodity-laundering and conflict finance, with limited near-term catalysts for improvement. The Colombia IFF architecture will remain analytically significant until a current NRA citation is available to update the 2015-2019 UNODC baseline. The Golden Triangle corridor will remain a watch signal through the FATF UK Presidency period, during which scam-compound ML/TF risk is a stated priority. The compliance-function priority for D4 is maintaining awareness of the commodity-laundering vectors — gold in Colombia, scam-compound proceeds in the Golden Triangle — and their intersection with correspondent-banking and trade-finance exposure.", "cumulative_word_count": 742, "cumulative_through_issue": 26 }, { "domain_ref": "D5", "domain_name": "Crypto, Digital Assets, and Financial Innovation", "content": "## Crypto, Digital Assets, and Financial Innovation\n\nThe D5 domain carries two distinct signal streams this cycle: a standards-development stream from the FATF June Plenary, and an enforcement stream from OFAC's ISIS-related designations. Both streams illuminate the same structural challenge — the extension of financial-crime infrastructure into digital-asset channels — from different analytical angles.\n\nThe FATF June 2026 Plenary approved a seventh targeted update on implementation of FATF standards for virtual assets and VASPs, alongside a new report on DeFi covering ML/TF/PF challenges, both for July 2026 publication. The seventh targeted update sustains the standards-implementation push that has been a consistent FATF priority since the 2019 revision of Recommendation 15. The analytical context is persistent global under-implementation of the travel rule — the requirement that VASPs transmit originator and beneficiary information alongside virtual-asset transfers — and uneven VASP supervision that continues to create arbitrage jurisdictions where crypto-asset operators can operate with lower compliance burdens. The DeFi report adds a new dimension: decentralised finance protocols present ML/TF/PF challenges that the existing VASP framework does not fully address, because the absence of a central intermediary complicates the application of conventional AML/CFT obligations. The July publication of both documents will be a significant D5 watch point.\n\nThe OFAC designation of 22 June 2026 targeted three individuals and six entities — including Syria-based Bitcoin Xchange, Turkish MSBs, and three Nigerian bureaux de change — for moving crypto and cash for ISIS, attaching two TRON wallet addresses to the designation. The structural finding is the hawala-to-crypto facilitation layer: the designation maps a network that spans European, MENA, and African donor flows, routing funds through conventional hawala and MSB channels before converting them into crypto for onward transmission. The attachment of specific TRON wallet addresses to the designation extends sanctions architecture on-chain, creating blockchain-native screening obligations for crypto-asset operators alongside the conventional MSB and correspondent-bank screening obligations that apply to the fiat-currency legs of the network. This is a CTF signal under the three-pillar balance: the ISIS designation is not an AML action but a counter-terrorism financing action, and its significance for D5 lies in the demonstration that terrorist financing networks are actively using crypto-asset infrastructure as a facilitation layer.\n\nThe Huione Group developments documented in D3 carry a significant D5 dimension. The payments arm of the Huione ecosystem received over USD 103 billion in crypto, and the guarantee-marketplace model that persists through Xinbi Guarantee is fundamentally a crypto-asset infrastructure. The FBI seizure of cloud infrastructure and the FinCEN Section 311 designation together represent the application of conventional enforcement tools to a crypto-native laundering architecture, with the persistence of the Xinbi successor demonstrating the limits of node-removal enforcement against distributed infrastructure.\n\nThe FATF R.15 and R.16 implementation gap — covering VASP registration, supervision, and travel-rule compliance — remains the structural backdrop against which all D5 signal is read. The seventh targeted update will assess progress against this gap; the expectation, based on prior updates, is that global implementation remains uneven and that arbitrage jurisdictions continue to attract VASP activity that would face higher compliance burdens in well-regulated centres.\n\n## Outlook\n\nThe D5 trajectory is assessed as stable this cycle, reflecting sustained enforcement and standards-development activity against a backdrop of persistent structural under-implementation. The July 2026 publication of the FATF seventh VA/VASP targeted update and DeFi report will be the most significant near-term D5 development, and its findings on travel-rule implementation and DeFi ML/TF/PF risks will shape supervisory expectations and typology guidance for the remainder of 2026. The OFAC ISIS designation with on-chain identifiers signals a continued willingness to extend sanctions architecture into blockchain-native channels, and crypto-asset operators should expect continued use of on-chain identifiers in future CTF designations. The FinCEN Section 311 Huione Group final rule, when published, will directly affect the correspondent-banking access of crypto-asset operators with exposure to the Huione and Xinbi ecosystems.", "typology_refs": [], "word_count": 641, "limited_signal_flag": false, "cumulative_content": "## Crypto, Digital Assets, and Financial Innovation — Cumulative Analysis\n\nThe D5 domain is defined by a structural tension that has persisted across the current monitoring period: the extension of financial-crime infrastructure into digital-asset channels is accelerating, while the regulatory and supervisory frameworks designed to address it remain unevenly implemented globally. This tension is documented across two distinct signal streams — a standards-development stream from the FATF, and an enforcement stream from OFAC and the FBI — that together illuminate the same underlying challenge from different analytical angles.\n\nThe FATF June 2026 Plenary approved a seventh targeted update on implementation of FATF standards for virtual assets and VASPs, alongside a new report on DeFi covering ML/TF/PF challenges, both for July 2026 publication. The seventh targeted update sustains the standards-implementation push that has been a consistent FATF priority since the 2019 revision of Recommendation 15. The analytical context is persistent global under-implementation of the travel rule — the requirement that VASPs transmit originator and beneficiary information alongside virtual-asset transfers — and uneven VASP supervision that continues to create arbitrage jurisdictions where crypto-asset operators can operate with lower compliance burdens. The DeFi report adds a new dimension: decentralised finance protocols present ML/TF/PF challenges that the existing VASP framework does not fully address, because the absence of a central intermediary complicates the application of conventional AML/CFT obligations.\n\nThe OFAC designation of 22 June 2026 targeted three individuals and six entities — including Syria-based Bitcoin Xchange, Turkish MSBs, and three Nigerian bureaux de change — for moving crypto and cash for ISIS, attaching two TRON wallet addresses to the designation. The structural finding is the hawala-to-crypto facilitation layer: the designation maps a network that spans European, MENA, and African donor flows, routing funds through conventional hawala and MSB channels before converting them into crypto for onward transmission. The attachment of specific TRON wallet addresses to the designation extends sanctions architecture on-chain, creating blockchain-native screening obligations for crypto-asset operators alongside the conventional MSB and correspondent-bank screening obligations that apply to the fiat-currency legs of the network. This is a CTF signal under the three-pillar balance: the ISIS designation is not an AML action but a counter-terrorism financing action, and its significance for D5 lies in the demonstration that terrorist financing networks are actively using crypto-asset infrastructure as a facilitation layer.\n\nThe Huione Group developments carry a significant D5 dimension. The payments arm of the Huione ecosystem received over USD 103 billion in crypto, and the guarantee-marketplace model that persists through Xinbi Guarantee is fundamentally a crypto-asset infrastructure. The FBI seizure of cloud infrastructure and the FinCEN Section 311 designation together represent the application of conventional enforcement tools to a crypto-native laundering architecture, with the persistence of the Xinbi successor demonstrating the limits of node-removal enforcement against distributed infrastructure. The active scheme inventory entry for the ISIS hawala-to-crypto facilitation layer documents the multi-jurisdictional donor network — spanning Norway, Belgium, the Netherlands, South Africa, and the US — that feeds into the Syria-Turkey-Nigeria facilitation chain.\n\nThe AMLA build-out documented in D2 carries a direct D5 implication: crypto-asset service providers are included in the direct-supervision eligibility methodology, meaning that CASPs operating in the EU will face AMLA direct supervision from 2028 under the AMLA Regulation (Reg (EU) 2024/1620). This represents a significant regulatory step-change for an asset class that has historically operated under fragmented national supervision across EU Member States.\n\nThe FATF R.15 and R.16 implementation gap — covering VASP registration, supervision, and travel-rule compliance — remains the structural backdrop against which all D5 signal is read. The seventh targeted update will assess progress against this gap; the expectation, based on prior updates, is that global implementation remains uneven and that arbitrage jurisdictions continue to attract VASP activity that would face higher compliance burdens in well-regulated centres.\n\nThe D5 trajectory is assessed as stable, reflecting sustained enforcement and standards-development activity against a backdrop of persistent structural under-implementation. The July 2026 publication of the FATF seventh VA/VASP targeted update and DeFi report will be the most significant near-term D5 development, and its findings on travel-rule implementation and DeFi ML/TF/PF risks will shape supervisory expectations and typology guidance for the remainder of 2026.\n\n## Outlook\n\nThe structural outlook for D5 is one of continued enforcement innovation — on-chain identifiers in OFAC designations, FBI seizure of cloud infrastructure — against a backdrop of infrastructure resilience and regulatory arbitrage. The OFAC ISIS designation with on-chain identifiers signals a continued willingness to extend sanctions architecture into blockchain-native channels, and crypto-asset operators should expect continued use of on-chain identifiers in future CTF designations. The FinCEN Section 311 Huione Group final rule, when published, will directly affect the correspondent-banking access of crypto-asset operators with exposure to the Huione and Xinbi ecosystems. The AMLA direct-supervision perimeter for CASPs from 2028 represents the most significant medium-term structural change for EU-based crypto-asset operators, and readiness planning for that supervisory transition should be underway now.", "cumulative_word_count": 812, "cumulative_through_issue": 26 }, { "domain_ref": "D6", "domain_name": "Compliance Technology and Active Defence", "content": "## Compliance Technology and Active Defence\n\nThe D6 signal this cycle is carried by a single structural development: the incoming UK FATF Presidency, effective 1 July 2026, has centred its agenda on the fraud epidemic, scam-compound ML/TF risk, and strengthening risk-based supervision, alongside FATF work on abuse of technology. The thematic pivot is analytically significant for D6 because it signals that the FATF standards-setting agenda for the UK Presidency period will include a focus on how technology is being abused to facilitate financial crime — and, by implication, on how compliance technology should respond.\n\nA documented gap persists between supervisory expectations for AI and machine-learning transaction-monitoring validation — covering model-risk and explainability — and uneven industry practice. No harmonised global model-risk standard for agentic compliance tooling exists. This gap is an analytical synthesis rather than a documented jurisdiction-bound instrument: the D6 global thesis is that the technology paradigm for compliance is cross-cutting, but its governing guidance is jurisdiction-bound, creating a structural mismatch between the global reach of the technology and the local scope of the regulatory frameworks that govern its use. The FATF UK Presidency's abuse-of-technology work programme may generate guidance that begins to address this mismatch, but the timeline and scope of that work are not yet established.\n\nThe D6 domain this cycle does not carry a discrete new enforcement action, regulatory instrument, or technology-specific development beyond the FATF Presidency framing. The signal is the persistence of the supervisory-expectation gap and the potential for the UK Presidency's agenda to generate new guidance in this space. The limited_signal_flag is set to false because the structural gap is a genuine D6 finding, but the signal volume is lower than other domains this cycle.\n\nThe cross-domain D6 implication of the Huione and CMLN developments documented in D3 is worth noting: the guarantee-marketplace model and the CMLN corridor both exploit weaknesses in transaction-monitoring and screening systems — the former through crypto-native infrastructure that may not be captured by conventional fiat-currency monitoring, the latter through structured cash transactions designed to fall below reporting thresholds. These are active-defence challenges that compliance technology must address, and the absence of harmonised model-risk standards for the AI/ML tools used to detect them is a structural vulnerability.\n\n## Outlook\n\nThe D6 trajectory is assessed as stable with a watch signal. The FATF UK Presidency's abuse-of-technology work programme is the most significant near-term D6 development to monitor, and its outputs — expected through 2026 and into 2027 — may generate new supervisory expectations for compliance technology validation and model-risk management. The structural gap between supervisory expectations and industry practice for AI/ML transaction-monitoring validation will persist until a harmonised global standard is developed, and the current FATF agenda suggests that standard remains at least one Presidency cycle away. Institutions with material exposure to the guarantee-marketplace and CMLN corridor architectures should assess whether their current transaction-monitoring and screening systems are calibrated to detect the specific red-flag indicators documented in the active scheme inventory.", "typology_refs": [], "word_count": 488, "limited_signal_flag": false, "cumulative_content": "## Compliance Technology and Active Defence — Cumulative Analysis\n\nThe D6 domain is defined by a structural gap that has persisted across the current monitoring period: the technology paradigm for compliance is cross-cutting and global, but its governing guidance is jurisdiction-bound and fragmented, creating a structural mismatch between the reach of the technology and the scope of the regulatory frameworks that govern its use. This gap is documented this cycle through the incoming UK FATF Presidency's agenda and the absence of a harmonised global model-risk standard for agentic compliance tooling.\n\nThe incoming UK FATF Presidency, effective 1 July 2026, has centred its agenda on the fraud epidemic, scam-compound ML/TF risk, and strengthening risk-based supervision, alongside FATF work on abuse of technology. The thematic pivot is analytically significant for D6 because it signals that the FATF standards-setting agenda for the UK Presidency period will include a focus on how technology is being abused to facilitate financial crime — and, by implication, on how compliance technology should respond. The abuse-of-technology work programme may generate guidance that begins to address the supervisory-expectation gap, but the timeline and scope of that work are not yet established.\n\nA documented gap persists between supervisory expectations for AI and machine-learning transaction-monitoring validation — covering model-risk and explainability — and uneven industry practice. No harmonised global model-risk standard for agentic compliance tooling exists. This gap is an analytical synthesis rather than a documented jurisdiction-bound instrument: the D6 global thesis is that the technology paradigm for compliance is cross-cutting, but its governing guidance is jurisdiction-bound. The FATF UK Presidency's abuse-of-technology work programme may generate guidance that begins to address this mismatch, but the timeline and scope of that work are not yet established.\n\nThe cross-domain D6 implication of the Huione and CMLN developments documented in D3 is worth noting: the guarantee-marketplace model and the CMLN corridor both exploit weaknesses in transaction-monitoring and screening systems — the former through crypto-native infrastructure that may not be captured by conventional fiat-currency monitoring, the latter through structured cash transactions designed to fall below reporting thresholds. These are active-defence challenges that compliance technology must address, and the absence of harmonised model-risk standards for the AI/ML tools used to detect them is a structural vulnerability.\n\nThe AMLA build-out documented in D2 carries a D6 implication: AMLA direct supervision from 2028 will impose a uniform EU-level supervisory standard on the compliance technology and model-risk frameworks of the up to 40 high-risk cross-border obliged entities in its direct-supervision perimeter. This creates a medium-term driver for compliance-technology standardisation within the EU, even in the absence of a global harmonised standard.\n\nThe D6 domain does not carry a discrete new enforcement action, regulatory instrument, or technology-specific development beyond the FATF Presidency framing this cycle. The signal is the persistence of the supervisory-expectation gap and the potential for the UK Presidency's agenda to generate new guidance in this space. The D6 trajectory is assessed as stable with a watch signal: the structural gap is real and documented, but the near-term catalyst for closing it has not yet materialised.\n\n## Outlook\n\nThe structural outlook for D6 is one of persistent gap between supervisory expectations and industry practice, with the FATF UK Presidency's abuse-of-technology work programme as the most significant near-term catalyst for change. The outputs of that programme — expected through 2026 and into 2027 — may generate new supervisory expectations for compliance technology validation and model-risk management. Institutions with material exposure to the guarantee-marketplace and CMLN corridor architectures should assess whether their current transaction-monitoring and screening systems are calibrated to detect the specific red-flag indicators documented in the active scheme inventory. The AMLA direct-supervision perimeter from 2028 will create a medium-term driver for compliance-technology standardisation within the EU, and institutions in the direct-supervision cohort should begin assessing their model-risk and explainability frameworks against the supervisory expectations that AMLA will apply.", "cumulative_word_count": 648, "cumulative_through_issue": 26 } ], "role_views": { "board": { "default_view": "dashboard", "mode": "rollup", "tier_gate": "open", "visible_domains": [], "ordering_hint": [], "note": "no domain_sub_briefs this cycle" }, "mlro": { "default_view": "triage", "mode": "severity_ranked", "tier_gate": "open", "visible_domains": [], "ordering_hint": [], "note": "no domain_sub_briefs this cycle" }, "legal": { "default_view": "alerts", "mode": "horizon_weighted", "tier_gate": "open", "visible_domains": [], "ordering_hint": [], "note": "no domain_sub_briefs this cycle" }, "cto": { "default_view": "alerts", "mode": "structured_payload", "tier_gate": "gated", "visible_domains": [], "ordering_hint": [], "note": "no domain_sub_briefs this cycle" } }, "enforcement_trend": { "kpi": { "total_actions": 2, "regulators": [ "US DOJ / FBI", "FinCEN" ], "regulator_count": 2, "trend_note": "Trend establishes over future cycles (1 cycle, 2 actions live)" }, "trend_summary": { "insufficient_history": true, "note": "Trend establishes over future cycles; only 1 cycle live with 2 enforcement rows", "cycle_count": 1, "action_count": 2 }, "register": [ { "action_id": "fbi-huione-2026-06", "regulator": "US DOJ / FBI", "breach_type": "money-laundering-infrastructure", "date": "2026-06-23", "source_url": "https://www.elliptic.co/media-center/elliptic-intelligence-used-by-the-fbi-in-action-against-huione-group", "source_tier": "2" }, { "action_id": "fincen-sinaloa-casinos-2026-03", "regulator": "FinCEN", "breach_type": "AML-primary-money-laundering-concern", "date": "2026-03-31", "source_url": "https://www.fincen.gov/news/news-releases/fincen-combats-financial-support-sinaloa-cartel-finding-transactions-involving", "source_tier": "1" } ], "jur_distribution": [ { "jurisdiction": "US", "risk_direction": "stable", "enforcement_vs_enablement": "enforcement", "primary_domains": [ "D1", "D3", "D4" ], "fatf_recommendations": [ "R.20" ] }, { "jurisdiction": "GB", "risk_direction": "stable", "enforcement_vs_enablement": "mixed", "primary_domains": [ "D1", "D6" ], "fatf_recommendations": [ "R.1" ] }, { "jurisdiction": "EEA", "risk_direction": "improving", "enforcement_vs_enablement": "enforcement", "primary_domains": [ "D2" ], "fatf_recommendations": [ "R.24", "R.25" ] }, { "jurisdiction": "KH", "risk_direction": "increasing", "enforcement_vs_enablement": "capacity_deficit", "primary_domains": [ "D3", "D5" ], "fatf_recommendations": [ "R.15" ] }, { "jurisdiction": "MX", "risk_direction": "increasing", "enforcement_vs_enablement": "mixed", "primary_domains": [ "D3", "D4" ], "fatf_recommendations": [ "R.20" ] }, { "jurisdiction": "CO", "risk_direction": "stable", "enforcement_vs_enablement": "capacity_deficit", "primary_domains": [ "D4" ], "fatf_recommendations": [] }, { "jurisdiction": "LA", "risk_direction": "stable", "enforcement_vs_enablement": "capacity_deficit", "primary_domains": [ "D4" ], "fatf_recommendations": [] } ], "balance": { "enforcement_vs_enablement_agg": "mixed_signal", "enforcement_count": 2, "capacity_deficit_count": 3, "mixed_count": 2, "total_jurisdictions": 7, "aggregation_method": "per-jurisdiction enforcement_vs_enablement enum count (real signal)", "aggregation_label": "Aggregated from jurisdiction_risk_tracker[].enforcement_vs_enablement", "aml_count": 2, "ctf_count": 0, "cpf_count": 0, "d3_secondary": { "severity": "ELEVATED", "summary": "Enabler dynamics within Tier A jurisdictions show divergent trajectories. The UK enabler ecosystem (Companies House, property and professional-services laundering) is being addressed through ECCTA but" } }, "scenarios": [ { "source": "scenario_sketches", "sketch_id": "fim-scn-2026-W26-001", "title": "AMLA Supervisory Transition and Residual Arbitrage Window", "narrative": "As AMLA moves from establishment to operational supervisory build-out, a transitional period exists between the AMLR application date (2027) and the commencement of AMLA direct supervision (2028). During this window, the single AML rulebook becomes binding but the supervisory authority over the highest-risk cross-border groups remains primarily with national competent authorities. An illustrative structural risk is that obliged entities — particularly those in the direct-supervision eligibility cohort — may face divergent supervisory expectations from national authorities applying the AMLR through different interpretive lenses, before AMLA direct supervision imposes a uniform EU-level standard. The per-Member-State 6AMLD transposition trajectory adds a further layer of divergence: Member States transposing 6AMLD at different speeds and with different national discretions may create a patchwork supervisory environment that sophisticated obliged entities could navigate to minimise supervisory intensity. The architecture-over-incident reading is that the 2027-2028 transitional window is itself a structural feature of the EU AML Package design — a managed transition rather than an oversight — and that the compliance-function priority is calibrating to the AMLR single rulebook while preparing for the supervisory relationship with AMLA that begins in 2028.", "disclaimer": "Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.", "related_typology_refs": [] }, { "source": "scenario_sketches", "sketch_id": "fim-scn-2026-W26-002", "title": "Cross-Jurisdiction Sanctions Arbitrage via Managed Divergence Architecture", "narrative": "The codification of the OFAC-OFSI divergence architecture in the June 2026 Comparative Overview creates a documented reference point for intermediaries seeking to structure cross-jurisdiction transactions to minimise aggregate sanctions exposure. An illustrative structural risk is that a sophisticated intermediary — a correspondent bank or trade-finance house operating across both regimes — could calibrate its transaction-structuring to exploit the gap between OFAC's jurisdiction-based blocking model and OFSI's breach-and-asset-freeze model. Transactions that do not involve US persons or US-dollar clearing may avoid OFAC blocking obligations while also falling below OFSI's asset-freeze threshold if the designated person's UK-reachable assets are limited. The EU's absence from the bilateral instrument means that EU-based intermediaries face a third, distinct sanctions architecture that may create further structuring opportunities. The architecture-over-incident reading is that the managed-divergence posture is a durable feature of the trilateral sanctions landscape, and that the compliance-function priority is mapping the specific transaction types and customer segments most exposed to the arbitrage surface created by the divergence.", "disclaimer": "Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.", "related_typology_refs": [] }, { "source": "scenario_sketches", "sketch_id": "fim-scn-2026-W26-003", "title": "Guarantee-Marketplace Infrastructure Persistence Post-Enforcement", "narrative": "The Huione-to-Xinbi transition illustrates an illustrative structural pattern in illicit finance infrastructure: enforcement actions that remove a primary node — through seizure, designation, or arrest — do not degrade the underlying infrastructure model if the model is replicable and the demand it serves persists. An illustrative forward-looking risk is that the guarantee-marketplace model will continue to evolve through successor platforms beyond Xinbi, each inheriting the operational architecture of its predecessor while adapting its technical and corporate structure to avoid the specific vulnerabilities that led to the predecessor's takedown. The FinCEN Section 311 Huione Group correspondent-account prohibition, when finalised, will sever US correspondent-banking access for the designated entity but may not address successor platforms that have not yet been designated. The architecture-over-incident reading is that the compliance-function priority is not monitoring for Huione or Xinbi specifically, but calibrating transaction-monitoring and screening systems to detect the guarantee-marketplace model's red-flag indicators — high-volume crypto inflows to platforms with opaque counterparty structures, payments-arm volumes inconsistent with stated business profiles — regardless of which platform is currently leading the ecosystem.", "disclaimer": "Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.", "related_typology_refs": [] }, { "source": "typology_scenarios", "scenario_id": "fim-tscn-2026-W26-001", "typology_id": "fim-typ-007", "layering_flow": "Illustrative step-sequence: 1. Cartel cash placed through MSB in designated southwest-border county at sub-$1,000 structured amounts to avoid GTO reporting threshold. 2. Funds aggregated through shell-company trade-finance accounts with offsetting import/export documentation. 3. Mirror transfers executed between PRC-linked counterparties and US-side accounts, with no apparent economic rationale. 4. Proceeds converted to crypto through CMLN-linked on-ramp and transferred to guarantee-marketplace platform. 5. Crypto withdrawn through successor platform (Xinbi-model) to obscure origin. Illustration only, not observation.", "disclaimer": "Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact." }, { "source": "typology_scenarios", "scenario_id": "fim-tscn-2026-W26-002", "typology_id": "fim-typ-007", "layering_flow": "Illustrative step-sequence: 1. ISIS donor in European jurisdiction transfers funds through hawala network to Turkish MSB. 2. Turkish MSB converts funds to TRON-based crypto and transfers to Syria-based crypto exchange. 3. Syria-based exchange routes funds through Nigerian bureau de change for cash-out or onward transfer. 4. Proceeds used to fund operational activities across MENA corridor. 5. On-chain TRON wallet addresses provide blockchain-native screening surface for crypto-asset operators. Illustration only, not observation.", "disclaimer": "Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact." } ], "scenarios_dropped_no_disclaimer": 0, "gaps_r15_signal": { "gaps_count": 6, "gap_ids": [ "fim-int-2026-06-25-G001", "fim-int-2026-06-25-G002", "fim-int-2026-06-25-G003", "fim-int-2026-06-25-G004", "fim-int-2026-06-25-G005", "fim-int-2026-06-25-G006" ], "note": "R15 floor signal: source-evidence gaps this cycle; see gaps_register[]" } }, "command_centre": { "p0_banner": { "role": "compliance", "priority": "High", "headline": "AMLA operational build-out and AMLR 2027 application date create a two-phase compliance readiness requirement for EU-exposed obliged entities.", "what_this_means": "AMLA published its direct-supervision eligibility methodology on 10 June 2026, identifying up to 40 high-risk cross-border obliged entities — including CASPs — for direct supervision from 2028. The AMLR (Reg (EU) 2024/1624) applies from 2027 as a directly applicable single rulebook. Compliance functions at EU-exposed institutions face a two-phase readiness requirement: AMLR alignment by 2027 and AMLA direct-supervision readiness by 2028. The FinCEN GTO expansion and CMLN advisory require policy updates for MSB and trade-finance customer segments, and the FATF June Plenary grey-list additions (Bosnia and Herzegovina, Iraq) require jurisdiction-risk-assessment updates.", "relevant_claim_ids": [ "fim-2026-W26-003", "fim-2026-W26-005", "fim-2026-W26-007", "fim-2026-W26-008" ] }, "kpi": { "obligations_mapped": 15, "control_gaps": 5, "enforcement_count": 2, "horizon_near_count": 6, "corpus_cycle_id": "fim-2026-W26", "shared_evidence_ids": [ "fim-2026-W26-001", "fim-2026-W26-003", "fim-2026-W26-004", "fim-2026-W26-005", "fim-2026-W26-007", "fim-2026-W26-010" ] }, "pillars": { "AML": [ { "domain_ref": "D1", "domain_name": "Sanctions Architecture and Evasion", "word_count": 712, "limited_signal_flag": false }, { "domain_ref": "D2", "domain_name": "Beneficial Ownership and Corporate Transparency", "word_count": 762, "limited_signal_flag": false }, { "domain_ref": "D3", "domain_name": "Enabler Jurisdictions and Professional Facilitators", "word_count": 793, "limited_signal_flag": false }, { "domain_ref": "D5", "domain_name": "Crypto, Digital Assets, and Financial Innovation", "word_count": 641, "limited_signal_flag": false }, { "domain_ref": "D6", "domain_name": "Compliance Technology and Active Defence", "word_count": 488, "limited_signal_flag": false } ], "CTF": [], "CPF": [ { "domain_ref": "D4", "domain_name": "Conflict Finance and Extractive-Industry Integrity", "word_count": 572, "limited_signal_flag": false } ], "cpf_floor": 2, "cpf_floor_breach": true, "cpf_floor_breach_note": "CPF pillar has 1 domain(s); R15 floor is 2 — rendered red." }, "open_gaps": [ { "claim_id": "fim-2026-W26-007", "domain": "D3", "framework": "FATF_Rec", "citation": "R.1", "control_gap_signal": "partial", "obligation_type": "governance" }, { "claim_id": "fim-2026-W26-008", "domain": "D5", "framework": "FATF_Rec", "citation": "R.15", "control_gap_signal": "partial", "obligation_type": "governance" }, { "claim_id": "fim-2026-W26-008", "domain": "D5", "framework": "FATF_Rec", "citation": "R.16", "control_gap_signal": "partial", "obligation_type": "record_keeping" }, { "claim_id": "fim-2026-W26-010", "domain": "D6", "framework": "BSA", "citation": "BSA 31 USC 5318(h)", "control_gap_signal": "partial", "obligation_type": "governance" }, { "claim_id": "fim-2026-W26-010", "domain": "D6", "framework": "MLR2017", "citation": "MLR 2017 Reg 18 (risk assessment)", "control_gap_signal": "partial", "obligation_type": "governance" } ], "jur_heat": { "items": [ { "jurisdiction": "US", "risk_direction": "stable", "enforcement_vs_enablement": "enforcement", "primary_domains": [ "D1", "D3", "D4" ], "fatf_recommendations": [ "R.20" ], "is_sub_national": false, "sub_national_note": "Sub-national gap: US-WY (D6 — Compliance Technology)" }, { "jurisdiction": "GB", "risk_direction": "stable", "enforcement_vs_enablement": "mixed", "primary_domains": [ "D1", "D6" ], "fatf_recommendations": [ "R.1" ], "is_sub_national": false, "sub_national_note": null }, { "jurisdiction": "EEA", "risk_direction": "improving", "enforcement_vs_enablement": "enforcement", "primary_domains": [ "D2" ], "fatf_recommendations": [ "R.24", "R.25" ], "is_sub_national": false, "sub_national_note": null }, { "jurisdiction": "KH", "risk_direction": "increasing", "enforcement_vs_enablement": "capacity_deficit", "primary_domains": [ "D3", "D5" ], "fatf_recommendations": [ "R.15" ], "is_sub_national": false, "sub_national_note": null }, { "jurisdiction": "MX", "risk_direction": "increasing", "enforcement_vs_enablement": "mixed", "primary_domains": [ "D3", "D4" ], "fatf_recommendations": [ "R.20" ], "is_sub_national": false, "sub_national_note": null }, { "jurisdiction": "CO", "risk_direction": "stable", "enforcement_vs_enablement": "capacity_deficit", "primary_domains": [ "D4" ], "fatf_recommendations": [], "is_sub_national": false, "sub_national_note": null }, { "jurisdiction": "LA", "risk_direction": "stable", "enforcement_vs_enablement": "capacity_deficit", "primary_domains": [ "D4" ], "fatf_recommendations": [], "is_sub_national": false, "sub_national_note": null } ], "count": 7 }, "enforcement_mini": { "items": [ { "action_id": "fbi-huione-2026-06", "regulator": "US DOJ / FBI", "breach_type": "money-laundering-infrastructure", "date": "2026-06-23", "source_url": "https://www.elliptic.co/media-center/elliptic-intelligence-used-by-the-fbi-in-action-against-huione-group", "source_tier": "2" }, { "action_id": "fincen-sinaloa-casinos-2026-03", "regulator": "FinCEN", "breach_type": "AML-primary-money-laundering-concern", "date": "2026-03-31", "source_url": "https://www.fincen.gov/news/news-releases/fincen-combats-financial-support-sinaloa-cartel-finding-transactions-involving", "source_tier": "1" } ], "count": 2 }, "horizon_preview": { "items": [ { "horizon_id": "fim-reg-2026-001", "title": "UK ECCTA 2023 failure-to-prevent-fraud offence enforcement maturation", "stage": "in_force", "estimated_impact_date": "2026-Q3", "uncertainty_band": "half_year", "instrument_type": "enforcement_policy", "affected_firm_types": [ "cross_sector" ], "affected_jurisdictions": [ "GB" ] }, { "horizon_id": "fim-reg-2026-002", "title": "FinCEN Southwest Border GTO expiry/renewal window", "stage": "in_force", "estimated_impact_date": "2026-Q3", "uncertainty_band": "quarter", "instrument_type": "enforcement_policy", "affected_firm_types": [ "payment_company", "bank" ], "affected_jurisdictions": [ "US", "MX" ] }, { "horizon_id": "fim-reg-2026-050", "title": "AMLA Work Programme / supervisory build-out", "stage": "in_force_pending", "estimated_impact_date": "2026-H2", "uncertainty_band": "half_year", "instrument_type": "regulation", "affected_firm_types": [ "cross_sector" ], "affected_jurisdictions": [ "DE", "FR", "IE", "NL", "LU", "MT", "CY" ] }, { "horizon_id": "fim-reg-2027-001", "title": "EU AML Regulation (2024/1624) / 6AMLD application date", "stage": "adopted", "estimated_impact_date": "2027-Q3", "uncertainty_band": "year", "instrument_type": "regulation", "affected_firm_types": [ "cross_sector" ], "affected_jurisdictions": [ "DE", "FR", "IE", "NL", "LU", "MT", "CY" ] }, { "horizon_id": "fim-reg-2028-001", "title": "AMLA direct supervision of selected obliged entities", "stage": "adopted", "estimated_impact_date": "2028-H1", "uncertainty_band": "multi_year", "instrument_type": "regulation", "affected_firm_types": [ "cross_sector" ], "affected_jurisdictions": [ "DE", "FR", "IE", "NL", "LU", "MT", "CY" ] } ], "total": 8 } }, "horizon_proximity_band": { "banded_items": [ { "horizon_id": "fim-reg-2026-001", "title": "UK ECCTA 2023 failure-to-prevent-fraud offence enforcement maturation", "stage": "in_force", "estimated_impact_date": "2026-Q3", "uncertainty_band": "half_year", "instrument_type": "enforcement_policy", "what_changes": "Large organisations with a UK nexus face strict-liability corporate exposure where an associated person commits a base fraud offence intending to benefit the organisation; the identification-doctrine reform broadens attribution to senior managers.", "primary_source_url": "https://www.gov.uk/government/publications/offence-of-failure-to-prevent-fraud-introduced-by-eccta", "confidence": "High", "source_tier": "1", "affected_firm_types": [ "cross_sector" ], "affected_jurisdictions": [ "GB" ], "urgency_band": "imminent", "obligation_coverage": [ { "framework": "ECCTA2023", "citation_stage": "in_force", "control_gap_signal": null } ] }, { "horizon_id": "fim-reg-2027-001", "title": "EU AML Regulation (2024/1624) / 6AMLD application date", "stage": "adopted", "estimated_impact_date": "2027-Q3", "uncertainty_band": "year", "instrument_type": "regulation", "what_changes": "The single AML rulebook (AMLR) becomes directly applicable and 6AMLD transposition deadlines bite across Member States, with AMLA direct supervision of up to 40 high-risk cross-border groups.", "primary_source_url": "https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-eu-level_en", "confidence": "High", "source_tier": "1", "affected_firm_types": [ "cross_sector" ], "affected_jurisdictions": [ "DE", "FR", "IE", "NL", "LU", "MT", "CY" ], "urgency_band": "medium", "obligation_coverage": [ { "framework": "EU_AMLR", "citation_stage": "adopted", "control_gap_signal": null }, { "framework": "EU_6AMLD", "citation_stage": "adopted", "control_gap_signal": null } ] }, { "horizon_id": "fim-reg-2026-050", "title": "AMLA Work Programme / supervisory build-out", "stage": "in_force_pending", "estimated_impact_date": "2026-H2", "uncertainty_band": "half_year", "instrument_type": "regulation", "what_changes": "AMLA stands up in Frankfurt and publishes its first supervisory methodology, identifying obliged entities eligible for direct supervision.", "primary_source_url": "https://finance.ec.europa.eu/financial-crime/amla_en/", "confidence": "High", "source_tier": "1", "affected_firm_types": [ "cross_sector" ], "affected_jurisdictions": [ "DE", "FR", "IE", "NL", "LU", "MT", "CY" ], "urgency_band": "imminent", "obligation_coverage": [ { "framework": "AMLAReg", "citation_stage": "in_force_pending", "control_gap_signal": null } ] }, { "horizon_id": "fim-reg-2028-001", "title": "AMLA direct supervision of selected obliged entities", "stage": "adopted", "estimated_impact_date": "2028-H1", "uncertainty_band": "multi_year", "instrument_type": "regulation", "what_changes": "AMLA begins direct supervision of a first cohort of high-risk cross-border obliged entities, shifting the supervisory perimeter from purely national authorities to a hybrid EU-level regime.", "primary_source_url": "https://finance.ec.europa.eu/financial-crime/amla_en/", "confidence": "High", "source_tier": "1", "affected_firm_types": [ "cross_sector" ], "affected_jurisdictions": [ "DE", "FR", "IE", "NL", "LU", "MT", "CY" ], "urgency_band": "future", "obligation_coverage": [ { "framework": "AMLAReg", "citation_stage": "adopted", "control_gap_signal": null } ] }, { "horizon_id": "fim-reg-2026-002", "title": "FinCEN Southwest Border GTO expiry/renewal window", "stage": "in_force", "estimated_impact_date": "2026-Q3", "uncertainty_band": "quarter", "instrument_type": "enforcement_policy", "what_changes": "MSBs in covered AZ, CA, NM and TX localities file CTRs for cash transactions $1,000-$10,000; expiry or further expansion alters the reporting perimeter.", "primary_source_url": "https://www.fincen.gov/news/news-releases/fincen-issues-expanded-southwest-border-geographic-targeting-order", "confidence": "High", "source_tier": "1", "affected_firm_types": [ "payment_company", "bank" ], "affected_jurisdictions": [ "US", "MX" ], "urgency_band": "imminent", "obligation_coverage": [ { "framework": "BSA", "citation_stage": "in_force", "control_gap_signal": null } ] }, { "horizon_id": "fim-reg-2026-003", "title": "FinCEN Section 311 Huione Group correspondent-account prohibition finalisation", "stage": "consultation", "estimated_impact_date": "2026-H2", "uncertainty_band": "half_year", "instrument_type": "regulation", "what_changes": "Finalisation would sever Huione Group's US correspondent-banking access; the operating environment shifts as institutions face successor guarantee-marketplace infrastructure.", "primary_source_url": "https://www.fincen.gov/news/news-releases/fincen-finds-cambodia-based-huione-group-be-primary-money-laundering-concern", "confidence": "Assessed", "source_tier": "1", "affected_firm_types": [ "bank", "crypto_asset_operator", "payment_company" ], "affected_jurisdictions": [ "US", "KH" ], "urgency_band": "imminent", "obligation_coverage": [ { "framework": "BSA", "citation_stage": "consultation", "control_gap_signal": null } ] }, { "horizon_id": "fim-reg-2026-004", "title": "UK HM Treasury National Risk Assessment refresh window", "stage": "proposed", "estimated_impact_date": "2026-2027", "uncertainty_band": "year", "instrument_type": "guidance", "what_changes": "Updated UK NRA and EU SNRA will reset national/supra-national risk baselines informing risk-based supervision and obliged-entity risk assessments.", "primary_source_url": "https://www.gov.uk/government/collections/uk-national-risk-assessment-of-money-laundering-and-terrorist-financing", "confidence": "Possible", "source_tier": "1", "affected_firm_types": [ "cross_sector" ], "affected_jurisdictions": [ "GB" ], "urgency_band": "near", "obligation_coverage": [ { "framework": "MLR2017", "citation_stage": "proposed", "control_gap_signal": null } ] }, { "horizon_id": "fim-reg-2026-005", "title": "FATF updated Recommendation 6 humanitarian exemption", "stage": "adopted", "estimated_impact_date": "2026-H2", "uncertainty_band": "half_year", "instrument_type": "technical_standard", "what_changes": "Targeted-financial-sanctions frameworks must accommodate humanitarian carve-outs, altering how obliged entities treat exempt flows.", "primary_source_url": "https://www.fatf-gafi.org/en/publications/Fatfgeneral/outcomes-fatf-plenary-june-2026.html", "confidence": "High", "source_tier": "1", "affected_firm_types": [ "bank", "payment_company", "cross_sector" ], "affected_jurisdictions": [ "US", "GB", "DE", "FR" ], "urgency_band": "imminent", "obligation_coverage": [ { "framework": "FATF_Rec", "citation_stage": "adopted", "control_gap_signal": null } ] } ], "filter_dimensions": { "stage": [ "adopted", "consultation", "in_force", "in_force_pending", "proposed" ], "instrument_type": [ "enforcement_policy", "guidance", "regulation", "technical_standard" ], "affected_firm_types": [ "bank", "cross_sector", "crypto_asset_operator", "payment_company" ], "affected_jurisdictions": [ "CY", "DE", "FR", "GB", "IE", "KH", "LU", "MT", "MX", "NL", "US" ], "date_band": [ "2026-2027", "2026-H2", "2026-Q3", "2027-Q3", "2028-H1" ], "domain_filter_note": "OMITTED: regulatory_horizon[] rows carry no 'domain' key. Domain derivation available in domain_derived_map but must be labelled as derived." }, "domain_derived_map": { "fim-reg-2026-001": { "derived_domain_hints": [ "AML/Fraud" ], "derivation_method": "framework and fatf_recommendations mapping (derived — not a pipeline field)" }, "fim-reg-2027-001": { "derived_domain_hints": [ "AML", "FATF" ], "derivation_method": "framework and fatf_recommendations mapping (derived — not a pipeline field)" }, "fim-reg-2026-050": { "derived_domain_hints": [ "AML", "FATF" ], "derivation_method": "framework and fatf_recommendations mapping (derived — not a pipeline field)" }, "fim-reg-2028-001": { "derived_domain_hints": [ "AML", "FATF" ], "derivation_method": "framework and fatf_recommendations mapping (derived — not a pipeline field)" }, "fim-reg-2026-002": { "derived_domain_hints": [ "AML", "FATF" ], "derivation_method": "framework and fatf_recommendations mapping (derived — not a pipeline field)" }, "fim-reg-2026-003": { "derived_domain_hints": [ "AML", "FATF" ], "derivation_method": "framework and fatf_recommendations mapping (derived — not a pipeline field)" }, "fim-reg-2026-004": { "derived_domain_hints": [ "AML" ], "derivation_method": "framework and fatf_recommendations mapping (derived — not a pipeline field)" }, "fim-reg-2026-005": { "derived_domain_hints": [ "FATF" ], "derivation_method": "framework and fatf_recommendations mapping (derived — not a pipeline field)" } }, "stage_inventory": { "stages_present": [ "adopted", "consultation", "in_force", "in_force_pending", "proposed" ], "stages_absent": [], "all_5_stages_present": true, "note": "All 5 canonical citation_stage values rendered regardless of live count (BRIEF §4 Slice B)." }, "urgency_band_legend": { "imminent": "<=90 days — rendered error-red", "near": "<=180 days — rendered amber", "medium": "<=1 year — rendered gold", "future": ">1 year — rendered faint", "note": "Band is a heuristic from period-form estimated_impact_date + uncertainty_band; uncertainty_band is mandatory." } }, "gap_register": { "coverage_rows": [ { "claim_id": "fim-2026-W26-001", "framework": "OFAC_reg", "citation": "Executive Order 14024", "control_gap_signal": "covered", "pillar": "cross-pillar", "domain": "D1", "fatf_recommendations": [], "obligation_type": "screening", "firm_type_lens": [ "bank", "payment_company", "cross_sector" ] }, { "claim_id": "fim-2026-W26-001", "framework": "OFSI", "citation": "The Russia (Sanctions) (EU Exit) Regulations 2019", "control_gap_signal": "covered", "pillar": "cross-pillar", "domain": "D1", "fatf_recommendations": [], "obligation_type": "screening", "firm_type_lens": [ "bank", "payment_company", "cross_sector" ] }, { "claim_id": "fim-2026-W26-002", "framework": "OFAC_reg", "citation": "Executive Order 14024", "control_gap_signal": "covered", "pillar": "cross-pillar", "domain": "D1", "fatf_recommendations": [], "obligation_type": "screening", "firm_type_lens": [ "bank", "payment_company", "cross_sector" ] }, { "claim_id": "fim-2026-W26-003", "framework": "EU_AMLR", "citation": "Regulation (EU) 2024/1624 (AMLR)", "control_gap_signal": null, "pillar": "AML", "domain": "D2", "fatf_recommendations": [ "R.24", "R.25" ], "obligation_type": "CDD", "firm_type_lens": [ "bank", "crypto_asset_operator", "investment_firm", "cross_sector" ] }, { "claim_id": "fim-2026-W26-003", "framework": "AMLAReg", "citation": "Regulation (EU) 2024/1620 (AMLA Regulation)", "control_gap_signal": null, "pillar": "AML", "domain": "D2", "fatf_recommendations": [ "R.24", "R.25" ], "obligation_type": "governance", "firm_type_lens": [ "bank", "crypto_asset_operator", "investment_firm", "cross_sector" ] }, { "claim_id": "fim-2026-W26-003", "framework": "EU_6AMLD", "citation": "Directive (EU) 2024/1640 (AMLD6)", "control_gap_signal": null, "pillar": "AML", "domain": "D2", "fatf_recommendations": [ "R.24", "R.25" ], "obligation_type": "governance", "firm_type_lens": [ "cross_sector" ] }, { "claim_id": "fim-2026-W26-004", "framework": "BSA", "citation": "USA PATRIOT Act Section 311 (31 USC 5318A)", "control_gap_signal": "covered", "pillar": "AML", "domain": "D3", "fatf_recommendations": [ "R.15" ], "obligation_type": "screening", "firm_type_lens": [ "bank", "crypto_asset_operator", "payment_company" ] }, { "claim_id": "fim-2026-W26-005", "framework": "BSA", "citation": "BSA 31 USC 5326 (Geographic Targeting Order)", "control_gap_signal": "covered", "pillar": "AML", "domain": "D3", "fatf_recommendations": [ "R.20" ], "obligation_type": "reporting", "firm_type_lens": [ "payment_company", "bank" ] }, { "claim_id": "fim-2026-W26-005", "framework": "OFAC_reg", "citation": "Executive Order 14157", "control_gap_signal": "covered", "pillar": "AML", "domain": "D3", "fatf_recommendations": [ "R.20" ], "obligation_type": "screening", "firm_type_lens": [ "bank", "payment_company", "cross_sector" ] }, { "claim_id": "fim-2026-W26-007", "framework": "FATF_Rec", "citation": "R.1", "control_gap_signal": "partial", "pillar": "cross-pillar", "domain": "D3", "fatf_recommendations": [ "R.1" ], "obligation_type": "governance", "firm_type_lens": [ "cross_sector" ] }, { "claim_id": "fim-2026-W26-008", "framework": "FATF_Rec", "citation": "R.15", "control_gap_signal": "partial", "pillar": "cross-pillar", "domain": "D5", "fatf_recommendations": [ "R.15", "R.16" ], "obligation_type": "governance", "firm_type_lens": [ "crypto_asset_operator" ] }, { "claim_id": "fim-2026-W26-008", "framework": "FATF_Rec", "citation": "R.16", "control_gap_signal": "partial", "pillar": "cross-pillar", "domain": "D5", "fatf_recommendations": [ "R.15", "R.16" ], "obligation_type": "record_keeping", "firm_type_lens": [ "crypto_asset_operator" ] }, { "claim_id": "fim-2026-W26-009", "framework": "FATF_Rec", "citation": "R.6", "control_gap_signal": "covered", "pillar": "CTF", "domain": "D5", "fatf_recommendations": [ "R.6" ], "obligation_type": "screening", "firm_type_lens": [ "crypto_asset_operator", "payment_company", "bank" ] }, { "claim_id": "fim-2026-W26-010", "framework": "BSA", "citation": "BSA 31 USC 5318(h)", "control_gap_signal": "partial", "pillar": "cross-pillar", "domain": "D6", "fatf_recommendations": [ "R.1" ], "obligation_type": "governance", "firm_type_lens": [ "bank", "cross_sector" ] }, { "claim_id": "fim-2026-W26-010", "framework": "MLR2017", "citation": "MLR 2017 Reg 18 (risk assessment)", "control_gap_signal": "partial", "pillar": "cross-pillar", "domain": "D6", "fatf_recommendations": [ "R.1" ], "obligation_type": "governance", "firm_type_lens": [ "bank", "payment_company", "cross_sector" ] } ], "coverage_summary": { "covered": 7, "partial": 5, "uncovered": 0, "null": 3, "total": 15 }, "action_rail": [ { "gap_id": "fim-int-2026-06-25-G001", "description": "Direct DOJ/FBI primary press release for the 23 June 2026 Huione cloud-infrastructure seizure was not captured; current evidence relies on T2 Elliptic plus historical T1 FinCEN Section 311, weakening current-cycle corroboration for the seizure event.", "enforcement_correlated": true, "correlated_action_ids": [ "fbi-huione-2026-06" ] }, { "gap_id": "fim-int-2026-06-25-G002", "description": "T1 OFAC primary press release for the 22 June 2026 ISIS crypto/MSB designations was not directly captured; the claim rests on a single T2 vendor (Chainalysis) characterisation, holding confidence at Assessed.", "enforcement_correlated": true, "correlated_action_ids": [ "fbi-huione-2026-06" ] }, { "gap_id": "fim-int-2026-06-25-G004", "description": "Per-Member-State 6AMLD (Directive (EU) 2024/1640) transposition status for the AMLA-supervision-priority jurisdictions (DE, FR, IE, NL, LU, MT, CY) was not established this cycle; divergent transposition is itself a regime-divergence signal.", "enforcement_correlated": true, "correlated_action_ids": [ "fbi-huione-2026-06", "fincen-sinaloa-casinos-2026-03" ] }, { "gap_id": "fim-int-2026-06-25-G003", "description": "No current Colombia National Risk Assessment citation was collected this cycle; UNODC IFF estimates are 2015-2019 historical baseline, limiting a current-cycle risk delta for CO.", "enforcement_correlated": false, "correlated_action_ids": [] }, { "gap_id": "fim-int-2026-06-25-G005", "description": "No fresh primary RegTech/model-risk instrument was collected for D6; the supervisory-expectation gap for AI/ML monitoring validation and agentic compliance tooling remains analytical synthesis rather than a documented jurisdiction-bound instrument.", "enforcement_correlated": false, "correlated_action_ids": [] }, { "gap_id": "fim-int-2026-06-25-G006", "description": "Pacific and Central Asia coverage remained thin this cycle (Papua New Guinea deferred FATF reporting); regional balance correction incomplete for these under-covered TBML/corruption geographies.", "enforcement_correlated": false, "correlated_action_ids": [] } ], "gap_ref_count": 5, "gap_frameworks": [ "BSA", "FATF_Rec", "MLR2017" ], "framework_chips": [ "AMLAReg", "BSA", "EU_6AMLD", "EU_AMLR", "FATF_Rec", "MLR2017", "OFAC_reg", "OFSI" ], "total_obligation_refs": 15, "real_action_ids_available": [ "fbi-huione-2026-06", "fincen-sinaloa-casinos-2026-03" ], "note": "Coverage state derived from structured_claims[].obligation_refs[].control_gap_signal; gaps from gaps_register[]." }, "scenario_panel": { "scenarios": [ { "source": "scenario_sketches", "sketch_id": "fim-scn-2026-W26-001", "title": "AMLA Supervisory Transition and Residual Arbitrage Window", "narrative": "As AMLA moves from establishment to operational supervisory build-out, a transitional period exists between the AMLR application date (2027) and the commencement of AMLA direct supervision (2028). During this window, the single AML rulebook becomes binding but the supervisory authority over the highest-risk cross-border groups remains primarily with national competent authorities. An illustrative structural risk is that obliged entities — particularly those in the direct-supervision eligibility cohort — may face divergent supervisory expectations from national authorities applying the AMLR through different interpretive lenses, before AMLA direct supervision imposes a uniform EU-level standard. The per-Member-State 6AMLD transposition trajectory adds a further layer of divergence: Member States transposing 6AMLD at different speeds and with different national discretions may create a patchwork supervisory environment that sophisticated obliged entities could navigate to minimise supervisory intensity. The architecture-over-incident reading is that the 2027-2028 transitional window is itself a structural feature of the EU AML Package design — a managed transition rather than an oversight — and that the compliance-function priority is calibrating to the AMLR single rulebook while preparing for the supervisory relationship with AMLA that begins in 2028.", "disclaimer": "Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.", "related_typology_refs": [] }, { "source": "scenario_sketches", "sketch_id": "fim-scn-2026-W26-002", "title": "Cross-Jurisdiction Sanctions Arbitrage via Managed Divergence Architecture", "narrative": "The codification of the OFAC-OFSI divergence architecture in the June 2026 Comparative Overview creates a documented reference point for intermediaries seeking to structure cross-jurisdiction transactions to minimise aggregate sanctions exposure. An illustrative structural risk is that a sophisticated intermediary — a correspondent bank or trade-finance house operating across both regimes — could calibrate its transaction-structuring to exploit the gap between OFAC's jurisdiction-based blocking model and OFSI's breach-and-asset-freeze model. Transactions that do not involve US persons or US-dollar clearing may avoid OFAC blocking obligations while also falling below OFSI's asset-freeze threshold if the designated person's UK-reachable assets are limited. The EU's absence from the bilateral instrument means that EU-based intermediaries face a third, distinct sanctions architecture that may create further structuring opportunities. The architecture-over-incident reading is that the managed-divergence posture is a durable feature of the trilateral sanctions landscape, and that the compliance-function priority is mapping the specific transaction types and customer segments most exposed to the arbitrage surface created by the divergence.", "disclaimer": "Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.", "related_typology_refs": [] }, { "source": "scenario_sketches", "sketch_id": "fim-scn-2026-W26-003", "title": "Guarantee-Marketplace Infrastructure Persistence Post-Enforcement", "narrative": "The Huione-to-Xinbi transition illustrates an illustrative structural pattern in illicit finance infrastructure: enforcement actions that remove a primary node — through seizure, designation, or arrest — do not degrade the underlying infrastructure model if the model is replicable and the demand it serves persists. An illustrative forward-looking risk is that the guarantee-marketplace model will continue to evolve through successor platforms beyond Xinbi, each inheriting the operational architecture of its predecessor while adapting its technical and corporate structure to avoid the specific vulnerabilities that led to the predecessor's takedown. The FinCEN Section 311 Huione Group correspondent-account prohibition, when finalised, will sever US correspondent-banking access for the designated entity but may not address successor platforms that have not yet been designated. The architecture-over-incident reading is that the compliance-function priority is not monitoring for Huione or Xinbi specifically, but calibrating transaction-monitoring and screening systems to detect the guarantee-marketplace model's red-flag indicators — high-volume crypto inflows to platforms with opaque counterparty structures, payments-arm volumes inconsistent with stated business profiles — regardless of which platform is currently leading the ecosystem.", "disclaimer": "Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.", "related_typology_refs": [] }, { "source": "typology_scenarios", "scenario_id": "fim-tscn-2026-W26-001", "typology_id": "fim-typ-007", "layering_flow": "Illustrative step-sequence: 1. Cartel cash placed through MSB in designated southwest-border county at sub-$1,000 structured amounts to avoid GTO reporting threshold. 2. Funds aggregated through shell-company trade-finance accounts with offsetting import/export documentation. 3. Mirror transfers executed between PRC-linked counterparties and US-side accounts, with no apparent economic rationale. 4. Proceeds converted to crypto through CMLN-linked on-ramp and transferred to guarantee-marketplace platform. 5. Crypto withdrawn through successor platform (Xinbi-model) to obscure origin. Illustration only, not observation.", "disclaimer": "Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact." }, { "source": "typology_scenarios", "scenario_id": "fim-tscn-2026-W26-002", "typology_id": "fim-typ-007", "layering_flow": "Illustrative step-sequence: 1. ISIS donor in European jurisdiction transfers funds through hawala network to Turkish MSB. 2. Turkish MSB converts funds to TRON-based crypto and transfers to Syria-based crypto exchange. 3. Syria-based exchange routes funds through Nigerian bureau de change for cash-out or onward transfer. 4. Proceeds used to fund operational activities across MENA corridor. 5. On-chain TRON wallet addresses provide blockchain-native screening surface for crypto-asset operators. Illustration only, not observation.", "disclaimer": "Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact." } ], "scenarios_dropped_no_disclaimer": 0, "typology_library_catalogue": [ { "typology_id": "fim-typ-001", "name": "Proxy Transfer to Sanctioned-Person Associates", "aliases": [ "asset transfer to family members", "designated-person proxy layering", "straw-man asset transfer" ], "definition": "A sanctioned or soon-to-be-designated person transfers beneficial ownership of legal entities, real property, or financial assets to family members, close associates, or trusted proxies, often in the period immediately preceding or following designation, to maintain de facto control while avoiding asset-freeze obligations. The true controller continues to exercise influence through informal arrangements or power of attorney.", "category": "sanctions_evasion", "indicators": [ "Asset transfers to family members or close associates timed within 30–90 days before or after a sanctions designation", "Newly registered entities with family members or associates of known PEPs or designated persons as directors or UBOs", "Power of attorney or side-letter arrangements granting control to an undesignated natural person where beneficial ownership record names a relative", "Purchase or sale of high-value assets (real estate, yachts, aircraft, luxury goods) by entities with opaque ownership linked to sanctioned-jurisdiction nationals", "Wire transfers from accounts linked to family members of designated persons to offshore accounts without commercial rationale", "Insurance policies on high-value assets transferred or terminated shortly after designation events" ], "actor_categories": [ "A1", "A2" ], "typical_jurisdictions": [ "RU", "AE", "TR", "GE", "AM", "RS", "AZ" ], "instruments_exploited": [ "shell company", "trust", "nominee directorship", "real estate", "SLP", "correspondent account" ], "pillar": [ "AML", "CPF" ], "domain_refs": [ "D1", "D2" ], "confidence": "High", "primary_source_url": "https://home.treasury.gov/system/files/136/REPO_Joint_Advisory.pdf", "source_tier": 1, "lifecycle": "established", "provenance": "research-derived", "ratification_status": "ratified", "notes": "Fully documented in the G7 REPO Task Force joint advisory (March 2023). Multiple confirmed enforcement actions by DOJ and OFAC cited within source. Overlaps with D2 (BO opacity) because proxy structures are also beneficial-ownership concealment vehicles. Strong cross-domain intelligence value.", "observed_this_cycle": false }, { "typology_id": "fim-typ-002", "name": "Shadow Fleet Maritime Sanctions Circumvention", "aliases": [ "dark fleet oil trading", "ghost tanker sanctions evasion", "flag-hopping vessel network" ], "definition": "Sanctioned-regime commodity exporters (primarily Russian, Iranian, and Venezuelan oil and gas) use networks of aging tankers with deliberately obscured ownership structures — routinely reflagged in permissive registries, renamed, and insured through shell entities — to transport prohibited cargoes to willing buyers while bypassing Western financial infrastructure. Front companies with limited trading history process payments through complex multi-hop wire transfers between obscure entities registered in non-sanctions-implementing jurisdictions.", "category": "sanctions_evasion", "indicators": [ "Companies with minimal or no trading history rapidly processing large-volume oil transactions", "Limited or absent beneficial ownership information, absent directors or beneficiary data on corporate records", "Multiple rapid transfers between shell companies with no clear commercial purpose across high-risk jurisdictions", "Vessel AIS transponder disabled or manipulated during port calls or transit through sensitive areas", "Vessel recently renamed, reflagged to open-registry jurisdiction, or transferred to new owner with opaque offshore registration", "Insurance coverage through captive or shell insurer not affiliated with International Group P&I clubs", "Corporate website contains only generic stock images with no named personnel or contact details", "Freight rates materially below market for type and age of vessel, consistent with discounted sanctioned-commodity pricing", "Payment routing through jurisdictions known to host shadow-fleet operating entities (e.g., TR, AE, IN, CN, KH)" ], "actor_categories": [ "A1", "A2", "A3" ], "typical_jurisdictions": [ "RU", "IR", "VE", "AE", "TR", "IN", "CN", "KH", "PA", "MH" ], "instruments_exploited": [ "shell company", "free-zone entity", "correspondent account", "nominee directorship", "freight-forwarding front" ], "pillar": [ "AML", "CPF" ], "domain_refs": [ "D1" ], "confidence": "High", "primary_source_url": "https://www.gov.je/gazette/pages/neccredalert03july2025.aspx", "source_tier": 1, "lifecycle": "emerging", "provenance": "research-derived", "ratification_status": "ratified", "notes": "Documented in NCA/OFSI/FCDO joint Red Alert issued 2 July 2025; further elaborated in NCA Amber Alert (December 2025) covering DPRK, Iran and Russia. FATF June 2025 proliferation financing report independently identifies maritime sector exploitation as one of four core typologies. Highly active in 2024–2026 period. Observer should also cross-reference FATF (June 2025) Complex Proliferation Financing and Sanctions Evasion Schemes report.", "observed_this_cycle": false }, { "typology_id": "fim-typ-003", "name": "Dual-Use Goods Procurement Network (DPRK/Iran Pattern)", "aliases": [ "WMD procurement front network", "proliferation goods transshipment", "third-country goods diversion" ], "definition": "State-linked actors seeking WMD components or dual-use technology establish networks of front and shell companies — typically registered in non-sanctioned third-country jurisdictions and managed by local agents — to procure restricted goods through indirect supply chains. Payments are structured through trade-based layering using natural-resource exports (e.g., coal, seafood, textiles) as the economic rationale, with funds cycled through front companies that share addresses, phone numbers, and personnel before reaching the sanctioned end-user.", "category": "proliferation_financing", "indicators": [ "Company shows no website, no stated business purpose, yet processes large-value wire transfers for diverse unrelated product lines", "Corporate address shared by multiple apparently unrelated entities, one of which is linked to a sanctioned jurisdiction", "Natural-resource export contracts (coal, seafood, minerals) involving entities registered near DPRK border provinces (e.g., Liaoning, China)", "Payment cycling in which Company A pays a beneficiary, then ceases and a co-addressed Company B begins paying the same beneficiary", "Corporate officers appearing as authorized signatories across multiple nominally unrelated companies", "Wire transfers that reference natural-resource purchases but accompanying trade documents show unrelated commodity categories", "Transactions involving jurisdictions identified in UN Panel of Experts reports as transshipment nodes for WMD-related goods", "Sudden surge in account activity followed by prolonged dormancy, consistent with front-company cycling" ], "actor_categories": [ "A1", "A2" ], "typical_jurisdictions": [ "KP", "IR", "CN", "HK", "SG", "MH", "VU", "AE" ], "instruments_exploited": [ "front company", "shell company", "correspondent account", "trade finance document" ], "pillar": [ "CPF", "AML" ], "domain_refs": [ "D1" ], "confidence": "High", "primary_source_url": "https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2017-a007", "source_tier": 1, "lifecycle": "established", "provenance": "research-derived", "ratification_status": "ratified", "notes": "Primary source is FinCEN Advisory FIN-2017-A007 (September 2017) on DPRK WMD financing networks using China-based front companies. Patterns corroborated by multiple UN Panel of Experts reports on DPRK. FATF June 2025 report identifies this as one of four core proliferation financing typologies. DPRK remains the most significant actor per FATF 2025.", "observed_this_cycle": false }, { "typology_id": "fim-typ-004", "name": "Nominee Layered Shell-Company Beneficial Ownership Concealment", "aliases": [ "multi-jurisdictional shell layering", "nominee director BO concealment", "straw-man ownership chain" ], "definition": "Criminals and corrupt actors conceal the true beneficial owner of assets or entities by interposing multiple layers of shell companies across several jurisdictions, with each layer using nominee directors and shareholders — often informal nominees (spouses, family members, associates) — to obscure the chain of ownership. Legal professional privilege, trust and company service providers (TCSPs), and legal arrangements such as offshore trusts may be added to further insulate the ultimate beneficial owner from detection.", "category": "BO_opacity", "indicators": [ "Corporate structure comprises three or more layers of legal entities across multiple jurisdictions with no discernible commercial rationale for the complexity", "Nominee directors or shareholders are family members, domestic employees, or individuals appearing across many unrelated companies", "Registered address is a mass-formation or virtual-office address associated with a TCSP", "Bearer shares or opaque ownership instruments with no recorded transfer history", "Sudden change of directors, shareholders, or registered jurisdiction in the period before a major transaction or anticipated regulatory action", "Power of attorney granted to a third party who is not named as a director or owner", "Legal professional trust or client account used to settle transactions without disclosure of underlying beneficiary", "Entity domiciled in a jurisdiction with no public beneficial-ownership register and no CDD requirements for company formation" ], "actor_categories": [ "A1", "A2" ], "typical_jurisdictions": [ "VG", "KY", "PA", "BZ", "SC", "JE", "GG", "IM", "LI" ], "instruments_exploited": [ "shell company", "shelf company", "trust", "nominee directorship", "bearer share", "legal trust account", "SLP" ], "pillar": [ "AML" ], "domain_refs": [ "D2", "D3" ], "confidence": "High", "primary_source_url": "https://egmontgroup.org/wp-content/uploads/2021/09/2018_Concealment_of_Beneficial_Ownership.pdf", "source_tier": 1, "lifecycle": "established", "provenance": "research-derived", "ratification_status": "ratified", "notes": "Joint FATF–Egmont Group report (2018) based on analysis of 106 case studies. Report identifies shell companies as the dominant vehicle and TCSPs as the most prevalent professional intermediary sector. Average laundered sum per case exceeded USD 500 million. Directly underpins FATF Recommendation 24/25 reforms.", "observed_this_cycle": false }, { "typology_id": "fim-typ-005", "name": "Trust and Company Service Provider (TCSP) Facilitated Layering", "aliases": [ "company factory laundering", "offshore service provider structuring", "TCSP complicit enablement" ], "definition": "Professional TCSPs provide mass incorporation, nominee director/shareholder services, registered-office provision, and bank-account introduction services across multiple jurisdictions to clients whose ultimate beneficial ownership and source of funds are concealed. TCSPs may operate with wilful blindness or complicity, accepting clients from other professional intermediaries in different countries without performing independent CDD, thereby creating multi-jurisdictional opacity.", "category": "BO_opacity", "indicators": [ "TCSP-introduced entity has no independently verifiable business purpose or operations", "TCSP provides nominees from a pool of professional directors appearing across dozens of companies in multiple jurisdictions", "Bank-account introduction letters issued by TCSP for entities whose UBO the TCSP cannot identify", "TCSP receives instructions exclusively through an intermediary (attorney or accountant) in a different jurisdiction without direct client contact", "Multiple TCSPs in different jurisdictions used sequentially in the same scheme (TCSP layering)", "Registered office address appears on company registers of more than 50 unrelated entities", "TCSP jurisdiction has no AML/CFT supervision for TCSPs or does not enforce FATF Recommendation 28" ], "actor_categories": [ "A2" ], "typical_jurisdictions": [ "VG", "KY", "SC", "PA", "BZ", "CY", "MT", "HK", "NZ" ], "instruments_exploited": [ "shell company", "shelf company", "nominee directorship", "trust", "registered-office service" ], "pillar": [ "AML" ], "domain_refs": [ "D2", "D3" ], "confidence": "High", "primary_source_url": "https://egmontgroup.org/wp-content/uploads/2021/09/2018_Concealment_of_Beneficial_Ownership.pdf", "source_tier": 1, "lifecycle": "established", "provenance": "research-derived", "ratification_status": "ratified", "notes": "Sourced from same FATF–Egmont 2018 Concealment of Beneficial Ownership report. TCSPs represented the highest proportion of professional intermediaries in the 106 case studies; wilful blindness was the most common complicity mode. Observer may wish to create a combined D2/D3 entry or keep separate to maintain domain granularity.", "observed_this_cycle": false }, { "typology_id": "fim-typ-006", "name": "Legal Professional Privilege Exploitation for Asset Concealment", "aliases": [ "lawyer-facilitated BO concealment", "solicitor account laundering", "LPP shield layering" ], "definition": "Legal professionals — lawyers, notaries, and independent legal practitioners — are used to hold client funds in trust accounts, manage beneficial-ownership arrangements, and provide advice that insulates criminal proceeds behind legal professional privilege (LPP). The LPP shield creates a practical barrier to disclosure obligations, allowing the arrangement to appear as legitimate legal work product while the underlying asset or beneficiary is concealed.", "category": "BO_opacity", "indicators": [ "High-value funds passing through solicitor or notary client account without an underlying identifiable transaction or litigation matter", "Legal professional unable or unwilling to identify the source of funds or ultimate beneficiary when requested by a financial institution", "Legal trust account used as pass-through: funds received and rapidly re-transmitted to unrelated third parties in multiple jurisdictions", "Attorney or notary domiciled in a jurisdiction that has not subjected legal professionals to AML/CFT obligations", "Engagement letter scope covers only a narrow legal task but account flows show much broader financial activity", "Multiple lawyers in the same jurisdiction used consecutively for what appears to be a single scheme (lawyer-shopping)" ], "actor_categories": [ "A1", "A2" ], "typical_jurisdictions": [ "GB", "US", "CH", "AE", "CY", "LU", "HK", "SG" ], "instruments_exploited": [ "legal trust account", "shell company", "real estate", "client account" ], "pillar": [ "AML" ], "domain_refs": [ "D2", "D3" ], "confidence": "High", "primary_source_url": "https://egmontgroup.org/wp-content/uploads/2021/09/2018_Concealment_of_Beneficial_Ownership.pdf", "source_tier": 1, "lifecycle": "established", "provenance": "research-derived", "notes": "FATF–Egmont 2018 report identifies lawyers as more involved in real-estate acquisition for ML than other intermediary sectors. LPP identified as a structural barrier to BO transparency in multiple mutual evaluation reports. NCA High-End Money Laundering Strategy (published at nationalcrimeagency.gov.uk) corroborates the enabler dynamic. ratification_status field corrected below.", "ratification_status": "ratified", "observed_this_cycle": false }, { "typology_id": "fim-typ-007", "name": "Free-Trade Zone Invoice Manipulation (TBML)", "aliases": [ "FTZ TBML", "special economic zone trade fraud", "free-zone re-invoicing scheme" ], "definition": "Illicit actors exploit the reduced customs scrutiny and document verification standards in free-trade zones (FTZs) or special economic zones (SEZs) to re-invoice goods, alter trade documentation, or conduct phantom shipments, thereby transferring value across borders under the guise of legitimate commerce. FTZs allow goods to enter, be re-labeled, and exit without the documentation requirements applied to normal international trade, making them structurally vulnerable to trade-based money laundering.", "category": "TBML", "indicators": [ "Trade routes that pass through FTZs or SEZs without an obvious commercial rationale for the transit", "Significant discrepancy between declared export value and declared import value for the same consignment in partner-country customs data", "Invoice price materially above or below commodity-benchmarked market prices for the goods described", "Multiple invoices issued for a single shipment, or invoices from apparently unrelated entities for the same goods", "Bill of lading date or cargo weight inconsistent with contemporaneous shipping or port records", "Front companies acting as trade broker or intermediary without verifiable operational capacity (no warehouse, no staff, new registration)", "Payment terms inconsistent with the declared nature of the transaction (e.g., full advance payment for bulk commodity to a newly registered counterparty)", "Trade counterparties registered in jurisdictions on FATF grey/black lists or subject to targeted sanctions" ], "actor_categories": [ "A3", "A2" ], "typical_jurisdictions": [ "AE", "HK", "PK", "CN", "MX", "CO", "PA", "TR", "KH", "LA" ], "instruments_exploited": [ "free-zone entity", "correspondent account", "trade finance document", "front company", "letter of credit" ], "pillar": [ "AML", "CTF" ], "domain_refs": [ "D3" ], "confidence": "High", "primary_source_url": "https://home.treasury.gov/system/files/246/best-practices-paper-Trade-based-ML-062008.pdf", "source_tier": 1, "lifecycle": "established", "provenance": "research-derived", "ratification_status": "ratified", "notes": "Primary source is the FATF Best Practices Paper on Trade-Based Money Laundering (June 2008), with further typologies codified in the FATF-Egmont joint report on TBML (2020). FTZ vulnerability specifically called out in JMLSG sector guidance (September 2021). Planned-domain hint: TBML is a strong candidate for a standalone D6 domain given volume; current domain_refs assign D3 as closest match. Observer should review FATF 2020 TBML update for additional indicators.", "observed_this_cycle": false }, { "typology_id": "fim-typ-008", "name": "Over- and Under-Invoicing of Goods", "aliases": [ "invoice mispricing", "trade misinvoicing", "over-invoicing import scheme" ], "definition": "A trader deliberately misrepresents the price, quantity, or quality of goods on trade invoices to transfer value across borders without triggering financial controls. Over-invoicing imports allows capital to be moved from the importing country to the exporting country; under-invoicing exports achieves the reverse. The technique requires at least tacit coordination between the trading parties and is facilitated by weak customs verification.", "category": "TBML", "indicators": [ "Invoice unit price deviates materially from published market benchmarks or comparable arm's-length transactions for the same commodity", "Declared import or export value for a commodity inconsistent with data from trade partner customs authorities (mirror data discrepancy)", "Goods described as high-value items (electronics, vehicles, metals) traded between related or affiliated parties at atypical prices", "Multiple invoices from different entities for the same shipment at varying prices", "Commodity most likely to be used in misinvoicing: cars/transport, metals/minerals, agricultural products, textiles (consistent with FATF risk sectors)", "Counterparty located in a jurisdiction on FATF high-risk list or identified as a known TBML hub", "Payment method inconsistent with trade value (e.g., full advance cash payment for large commodity shipment to unknown counterparty)" ], "actor_categories": [ "A3", "A2" ], "typical_jurisdictions": [ "MX", "CO", "CN", "AE", "TR", "IN", "HK", "PK" ], "instruments_exploited": [ "trade finance document", "correspondent account", "front company", "letter of credit" ], "pillar": [ "AML" ], "domain_refs": [ "D3" ], "confidence": "High", "primary_source_url": "https://home.treasury.gov/system/files/246/best-practices-paper-Trade-based-ML-062008.pdf", "source_tier": 1, "lifecycle": "established", "provenance": "research-derived", "ratification_status": "ratified", "notes": "Core TBML method documented in FATF (2006, 2008, 2020) typology reports. Global Financial Integrity (2023) mapped over $60 billion in TBML cases 2011–2021, identifying misinvoicing as the most prevalent mechanism. Phantom shipments (no goods delivered at all) are a closely related variant; BoL/shipping record anomalies are a key indicator. planned_domain_hint: misinvoicing is sufficiently distinct to warrant its own entry under a prospective D6 (TBML standalone axis).", "observed_this_cycle": false }, { "typology_id": "fim-typ-009", "name": "Russian Export Control Evasion via Third-Country Transshipment", "aliases": [ "dual-use goods diversion", "export control triangulation", "commodity-of-concern transshipment" ], "definition": "Sanctioned end-users in Russia procure export-controlled or dual-use goods (electronics, semiconductors, military components) by routing purchases through freight-forwarding entities in third-country jurisdictions, which are listed as the final destination on export documentation. The goods are then re-exported to Russia, with the intermediate entity providing false bill-of-lading information and other supporting trade documents to conceal the true final destination.", "category": "sanctions_evasion", "indicators": [ "Final destination on export documentation is a freight-forwarding or logistics entity in a third country with no history in the relevant goods sector", "Declared commodity description does not match the harmonised tariff code or the stated business of the consignee", "Goods described as high-risk per published commodity-of-concern lists (advanced semiconductors, drone components, night-vision optics)", "Transshipment hub jurisdictions known to be used for Russian rerouting (e.g., AM, AZ, GE, KZ, TR, AE, RS)", "Sudden spike in exports of controlled goods from the domestic jurisdiction to a third country with no prior trade relationship in those goods", "Trade documentation contains inconsistencies in dates, HS codes, or shipper details across related documents (invoice, packing list, bill of lading)", "Payment via newly established account or non-bank financial institution in a jurisdiction outside of main trading-partner list" ], "actor_categories": [ "A1", "A2", "A3" ], "typical_jurisdictions": [ "RU", "AM", "AZ", "GE", "KZ", "TR", "AE", "RS", "CN", "HK" ], "instruments_exploited": [ "front company", "shell company", "trade finance document", "freight-forwarding entity", "correspondent account" ], "pillar": [ "AML", "CPF" ], "domain_refs": [ "D1" ], "confidence": "High", "primary_source_url": "https://www.fincen.gov/system/files/shared/FTA_Russian_Export_Controls_FINAL_508.pdf", "source_tier": 1, "lifecycle": "emerging", "provenance": "research-derived", "ratification_status": "ratified", "notes": "FinCEN Financial Trend Analysis (2023) based on BSA data June 2022–July 2023. G7 REPO Advisory (March 2023) independently documents the same typology. Overlaps with D1 (sanctions) and D3 (enabler jurisdictions as transshipment hubs). OFAC and BIS maintain commodity-of-concern lists that define the specific goods targeted. Observer should note the third-country node states are frequently non-implementing for Western sanctions.", "observed_this_cycle": false }, { "typology_id": "fim-typ-010", "name": "Artisanal Gold Laundering via Conflict-Zone Supply Chains", "aliases": [ "conflict gold laundering", "ASGM illicit supply chain", "gold trafficking BO laundering" ], "definition": "Artisanal and small-scale gold mining (ASGM) output from conflict-affected areas — where armed groups tax, extort, or directly control mining operations — enters legitimate global refinery and commodity markets through a chain of unlicensed local buyers, high-profile regional traffickers, and international trading hubs. Gold is laundered by under-declaring export values, misrepresenting origin and purity, forging certification documentation, bribing officials to issue compliance certificates, and routing gold through trading hubs with large legitimate markets that lack origin-tracing requirements.", "category": "placement", "indicators": [ "Declared export value per kilogram of gold materially below the London Bullion Market Association spot price for the declared purity", "Large discrepancy between gold quantity reported as exported by the country of origin and gold quantity reported as imported by the destination country (mirror-data gap)", "Gold originating from Sahel, DRC, CAR, Sudan, or South Sudan routed through UAE, Switzerland, or Turkey with no independently verifiable chain-of-custody documentation", "Certification documentation from schemes (e.g., ITSCI bag-and-tag) where field verification of mine-site compliance is absent or minimal", "Exporting entity registered as a gold dealer or trading company with no independently verifiable physical premises or operational staff", "Gold declared as doré (unrefined) but priced at refined-gold parity, or vice versa", "Evidence of armed-group taxation points, protection arrangements, or physical control at or near declared mine sites", "Payments to artisanal miners or local buyers made in cash or informal value transfer systems with no paper trail" ], "actor_categories": [ "A6", "A3", "A2" ], "typical_jurisdictions": [ "CD", "ML", "BF", "NE", "TD", "SS", "SD", "CF", "AE", "CH", "TR", "UG", "RW" ], "instruments_exploited": [ "front company", "cash", "informal value transfer", "trade finance document", "free-zone entity" ], "pillar": [ "AML", "CTF" ], "domain_refs": [ "D4" ], "confidence": "High", "primary_source_url": "https://www.unodc.org/documents/data-and-analysis/tocta_sahel/TOCTA_Sahel_Gold_v5.pdf", "source_tier": 1, "lifecycle": "established", "provenance": "research-derived", "ratification_status": "ratified", "notes": "UNODC TOCTA Sahel Gold Trafficking report (2023) provides the primary framework. Corroborated by Global Witness (2009, 2022) DRC conflict minerals investigations. UAE imports declared as exceeding Sahel country declared exports by multiples (e.g., UAE imported 80,986 kg from Mali in 2019 vs. Mali declaring 567 kg of exports). GIABA MER reports on Burkina Faso, Mali, and Niger provide additional D4 anchor. Observer should note the D4 corpus is structurally thinner than D1–D3.", "observed_this_cycle": false }, { "typology_id": "fim-typ-011", "name": "Conflict Mineral Certification Fraud (3T Metals)", "aliases": [ "mineral laundering through certification scheme", "bag-and-tag fraud", "conflict-free certification abuse" ], "definition": "Armed groups or their commercial intermediaries launder minerals from conflict-affected and high-risk areas (CAHRAs) by infiltrating or corrupting mineral certification and tagging schemes designed to verify conflict-free sourcing. Minerals extracted from armed-group-controlled or unlicensed sites are mixed with legitimately sourced minerals at aggregation points or certified sites, enabling them to obtain legitimate traceability documentation (bag-and-tag certificates, chain-of-custody records) and enter international supply chains. Corruption of field monitors or customs officials is a key enabler.", "category": "placement", "indicators": [ "Large volumes of minerals entering a certification scheme from a site or region where field verification coverage is minimal or absent", "Certification records showing mine-site origin that is inconsistent with known licensed-mining operations in the area", "Miners or local traders presenting certification documents for quantities exceeding plausible production capacity of the declared site", "Field monitors employed by certification scheme have financial or personal relationships with local traders or armed-group intermediaries", "Customs declarations for certified minerals inconsistent with quantities certified (over- or under-reporting at export)", "Sudden spike in certified export volumes from a region following degradation in government security or expansion of armed-group territory", "Minerals declared as originating in one country but physical evidence (ore composition, isotope profile) consistent with different origin" ], "actor_categories": [ "A6", "A3", "A2" ], "typical_jurisdictions": [ "CD", "RW", "BI", "UG", "CF", "TZ", "AE", "BE", "DE" ], "instruments_exploited": [ "certification document", "front company", "trade finance document", "cash" ], "pillar": [ "AML", "CTF" ], "domain_refs": [ "D4" ], "confidence": "Assessed", "primary_source_url": "https://www.oecd.org/content/dam/oecd/en/publications/reports/2016/04/oecd-due-diligence-guidance-for-responsible-supply-chains-of-minerals-from-conflict-affected-and-high-risk-areas_g1g65996/9789264252479-en.pdf", "source_tier": 1, "lifecycle": "established", "provenance": "research-derived", "ratification_status": "ratified", "notes": "Global Witness (2022) documented systemic certification failures in the ITSCI scheme used by Apple, Intel, Tesla and others; found up to 90% of minerals at some sites did not meet standards. Global Witness (2009) first established company links to DRC armed groups. Observer should note source is Tier 2 (Global Witness NGO); a Tier 1 anchor may be available in OECD Due Diligence Guidance for Responsible Mineral Supply Chains (5th ed., 2016) or a GIABA extractives MER. OBSERVER-SHOULD-VERIFY additional Tier 1 URL if required. [Architect URL cure 2026-06-14: OECD Due Diligence Guidance for Responsible Supply Chains of Minerals (Tier-1). Global Witness (2022) retained as corroborating notes.]", "observed_this_cycle": false }, { "typology_id": "fim-typ-012", "name": "Armed Group Revenue Extraction from Extractive Industries", "aliases": [ "conflict resource taxation", "militia mine levies", "armed actor extortion of extractive sector" ], "definition": "Non-state armed groups, including jihadist and militia organizations, generate revenue by imposing taxation, protection fees, or forced labour arrangements on artisanal miners and mining site operators in territory they control or influence. Proceeds are integrated into the regional economy through local gold, mineral, and commodity trading networks and may be laundered through parallel financing systems, informal remittance channels, or prefinancing arrangements with high-profile traffickers who provide working capital in exchange for preferential access to mine output.", "category": "terrorist_financing", "indicators": [ "Mining site located within geographic perimeter associated with armed-group activity per publicly available conflict-incident databases (ACLED etc.)", "Local mine operators making unexplained payments to non-government actors at access checkpoints documented by field investigators or satellite imagery", "Prefinancing arrangements with unidentified external investors who take possession of gold output without commercial documentation", "Informal money transfers between mining communities and known terrorist-financing jurisdictions without verifiable commercial purpose", "Artisanal mining output sold exclusively through single unlicensed buyer with strong social or coercive ties to armed group leadership", "Evidence of forced labour or extortion at mine site corroborated by humanitarian reporting or court records", "Funds flowing from mining proceeds to import of weapons components, fuel, communications equipment consistent with armed-group logistics" ], "actor_categories": [ "A6", "A3" ], "typical_jurisdictions": [ "ML", "BF", "NE", "CD", "CF", "SS", "SD", "SO", "LY" ], "instruments_exploited": [ "cash", "informal value transfer", "gold (physical)", "front company" ], "pillar": [ "CTF", "AML" ], "domain_refs": [ "D4" ], "confidence": "Assessed", "primary_source_url": "https://www.unodc.org/documents/data-and-analysis/tocta_sahel/TOCTA_Sahel_Gold_v5.pdf", "source_tier": 1, "lifecycle": "established", "provenance": "research-derived", "ratification_status": "ratified", "notes": "UNODC Sahel Gold report (2023) documents armed-group expansion into ASGM sites across Burkina Faso, Mali, Niger, and Chad. The Sentry report (2021) documents conflict gold in Sudan, South Sudan, DRC, and CAR. D4 evidence base is thinner than other domains; Observer should treat this and the preceding D4 entry as providing minimum required three D4 methods but should seek additional GIABA and FATF-ESAAMLG mutual evaluation data to deepen coverage.", "observed_this_cycle": false }, { "typology_id": "fim-typ-013", "name": "Virtual Currency Mixer and Tumbler Obfuscation", "aliases": [ "crypto mixing", "coin tumbling", "CVC mixer layering", "chain-break obfuscation" ], "definition": "Illicit actors route criminally-derived virtual currency through mixing or tumbling services that pool multiple inputs and redistribute outputs to break the on-chain transaction trail, severing the link between the original illicit source wallet and the destination wallet. Classical centralised mixers (e.g., Helix, BestMixer) are increasingly supplemented by decentralised protocols and smart-contract mixers (e.g., Tornado Cash) that provide the same obfuscation function without a central operator.", "category": "crypto_obfuscation", "indicators": [ "Customer initiates a transfer of virtual currency to a known mixing service address or to an address cluster associated with mixing behaviour", "On-chain analytics identify a wallet as having received funds that pass through a mixer contract before reaching the customer's account", "Customer receives virtual currency from an external wallet then immediately initiates multiple rapid trades among different CVCs with no apparent investment purpose, followed by an off-platform transfer", "Transaction pattern shows equal-value outputs dispersed to multiple addresses (classic tumbler output signature)", "IP addresses used to initiate transactions originate from Tor, VPN exit nodes, or jurisdictions flagged by OFAC or FATF", "Virtual currency wallet address appears on OFAC SDN list (e.g., Tornado Cash designation August 2022)", "Customer uses a non-custodial wallet and privacy coin (e.g., Monero, Zcash) in conjunction with mixing service to maximise obfuscation" ], "actor_categories": [ "A5", "A4", "A1" ], "typical_jurisdictions": [ "RU", "KP", "IR", "US", "GB", "EU" ], "instruments_exploited": [ "mixer contract", "privacy coin", "non-custodial wallet", "stablecoin" ], "pillar": [ "AML", "CTF", "CPF" ], "domain_refs": [ "D5" ], "confidence": "High", "primary_source_url": "https://www.fincen.gov/sites/default/files/2022-03/FinCEN%20Alert%20Russian%20Sanctions%20Evasion%20FINAL%20508.pdf", "source_tier": 1, "lifecycle": "established", "provenance": "research-derived", "ratification_status": "ratified", "notes": "FinCEN Alert FIN-2022-Alert001 (March 2022) documents mixer use in sanctions evasion. UN Panel of Experts (2023) documents DPRK use of Tornado Cash and Blender.io; OFAC designated both. Chainalysis 2024 Crypto Money Laundering Report corroborates shift to DeFi and cross-chain bridges as mixer pressure increases. Mixer obfuscation patterns are also documented in FATF virtual assets red-flag report (2020).", "observed_this_cycle": false }, { "typology_id": "fim-typ-014", "name": "Cross-Chain Bridge and DeFi Protocol Laundering", "aliases": [ "bridge hopping", "multi-chain laundering", "DeFi obfuscation", "cross-chain crime" ], "definition": "As enforcement pressure on centralised mixers has intensified, illicit actors have migrated to using cross-chain bridges, decentralised exchanges (DEXs), and automated-market-maker (AMM) protocols to move value between blockchains and cryptocurrencies, breaking the on-chain audit trail. Stolen or illicitly sourced assets are rapidly swapped into tokens that are harder to freeze, routed through layer-2 networks and bridge protocols, and cashed out through centralised exchanges in less-regulated jurisdictions.", "category": "crypto_obfuscation", "indicators": [ "Stolen or illicitly labelled funds swapped within minutes of leaving the origin address via a DEX into a token not associated with the original theft", "Funds routed through one or more cross-chain bridge contracts between different blockchain networks in rapid succession", "Transaction graph shows funds entering a bridge contract from an address flagged as illicit and exiting on a different chain to a new wallet not previously associated with that actor", "Use of layer-2 networks (e.g., Arbitrum, Optimism, Polygon) as intermediate hops between bridge protocols", "Funds reaching a centralised exchange after cross-chain obfuscation originate from wallets connected to hack events, ransomware, or sanctioned entities per blockchain analytics", "High-value rapid automated-market-maker swaps from high-liquidity tokens into low-liquidity privacy-adjacent tokens followed by withdrawal to unhosted wallets" ], "actor_categories": [ "A5", "A4", "A1" ], "typical_jurisdictions": [ "KP", "RU", "CN", "US", "SG" ], "instruments_exploited": [ "mixer contract", "stablecoin", "DEX protocol", "cross-chain bridge", "non-custodial wallet" ], "pillar": [ "AML", "CPF" ], "domain_refs": [ "D5" ], "confidence": "High", "primary_source_url": "https://www.elliptic.co/hubfs/The%20state%20of%20cross-chain%20crime%202025/The%20state%20of%20cross-chain%20crime%202025%20-%20FINAL.pdf", "source_tier": 2, "lifecycle": "emerging", "provenance": "research-derived", "ratification_status": "ratified", "notes": "Elliptic and Chainalysis both document this shift in public reports: Elliptic identified $21–22 billion in cross-chain crime (2025); Chainalysis notes 2024 flows concentrated through bridges. The FATF targeted stablecoin/unhosted wallet report (March 2026) touches P2P and DeFi risks. Observer should confirm a fetched Tier-1 or Tier-2 primary source URL (e.g., Chainalysis 2024 Crypto Crime Report or Elliptic cross-chain crime report) before ratifying. Source tier set null pending verification. Planned-domain hint: DeFi-specific obfuscation may warrant a D5 sub-category or separate entry. [Architect URL cure 2026-06-14: Elliptic 'The state of cross-chain crime 2025' — $21.8B cross-chain illicit estimate; primary analytics report (Tier-2).]", "observed_this_cycle": false }, { "typology_id": "fim-typ-015", "name": "State-Sponsored Cyber Heist and Virtual Asset Theft (DPRK Pattern)", "aliases": [ "Lazarus Group crypto theft", "nation-state exchange hack", "DPRK cyber-enabled sanctions evasion" ], "definition": "State-affiliated cyber actors (primarily DPRK Lazarus Group and related RGB-linked units) conduct intrusions against cryptocurrency exchanges, DeFi protocols, and NFT platforms to steal virtual assets at scale, financing WMD and ballistic missile programmes. Stolen assets are laundered through sequences of mixing services, cross-chain bridges, and peer-to-peer OTC desks before being converted to fiat or used to procure sanctioned goods, generating record revenues estimated at $630 million to over $1 billion in 2022 alone.", "category": "proliferation_financing", "indicators": [ "Exchange or protocol hack proceeds immediately routed to wallets displaying transaction patterns consistent with DPRK Lazarus Group (e.g., use of Tornado Cash, Blender, cross-chain bridges to Bitcoin)", "Large-volume virtual asset theft followed by rapid sequential swaps through multiple token types within hours of the compromise event", "Stolen funds eventually appear at OTC brokers in high-risk jurisdictions accepting large-volume BTC or ETH for fiat conversion without KYC", "On-chain analytics link wallet clusters to addresses previously sanctioned by OFAC in connection with DPRK programmes", "Phishing or social-engineering attacks targeting exchange employees using fabricated job offers linked to North Korean state entities", "NFT investor accounts targeted by approvals-phishing attacks draining wallet contents to addresses connected to DPRK laundering clusters" ], "actor_categories": [ "A1", "A5" ], "typical_jurisdictions": [ "KP", "CN", "SG", "AE", "VN" ], "instruments_exploited": [ "stablecoin", "mixer contract", "cross-chain bridge", "non-custodial wallet", "OTC desk" ], "pillar": [ "CPF", "AML" ], "domain_refs": [ "D5", "D1" ], "confidence": "High", "primary_source_url": "https://www.fincen.gov/news/news-releases/readout-fincen-hosts-public-private-dialogue-countering-dprks-illicit-cyber", "source_tier": 1, "lifecycle": "emerging", "provenance": "research-derived", "ratification_status": "ratified", "notes": "FinCEN hosted dedicated DPRK cyber exchange (August 2023); UN Panel of Experts March 2023 report documents record 2022 theft revenues; OFAC designated Tornado Cash (August 2022) and Blender.io (May 2022) citing DPRK use. Chainalysis 2024 report corroborates migration from mixers to bridges. Intersects both D5 (crypto methods) and D1 (sanctions/proliferation). FATF June 2025 report identifies DPRK as the most significant proliferation financing actor.", "observed_this_cycle": false }, { "typology_id": "fim-typ-016", "name": "Pig-Butchering (Sha Zhu Pan) Virtual Currency Investment Fraud", "aliases": [ "sha zhu pan scam", "romance investment scam", "confidence fraud crypto laundering", "Southeast Asia scam compound finance" ], "definition": "Criminal organisations operating primarily from Southeast Asian compounds — often using victims of labour trafficking as operators — cultivate trust with victims through unsolicited social media, text, or dating-app contact over weeks or months before introducing a fraudulent virtual currency investment platform. Victims are induced to make escalating deposits that are immediately controlled by the scammer; proceeds are laundered through rapid multi-hop virtual currency transfers, swap services, and conversion to stablecoins before being cashed out through intermediary accounts.", "category": "crypto_obfuscation", "indicators": [ "Customer with no history of virtual currency activity suddenly attempts high-value fiat-to-virtual-currency exchange following unsolicited online contact", "Customer mentions a new online contact who advised them about a virtual currency investment opportunity with exceptionally high returns", "Customer liquidates long-term savings accounts (certificates of deposit, pension, HELOC) to fund virtual currency purchases directed by a third party", "Funds sent to addresses associated with VASP that are non-registered or recently registered and have characteristics of fraudulent platforms (spoofed domain, no physical address, recent domain registration)", "Multiple device IDs and IP addresses accessing the same customer account, inconsistent with the customer's normal access patterns", "Customer deposits virtual currency and account immediately shows reported gains; customer then attempts to withdraw but is presented with demands for 'taxes' or 'fees' before release", "Received virtual currency (often TRX or stablecoins) immediately converted and transferred out of exchange without further investment activity", "Wire transfers to holding companies, LLCs, or individuals with no prior transaction history in rapid succession escalating in value" ], "actor_categories": [ "A4", "A5" ], "typical_jurisdictions": [ "KH", "LA", "MM", "CN", "PH", "AE", "US", "GB" ], "instruments_exploited": [ "stablecoin", "non-custodial wallet", "fraudulent VASP", "wire transfer" ], "pillar": [ "AML" ], "domain_refs": [ "D5" ], "confidence": "High", "primary_source_url": "https://www.fincen.gov/system/files/shared/FinCEN_Alert_Pig_Butchering_FINAL_508c.pdf", "source_tier": 1, "lifecycle": "emerging", "provenance": "research-derived", "ratification_status": "ratified", "notes": "FinCEN Alert FIN-2023-Alert005 (September 2023) is the primary Tier-1 source. FBI IC3 reported $2.57 billion in losses from cryptocurrency investment fraud (2022), a 183% increase. Scam compounds in KH, LA, MM are documented by UN Special Rapporteurs and UNODC. Planned-domain hint: Pig butchering and scam-centre finance are strong candidates for a dedicated D7 domain (fraud/scam-centre finance). Observer should note KH and LA as Tier-D jurisdictions relevant to D4/D5 context.", "observed_this_cycle": false }, { "typology_id": "fim-typ-017", "name": "Stablecoin P2P Transfer for Sanctions and Capital Controls Evasion", "aliases": [ "USDT sanctions evasion", "stablecoin P2P layering", "unhosted wallet stablecoin circumvention" ], "definition": "Illicit actors and sanctioned entities use stablecoins (particularly USDT on TRON network due to low fees) transacted peer-to-peer through unhosted wallets to move value across jurisdictions while bypassing bank-based transaction monitoring and sanctions screening. The use of P2P channels without VASP intermediation eliminates standard AML/CFT controls at the point of transfer; funds may then be on-ramped to regulated exchanges through intermediary wallets to obscure origin.", "category": "crypto_obfuscation", "indicators": [ "Large-value stablecoin transfers between unhosted wallets without any VASP as counterparty, inconsistent with claimed personal use", "Stablecoin transactions originating from IP addresses in sanctioned jurisdictions or using VPN/Tor obfuscation", "Customer deposits stablecoins received from unhosted wallets at a VASP where the source chain history shows direct or indirect links to sanctioned-entity wallets", "P2P stablecoin transactions structured in amounts below reporting thresholds across multiple transfers within a short period (structuring pattern)", "High-frequency USDT-TRC20 transactions between wallets in jurisdictions with no VASP oversight of P2P activity", "Smart contract controls such as freeze and burn functions not implemented by issuer on wallets involved in sanctioned-jurisdiction transactions", "Stablecoin redemption at issuer level by entity with no verifiable commercial rationale for holding large stablecoin balances" ], "actor_categories": [ "A1", "A5", "A4" ], "typical_jurisdictions": [ "RU", "IR", "KP", "VE", "CN", "AE", "TR" ], "instruments_exploited": [ "stablecoin", "non-custodial wallet", "unhosted wallet", "mixer contract" ], "pillar": [ "AML", "CPF", "CTF" ], "domain_refs": [ "D5", "D1" ], "confidence": "Assessed", "primary_source_url": "https://www.fatf-gafi.org/en/publications/Virtualassets/targeted-report-stablecoins-unhosted-wallets.html", "source_tier": 1, "lifecycle": "emerging", "provenance": "research-derived", "ratification_status": "ratified", "notes": "FATF published a targeted report on stablecoins and unhosted wallets in March 2026, identifying P2P stablecoin transactions as a primary AML/CTF/PF vulnerability. Note: primary_source_url points to an A&O Shearman summary of the FATF report rather than the FATF document itself. Observer should verify and replace with the direct FATF document URL (fatf-gafi.org) if accessible. Source_tier assigned 1 on the basis of the underlying FATF document being Tier 1. Planned-domain hint: Stablecoin-specific evasion may warrant its own D5 sub-category. [Architect URL cure 2026-06-14: FATF 'Targeted Report on Stablecoins and Unhosted Wallets: Peer-to-Peer Transactions' (3 March 2026), Tier-1 issuer (FATF); canonical FATF page (operator-supplied 2026-06-14; fatf-gafi.org blanket-blocks automated verification but URL is operator-confirmed). Replaces A&O Shearman client summary.]", "observed_this_cycle": false }, { "typology_id": "fim-typ-018", "name": "High-Value Asset Layering for Sanctioned-Person Wealth Preservation", "aliases": [ "luxury asset layering", "oligarch asset concealment", "artwork and yacht wealth preservation" ], "definition": "Sanctioned individuals or their proxies hold and transfer wealth through high-value assets — including luxury real estate, art, yachts, aircraft, and precious metals — that are difficult to trace, value independently, and subject to rapid divestment. These assets can be held through opaque corporate vehicles, insured through captive entities, and sold through auction houses or private dealers that have limited or no AML obligations in many jurisdictions, enabling the preservation and subsequent liquidation of frozen or targeted wealth.", "category": "sanctions_evasion", "indicators": [ "Purchase or sale of luxury real estate, yacht, or aircraft by a shell company or trust with opaque beneficial ownership and links to a sanctioned jurisdiction", "Acquisition or disposal of high-value artwork through auction house or private sale with payment routed through non-bank intermediaries or third-party accounts", "Insurance policy on high-value asset transferred to or from an entity linked to a sanctioned person within 90 days of a designation event", "High-value asset purchased in an all-cash or non-bank financed transaction by a newly incorporated entity with no prior transaction history", "Precious metals, jewellery, or gems used as physical value stores transported across borders with declarations materially below market value", "Non-residential real estate entity formed in a jurisdiction that does not require disclosure of beneficial ownership for property registration", "Purchase price for real estate above or below independently assessed market value, consistent with value-transfer rather than arm's-length purchase" ], "actor_categories": [ "A1", "A2" ], "typical_jurisdictions": [ "AE", "CH", "MC", "GB", "US", "CY", "MT", "LU", "SG", "AU" ], "instruments_exploited": [ "shell company", "trust", "real estate", "art", "yacht", "aircraft", "precious metals" ], "pillar": [ "AML", "CPF" ], "domain_refs": [ "D1", "D2" ], "confidence": "High", "primary_source_url": "https://home.treasury.gov/system/files/136/REPO_Joint_Advisory.pdf", "source_tier": 1, "lifecycle": "established", "provenance": "research-derived", "ratification_status": "ratified", "notes": "G7 REPO Advisory (March 2023) documents real estate and high-value assets as primary wealth-preservation vehicles for sanctioned Russian elites. FinCEN Alert March 2022 (FIN-2022-Alert001) specifically calls out real estate, art, precious metals, yachts and aircraft. FATF Risk-Based Approach Guidance for the Real Estate Sector (July 2022) provides additional typologies. Observer should note this entry has strong dual D1/D2 relevance.", "observed_this_cycle": false }, { "typology_id": "fim-typ-019", "name": "Correspondent Account Shadow Banking (Iranian Pattern)", "aliases": [ "nested correspondent banking", "Iranian shadow banking", "non-transparent respondent layering" ], "definition": "Sanctioned or high-risk state-linked financial networks access the U.S. and international financial system by routing transactions through correspondent accounts held at non-sanctioned respondent banks, which in turn provide access to their own correspondents without disclosing the ultimate originator or beneficiary. FinCEN identified approximately $9 billion in potential Iranian shadow banking activity flowing through U.S. correspondent accounts in 2024, exploiting the nested nature of correspondent banking chains.", "category": "sanctions_evasion", "indicators": [ "Correspondent account transactions involving a respondent bank in a jurisdiction adjacent to a sanctioned country showing unusual volume spikes inconsistent with the respondent's known customer base", "Wire transfers where the originator or beneficiary information is incomplete, masked, or shows a non-sanctioned intermediary as principal party", "Respondent bank known to maintain correspondent relationships with financial institutions in sanctioned jurisdictions per supervisory intelligence", "Transaction patterns at U.S. correspondent accounts of foreign banks showing sudden non-routine foreign exchange activity inconsistent with prior 12-month baseline", "Payments routed through chains of three or more correspondent institutions across multiple jurisdictions before reaching the final beneficiary", "Accounts at non-sanctioned financial institutions experiencing sudden value increases with no clear business rationale, potentially consistent with sanctioned-country capital flight" ], "actor_categories": [ "A1", "A4" ], "typical_jurisdictions": [ "IR", "IQ", "TR", "AE", "CN", "KZ", "OM" ], "instruments_exploited": [ "correspondent account", "nested correspondent account", "wire transfer" ], "pillar": [ "AML", "CPF" ], "domain_refs": [ "D1", "D3" ], "confidence": "Assessed", "primary_source_url": "https://www.fincen.gov/system/files/2025-10/FTA-Iranian-Shadow-Banking.pdf", "source_tier": 1, "lifecycle": "established", "provenance": "research-derived", "ratification_status": "ratified", "notes": "FinCEN (March 2022) documents correspondent account red flags in the context of Russian sanctions evasion; the $9 billion Iranian shadow banking figure is sourced from FinCEN trend analysis (2024) referenced in the FATF jurisdiction deficiency release (March 2026). Observer should note the primary_source_url is the March 2022 FinCEN alert which documents the correspondent-account evasion pattern; the Iranian-specific $9 billion figure requires a separate FinCEN trend analysis source for full provenance. OBSERVER-SHOULD-VERIFY direct FinCEN Iranian shadow banking FTA URL. Assigned Assessed confidence accordingly. [Architect URL cure 2026-06-14: FinCEN FTA 'Iranian Shadow Banking: Trends in Bank Secrecy Act Data' (23 Oct 2025) — exact $9B / 2024 BSA match. Replaces the Russia red-flags release URL.]", "observed_this_cycle": false }, { "typology_id": "fim-typ-020", "name": "Phantom Shipment Trade Fraud", "aliases": [ "ghost shipment TBML", "fictitious trade document fraud", "phantom cargo financing" ], "definition": "A payment is made for goods that are never shipped or do not exist, enabling value to be transferred across borders under the guise of a legitimate trade transaction. Documentary fraud — including forged bills of lading, fabricated invoices, and falsified certificates of origin — is used to satisfy bank trade-finance requirements. UAEFIU analysis of 610 suspicious reports found phantom shipments were the most prevalent TBML method, present in 61% of cases.", "category": "TBML", "indicators": [ "Bill of lading date, vessel name, or port of loading inconsistent with contemporaneous port records or shipping intelligence", "Cargo weight or volume declared on shipping documents inconsistent with the capacity of the vessel or container used", "Trade documentation references a vessel or carrier that does not exist or has a different registered service area", "Invoice issued by a counterparty with no verifiable operational existence (no registered address, no employees, newly incorporated)", "Payment for goods made in full before shipment by a counterparty with no established trading history with the exporter", "Trade finance facility drawdown with no corresponding evidence of goods receipt, customs clearance, or delivery confirmation", "Account turnover significantly exceeds the declared trade volume for the customer's stated business activity", "Multiple drawdowns on trade finance facilities within a short period for shipments to the same recipient without independent cargo confirmation" ], "actor_categories": [ "A3", "A2" ], "typical_jurisdictions": [ "AE", "CN", "HK", "PK", "TR", "KH", "LA", "CO", "MX" ], "instruments_exploited": [ "trade finance document", "letter of credit", "correspondent account", "front company" ], "pillar": [ "AML" ], "domain_refs": [ "D3" ], "confidence": "High", "primary_source_url": "https://uaefiu.gov.ae/media/vduba40z/updated-strategic-analysis-report-on-trade-based-money-laundering-rsas-2024.pdf", "source_tier": 1, "lifecycle": "established", "provenance": "research-derived", "ratification_status": "ratified", "notes": "UAEFIU Strategic Analysis Report on TBML (2024) is a primary FIU-published typology report based on 610 suspicious reports over 2022–2023. Phantom shipments account for 61% of cases. Fictitious documents used in 41% of cases and frequently overlapped. FATF Best Practices Paper (2008) and FATF-Egmont TBML report (2020) provide the broader methodological framework. Planned-domain hint: phantom shipments as a distinct TBML subcategory could form part of a prospective D6 (TBML standalone axis). Observer should note that the UAE FIU report is Tier 1 in the FATF/multilateral regulator family.", "observed_this_cycle": false } ], "typology_library_catalogue_count": 20, "typology_observations_this_cycle": [], "typology_observations_this_cycle_empty_state": true, "typology_observations_this_cycle_count": 0, "red_flag_schemes": [ { "scheme_id": "huione-guarantee-marketplace", "scheme_name": "Huione/Xinbi guarantee-marketplace laundering infrastructure", "domain": "D3", "pillar": "AML", "actor_category": "A4", "jurisdiction": "KH", "status": "active", "customer_typology": [ "VASP_counterparty", "correspondent_bank", "MSB" ], "red_flag_indicators": [ { "indicator": "Guarantee-marketplace intermediary receiving very high aggregate crypto inflow volumes routed through successor platforms after a primary platform takedown", "observability": "onchain", "linked_customer_typology": [ "VASP_counterparty" ], "disclaimer": "Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact." }, { "indicator": "Payments-arm volumes inconsistent with stated business profile and concentrated counterparties", "observability": "transaction_monitoring", "linked_customer_typology": [ "MSB", "VASP_counterparty" ], "disclaimer": "Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact." } ], "rfi_count": 2 }, { "scheme_id": "cmln-cartel-tbml-corridor", "scheme_name": "Chinese money-laundering network / cartel TBML corridor", "domain": "D3", "pillar": "AML", "actor_category": "A4", "jurisdiction": "MX", "status": "active", "customer_typology": [ "MSB", "trade_finance", "correspondent_bank", "retail" ], "red_flag_indicators": [ { "indicator": "Structured cash transactions between $1,000 and $10,000 by MSBs in designated southwest-border counties", "observability": "transaction_monitoring", "linked_customer_typology": [ "MSB", "retail" ], "disclaimer": "Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact." }, { "indicator": "Mirror-transfer patterns and offsetting trade flows with no apparent economic rationale linking PRC and Mexican counterparties", "observability": "trade_docs", "linked_customer_typology": [ "trade_finance", "correspondent_bank" ], "disclaimer": "Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact." } ], "rfi_count": 2 }, { "scheme_id": "serniya-majory-procurement", "scheme_name": "Serniya/Majory dual-use procurement network", "domain": "D1", "pillar": "cross-pillar", "actor_category": "A2", "jurisdiction": "RU", "status": "active", "customer_typology": [ "corporate", "trade_finance", "correspondent_bank" ], "red_flag_indicators": [ { "indicator": "Third-country intermediary entities re-exporting controlled dual-use goods to higher-risk destinations shortly after import", "observability": "trade_docs", "linked_customer_typology": [ "trade_finance", "corporate" ], "disclaimer": "Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact." } ], "rfi_count": 1 }, { "scheme_id": "isis-hawala-crypto-facilitation", "scheme_name": "ISIS hawala-to-crypto facilitation layer", "domain": "D5", "pillar": "CTF", "actor_category": "A6", "jurisdiction": "AFR", "status": "active", "customer_typology": [ "MSB", "VASP_counterparty", "correspondent_bank" ], "red_flag_indicators": [ { "indicator": "Bureau-de-change and MSB transactions to crypto on-ramps with onward transfers to flagged TRON wallet addresses", "observability": "onchain", "linked_customer_typology": [ "MSB", "VASP_counterparty" ], "disclaimer": "Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact." } ], "rfi_count": 1 } ], "red_flag_scheme_count": 4, "scheme_architecture_dropped": true, "scheme_architecture_drop_reason": "fim-scheme register is fiction (0 live occurrences); BRIEF §6 REJECT.", "note": "Scenarios guard-applied via _guard_scenarios (Slice E); red-flags from active_scheme_inventory[].red_flag_indicators[]; typology_library_catalogue loaded from sentinel-typology-library-v1.0.json (20 entries); typology_observations_this_cycle from this-cycle interpreter output." }, "jurisdiction_risk_profiles": { "source_doc": "docs/monitors/financial-integrity/data/report-latest.json", "count": 7, "profiles": [ { "jurisdiction": { "value": "US", "source_path": "jurisdiction_risk_tracker[0].jurisdiction" }, "trend_direction": { "value": "stable", "source_path": "jurisdiction_risk_tracker[0].risk_direction" }, "enforcement_vs_enablement": { "value": "enforcement", "source_path": "jurisdiction_risk_tracker[0].enforcement_vs_enablement" }, "structural_vs_episodic": { "value": "structural", "source_path": "jurisdiction_risk_tracker[0].structural_vs_episodic" }, "primary_domains": { "value": [ "D1", "D3", "D4" ], "source_path": "jurisdiction_risk_tracker[0].primary_domains" }, "fatf_recommendations": { "value": [ "R.20" ], "source_path": "jurisdiction_risk_tracker[0].fatf_recommendations" }, "key_signal": { "value": "OFAC-OFSI comparative overview codifies a managed-divergence posture; FinCEN GTO/CMLN advisory and continued OFAC procurement/TCO/ISIS designations sustain a high-tempo enforcement posture. The structural signal is the bilateral US-UK divergence architecture itself, not the individual designations.", "source_path": "jurisdiction_risk_tracker[0].key_signal" }, "source_quality": { "value": null, "source_path": "jurisdiction_risk_tracker[0].source_quality" }, "composite_score": { "value": null, "source_path": null }, "rag_band": { "value": null, "source_path": null } }, { "jurisdiction": { "value": "GB", "source_path": "jurisdiction_risk_tracker[1].jurisdiction" }, "trend_direction": { "value": "stable", "source_path": "jurisdiction_risk_tracker[1].risk_direction" }, "enforcement_vs_enablement": { "value": "mixed", "source_path": "jurisdiction_risk_tracker[1].enforcement_vs_enablement" }, "structural_vs_episodic": { "value": "structural", "source_path": "jurisdiction_risk_tracker[1].structural_vs_episodic" }, "primary_domains": { "value": [ "D1", "D6" ], "source_path": "jurisdiction_risk_tracker[1].primary_domains" }, "fatf_recommendations": { "value": [ "R.1" ], "source_path": "jurisdiction_risk_tracker[1].fatf_recommendations" }, "key_signal": { "value": "OFSI co-authored the comparative overview, signalling intent to align rapid-escalation mechanisms with OFAC; the incoming UK FATF Presidency (1 July 2026) reframes priorities around fraud and scam-compound ML/TF. ECCTA failure-to-prevent-fraud enforcement remains untested. 6AMLD is not applicable to GB (non-EEA); transposition status not relevant this cycle.", "source_path": "jurisdiction_risk_tracker[1].key_signal" }, "source_quality": { "value": null, "source_path": "jurisdiction_risk_tracker[1].source_quality" }, "composite_score": { "value": null, "source_path": null }, "rag_band": { "value": null, "source_path": null } }, { "jurisdiction": { "value": "EEA", "source_path": "jurisdiction_risk_tracker[2].jurisdiction" }, "trend_direction": { "value": "improving", "source_path": "jurisdiction_risk_tracker[2].risk_direction" }, "enforcement_vs_enablement": { "value": "enforcement", "source_path": "jurisdiction_risk_tracker[2].enforcement_vs_enablement" }, "structural_vs_episodic": { "value": "structural", "source_path": "jurisdiction_risk_tracker[2].structural_vs_episodic" }, "primary_domains": { "value": [ "D2" ], "source_path": "jurisdiction_risk_tracker[2].primary_domains" }, "fatf_recommendations": { "value": [ "R.24", "R.25" ], "source_path": "jurisdiction_risk_tracker[2].fatf_recommendations" }, "key_signal": { "value": "AMLA operationalisation (Frankfurt conference 9 June; direct-supervision methodology 10 June) centralises supervision to close historical regulatory-arbitrage gaps from fragmented national transposition. AMLR (Reg 2024/1624) applies 2027; AMLA direct supervision begins 2028. 6AMLD (Directive (EU) 2024/1640) is transposed per-Member-State and divergent; per-state transposition status not established this cycle and is a collection gap.", "source_path": "jurisdiction_risk_tracker[2].key_signal" }, "source_quality": { "value": null, "source_path": "jurisdiction_risk_tracker[2].source_quality" }, "composite_score": { "value": null, "source_path": null }, "rag_band": { "value": null, "source_path": null } }, { "jurisdiction": { "value": "KH", "source_path": "jurisdiction_risk_tracker[3].jurisdiction" }, "trend_direction": { "value": "increasing", "source_path": "jurisdiction_risk_tracker[3].risk_direction" }, "enforcement_vs_enablement": { "value": "capacity_deficit", "source_path": "jurisdiction_risk_tracker[3].enforcement_vs_enablement" }, "structural_vs_episodic": { "value": "structural", "source_path": "jurisdiction_risk_tracker[3].structural_vs_episodic" }, "primary_domains": { "value": [ "D3", "D5" ], "source_path": "jurisdiction_risk_tracker[3].primary_domains" }, "fatf_recommendations": { "value": [ "R.15" ], "source_path": "jurisdiction_risk_tracker[3].fatf_recommendations" }, "key_signal": { "value": "FBI seizure of Huione cloud infrastructure confirms entrenched scam-compound and laundering ecosystem; the guarantee-marketplace model persists via successor marketplaces (Xinbi). F1 entanglement of scam-compound economy with state-linked corporate conglomerates (Prince Group, Huione) flagged for WDM.", "source_path": "jurisdiction_risk_tracker[3].key_signal" }, "source_quality": { "value": null, "source_path": "jurisdiction_risk_tracker[3].source_quality" }, "composite_score": { "value": null, "source_path": null }, "rag_band": { "value": null, "source_path": null } }, { "jurisdiction": { "value": "MX", "source_path": "jurisdiction_risk_tracker[4].jurisdiction" }, "trend_direction": { "value": "increasing", "source_path": "jurisdiction_risk_tracker[4].risk_direction" }, "enforcement_vs_enablement": { "value": "mixed", "source_path": "jurisdiction_risk_tracker[4].enforcement_vs_enablement" }, "structural_vs_episodic": { "value": "structural", "source_path": "jurisdiction_risk_tracker[4].structural_vs_episodic" }, "primary_domains": { "value": [ "D3", "D4" ], "source_path": "jurisdiction_risk_tracker[4].primary_domains" }, "fatf_recommendations": { "value": [ "R.20" ], "source_path": "jurisdiction_risk_tracker[4].fatf_recommendations" }, "key_signal": { "value": "Expanded FinCEN GTO and CMLN advisory evidence escalating cartel-finance and TBML pressure; the Mexico-PRC-US laundering corridor links cartel cash, PRC capital-flight demand and US MSB/real-estate exposure into a single architecture. Cartels designated as FTOs/SDGTs under EO 14157 fuse CT and AML authorities.", "source_path": "jurisdiction_risk_tracker[4].key_signal" }, "source_quality": { "value": null, "source_path": "jurisdiction_risk_tracker[4].source_quality" }, "composite_score": { "value": null, "source_path": null }, "rag_band": { "value": null, "source_path": null } }, { "jurisdiction": { "value": "CO", "source_path": "jurisdiction_risk_tracker[5].jurisdiction" }, "trend_direction": { "value": "stable", "source_path": "jurisdiction_risk_tracker[5].risk_direction" }, "enforcement_vs_enablement": { "value": "capacity_deficit", "source_path": "jurisdiction_risk_tracker[5].enforcement_vs_enablement" }, "structural_vs_episodic": { "value": "structural", "source_path": "jurisdiction_risk_tracker[5].structural_vs_episodic" }, "primary_domains": { "value": [ "D4" ], "source_path": "jurisdiction_risk_tracker[5].primary_domains" }, "fatf_recommendations": { "value": [], "source_path": "jurisdiction_risk_tracker[5].fatf_recommendations" }, "key_signal": { "value": "UNODC IFF estimates (USD 1.2-8.6bn/yr cocaine inward, 2015-2019) underscore cocaine and illegal-gold laundering architecture exploiting gold's licit-trade status. Colombia remains in FATF follow-up rather than grey-listing; a current NRA citation is a noted collection gap.", "source_path": "jurisdiction_risk_tracker[5].key_signal" }, "source_quality": { "value": null, "source_path": "jurisdiction_risk_tracker[5].source_quality" }, "composite_score": { "value": null, "source_path": null }, "rag_band": { "value": null, "source_path": null } }, { "jurisdiction": { "value": "LA", "source_path": "jurisdiction_risk_tracker[6].jurisdiction" }, "trend_direction": { "value": "stable", "source_path": "jurisdiction_risk_tracker[6].risk_direction" }, "enforcement_vs_enablement": { "value": "capacity_deficit", "source_path": "jurisdiction_risk_tracker[6].enforcement_vs_enablement" }, "structural_vs_episodic": { "value": "structural", "source_path": "jurisdiction_risk_tracker[6].structural_vs_episodic" }, "primary_domains": { "value": [ "D4" ], "source_path": "jurisdiction_risk_tracker[6].primary_domains" }, "fatf_recommendations": { "value": [], "source_path": "jurisdiction_risk_tracker[6].fatf_recommendations" }, "key_signal": { "value": "Lao PDR remains under FATF increased monitoring following June review; special economic zones host scam-compound infrastructure with weak supervision, linked to the Golden Triangle Prince Group network.", "source_path": "jurisdiction_risk_tracker[6].key_signal" }, "source_quality": { "value": null, "source_path": "jurisdiction_risk_tracker[6].source_quality" }, "composite_score": { "value": null, "source_path": null }, "rag_band": { "value": null, "source_path": null } } ], "absent_components": [ "composite_score (FATF grade / HMT MLA / sanctions density / PEP density / Basel AML Index)", "rag_band" ], "_escalations": [ { "id": "A3-DRIFT-001", "severity": "high", "finding": "BRIEF A3.1 composite-score components and RAG band have no literal source field in report-latest.json.", "action": "Emitted null (not fabricated) per literal-source-field gate; rendered components below are all live-field-backed. Pipeline sprint must surface a composite/RAG field before these can be populated." } ], "persona": "MLRO / financial-crime (COMMERCIAL-CONTEXT §2.1)", "note": "trend_direction ← risk_direction (literal). All rendered values carry source_path for parent verification." }, "typology_registry": { "source_doc": "commercial/sentinel/sentinel-typology-library-v1.0.json", "count": 20, "records": [ { "typology_id": { "value": "fim-typ-001", "source_path": "entries[typology_id=fim-typ-001].typology_id" }, "name": { "value": "Proxy Transfer to Sanctioned-Person Associates", "source_path": "entries[typology_id=fim-typ-001].name" }, "category": { "value": "sanctions_evasion", "source_path": "entries[typology_id=fim-typ-001].category" }, "pillar": { "value": [ "AML", "CPF" ], "source_path": "entries[typology_id=fim-typ-001].pillar" }, "domain_refs": { "value": [ "D1", "D2" ], "source_path": "entries[typology_id=fim-typ-001].domain_refs" }, "jurisdictions": { "value": [ "RU", "AE", "TR", "GE", "AM", "RS", "AZ" ], "source_path": "entries[typology_id=fim-typ-001].typical_jurisdictions" }, "products": { "value": [ "shell company", "trust", "nominee directorship", "real estate", "SLP", "correspondent account" ], "source_path": "entries[typology_id=fim-typ-001].instruments_exploited" }, "red_flag_indicators": { "value": [ "Asset transfers to family members or close associates timed within 30–90 days before or after a sanctions designation", "Newly registered entities with family members or associates of known PEPs or designated persons as directors or UBOs", "Power of attorney or side-letter arrangements granting control to an undesignated natural person where beneficial ownership record names a relative", "Purchase or sale of high-value assets (real estate, yachts, aircraft, luxury goods) by entities with opaque ownership linked to sanctioned-jurisdiction nationals", "Wire transfers from accounts linked to family members of designated persons to offshore accounts without commercial rationale", "Insurance policies on high-value assets transferred or terminated shortly after designation events" ], "source_path": "entries[typology_id=fim-typ-001].indicators" }, "confidence": { "value": "High", "source_path": "entries[typology_id=fim-typ-001].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-001].source_tier" }, "primary_source_url": { "value": "https://home.treasury.gov/system/files/136/REPO_Joint_Advisory.pdf", "source_path": "entries[typology_id=fim-typ-001].primary_source_url" } }, { "typology_id": { "value": "fim-typ-002", "source_path": "entries[typology_id=fim-typ-002].typology_id" }, "name": { "value": "Shadow Fleet Maritime Sanctions Circumvention", "source_path": "entries[typology_id=fim-typ-002].name" }, "category": { "value": "sanctions_evasion", "source_path": "entries[typology_id=fim-typ-002].category" }, "pillar": { "value": [ "AML", "CPF" ], "source_path": "entries[typology_id=fim-typ-002].pillar" }, "domain_refs": { "value": [ "D1" ], "source_path": "entries[typology_id=fim-typ-002].domain_refs" }, "jurisdictions": { "value": [ "RU", "IR", "VE", "AE", "TR", "IN", "CN", "KH", "PA", "MH" ], "source_path": "entries[typology_id=fim-typ-002].typical_jurisdictions" }, "products": { "value": [ "shell company", "free-zone entity", "correspondent account", "nominee directorship", "freight-forwarding front" ], "source_path": "entries[typology_id=fim-typ-002].instruments_exploited" }, "red_flag_indicators": { "value": [ "Companies with minimal or no trading history rapidly processing large-volume oil transactions", "Limited or absent beneficial ownership information, absent directors or beneficiary data on corporate records", "Multiple rapid transfers between shell companies with no clear commercial purpose across high-risk jurisdictions", "Vessel AIS transponder disabled or manipulated during port calls or transit through sensitive areas", "Vessel recently renamed, reflagged to open-registry jurisdiction, or transferred to new owner with opaque offshore registration", "Insurance coverage through captive or shell insurer not affiliated with International Group P&I clubs", "Corporate website contains only generic stock images with no named personnel or contact details", "Freight rates materially below market for type and age of vessel, consistent with discounted sanctioned-commodity pricing", "Payment routing through jurisdictions known to host shadow-fleet operating entities (e.g., TR, AE, IN, CN, KH)" ], "source_path": "entries[typology_id=fim-typ-002].indicators" }, "confidence": { "value": "High", "source_path": "entries[typology_id=fim-typ-002].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-002].source_tier" }, "primary_source_url": { "value": "https://www.gov.je/gazette/pages/neccredalert03july2025.aspx", "source_path": "entries[typology_id=fim-typ-002].primary_source_url" } }, { "typology_id": { "value": "fim-typ-003", "source_path": "entries[typology_id=fim-typ-003].typology_id" }, "name": { "value": "Dual-Use Goods Procurement Network (DPRK/Iran Pattern)", "source_path": "entries[typology_id=fim-typ-003].name" }, "category": { "value": "proliferation_financing", "source_path": "entries[typology_id=fim-typ-003].category" }, "pillar": { "value": [ "CPF", "AML" ], "source_path": "entries[typology_id=fim-typ-003].pillar" }, "domain_refs": { "value": [ "D1" ], "source_path": "entries[typology_id=fim-typ-003].domain_refs" }, "jurisdictions": { "value": [ "KP", "IR", "CN", "HK", "SG", "MH", "VU", "AE" ], "source_path": "entries[typology_id=fim-typ-003].typical_jurisdictions" }, "products": { "value": [ "front company", "shell company", "correspondent account", "trade finance document" ], "source_path": "entries[typology_id=fim-typ-003].instruments_exploited" }, "red_flag_indicators": { "value": [ "Company shows no website, no stated business purpose, yet processes large-value wire transfers for diverse unrelated product lines", "Corporate address shared by multiple apparently unrelated entities, one of which is linked to a sanctioned jurisdiction", "Natural-resource export contracts (coal, seafood, minerals) involving entities registered near DPRK border provinces (e.g., Liaoning, China)", "Payment cycling in which Company A pays a beneficiary, then ceases and a co-addressed Company B begins paying the same beneficiary", "Corporate officers appearing as authorized signatories across multiple nominally unrelated companies", "Wire transfers that reference natural-resource purchases but accompanying trade documents show unrelated commodity categories", "Transactions involving jurisdictions identified in UN Panel of Experts reports as transshipment nodes for WMD-related goods", "Sudden surge in account activity followed by prolonged dormancy, consistent with front-company cycling" ], "source_path": "entries[typology_id=fim-typ-003].indicators" }, "confidence": { "value": "High", "source_path": "entries[typology_id=fim-typ-003].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-003].source_tier" }, "primary_source_url": { "value": "https://www.fincen.gov/resources/advisories/fincen-advisory-fin-2017-a007", "source_path": "entries[typology_id=fim-typ-003].primary_source_url" } }, { "typology_id": { "value": "fim-typ-004", "source_path": "entries[typology_id=fim-typ-004].typology_id" }, "name": { "value": "Nominee Layered Shell-Company Beneficial Ownership Concealment", "source_path": "entries[typology_id=fim-typ-004].name" }, "category": { "value": "BO_opacity", "source_path": "entries[typology_id=fim-typ-004].category" }, "pillar": { "value": [ "AML" ], "source_path": "entries[typology_id=fim-typ-004].pillar" }, "domain_refs": { "value": [ "D2", "D3" ], "source_path": "entries[typology_id=fim-typ-004].domain_refs" }, "jurisdictions": { "value": [ "VG", "KY", "PA", "BZ", "SC", "JE", "GG", "IM", "LI" ], "source_path": "entries[typology_id=fim-typ-004].typical_jurisdictions" }, "products": { "value": [ "shell company", "shelf company", "trust", "nominee directorship", "bearer share", "legal trust account", "SLP" ], "source_path": "entries[typology_id=fim-typ-004].instruments_exploited" }, "red_flag_indicators": { "value": [ "Corporate structure comprises three or more layers of legal entities across multiple jurisdictions with no discernible commercial rationale for the complexity", "Nominee directors or shareholders are family members, domestic employees, or individuals appearing across many unrelated companies", "Registered address is a mass-formation or virtual-office address associated with a TCSP", "Bearer shares or opaque ownership instruments with no recorded transfer history", "Sudden change of directors, shareholders, or registered jurisdiction in the period before a major transaction or anticipated regulatory action", "Power of attorney granted to a third party who is not named as a director or owner", "Legal professional trust or client account used to settle transactions without disclosure of underlying beneficiary", "Entity domiciled in a jurisdiction with no public beneficial-ownership register and no CDD requirements for company formation" ], "source_path": "entries[typology_id=fim-typ-004].indicators" }, "confidence": { "value": "High", "source_path": "entries[typology_id=fim-typ-004].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-004].source_tier" }, "primary_source_url": { "value": "https://egmontgroup.org/wp-content/uploads/2021/09/2018_Concealment_of_Beneficial_Ownership.pdf", "source_path": "entries[typology_id=fim-typ-004].primary_source_url" } }, { "typology_id": { "value": "fim-typ-005", "source_path": "entries[typology_id=fim-typ-005].typology_id" }, "name": { "value": "Trust and Company Service Provider (TCSP) Facilitated Layering", "source_path": "entries[typology_id=fim-typ-005].name" }, "category": { "value": "BO_opacity", "source_path": "entries[typology_id=fim-typ-005].category" }, "pillar": { "value": [ "AML" ], "source_path": "entries[typology_id=fim-typ-005].pillar" }, "domain_refs": { "value": [ "D2", "D3" ], "source_path": "entries[typology_id=fim-typ-005].domain_refs" }, "jurisdictions": { "value": [ "VG", "KY", "SC", "PA", "BZ", "CY", "MT", "HK", "NZ" ], "source_path": "entries[typology_id=fim-typ-005].typical_jurisdictions" }, "products": { "value": [ "shell company", "shelf company", "nominee directorship", "trust", "registered-office service" ], "source_path": "entries[typology_id=fim-typ-005].instruments_exploited" }, "red_flag_indicators": { "value": [ "TCSP-introduced entity has no independently verifiable business purpose or operations", "TCSP provides nominees from a pool of professional directors appearing across dozens of companies in multiple jurisdictions", "Bank-account introduction letters issued by TCSP for entities whose UBO the TCSP cannot identify", "TCSP receives instructions exclusively through an intermediary (attorney or accountant) in a different jurisdiction without direct client contact", "Multiple TCSPs in different jurisdictions used sequentially in the same scheme (TCSP layering)", "Registered office address appears on company registers of more than 50 unrelated entities", "TCSP jurisdiction has no AML/CFT supervision for TCSPs or does not enforce FATF Recommendation 28" ], "source_path": "entries[typology_id=fim-typ-005].indicators" }, "confidence": { "value": "High", "source_path": "entries[typology_id=fim-typ-005].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-005].source_tier" }, "primary_source_url": { "value": "https://egmontgroup.org/wp-content/uploads/2021/09/2018_Concealment_of_Beneficial_Ownership.pdf", "source_path": "entries[typology_id=fim-typ-005].primary_source_url" } }, { "typology_id": { "value": "fim-typ-006", "source_path": "entries[typology_id=fim-typ-006].typology_id" }, "name": { "value": "Legal Professional Privilege Exploitation for Asset Concealment", "source_path": "entries[typology_id=fim-typ-006].name" }, "category": { "value": "BO_opacity", "source_path": "entries[typology_id=fim-typ-006].category" }, "pillar": { "value": [ "AML" ], "source_path": "entries[typology_id=fim-typ-006].pillar" }, "domain_refs": { "value": [ "D2", "D3" ], "source_path": "entries[typology_id=fim-typ-006].domain_refs" }, "jurisdictions": { "value": [ "GB", "US", "CH", "AE", "CY", "LU", "HK", "SG" ], "source_path": "entries[typology_id=fim-typ-006].typical_jurisdictions" }, "products": { "value": [ "legal trust account", "shell company", "real estate", "client account" ], "source_path": "entries[typology_id=fim-typ-006].instruments_exploited" }, "red_flag_indicators": { "value": [ "High-value funds passing through solicitor or notary client account without an underlying identifiable transaction or litigation matter", "Legal professional unable or unwilling to identify the source of funds or ultimate beneficiary when requested by a financial institution", "Legal trust account used as pass-through: funds received and rapidly re-transmitted to unrelated third parties in multiple jurisdictions", "Attorney or notary domiciled in a jurisdiction that has not subjected legal professionals to AML/CFT obligations", "Engagement letter scope covers only a narrow legal task but account flows show much broader financial activity", "Multiple lawyers in the same jurisdiction used consecutively for what appears to be a single scheme (lawyer-shopping)" ], "source_path": "entries[typology_id=fim-typ-006].indicators" }, "confidence": { "value": "High", "source_path": "entries[typology_id=fim-typ-006].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-006].source_tier" }, "primary_source_url": { "value": "https://egmontgroup.org/wp-content/uploads/2021/09/2018_Concealment_of_Beneficial_Ownership.pdf", "source_path": "entries[typology_id=fim-typ-006].primary_source_url" } }, { "typology_id": { "value": "fim-typ-007", "source_path": "entries[typology_id=fim-typ-007].typology_id" }, "name": { "value": "Free-Trade Zone Invoice Manipulation (TBML)", "source_path": "entries[typology_id=fim-typ-007].name" }, "category": { "value": "TBML", "source_path": "entries[typology_id=fim-typ-007].category" }, "pillar": { "value": [ "AML", "CTF" ], "source_path": "entries[typology_id=fim-typ-007].pillar" }, "domain_refs": { "value": [ "D3" ], "source_path": "entries[typology_id=fim-typ-007].domain_refs" }, "jurisdictions": { "value": [ "AE", "HK", "PK", "CN", "MX", "CO", "PA", "TR", "KH", "LA" ], "source_path": "entries[typology_id=fim-typ-007].typical_jurisdictions" }, "products": { "value": [ "free-zone entity", "correspondent account", "trade finance document", "front company", "letter of credit" ], "source_path": "entries[typology_id=fim-typ-007].instruments_exploited" }, "red_flag_indicators": { "value": [ "Trade routes that pass through FTZs or SEZs without an obvious commercial rationale for the transit", "Significant discrepancy between declared export value and declared import value for the same consignment in partner-country customs data", "Invoice price materially above or below commodity-benchmarked market prices for the goods described", "Multiple invoices issued for a single shipment, or invoices from apparently unrelated entities for the same goods", "Bill of lading date or cargo weight inconsistent with contemporaneous shipping or port records", "Front companies acting as trade broker or intermediary without verifiable operational capacity (no warehouse, no staff, new registration)", "Payment terms inconsistent with the declared nature of the transaction (e.g., full advance payment for bulk commodity to a newly registered counterparty)", "Trade counterparties registered in jurisdictions on FATF grey/black lists or subject to targeted sanctions" ], "source_path": "entries[typology_id=fim-typ-007].indicators" }, "confidence": { "value": "High", "source_path": "entries[typology_id=fim-typ-007].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-007].source_tier" }, "primary_source_url": { "value": "https://home.treasury.gov/system/files/246/best-practices-paper-Trade-based-ML-062008.pdf", "source_path": "entries[typology_id=fim-typ-007].primary_source_url" } }, { "typology_id": { "value": "fim-typ-008", "source_path": "entries[typology_id=fim-typ-008].typology_id" }, "name": { "value": "Over- and Under-Invoicing of Goods", "source_path": "entries[typology_id=fim-typ-008].name" }, "category": { "value": "TBML", "source_path": "entries[typology_id=fim-typ-008].category" }, "pillar": { "value": [ "AML" ], "source_path": "entries[typology_id=fim-typ-008].pillar" }, "domain_refs": { "value": [ "D3" ], "source_path": "entries[typology_id=fim-typ-008].domain_refs" }, "jurisdictions": { "value": [ "MX", "CO", "CN", "AE", "TR", "IN", "HK", "PK" ], "source_path": "entries[typology_id=fim-typ-008].typical_jurisdictions" }, "products": { "value": [ "trade finance document", "correspondent account", "front company", "letter of credit" ], "source_path": "entries[typology_id=fim-typ-008].instruments_exploited" }, "red_flag_indicators": { "value": [ "Invoice unit price deviates materially from published market benchmarks or comparable arm's-length transactions for the same commodity", "Declared import or export value for a commodity inconsistent with data from trade partner customs authorities (mirror data discrepancy)", "Goods described as high-value items (electronics, vehicles, metals) traded between related or affiliated parties at atypical prices", "Multiple invoices from different entities for the same shipment at varying prices", "Commodity most likely to be used in misinvoicing: cars/transport, metals/minerals, agricultural products, textiles (consistent with FATF risk sectors)", "Counterparty located in a jurisdiction on FATF high-risk list or identified as a known TBML hub", "Payment method inconsistent with trade value (e.g., full advance cash payment for large commodity shipment to unknown counterparty)" ], "source_path": "entries[typology_id=fim-typ-008].indicators" }, "confidence": { "value": "High", "source_path": "entries[typology_id=fim-typ-008].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-008].source_tier" }, "primary_source_url": { "value": "https://home.treasury.gov/system/files/246/best-practices-paper-Trade-based-ML-062008.pdf", "source_path": "entries[typology_id=fim-typ-008].primary_source_url" } }, { "typology_id": { "value": "fim-typ-009", "source_path": "entries[typology_id=fim-typ-009].typology_id" }, "name": { "value": "Russian Export Control Evasion via Third-Country Transshipment", "source_path": "entries[typology_id=fim-typ-009].name" }, "category": { "value": "sanctions_evasion", "source_path": "entries[typology_id=fim-typ-009].category" }, "pillar": { "value": [ "AML", "CPF" ], "source_path": "entries[typology_id=fim-typ-009].pillar" }, "domain_refs": { "value": [ "D1" ], "source_path": "entries[typology_id=fim-typ-009].domain_refs" }, "jurisdictions": { "value": [ "RU", "AM", "AZ", "GE", "KZ", "TR", "AE", "RS", "CN", "HK" ], "source_path": "entries[typology_id=fim-typ-009].typical_jurisdictions" }, "products": { "value": [ "front company", "shell company", "trade finance document", "freight-forwarding entity", "correspondent account" ], "source_path": "entries[typology_id=fim-typ-009].instruments_exploited" }, "red_flag_indicators": { "value": [ "Final destination on export documentation is a freight-forwarding or logistics entity in a third country with no history in the relevant goods sector", "Declared commodity description does not match the harmonised tariff code or the stated business of the consignee", "Goods described as high-risk per published commodity-of-concern lists (advanced semiconductors, drone components, night-vision optics)", "Transshipment hub jurisdictions known to be used for Russian rerouting (e.g., AM, AZ, GE, KZ, TR, AE, RS)", "Sudden spike in exports of controlled goods from the domestic jurisdiction to a third country with no prior trade relationship in those goods", "Trade documentation contains inconsistencies in dates, HS codes, or shipper details across related documents (invoice, packing list, bill of lading)", "Payment via newly established account or non-bank financial institution in a jurisdiction outside of main trading-partner list" ], "source_path": "entries[typology_id=fim-typ-009].indicators" }, "confidence": { "value": "High", "source_path": "entries[typology_id=fim-typ-009].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-009].source_tier" }, "primary_source_url": { "value": "https://www.fincen.gov/system/files/shared/FTA_Russian_Export_Controls_FINAL_508.pdf", "source_path": "entries[typology_id=fim-typ-009].primary_source_url" } }, { "typology_id": { "value": "fim-typ-010", "source_path": "entries[typology_id=fim-typ-010].typology_id" }, "name": { "value": "Artisanal Gold Laundering via Conflict-Zone Supply Chains", "source_path": "entries[typology_id=fim-typ-010].name" }, "category": { "value": "placement", "source_path": "entries[typology_id=fim-typ-010].category" }, "pillar": { "value": [ "AML", "CTF" ], "source_path": "entries[typology_id=fim-typ-010].pillar" }, "domain_refs": { "value": [ "D4" ], "source_path": "entries[typology_id=fim-typ-010].domain_refs" }, "jurisdictions": { "value": [ "CD", "ML", "BF", "NE", "TD", "SS", "SD", "CF", "AE", "CH", "TR", "UG", "RW" ], "source_path": "entries[typology_id=fim-typ-010].typical_jurisdictions" }, "products": { "value": [ "front company", "cash", "informal value transfer", "trade finance document", "free-zone entity" ], "source_path": "entries[typology_id=fim-typ-010].instruments_exploited" }, "red_flag_indicators": { "value": [ "Declared export value per kilogram of gold materially below the London Bullion Market Association spot price for the declared purity", "Large discrepancy between gold quantity reported as exported by the country of origin and gold quantity reported as imported by the destination country (mirror-data gap)", "Gold originating from Sahel, DRC, CAR, Sudan, or South Sudan routed through UAE, Switzerland, or Turkey with no independently verifiable chain-of-custody documentation", "Certification documentation from schemes (e.g., ITSCI bag-and-tag) where field verification of mine-site compliance is absent or minimal", "Exporting entity registered as a gold dealer or trading company with no independently verifiable physical premises or operational staff", "Gold declared as doré (unrefined) but priced at refined-gold parity, or vice versa", "Evidence of armed-group taxation points, protection arrangements, or physical control at or near declared mine sites", "Payments to artisanal miners or local buyers made in cash or informal value transfer systems with no paper trail" ], "source_path": "entries[typology_id=fim-typ-010].indicators" }, "confidence": { "value": "High", "source_path": "entries[typology_id=fim-typ-010].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-010].source_tier" }, "primary_source_url": { "value": "https://www.unodc.org/documents/data-and-analysis/tocta_sahel/TOCTA_Sahel_Gold_v5.pdf", "source_path": "entries[typology_id=fim-typ-010].primary_source_url" } }, { "typology_id": { "value": "fim-typ-011", "source_path": "entries[typology_id=fim-typ-011].typology_id" }, "name": { "value": "Conflict Mineral Certification Fraud (3T Metals)", "source_path": "entries[typology_id=fim-typ-011].name" }, "category": { "value": "placement", "source_path": "entries[typology_id=fim-typ-011].category" }, "pillar": { "value": [ "AML", "CTF" ], "source_path": "entries[typology_id=fim-typ-011].pillar" }, "domain_refs": { "value": [ "D4" ], "source_path": "entries[typology_id=fim-typ-011].domain_refs" }, "jurisdictions": { "value": [ "CD", "RW", "BI", "UG", "CF", "TZ", "AE", "BE", "DE" ], "source_path": "entries[typology_id=fim-typ-011].typical_jurisdictions" }, "products": { "value": [ "certification document", "front company", "trade finance document", "cash" ], "source_path": "entries[typology_id=fim-typ-011].instruments_exploited" }, "red_flag_indicators": { "value": [ "Large volumes of minerals entering a certification scheme from a site or region where field verification coverage is minimal or absent", "Certification records showing mine-site origin that is inconsistent with known licensed-mining operations in the area", "Miners or local traders presenting certification documents for quantities exceeding plausible production capacity of the declared site", "Field monitors employed by certification scheme have financial or personal relationships with local traders or armed-group intermediaries", "Customs declarations for certified minerals inconsistent with quantities certified (over- or under-reporting at export)", "Sudden spike in certified export volumes from a region following degradation in government security or expansion of armed-group territory", "Minerals declared as originating in one country but physical evidence (ore composition, isotope profile) consistent with different origin" ], "source_path": "entries[typology_id=fim-typ-011].indicators" }, "confidence": { "value": "Assessed", "source_path": "entries[typology_id=fim-typ-011].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-011].source_tier" }, "primary_source_url": { "value": "https://www.oecd.org/content/dam/oecd/en/publications/reports/2016/04/oecd-due-diligence-guidance-for-responsible-supply-chains-of-minerals-from-conflict-affected-and-high-risk-areas_g1g65996/9789264252479-en.pdf", "source_path": "entries[typology_id=fim-typ-011].primary_source_url" } }, { "typology_id": { "value": "fim-typ-012", "source_path": "entries[typology_id=fim-typ-012].typology_id" }, "name": { "value": "Armed Group Revenue Extraction from Extractive Industries", "source_path": "entries[typology_id=fim-typ-012].name" }, "category": { "value": "terrorist_financing", "source_path": "entries[typology_id=fim-typ-012].category" }, "pillar": { "value": [ "CTF", "AML" ], "source_path": "entries[typology_id=fim-typ-012].pillar" }, "domain_refs": { "value": [ "D4" ], "source_path": "entries[typology_id=fim-typ-012].domain_refs" }, "jurisdictions": { "value": [ "ML", "BF", "NE", "CD", "CF", "SS", "SD", "SO", "LY" ], "source_path": "entries[typology_id=fim-typ-012].typical_jurisdictions" }, "products": { "value": [ "cash", "informal value transfer", "gold (physical)", "front company" ], "source_path": "entries[typology_id=fim-typ-012].instruments_exploited" }, "red_flag_indicators": { "value": [ "Mining site located within geographic perimeter associated with armed-group activity per publicly available conflict-incident databases (ACLED etc.)", "Local mine operators making unexplained payments to non-government actors at access checkpoints documented by field investigators or satellite imagery", "Prefinancing arrangements with unidentified external investors who take possession of gold output without commercial documentation", "Informal money transfers between mining communities and known terrorist-financing jurisdictions without verifiable commercial purpose", "Artisanal mining output sold exclusively through single unlicensed buyer with strong social or coercive ties to armed group leadership", "Evidence of forced labour or extortion at mine site corroborated by humanitarian reporting or court records", "Funds flowing from mining proceeds to import of weapons components, fuel, communications equipment consistent with armed-group logistics" ], "source_path": "entries[typology_id=fim-typ-012].indicators" }, "confidence": { "value": "Assessed", "source_path": "entries[typology_id=fim-typ-012].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-012].source_tier" }, "primary_source_url": { "value": "https://www.unodc.org/documents/data-and-analysis/tocta_sahel/TOCTA_Sahel_Gold_v5.pdf", "source_path": "entries[typology_id=fim-typ-012].primary_source_url" } }, { "typology_id": { "value": "fim-typ-013", "source_path": "entries[typology_id=fim-typ-013].typology_id" }, "name": { "value": "Virtual Currency Mixer and Tumbler Obfuscation", "source_path": "entries[typology_id=fim-typ-013].name" }, "category": { "value": "crypto_obfuscation", "source_path": "entries[typology_id=fim-typ-013].category" }, "pillar": { "value": [ "AML", "CTF", "CPF" ], "source_path": "entries[typology_id=fim-typ-013].pillar" }, "domain_refs": { "value": [ "D5" ], "source_path": "entries[typology_id=fim-typ-013].domain_refs" }, "jurisdictions": { "value": [ "RU", "KP", "IR", "US", "GB", "EU" ], "source_path": "entries[typology_id=fim-typ-013].typical_jurisdictions" }, "products": { "value": [ "mixer contract", "privacy coin", "non-custodial wallet", "stablecoin" ], "source_path": "entries[typology_id=fim-typ-013].instruments_exploited" }, "red_flag_indicators": { "value": [ "Customer initiates a transfer of virtual currency to a known mixing service address or to an address cluster associated with mixing behaviour", "On-chain analytics identify a wallet as having received funds that pass through a mixer contract before reaching the customer's account", "Customer receives virtual currency from an external wallet then immediately initiates multiple rapid trades among different CVCs with no apparent investment purpose, followed by an off-platform transfer", "Transaction pattern shows equal-value outputs dispersed to multiple addresses (classic tumbler output signature)", "IP addresses used to initiate transactions originate from Tor, VPN exit nodes, or jurisdictions flagged by OFAC or FATF", "Virtual currency wallet address appears on OFAC SDN list (e.g., Tornado Cash designation August 2022)", "Customer uses a non-custodial wallet and privacy coin (e.g., Monero, Zcash) in conjunction with mixing service to maximise obfuscation" ], "source_path": "entries[typology_id=fim-typ-013].indicators" }, "confidence": { "value": "High", "source_path": "entries[typology_id=fim-typ-013].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-013].source_tier" }, "primary_source_url": { "value": "https://www.fincen.gov/sites/default/files/2022-03/FinCEN%20Alert%20Russian%20Sanctions%20Evasion%20FINAL%20508.pdf", "source_path": "entries[typology_id=fim-typ-013].primary_source_url" } }, { "typology_id": { "value": "fim-typ-014", "source_path": "entries[typology_id=fim-typ-014].typology_id" }, "name": { "value": "Cross-Chain Bridge and DeFi Protocol Laundering", "source_path": "entries[typology_id=fim-typ-014].name" }, "category": { "value": "crypto_obfuscation", "source_path": "entries[typology_id=fim-typ-014].category" }, "pillar": { "value": [ "AML", "CPF" ], "source_path": "entries[typology_id=fim-typ-014].pillar" }, "domain_refs": { "value": [ "D5" ], "source_path": "entries[typology_id=fim-typ-014].domain_refs" }, "jurisdictions": { "value": [ "KP", "RU", "CN", "US", "SG" ], "source_path": "entries[typology_id=fim-typ-014].typical_jurisdictions" }, "products": { "value": [ "mixer contract", "stablecoin", "DEX protocol", "cross-chain bridge", "non-custodial wallet" ], "source_path": "entries[typology_id=fim-typ-014].instruments_exploited" }, "red_flag_indicators": { "value": [ "Stolen or illicitly labelled funds swapped within minutes of leaving the origin address via a DEX into a token not associated with the original theft", "Funds routed through one or more cross-chain bridge contracts between different blockchain networks in rapid succession", "Transaction graph shows funds entering a bridge contract from an address flagged as illicit and exiting on a different chain to a new wallet not previously associated with that actor", "Use of layer-2 networks (e.g., Arbitrum, Optimism, Polygon) as intermediate hops between bridge protocols", "Funds reaching a centralised exchange after cross-chain obfuscation originate from wallets connected to hack events, ransomware, or sanctioned entities per blockchain analytics", "High-value rapid automated-market-maker swaps from high-liquidity tokens into low-liquidity privacy-adjacent tokens followed by withdrawal to unhosted wallets" ], "source_path": "entries[typology_id=fim-typ-014].indicators" }, "confidence": { "value": "High", "source_path": "entries[typology_id=fim-typ-014].confidence" }, "source_tier": { "value": 2, "source_path": "entries[typology_id=fim-typ-014].source_tier" }, "primary_source_url": { "value": "https://www.elliptic.co/hubfs/The%20state%20of%20cross-chain%20crime%202025/The%20state%20of%20cross-chain%20crime%202025%20-%20FINAL.pdf", "source_path": "entries[typology_id=fim-typ-014].primary_source_url" } }, { "typology_id": { "value": "fim-typ-015", "source_path": "entries[typology_id=fim-typ-015].typology_id" }, "name": { "value": "State-Sponsored Cyber Heist and Virtual Asset Theft (DPRK Pattern)", "source_path": "entries[typology_id=fim-typ-015].name" }, "category": { "value": "proliferation_financing", "source_path": "entries[typology_id=fim-typ-015].category" }, "pillar": { "value": [ "CPF", "AML" ], "source_path": "entries[typology_id=fim-typ-015].pillar" }, "domain_refs": { "value": [ "D5", "D1" ], "source_path": "entries[typology_id=fim-typ-015].domain_refs" }, "jurisdictions": { "value": [ "KP", "CN", "SG", "AE", "VN" ], "source_path": "entries[typology_id=fim-typ-015].typical_jurisdictions" }, "products": { "value": [ "stablecoin", "mixer contract", "cross-chain bridge", "non-custodial wallet", "OTC desk" ], "source_path": "entries[typology_id=fim-typ-015].instruments_exploited" }, "red_flag_indicators": { "value": [ "Exchange or protocol hack proceeds immediately routed to wallets displaying transaction patterns consistent with DPRK Lazarus Group (e.g., use of Tornado Cash, Blender, cross-chain bridges to Bitcoin)", "Large-volume virtual asset theft followed by rapid sequential swaps through multiple token types within hours of the compromise event", "Stolen funds eventually appear at OTC brokers in high-risk jurisdictions accepting large-volume BTC or ETH for fiat conversion without KYC", "On-chain analytics link wallet clusters to addresses previously sanctioned by OFAC in connection with DPRK programmes", "Phishing or social-engineering attacks targeting exchange employees using fabricated job offers linked to North Korean state entities", "NFT investor accounts targeted by approvals-phishing attacks draining wallet contents to addresses connected to DPRK laundering clusters" ], "source_path": "entries[typology_id=fim-typ-015].indicators" }, "confidence": { "value": "High", "source_path": "entries[typology_id=fim-typ-015].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-015].source_tier" }, "primary_source_url": { "value": "https://www.fincen.gov/news/news-releases/readout-fincen-hosts-public-private-dialogue-countering-dprks-illicit-cyber", "source_path": "entries[typology_id=fim-typ-015].primary_source_url" } }, { "typology_id": { "value": "fim-typ-016", "source_path": "entries[typology_id=fim-typ-016].typology_id" }, "name": { "value": "Pig-Butchering (Sha Zhu Pan) Virtual Currency Investment Fraud", "source_path": "entries[typology_id=fim-typ-016].name" }, "category": { "value": "crypto_obfuscation", "source_path": "entries[typology_id=fim-typ-016].category" }, "pillar": { "value": [ "AML" ], "source_path": "entries[typology_id=fim-typ-016].pillar" }, "domain_refs": { "value": [ "D5" ], "source_path": "entries[typology_id=fim-typ-016].domain_refs" }, "jurisdictions": { "value": [ "KH", "LA", "MM", "CN", "PH", "AE", "US", "GB" ], "source_path": "entries[typology_id=fim-typ-016].typical_jurisdictions" }, "products": { "value": [ "stablecoin", "non-custodial wallet", "fraudulent VASP", "wire transfer" ], "source_path": "entries[typology_id=fim-typ-016].instruments_exploited" }, "red_flag_indicators": { "value": [ "Customer with no history of virtual currency activity suddenly attempts high-value fiat-to-virtual-currency exchange following unsolicited online contact", "Customer mentions a new online contact who advised them about a virtual currency investment opportunity with exceptionally high returns", "Customer liquidates long-term savings accounts (certificates of deposit, pension, HELOC) to fund virtual currency purchases directed by a third party", "Funds sent to addresses associated with VASP that are non-registered or recently registered and have characteristics of fraudulent platforms (spoofed domain, no physical address, recent domain registration)", "Multiple device IDs and IP addresses accessing the same customer account, inconsistent with the customer's normal access patterns", "Customer deposits virtual currency and account immediately shows reported gains; customer then attempts to withdraw but is presented with demands for 'taxes' or 'fees' before release", "Received virtual currency (often TRX or stablecoins) immediately converted and transferred out of exchange without further investment activity", "Wire transfers to holding companies, LLCs, or individuals with no prior transaction history in rapid succession escalating in value" ], "source_path": "entries[typology_id=fim-typ-016].indicators" }, "confidence": { "value": "High", "source_path": "entries[typology_id=fim-typ-016].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-016].source_tier" }, "primary_source_url": { "value": "https://www.fincen.gov/system/files/shared/FinCEN_Alert_Pig_Butchering_FINAL_508c.pdf", "source_path": "entries[typology_id=fim-typ-016].primary_source_url" } }, { "typology_id": { "value": "fim-typ-017", "source_path": "entries[typology_id=fim-typ-017].typology_id" }, "name": { "value": "Stablecoin P2P Transfer for Sanctions and Capital Controls Evasion", "source_path": "entries[typology_id=fim-typ-017].name" }, "category": { "value": "crypto_obfuscation", "source_path": "entries[typology_id=fim-typ-017].category" }, "pillar": { "value": [ "AML", "CPF", "CTF" ], "source_path": "entries[typology_id=fim-typ-017].pillar" }, "domain_refs": { "value": [ "D5", "D1" ], "source_path": "entries[typology_id=fim-typ-017].domain_refs" }, "jurisdictions": { "value": [ "RU", "IR", "KP", "VE", "CN", "AE", "TR" ], "source_path": "entries[typology_id=fim-typ-017].typical_jurisdictions" }, "products": { "value": [ "stablecoin", "non-custodial wallet", "unhosted wallet", "mixer contract" ], "source_path": "entries[typology_id=fim-typ-017].instruments_exploited" }, "red_flag_indicators": { "value": [ "Large-value stablecoin transfers between unhosted wallets without any VASP as counterparty, inconsistent with claimed personal use", "Stablecoin transactions originating from IP addresses in sanctioned jurisdictions or using VPN/Tor obfuscation", "Customer deposits stablecoins received from unhosted wallets at a VASP where the source chain history shows direct or indirect links to sanctioned-entity wallets", "P2P stablecoin transactions structured in amounts below reporting thresholds across multiple transfers within a short period (structuring pattern)", "High-frequency USDT-TRC20 transactions between wallets in jurisdictions with no VASP oversight of P2P activity", "Smart contract controls such as freeze and burn functions not implemented by issuer on wallets involved in sanctioned-jurisdiction transactions", "Stablecoin redemption at issuer level by entity with no verifiable commercial rationale for holding large stablecoin balances" ], "source_path": "entries[typology_id=fim-typ-017].indicators" }, "confidence": { "value": "Assessed", "source_path": "entries[typology_id=fim-typ-017].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-017].source_tier" }, "primary_source_url": { "value": "https://www.fatf-gafi.org/en/publications/Virtualassets/targeted-report-stablecoins-unhosted-wallets.html", "source_path": "entries[typology_id=fim-typ-017].primary_source_url" } }, { "typology_id": { "value": "fim-typ-018", "source_path": "entries[typology_id=fim-typ-018].typology_id" }, "name": { "value": "High-Value Asset Layering for Sanctioned-Person Wealth Preservation", "source_path": "entries[typology_id=fim-typ-018].name" }, "category": { "value": "sanctions_evasion", "source_path": "entries[typology_id=fim-typ-018].category" }, "pillar": { "value": [ "AML", "CPF" ], "source_path": "entries[typology_id=fim-typ-018].pillar" }, "domain_refs": { "value": [ "D1", "D2" ], "source_path": "entries[typology_id=fim-typ-018].domain_refs" }, "jurisdictions": { "value": [ "AE", "CH", "MC", "GB", "US", "CY", "MT", "LU", "SG", "AU" ], "source_path": "entries[typology_id=fim-typ-018].typical_jurisdictions" }, "products": { "value": [ "shell company", "trust", "real estate", "art", "yacht", "aircraft", "precious metals" ], "source_path": "entries[typology_id=fim-typ-018].instruments_exploited" }, "red_flag_indicators": { "value": [ "Purchase or sale of luxury real estate, yacht, or aircraft by a shell company or trust with opaque beneficial ownership and links to a sanctioned jurisdiction", "Acquisition or disposal of high-value artwork through auction house or private sale with payment routed through non-bank intermediaries or third-party accounts", "Insurance policy on high-value asset transferred to or from an entity linked to a sanctioned person within 90 days of a designation event", "High-value asset purchased in an all-cash or non-bank financed transaction by a newly incorporated entity with no prior transaction history", "Precious metals, jewellery, or gems used as physical value stores transported across borders with declarations materially below market value", "Non-residential real estate entity formed in a jurisdiction that does not require disclosure of beneficial ownership for property registration", "Purchase price for real estate above or below independently assessed market value, consistent with value-transfer rather than arm's-length purchase" ], "source_path": "entries[typology_id=fim-typ-018].indicators" }, "confidence": { "value": "High", "source_path": "entries[typology_id=fim-typ-018].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-018].source_tier" }, "primary_source_url": { "value": "https://home.treasury.gov/system/files/136/REPO_Joint_Advisory.pdf", "source_path": "entries[typology_id=fim-typ-018].primary_source_url" } }, { "typology_id": { "value": "fim-typ-019", "source_path": "entries[typology_id=fim-typ-019].typology_id" }, "name": { "value": "Correspondent Account Shadow Banking (Iranian Pattern)", "source_path": "entries[typology_id=fim-typ-019].name" }, "category": { "value": "sanctions_evasion", "source_path": "entries[typology_id=fim-typ-019].category" }, "pillar": { "value": [ "AML", "CPF" ], "source_path": "entries[typology_id=fim-typ-019].pillar" }, "domain_refs": { "value": [ "D1", "D3" ], "source_path": "entries[typology_id=fim-typ-019].domain_refs" }, "jurisdictions": { "value": [ "IR", "IQ", "TR", "AE", "CN", "KZ", "OM" ], "source_path": "entries[typology_id=fim-typ-019].typical_jurisdictions" }, "products": { "value": [ "correspondent account", "nested correspondent account", "wire transfer" ], "source_path": "entries[typology_id=fim-typ-019].instruments_exploited" }, "red_flag_indicators": { "value": [ "Correspondent account transactions involving a respondent bank in a jurisdiction adjacent to a sanctioned country showing unusual volume spikes inconsistent with the respondent's known customer base", "Wire transfers where the originator or beneficiary information is incomplete, masked, or shows a non-sanctioned intermediary as principal party", "Respondent bank known to maintain correspondent relationships with financial institutions in sanctioned jurisdictions per supervisory intelligence", "Transaction patterns at U.S. correspondent accounts of foreign banks showing sudden non-routine foreign exchange activity inconsistent with prior 12-month baseline", "Payments routed through chains of three or more correspondent institutions across multiple jurisdictions before reaching the final beneficiary", "Accounts at non-sanctioned financial institutions experiencing sudden value increases with no clear business rationale, potentially consistent with sanctioned-country capital flight" ], "source_path": "entries[typology_id=fim-typ-019].indicators" }, "confidence": { "value": "Assessed", "source_path": "entries[typology_id=fim-typ-019].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-019].source_tier" }, "primary_source_url": { "value": "https://www.fincen.gov/system/files/2025-10/FTA-Iranian-Shadow-Banking.pdf", "source_path": "entries[typology_id=fim-typ-019].primary_source_url" } }, { "typology_id": { "value": "fim-typ-020", "source_path": "entries[typology_id=fim-typ-020].typology_id" }, "name": { "value": "Phantom Shipment Trade Fraud", "source_path": "entries[typology_id=fim-typ-020].name" }, "category": { "value": "TBML", "source_path": "entries[typology_id=fim-typ-020].category" }, "pillar": { "value": [ "AML" ], "source_path": "entries[typology_id=fim-typ-020].pillar" }, "domain_refs": { "value": [ "D3" ], "source_path": "entries[typology_id=fim-typ-020].domain_refs" }, "jurisdictions": { "value": [ "AE", "CN", "HK", "PK", "TR", "KH", "LA", "CO", "MX" ], "source_path": "entries[typology_id=fim-typ-020].typical_jurisdictions" }, "products": { "value": [ "trade finance document", "letter of credit", "correspondent account", "front company" ], "source_path": "entries[typology_id=fim-typ-020].instruments_exploited" }, "red_flag_indicators": { "value": [ "Bill of lading date, vessel name, or port of loading inconsistent with contemporaneous port records or shipping intelligence", "Cargo weight or volume declared on shipping documents inconsistent with the capacity of the vessel or container used", "Trade documentation references a vessel or carrier that does not exist or has a different registered service area", "Invoice issued by a counterparty with no verifiable operational existence (no registered address, no employees, newly incorporated)", "Payment for goods made in full before shipment by a counterparty with no established trading history with the exporter", "Trade finance facility drawdown with no corresponding evidence of goods receipt, customs clearance, or delivery confirmation", "Account turnover significantly exceeds the declared trade volume for the customer's stated business activity", "Multiple drawdowns on trade finance facilities within a short period for shipments to the same recipient without independent cargo confirmation" ], "source_path": "entries[typology_id=fim-typ-020].indicators" }, "confidence": { "value": "High", "source_path": "entries[typology_id=fim-typ-020].confidence" }, "source_tier": { "value": 1, "source_path": "entries[typology_id=fim-typ-020].source_tier" }, "primary_source_url": { "value": "https://uaefiu.gov.ae/media/vduba40z/updated-strategic-analysis-report-on-trade-based-money-laundering-rsas-2024.pdf", "source_path": "entries[typology_id=fim-typ-020].primary_source_url" } } ], "filters": { "jurisdiction": [ "AE", "AM", "AU", "AZ", "BE", "BF", "BI", "BZ", "CD", "CF", "CH", "CN", "CO", "CY", "DE", "EU", "GB", "GE", "GG", "HK", "IM", "IN", "IQ", "IR", "JE", "KH", "KP", "KY", "KZ", "LA", "LI", "LU", "LY", "MC", "MH", "ML", "MM", "MT", "MX", "NE", "NZ", "OM", "PA", "PH", "PK", "RS", "RU", "RW", "SC", "SD", "SG", "SO", "SS", "TD", "TR", "TZ", "UG", "US", "VE", "VG", "VN", "VU" ], "product": [ "DEX protocol", "OTC desk", "SLP", "aircraft", "art", "bearer share", "cash", "certification document", "client account", "correspondent account", "cross-chain bridge", "fraudulent VASP", "free-zone entity", "freight-forwarding entity", "freight-forwarding front", "front company", "gold (physical)", "informal value transfer", "legal trust account", "letter of credit", "mixer contract", "nested correspondent account", "nominee directorship", "non-custodial wallet", "precious metals", "privacy coin", "real estate", "registered-office service", "shelf company", "shell company", "stablecoin", "trade finance document", "trust", "unhosted wallet", "wire transfer", "yacht" ] }, "persona": "MLRO / financial-crime + typology analyst (COMMERCIAL-CONTEXT §2.1)", "note": "Verbatim render of operator-curated library (no new authorship). Filterable by jurisdiction + product." }, "corridor_risk": { "source_doc": "docs/monitors/financial-integrity/data/report-latest.json", "count": 4, "corridors": [ { "scheme_id": { "value": "huione-guarantee-marketplace", "source_path": "active_scheme_inventory[0].scheme_id" }, "scheme_name": { "value": "Huione/Xinbi guarantee-marketplace laundering infrastructure", "source_path": "active_scheme_inventory[0].scheme_name" }, "origin_jurisdiction": { "value": "KH", "source_path": "active_scheme_inventory[0].jurisdiction" }, "destination_jurisdiction": { "value": null, "source_path": null }, "domain": { "value": "D3", "source_path": "active_scheme_inventory[0].domain" }, "pillar": { "value": "AML", "source_path": "active_scheme_inventory[0].pillar" }, "actor_category": { "value": "A4", "source_path": "active_scheme_inventory[0].actor_category" }, "status": { "value": "active", "source_path": "active_scheme_inventory[0].status" }, "customer_typology": { "value": [ "VASP_counterparty", "correspondent_bank", "MSB" ], "source_path": "active_scheme_inventory[0].customer_typology" }, "red_flag_indicators": { "value": [ { "indicator": "Guarantee-marketplace intermediary receiving very high aggregate crypto inflow volumes routed through successor platforms after a primary platform takedown", "observability": "onchain", "linked_customer_typology": [ "VASP_counterparty" ] }, { "indicator": "Payments-arm volumes inconsistent with stated business profile and concentrated counterparties", "observability": "transaction_monitoring", "linked_customer_typology": [ "MSB", "VASP_counterparty" ] } ], "source_path": "active_scheme_inventory[0].red_flag_indicators" }, "description": { "value": "Cambodia-based guarantee-marketplace conglomerate model receiving over $31bn (marketplace) and $103bn (payments arm), laundering cyber-heist and pig-butchering proceeds; persists via successor Xinbi Guarantee despite FBI seizure, FinCEN Section 311 designation and Prince Group sanctions.", "source_path": "active_scheme_inventory[0].description" } }, { "scheme_id": { "value": "cmln-cartel-tbml-corridor", "source_path": "active_scheme_inventory[1].scheme_id" }, "scheme_name": { "value": "Chinese money-laundering network / cartel TBML corridor", "source_path": "active_scheme_inventory[1].scheme_name" }, "origin_jurisdiction": { "value": "MX", "source_path": "active_scheme_inventory[1].jurisdiction" }, "destination_jurisdiction": { "value": null, "source_path": null }, "domain": { "value": "D3", "source_path": "active_scheme_inventory[1].domain" }, "pillar": { "value": "AML", "source_path": "active_scheme_inventory[1].pillar" }, "actor_category": { "value": "A4", "source_path": "active_scheme_inventory[1].actor_category" }, "status": { "value": "active", "source_path": "active_scheme_inventory[1].status" }, "customer_typology": { "value": [ "MSB", "trade_finance", "correspondent_bank", "retail" ], "source_path": "active_scheme_inventory[1].customer_typology" }, "red_flag_indicators": { "value": [ { "indicator": "Structured cash transactions between $1,000 and $10,000 by MSBs in designated southwest-border counties", "observability": "transaction_monitoring", "linked_customer_typology": [ "MSB", "retail" ] }, { "indicator": "Mirror-transfer patterns and offsetting trade flows with no apparent economic rationale linking PRC and Mexican counterparties", "observability": "trade_docs", "linked_customer_typology": [ "trade_finance", "correspondent_bank" ] } ], "source_path": "active_scheme_inventory[1].red_flag_indicators" }, "description": { "value": "Chinese money-laundering networks service Sinaloa and other cartels via TBML, mirror transfers and the Chinese underground banking system, linking Mexican cartel cash, PRC capital-flight demand and US MSB/real-estate exposure into a single corridor.", "source_path": "active_scheme_inventory[1].description" } }, { "scheme_id": { "value": "serniya-majory-procurement", "source_path": "active_scheme_inventory[2].scheme_id" }, "scheme_name": { "value": "Serniya/Majory dual-use procurement network", "source_path": "active_scheme_inventory[2].scheme_name" }, "origin_jurisdiction": { "value": "RU", "source_path": "active_scheme_inventory[2].jurisdiction" }, "destination_jurisdiction": { "value": null, "source_path": null }, "domain": { "value": "D1", "source_path": "active_scheme_inventory[2].domain" }, "pillar": { "value": "cross-pillar", "source_path": "active_scheme_inventory[2].pillar" }, "actor_category": { "value": "A2", "source_path": "active_scheme_inventory[2].actor_category" }, "status": { "value": "active", "source_path": "active_scheme_inventory[2].status" }, "customer_typology": { "value": [ "corporate", "trade_finance", "correspondent_bank" ], "source_path": "active_scheme_inventory[2].customer_typology" }, "red_flag_indicators": { "value": [ { "indicator": "Third-country intermediary entities re-exporting controlled dual-use goods to higher-risk destinations shortly after import", "observability": "trade_docs", "linked_customer_typology": [ "trade_finance", "corporate" ] } ], "source_path": "active_scheme_inventory[2].red_flag_indicators" }, "description": { "value": "Procurement intermediaries (Serniya Inzhiniring, Majory LLP, Invention Bridge SL) routing dual-use technology to Russia's military-industrial base through third-country conduits.", "source_path": "active_scheme_inventory[2].description" } }, { "scheme_id": { "value": "isis-hawala-crypto-facilitation", "source_path": "active_scheme_inventory[3].scheme_id" }, "scheme_name": { "value": "ISIS hawala-to-crypto facilitation layer", "source_path": "active_scheme_inventory[3].scheme_name" }, "origin_jurisdiction": { "value": "AFR", "source_path": "active_scheme_inventory[3].jurisdiction" }, "destination_jurisdiction": { "value": null, "source_path": null }, "domain": { "value": "D5", "source_path": "active_scheme_inventory[3].domain" }, "pillar": { "value": "CTF", "source_path": "active_scheme_inventory[3].pillar" }, "actor_category": { "value": "A6", "source_path": "active_scheme_inventory[3].actor_category" }, "status": { "value": "active", "source_path": "active_scheme_inventory[3].status" }, "customer_typology": { "value": [ "MSB", "VASP_counterparty", "correspondent_bank" ], "source_path": "active_scheme_inventory[3].customer_typology" }, "red_flag_indicators": { "value": [ { "indicator": "Bureau-de-change and MSB transactions to crypto on-ramps with onward transfers to flagged TRON wallet addresses", "observability": "onchain", "linked_customer_typology": [ "MSB", "VASP_counterparty" ] } ], "source_path": "active_scheme_inventory[3].red_flag_indicators" }, "description": { "value": "Syria-based crypto exchange, Turkish MSBs and Nigerian bureaux de change moving crypto and cash for ISIS, with donor flows from Norway, Belgium, Netherlands, South Africa and the US, attaching identifiable TRON wallet addresses.", "source_path": "active_scheme_inventory[3].description" } } ], "_escalations": [ { "id": "A3-DRIFT-002", "severity": "medium", "finding": "No discrete origin×destination bilateral pair field in FIM output; corridor = single-jurisdiction scheme + free-text description.", "action": "origin_jurisdiction ← jurisdiction (literal); destination_jurisdiction emitted null (not fabricated). Pipeline must add a destination field for a true bilateral cell." } ], "persona": "MLRO / financial-crime — correspondent-banking / TBML lens (COMMERCIAL-CONTEXT §2.1)", "note": "Rendered from active_scheme_inventory[] (structured laundering-corridor records). Each cell cites its source field." }, "edd_trigger_flags": { "source_doc": "docs/monitors/financial-integrity/data/report-latest.json", "count": 7, "flags": [ { "jurisdiction": { "value": "US", "source_path": "jurisdiction_risk_tracker[0].jurisdiction" }, "edd_flag": "standard DD", "triggers_fired": [], "enforcement_vs_enablement": { "value": "enforcement", "source_path": "jurisdiction_risk_tracker[0].enforcement_vs_enablement" }, "risk_direction": { "value": "stable", "source_path": "jurisdiction_risk_tracker[0].risk_direction" } }, { "jurisdiction": { "value": "GB", "source_path": "jurisdiction_risk_tracker[1].jurisdiction" }, "edd_flag": "standard DD", "triggers_fired": [], "enforcement_vs_enablement": { "value": "mixed", "source_path": "jurisdiction_risk_tracker[1].enforcement_vs_enablement" }, "risk_direction": { "value": "stable", "source_path": "jurisdiction_risk_tracker[1].risk_direction" } }, { "jurisdiction": { "value": "EEA", "source_path": "jurisdiction_risk_tracker[2].jurisdiction" }, "edd_flag": "standard DD", "triggers_fired": [], "enforcement_vs_enablement": { "value": "enforcement", "source_path": "jurisdiction_risk_tracker[2].enforcement_vs_enablement" }, "risk_direction": { "value": "improving", "source_path": "jurisdiction_risk_tracker[2].risk_direction" } }, { "jurisdiction": { "value": "KH", "source_path": "jurisdiction_risk_tracker[3].jurisdiction" }, "edd_flag": "EDD REQUIRED", "triggers_fired": [ "enforcement_vs_enablement == capacity_deficit", "risk_direction == increasing" ], "enforcement_vs_enablement": { "value": "capacity_deficit", "source_path": "jurisdiction_risk_tracker[3].enforcement_vs_enablement" }, "risk_direction": { "value": "increasing", "source_path": "jurisdiction_risk_tracker[3].risk_direction" } }, { "jurisdiction": { "value": "MX", "source_path": "jurisdiction_risk_tracker[4].jurisdiction" }, "edd_flag": "EDD REQUIRED", "triggers_fired": [ "risk_direction == increasing" ], "enforcement_vs_enablement": { "value": "mixed", "source_path": "jurisdiction_risk_tracker[4].enforcement_vs_enablement" }, "risk_direction": { "value": "increasing", "source_path": "jurisdiction_risk_tracker[4].risk_direction" } }, { "jurisdiction": { "value": "CO", "source_path": "jurisdiction_risk_tracker[5].jurisdiction" }, "edd_flag": "EDD REQUIRED", "triggers_fired": [ "enforcement_vs_enablement == capacity_deficit" ], "enforcement_vs_enablement": { "value": "capacity_deficit", "source_path": "jurisdiction_risk_tracker[5].enforcement_vs_enablement" }, "risk_direction": { "value": "stable", "source_path": "jurisdiction_risk_tracker[5].risk_direction" } }, { "jurisdiction": { "value": "LA", "source_path": "jurisdiction_risk_tracker[6].jurisdiction" }, "edd_flag": "EDD REQUIRED", "triggers_fired": [ "enforcement_vs_enablement == capacity_deficit" ], "enforcement_vs_enablement": { "value": "capacity_deficit", "source_path": "jurisdiction_risk_tracker[6].enforcement_vs_enablement" }, "risk_direction": { "value": "stable", "source_path": "jurisdiction_risk_tracker[6].risk_direction" } } ], "rule": "EDD REQUIRED iff enforcement_vs_enablement == 'capacity_deficit' OR risk_direction == 'increasing'; else 'standard DD'.", "rule_alignment": "MLRs Reg 33 / HMT MLA high-risk concept (deterministic projection, not a new adjudication).", "persona": "MLRO / financial-crime — onboarding / periodic-review lens (COMMERCIAL-CONTEXT §2.1)", "note": "Binds to two literal per-jurisdiction signal fields (composite score absent — see A3-DRIFT-004)." }, "enforcement_feed": { "source_doc": "docs/monitors/financial-integrity/data/report-latest.json", "count": 2, "window": "last 12 months (as emitted by FIM pipeline; no re-derivation)", "sortable_by": [ "date", "regulator" ], "entries": [ { "action_id": { "value": "fbi-huione-2026-06", "source_path": "enforcement_actions[0].action_id" }, "regulator": { "value": "US DOJ / FBI", "source_path": "enforcement_actions[0].regulator" }, "breach_type": { "value": "money-laundering-infrastructure", "source_path": "enforcement_actions[0].breach_type" }, "date": { "value": "2026-06-23", "source_path": "enforcement_actions[0].date" }, "source_url": { "value": "https://www.elliptic.co/media-center/elliptic-intelligence-used-by-the-fbi-in-action-against-huione-group", "source_path": "enforcement_actions[0].source_url" }, "source_tier": { "value": "2", "source_path": "enforcement_actions[0].source_tier" }, "jurisdiction": { "value": null, "source_path": null } }, { "action_id": { "value": "fincen-sinaloa-casinos-2026-03", "source_path": "enforcement_actions[1].action_id" }, "regulator": { "value": "FinCEN", "source_path": "enforcement_actions[1].regulator" }, "breach_type": { "value": "AML-primary-money-laundering-concern", "source_path": "enforcement_actions[1].breach_type" }, "date": { "value": "2026-03-31", "source_path": "enforcement_actions[1].date" }, "source_url": { "value": "https://www.fincen.gov/news/news-releases/fincen-combats-financial-support-sinaloa-cartel-finding-transactions-involving", "source_path": "enforcement_actions[1].source_url" }, "source_tier": { "value": "1", "source_path": "enforcement_actions[1].source_tier" }, "jurisdiction": { "value": null, "source_path": null } } ], "_escalations": [ { "id": "A4-DRIFT-001", "severity": "medium", "finding": "enforcement_actions[] carry no discrete jurisdiction (JID) field; only a free-string `regulator`.", "action": "jurisdiction emitted null (not parsed from regulator string); regulator rendered verbatim as the literal jurisdiction-bearing signal. Pipeline must add a JID field for a true per-jurisdiction cut. BRIEF exit-gate §5.3 ('≥1 action for a tracked jurisdiction') is met in the render sense (≥1 action cites its source record) but the structured JID linkage is absent." } ], "persona": "MLRO / financial-crime (COMMERCIAL-CONTEXT §2.1)", "note": "Verbatim render of enforcement_actions[]; each entry cites its source record. Sortable by date + regulator." }, "source_tier_transparency": { "source_doc": "docs/monitors/financial-integrity/data/report-latest.json", "feed_proportions": { "enforcement_actions": { "total": 2, "tier1_count": 1, "tier2_count": 1, "tier1_share": 0.5, "tier2_share": 0.5, "source_paths": [ "enforcement_actions[0].source_tier", "enforcement_actions[1].source_tier" ] }, "sanctions_changes": { "total": 5, "tier1_count": 4, "tier2_count": 1, "tier1_share": 0.8, "tier2_share": 0.2, "source_paths": [ "sanctions_changes[0].source_tier", "sanctions_changes[1].source_tier", "sanctions_changes[2].source_tier", "sanctions_changes[3].source_tier", "sanctions_changes[4].source_tier" ] }, "regulatory_horizon": { "total": 8, "tier1_count": 8, "tier2_count": 0, "tier1_share": 1.0, "tier2_share": 0.0, "source_paths": [ "regulatory_horizon[0].source_tier", "regulatory_horizon[1].source_tier", "regulatory_horizon[2].source_tier", "regulatory_horizon[3].source_tier", "regulatory_horizon[4].source_tier", "regulatory_horizon[5].source_tier", "regulatory_horizon[6].source_tier", "regulatory_horizon[7].source_tier" ] }, "typology_library": { "total": 20, "tier1_count": 19, "tier2_count": 1, "tier1_share": 0.95, "tier2_share": 0.05, "source_paths": [ "entries[typology_id=fim-typ-001].source_tier", "entries[typology_id=fim-typ-002].source_tier", "entries[typology_id=fim-typ-003].source_tier", "entries[typology_id=fim-typ-004].source_tier", "entries[typology_id=fim-typ-005].source_tier", "entries[typology_id=fim-typ-006].source_tier", "entries[typology_id=fim-typ-007].source_tier", "entries[typology_id=fim-typ-008].source_tier", "entries[typology_id=fim-typ-009].source_tier", "entries[typology_id=fim-typ-010].source_tier", "entries[typology_id=fim-typ-011].source_tier", "entries[typology_id=fim-typ-012].source_tier", "entries[typology_id=fim-typ-013].source_tier", "entries[typology_id=fim-typ-014].source_tier", "entries[typology_id=fim-typ-015].source_tier", "entries[typology_id=fim-typ-016].source_tier", "entries[typology_id=fim-typ-017].source_tier", "entries[typology_id=fim-typ-018].source_tier", "entries[typology_id=fim-typ-019].source_tier", "entries[typology_id=fim-typ-020].source_tier" ] } }, "risk_score_proportion": { "value": null, "source_path": null }, "_escalations": [ { "id": "A4-DRIFT-002", "severity": "high", "finding": "A3 per-jurisdiction risk scores carry no literal per-score tier field: jurisdiction_risk_tracker[].source_quality is null for all tracked JIDs, and composite_score/rag_band are live-null (A3-DRIFT-001).", "action": "Score-level T1/T2 proportion emitted null (not fabricated); the null composite is NOT decorated. Feed-level proportions (enforcement/sanctions/horizon/typology) ARE literal-field-backed and displayed. Pipeline must emit a per-component source_tier before A3 scores can carry a proportion." } ], "persona": "MLRO / financial-crime + GC (COMMERCIAL-CONTEXT §2.1)", "note": "T1/T2 share per feed = count of source_tier=='1'/'2' over total; each proportion cites its literal source_tier paths. Tiers displayed as emitted (not re-derived)." }, "horizon_feed": { "source_doc": "docs/monitors/financial-integrity/data/report-latest.json", "horizon_count": 8, "standing_count": 6, "horizon": [ { "horizon_id": { "value": "fim-reg-2026-001", "source_path": "regulatory_horizon[0].horizon_id" }, "title": { "value": "UK ECCTA 2023 failure-to-prevent-fraud offence enforcement maturation", "source_path": "regulatory_horizon[0].title" }, "instrument_type": { "value": "enforcement_policy", "source_path": "regulatory_horizon[0].instrument_type" }, "stage": { "value": "in_force", "source_path": "regulatory_horizon[0].stage" }, "expected_date": { "value": "2026-Q3", "source_path": "regulatory_horizon[0].expected_date" }, "estimated_impact_date": { "value": "2026-Q3", "source_path": "regulatory_horizon[0].estimated_impact_date" }, "uncertainty_band": { "value": "half_year", "source_path": "regulatory_horizon[0].uncertainty_band" }, "risk_direction_on_implementation": { "value": "improving", "source_path": "regulatory_horizon[0].risk_direction_on_implementation" }, "affected_jurisdictions": { "value": [ "GB" ], "source_path": "regulatory_horizon[0].affected_jurisdictions" }, "what_changes": { "value": "Large organisations with a UK nexus face strict-liability corporate exposure where an associated person commits a base fraud offence intending to benefit the organisation; the identification-doctrine reform broadens attribution to senior managers.", "source_path": "regulatory_horizon[0].what_changes" }, "gap_assessment": { "value": "Offence in force since 1 September 2025 for large organisations; general industry practice is still maturing reasonable-prevention procedures aligned to Home Office guidance, and first prosecutions/DPA outcomes are pending, leaving the reasonableness benchmark untested.", "source_path": "regulatory_horizon[0].gap_assessment" }, "primary_source_url": { "value": "https://www.gov.uk/government/publications/offence-of-failure-to-prevent-fraud-introduced-by-eccta", "source_path": "regulatory_horizon[0].primary_source_url" }, "confidence": { "value": "High", "source_path": "regulatory_horizon[0].confidence" }, "source_tier": { "value": "1", "source_path": "regulatory_horizon[0].source_tier" } }, { "horizon_id": { "value": "fim-reg-2027-001", "source_path": "regulatory_horizon[1].horizon_id" }, "title": { "value": "EU AML Regulation (2024/1624) / 6AMLD application date", "source_path": "regulatory_horizon[1].title" }, "instrument_type": { "value": "regulation", "source_path": "regulatory_horizon[1].instrument_type" }, "stage": { "value": "adopted", "source_path": "regulatory_horizon[1].stage" }, "expected_date": { "value": "2027-Q3", "source_path": "regulatory_horizon[1].expected_date" }, "estimated_impact_date": { "value": "2027-Q3", "source_path": "regulatory_horizon[1].estimated_impact_date" }, "uncertainty_band": { "value": "year", "source_path": "regulatory_horizon[1].uncertainty_band" }, "risk_direction_on_implementation": { "value": "improving", "source_path": "regulatory_horizon[1].risk_direction_on_implementation" }, "affected_jurisdictions": { "value": [ "DE", "FR", "IE", "NL", "LU", "MT", "CY" ], "source_path": "regulatory_horizon[1].affected_jurisdictions" }, "what_changes": { "value": "The single AML rulebook (AMLR) becomes directly applicable and 6AMLD transposition deadlines bite across Member States, with AMLA direct supervision of up to 40 high-risk cross-border groups.", "source_path": "regulatory_horizon[1].what_changes" }, "gap_assessment": { "value": "Directly applicable single rulebook supersedes divergent national transpositions; general industry readiness varies widely across newly in-scope obliged-entity categories.", "source_path": "regulatory_horizon[1].gap_assessment" }, "primary_source_url": { "value": "https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-eu-level_en", "source_path": "regulatory_horizon[1].primary_source_url" }, "confidence": { "value": "High", "source_path": "regulatory_horizon[1].confidence" }, "source_tier": { "value": "1", "source_path": "regulatory_horizon[1].source_tier" } }, { "horizon_id": { "value": "fim-reg-2026-050", "source_path": "regulatory_horizon[2].horizon_id" }, "title": { "value": "AMLA Work Programme / supervisory build-out", "source_path": "regulatory_horizon[2].title" }, "instrument_type": { "value": "regulation", "source_path": "regulatory_horizon[2].instrument_type" }, "stage": { "value": "in_force_pending", "source_path": "regulatory_horizon[2].stage" }, "expected_date": { "value": "2026-H2", "source_path": "regulatory_horizon[2].expected_date" }, "estimated_impact_date": { "value": "2026-H2", "source_path": "regulatory_horizon[2].estimated_impact_date" }, "uncertainty_band": { "value": "half_year", "source_path": "regulatory_horizon[2].uncertainty_band" }, "risk_direction_on_implementation": { "value": "improving", "source_path": "regulatory_horizon[2].risk_direction_on_implementation" }, "affected_jurisdictions": { "value": [ "DE", "FR", "IE", "NL", "LU", "MT", "CY" ], "source_path": "regulatory_horizon[2].affected_jurisdictions" }, "what_changes": { "value": "AMLA stands up in Frankfurt and publishes its first supervisory methodology, identifying obliged entities eligible for direct supervision.", "source_path": "regulatory_horizon[2].what_changes" }, "gap_assessment": { "value": "AMLA moved from establishment to operational supervisory build-out; direct-supervision eligibility methodology published 10 June, with BO registry interconnection a core deliverable.", "source_path": "regulatory_horizon[2].gap_assessment" }, "primary_source_url": { "value": "https://finance.ec.europa.eu/financial-crime/amla_en/", "source_path": "regulatory_horizon[2].primary_source_url" }, "confidence": { "value": "High", "source_path": "regulatory_horizon[2].confidence" }, "source_tier": { "value": "1", "source_path": "regulatory_horizon[2].source_tier" } }, { "horizon_id": { "value": "fim-reg-2028-001", "source_path": "regulatory_horizon[3].horizon_id" }, "title": { "value": "AMLA direct supervision of selected obliged entities", "source_path": "regulatory_horizon[3].title" }, "instrument_type": { "value": "regulation", "source_path": "regulatory_horizon[3].instrument_type" }, "stage": { "value": "adopted", "source_path": "regulatory_horizon[3].stage" }, "expected_date": { "value": "2028-H1", "source_path": "regulatory_horizon[3].expected_date" }, "estimated_impact_date": { "value": "2028-H1", "source_path": "regulatory_horizon[3].estimated_impact_date" }, "uncertainty_band": { "value": "multi_year", "source_path": "regulatory_horizon[3].uncertainty_band" }, "risk_direction_on_implementation": { "value": "improving", "source_path": "regulatory_horizon[3].risk_direction_on_implementation" }, "affected_jurisdictions": { "value": [ "DE", "FR", "IE", "NL", "LU", "MT", "CY" ], "source_path": "regulatory_horizon[3].affected_jurisdictions" }, "what_changes": { "value": "AMLA begins direct supervision of a first cohort of high-risk cross-border obliged entities, shifting the supervisory perimeter from purely national authorities to a hybrid EU-level regime.", "source_path": "regulatory_horizon[3].what_changes" }, "gap_assessment": { "value": "General industry readiness for a hybrid EU-level supervisory regime varies; the cohort of high-risk cross-border obliged entities is being defined under the eligibility methodology.", "source_path": "regulatory_horizon[3].gap_assessment" }, "primary_source_url": { "value": "https://finance.ec.europa.eu/financial-crime/amla_en/", "source_path": "regulatory_horizon[3].primary_source_url" }, "confidence": { "value": "High", "source_path": "regulatory_horizon[3].confidence" }, "source_tier": { "value": "1", "source_path": "regulatory_horizon[3].source_tier" } }, { "horizon_id": { "value": "fim-reg-2026-002", "source_path": "regulatory_horizon[4].horizon_id" }, "title": { "value": "FinCEN Southwest Border GTO expiry/renewal window", "source_path": "regulatory_horizon[4].title" }, "instrument_type": { "value": "enforcement_policy", "source_path": "regulatory_horizon[4].instrument_type" }, "stage": { "value": "in_force", "source_path": "regulatory_horizon[4].stage" }, "expected_date": { "value": "2026-Q3", "source_path": "regulatory_horizon[4].expected_date" }, "estimated_impact_date": { "value": "2026-Q3", "source_path": "regulatory_horizon[4].estimated_impact_date" }, "uncertainty_band": { "value": "quarter", "source_path": "regulatory_horizon[4].uncertainty_band" }, "risk_direction_on_implementation": { "value": "uncertain", "source_path": "regulatory_horizon[4].risk_direction_on_implementation" }, "affected_jurisdictions": { "value": [ "US", "MX" ], "source_path": "regulatory_horizon[4].affected_jurisdictions" }, "what_changes": { "value": "MSBs in covered AZ, CA, NM and TX localities file CTRs for cash transactions $1,000-$10,000; expiry or further expansion alters the reporting perimeter.", "source_path": "regulatory_horizon[4].what_changes" }, "gap_assessment": { "value": "Current GTO runs to 2 September 2026 with a $1,000 CTR threshold for MSBs in designated counties; renewal/expansion decisions create recurring compliance-scope uncertainty versus standard $10,000 reporting practice.", "source_path": "regulatory_horizon[4].gap_assessment" }, "primary_source_url": { "value": "https://www.fincen.gov/news/news-releases/fincen-issues-expanded-southwest-border-geographic-targeting-order", "source_path": "regulatory_horizon[4].primary_source_url" }, "confidence": { "value": "High", "source_path": "regulatory_horizon[4].confidence" }, "source_tier": { "value": "1", "source_path": "regulatory_horizon[4].source_tier" } }, { "horizon_id": { "value": "fim-reg-2026-003", "source_path": "regulatory_horizon[5].horizon_id" }, "title": { "value": "FinCEN Section 311 Huione Group correspondent-account prohibition finalisation", "source_path": "regulatory_horizon[5].title" }, "instrument_type": { "value": "regulation", "source_path": "regulatory_horizon[5].instrument_type" }, "stage": { "value": "consultation", "source_path": "regulatory_horizon[5].stage" }, "expected_date": { "value": "2026-H2", "source_path": "regulatory_horizon[5].expected_date" }, "estimated_impact_date": { "value": "2026-H2", "source_path": "regulatory_horizon[5].estimated_impact_date" }, "uncertainty_band": { "value": "half_year", "source_path": "regulatory_horizon[5].uncertainty_band" }, "risk_direction_on_implementation": { "value": "improving", "source_path": "regulatory_horizon[5].risk_direction_on_implementation" }, "affected_jurisdictions": { "value": [ "US", "KH" ], "source_path": "regulatory_horizon[5].affected_jurisdictions" }, "what_changes": { "value": "Finalisation would sever Huione Group's US correspondent-banking access; the operating environment shifts as institutions face successor guarantee-marketplace infrastructure.", "source_path": "regulatory_horizon[5].what_changes" }, "gap_assessment": { "value": "The proposed rule would prohibit US institutions from maintaining correspondent/payable-through accounts for Huione Group; final-rule timing and scope relative to successor marketplaces (Xinbi) leave residual exposure-management uncertainty.", "source_path": "regulatory_horizon[5].gap_assessment" }, "primary_source_url": { "value": "https://www.fincen.gov/news/news-releases/fincen-finds-cambodia-based-huione-group-be-primary-money-laundering-concern", "source_path": "regulatory_horizon[5].primary_source_url" }, "confidence": { "value": "Assessed", "source_path": "regulatory_horizon[5].confidence" }, "source_tier": { "value": "1", "source_path": "regulatory_horizon[5].source_tier" } }, { "horizon_id": { "value": "fim-reg-2026-004", "source_path": "regulatory_horizon[6].horizon_id" }, "title": { "value": "UK HM Treasury National Risk Assessment refresh window", "source_path": "regulatory_horizon[6].title" }, "instrument_type": { "value": "guidance", "source_path": "regulatory_horizon[6].instrument_type" }, "stage": { "value": "proposed", "source_path": "regulatory_horizon[6].stage" }, "expected_date": { "value": "2026-2027", "source_path": "regulatory_horizon[6].expected_date" }, "estimated_impact_date": { "value": "2026-2027", "source_path": "regulatory_horizon[6].estimated_impact_date" }, "uncertainty_band": { "value": "year", "source_path": "regulatory_horizon[6].uncertainty_band" }, "risk_direction_on_implementation": { "value": "uncertain", "source_path": "regulatory_horizon[6].risk_direction_on_implementation" }, "affected_jurisdictions": { "value": [ "GB" ], "source_path": "regulatory_horizon[6].affected_jurisdictions" }, "what_changes": { "value": "Updated UK NRA and EU SNRA will reset national/supra-national risk baselines informing risk-based supervision and obliged-entity risk assessments.", "source_path": "regulatory_horizon[6].what_changes" }, "gap_assessment": { "value": "Next UK NRA refresh anticipated 2026-2027; EU SNRA refresh similarly pending. Where jurisdiction-risk rows lack a current NRA citation (e.g. Colombia this cycle), the absence is a noted collection gap.", "source_path": "regulatory_horizon[6].gap_assessment" }, "primary_source_url": { "value": "https://www.gov.uk/government/collections/uk-national-risk-assessment-of-money-laundering-and-terrorist-financing", "source_path": "regulatory_horizon[6].primary_source_url" }, "confidence": { "value": "Possible", "source_path": "regulatory_horizon[6].confidence" }, "source_tier": { "value": "1", "source_path": "regulatory_horizon[6].source_tier" } }, { "horizon_id": { "value": "fim-reg-2026-005", "source_path": "regulatory_horizon[7].horizon_id" }, "title": { "value": "FATF updated Recommendation 6 humanitarian exemption", "source_path": "regulatory_horizon[7].title" }, "instrument_type": { "value": "technical_standard", "source_path": "regulatory_horizon[7].instrument_type" }, "stage": { "value": "adopted", "source_path": "regulatory_horizon[7].stage" }, "expected_date": { "value": "2026-H2", "source_path": "regulatory_horizon[7].expected_date" }, "estimated_impact_date": { "value": "2026-H2", "source_path": "regulatory_horizon[7].estimated_impact_date" }, "uncertainty_band": { "value": "half_year", "source_path": "regulatory_horizon[7].uncertainty_band" }, "risk_direction_on_implementation": { "value": "improving", "source_path": "regulatory_horizon[7].risk_direction_on_implementation" }, "affected_jurisdictions": { "value": [ "US", "GB", "DE", "FR" ], "source_path": "regulatory_horizon[7].affected_jurisdictions" }, "what_changes": { "value": "Targeted-financial-sanctions frameworks must accommodate humanitarian carve-outs, altering how obliged entities treat exempt flows.", "source_path": "regulatory_horizon[7].what_changes" }, "gap_assessment": { "value": "R.6 amended to incorporate UNSCR 2664/2761 humanitarian exemptions; national implementation across regimes will lag the standard update.", "source_path": "regulatory_horizon[7].gap_assessment" }, "primary_source_url": { "value": "https://www.fatf-gafi.org/en/publications/Fatfgeneral/outcomes-fatf-plenary-june-2026.html", "source_path": "regulatory_horizon[7].primary_source_url" }, "confidence": { "value": "High", "source_path": "regulatory_horizon[7].confidence" }, "source_tier": { "value": "1", "source_path": "regulatory_horizon[7].source_tier" } } ], "standing_trackers": [ { "tracker_id": { "value": "T1", "source_path": "standing_trackers[0].tracker_id" }, "tracker_name": { "value": "Russian Sanctions-Evasion Architecture", "source_path": "standing_trackers[0].tracker_name" }, "status": { "value": "material_change", "source_path": "standing_trackers[0].status" }, "trajectory": { "value": "stable", "source_path": "standing_trackers[0].trajectory" }, "key_development": { "value": "OFAC continued procurement-network designations (Serniya/Majory-linked individuals) and processed Russia-related delistings (18/23/24 June), while extending Lukoil/LIG divestment licensing (GL 131F expires 28 June 2026) and Sakhalin-2 GL 55F to December 2026. Houthi/Yemen channels recorded no material change this cycle.", "source_path": "standing_trackers[0].key_development" } }, { "tracker_id": { "value": "T2", "source_path": "standing_trackers[1].tracker_id" }, "tracker_name": { "value": "EU AML Package / AMLA", "source_path": "standing_trackers[1].tracker_name" }, "status": { "value": "material_change", "source_path": "standing_trackers[1].status" }, "trajectory": { "value": "improving", "source_path": "standing_trackers[1].trajectory" }, "key_development": { "value": "AMLA reached operational milestones (first Frankfurt conference 9 June; direct-supervision eligibility methodology 10 June). AMLR (2024/1624) applies from 2027; AMLD6 transposition and BO registry interconnection proceed; AMLA Regulation amended by Reg (EU) 2025/2088. Track the three instruments separately (AMLR/6AMLD/AMLAReg).", "source_path": "standing_trackers[1].key_development" } }, { "tracker_id": { "value": "T3", "source_path": "standing_trackers[2].tracker_id" }, "tracker_name": { "value": "FATF Grey List", "source_path": "standing_trackers[2].tracker_name" }, "status": { "value": "material_change", "source_path": "standing_trackers[2].status" }, "trajectory": { "value": "mixed", "source_path": "standing_trackers[2].trajectory" }, "key_development": { "value": "June 2026 Plenary removed Algeria and Namibia, made substantial-completion determinations for Bulgaria, Cote d'Ivoire and DRC, and newly identified Bosnia and Herzegovina and Iraq. Canada and Turkiye mutual evaluations adopted; Iran/DPRK remain on the call-for-action list.", "source_path": "standing_trackers[2].key_development" } }, { "tracker_id": { "value": "T4", "source_path": "standing_trackers[3].tracker_id" }, "tracker_name": { "value": "Beneficial-Ownership Register Status", "source_path": "standing_trackers[3].tracker_name" }, "status": { "value": "incremental_development", "source_path": "standing_trackers[3].status" }, "trajectory": { "value": "improving", "source_path": "standing_trackers[3].trajectory" }, "key_development": { "value": "EU BO interconnection advances under AMLD6/AMLR (centralised bank-account-register single access point and BO registry access for competent authorities); global picture remains uneven and FATF R.24/R.25 implementation lags in several monitored jurisdictions. No discrete global registry event beyond the AMLA build-out.", "source_path": "standing_trackers[3].key_development" } }, { "tracker_id": { "value": "T5", "source_path": "standing_trackers[4].tracker_id" }, "tracker_name": { "value": "Crypto & Digital-Asset Integrity", "source_path": "standing_trackers[4].tracker_name" }, "status": { "value": "material_change", "source_path": "standing_trackers[4].status" }, "trajectory": { "value": "stable", "source_path": "standing_trackers[4].trajectory" }, "key_development": { "value": "FBI seized Huione Group cloud infrastructure (23 June); FATF approved a seventh VA/VASP targeted update plus a DeFi report (July publication); OFAC's 22 June ISIS designations attached on-chain TRON identifiers; the guarantee-marketplace ecosystem (Xinbi) persists post-Huione, demonstrating infrastructure resilience.", "source_path": "standing_trackers[4].key_development" } }, { "tracker_id": { "value": "T6", "source_path": "standing_trackers[5].tracker_id" }, "tracker_name": { "value": "Sanctions Regime Divergence", "source_path": "standing_trackers[5].tracker_name" }, "status": { "value": "material_change", "source_path": "standing_trackers[5].status" }, "trajectory": { "value": "deteriorating", "source_path": "standing_trackers[5].trajectory" }, "key_development": { "value": "OFAC and OFSI jointly published a Comparative Overview (23 June) documenting structural divergence (jurisdiction-based blocking versus breach/asset-freeze) and signalling intent to align escalation mechanisms, shadow-fleet typologies and structured regime-dismantling. The EU remains outside the bilateral, widening trilateral divergence.", "source_path": "standing_trackers[5].key_development" } } ], "persona": "General Counsel (COMMERCIAL-CONTEXT §2.1)", "note": "Render-only over regulatory_horizon[] (upcoming instruments) + standing_trackers[] (AMLA + standing regimes). Each cell cites its source field." }, "pricing_packaging": { "source_doc": "asym-intel-internal:commercial/SENTINEL-RUNBOOK.md §Pricing + docs/sprints/2026-07-01-fleet-external-api-governance/COMMERCIAL-CONTEXT-AND-END-USER-VALUE.md §2.1 (operator-locked 2026-07-15)", "policy": { "locked": true, "locked_by": "operator 2026-07-15", "envelope_gbp": [ 1000, 8000 ], "ceiling_gbp": 8000, "ceiling_display": "£8,000", "rule": "WPM and FIM are licensed separately; £1,000–£8,000 per customer organisation, per year, per product; £8,000 is a hard ceiling with no override." }, "licensed_separately_statement": "Financial Integrity Monitor and World Payments Monitor are licensed separately and are independently purchasable. There is no bundle and no shared-core double-charge: the standalone subscription and the producer/API data licence are distinct products, each purchased on its own terms.", "standalone_subscription": { "revenue_line": 1, "name": "FIM Standalone Subscription", "unit": "per customer organisation, per year", "ceiling_gbp": 8000, "ceiling_display": "£8,000", "top_tier_is_published": true, "tiers": [ { "tier": "Essential", "annual_gbp": 1000, "annual_display": "£1,000", "unlocks": [ "Jurisdictional risk profiles (A3.1)", "Typology registry (A3.2)" ] }, { "tier": "Standard", "annual_gbp": 3000, "annual_display": "£3,000", "unlocks": [ "Everything in Essential", "Corridor risk (A3.3)", "EDD trigger flags (A3.4)" ] }, { "tier": "Professional", "annual_gbp": 5500, "annual_display": "£5,500", "unlocks": [ "Everything in Standard", "Recent-enforcement feed (A4.1)", "Source-tier transparency / trust layer (A4.2)" ] }, { "tier": "Enterprise", "annual_gbp": 8000, "annual_display": "£8,000", "is_ceiling": true, "unlocks": [ "Everything in Professional", "AML/CTF horizon feed — GC persona (A4.3)", "All personas (MLRO / financial-crime + General Counsel)" ] } ] }, "producer_api": { "revenue_line": 2, "name": "Producer / API Data-Licence", "unit": "per consumer organisation, per year", "audience": "external GRC / SaaS embedders", "ceiling_gbp": 8000, "ceiling_display": "£8,000", "top_tier_is_published": true, "tiers": [ { "tier": "API Starter", "annual_gbp": 2000, "annual_display": "£2,000", "unlocks": [ "Entry metered access to the FIM producer/API data licence" ] }, { "tier": "API Growth", "annual_gbp": 5000, "annual_display": "£5,000", "unlocks": [ "Growth-volume metered access to the FIM producer/API data licence" ] }, { "tier": "API Scale", "annual_gbp": 8000, "annual_display": "£8,000", "is_ceiling": true, "unlocks": [ "Scale-volume metered access to the FIM producer/API data licence" ] } ] }, "note": "Render of the operator-locked canonical schedule (BRIEF-2026-07-01-A5 §4). Prices rendered verbatim; not pipeline-derived; £8,000 hard ceiling; two distinct, independently-purchasable revenue lines." }, "jurisdiction_slugs": { "AE": "united-arab-emirates", "AFR": "africa", "APAC": "asia-pacific", "AR": "argentina", "AT": "austria", "AU": "australia", "BD": "bangladesh", "BE": "belgium", "BG": "bulgaria", "BR": "brazil", "CA": "canada", "CA-AB": "canada-alberta", "CA-BC": "canada-british-columbia", "CA-NB": "canada-new-brunswick", "CA-ON": "canada-ontario", "CA-QC": "canada-quebec", "CH": "switzerland", "CI": "ivory-coast-uemoa", "CL": "chile", "CM": "cameroon", "CN": "china-mainland", "CN-HK": "hong-kong-sar", "CN-MO": "macau-sar", "CO": "colombia", "CR": "costa-rica", "CW": "curacao", "CY": "cyprus", "CZ": "czech-republic", "DE": "germany", "DK": "denmark", "DO": "dominican-republic", "DZ": "algeria", "EC": "ecuador", "EE": "estonia", "EEA": "european-economic-area", "EG": "egypt", "ES": "spain", "FI": "finland", "FR": "france", "GB": "united-kingdom-of-great-britain-england-wales-scotland", "GB-NIR": "northern-ireland", "GH": "ghana", "GIB": "gibraltar", "GR": "greece", "HR": "croatia", "HU": "hungary", "ID": "indonesia", "IE": "ireland", "IM": "isle-of-man", "IN": "india", "IS": "iceland", "IT": "italy", "JP": "japan", "KE": "kenya", "KH": "cambodia", "KR": "south-korea", "KZ": "kazakhstan", "LA": "laos", "LATAM": "latin-america", "LI": "liechtenstein", "LK": "sri-lanka", "LT": "lithuania", "LU": "luxembourg", "LV": "latvia", "MA": "morocco", "MM": "myanmar", "MT": "malta", "MX": "mexico", "MY": "malaysia", "MZ": "mozambique", "NG": "nigeria", "NL": "netherlands", "NO": "norway", "NP": "nepal", "NZ": "new-zealand", "PA": "panama", "PE": "peru", "PH": "philippines", "PK": "pakistan", "PL": "poland", "PT": "portugal", "QA": "qatar", "RO": "romania", "RS": "serbia", "RU": "russia", "RW": "rwanda", "SA": "saudi-arabia", "SE": "sweden", "SG": "singapore", "SI": "slovenia", "SK": "slovakia", "SN": "senegal", "TH": "thailand", "TN": "tunisia", "TR": "turkey", "TW": "taiwan", "TZ": "tanzania", "UA": "ukraine", "UG": "uganda", "UK": "united-kingdom", "US": "united-states-federal-national", "US-AK": "united-states-alaska", "US-AL": "united-states-alabama", "US-AR": "united-states-arkansas", "US-AZ": "united-states-arizona", "US-CA": "united-states-california", "US-CO": "united-states-colorado", "US-CT": "united-states-connecticut", "US-DC": "united-states-district-of-columbia", "US-DE": "united-states-delaware", "US-FL": "united-states-florida", "US-GA": "united-states-georgia", "US-HI": "united-states-hawaii", "US-IA": "united-states-iowa", "US-ID": "united-states-idaho", "US-IL": "united-states-illinois", "US-IN": "united-states-indiana", "US-KS": "united-states-kansas", "US-KY": "united-states-kentucky", "US-LA": "united-states-louisiana", "US-MA": "united-states-massachusetts", "US-MD": "united-states-maryland", "US-ME": "united-states-maine", "US-MI": "united-states-michigan", "US-MN": "united-states-minnesota", "US-MO": "united-states-missouri", "US-MS": "united-states-mississippi", "US-MT": "united-states-montana", "US-NC": "united-states-north-carolina", "US-ND": "united-states-north-dakota", "US-NE": "united-states-nebraska", "US-NH": "united-states-new-hampshire", "US-NJ": "united-states-new-jersey", "US-NM": "united-states-new-mexico", "US-NV": "united-states-nevada", "US-NY": "united-states-new-york", "US-OH": "united-states-ohio", "US-OK": "united-states-oklahoma", "US-OR": "united-states-oregon", "US-PA": "united-states-pennsylvania", "US-RI": "united-states-rhode-island", "US-SC": "united-states-south-carolina", "US-SD": "united-states-south-dakota", "US-TN": "united-states-tennessee", "US-TX": "united-states-texas", "US-UT": "united-states-utah", "US-VA": "united-states-virginia", "US-VT": "united-states-vermont", "US-WA": "united-states-washington-state", "US-WI": "united-states-wisconsin", "US-WV": "united-states-west-virginia", "US-WY": "united-states-wyoming", "UY": "uruguay", "VE": "venezuela", "VN": "vietnam", "ZA": "south-africa", "ZM": "zambia" } }