Financial Integrity Monitor
Sign in

Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

Financial Integrity Monitor

United States — Colorado US-CO

Domains covered
8 of 8
Sources
143
Role actions
8
Horizon <90d
0
Jurisdiction profile
FATF status: Compliant Tier: B Risk direction: Increasing Enablement vs enforcement: Mixed

Colorado operates under the federal Bank Secrecy Act/AML framework administered by FinCEN, overlaid by state money-transmitter licensing (Colorado Money Transmitters Act, C.R.S.

MoreTitle 11-110) supervised by the Colorado Division of Banking (DORA). Federal Corporate Transparency Act BOI reporting for domestic entities was rescinded in March 2025, removing a key transparency backstop for Colorado-formed LLCs; state cannabis banking remains cash-intensive due to persistent federal-state conflict.

Key deficiencies
  • Federal CTA rollback exempts all Colorado-domiciled domestic LLCs/corporations from beneficial ownership reporting, and Colorado's own Secretary of State registry does not independently collect BO data
  • No identified Colorado Attorney General enforcement action against crypto ATM/kiosk operators despite a nationwide multi-state litigation wave
  • Reduced federal (IRS/FinCEN) examiner capacity for MSB and virtual-asset AML supervision nationally, diminishing oversight reach into Colorado-domiciled nonbank financial institutions
  • Persistent cash-intensive cannabis banking gap in a state with one of the longest-running legal cannabis markets in the US
Recent developments (18m)
  • FinCEN interim final rule (March 21/26, 2025) exempting all US domestic reporting companies, including Colorado-formed entities, from Corporate Transparency Act BOI reporting
  • FinCEN Notice FIN-2025-NTC1 (August 4, 2025) on convertible virtual currency kiosk illicit-activity risk, directly implicating Colorado's dense Bitcoin ATM network
  • FinCEN Section 311 designation of Huione Group as a foreign financial institution of primary money laundering concern (2025), binding on Colorado banks' correspondent-screening obligations
  • Bankruptcy filing of Bitcoin Depot (May 2026), the largest US crypto-ATM operator with machines sited in Colorado, amid multi-state regulatory pressure
  • FinCEN AML/CFT Program NPRM (April 7, 2026) proposing to reform risk-based AML/CFT program requirements applicable to all US BSA-regulated institutions, including Colorado-chartered entities

United States federal law that applies in United States – Colorado is covered once, on the United States page. This page covers United States – Colorado’s own layer: its own law, regulators and enforcement.

Brief

Lead signal

Lead Signal

Colorado has moved its Automated Decision-Making Technology (ADMT) and Chatbot Safety rulemaking into a live procedural phase that carries direct consequences for financial and payment firms. The Colorado Department of Law released a revised interim draft of the rules on 6 October 2026 and held a formal rulemaking hearing on 26 October 2026, with written comments accepted through the hearing date. The draft's definition of a covered Financial or Lending Service, and the boundary of its fraud-prevention and identity-verification exclusion, directly implicate artificial-intelligence and machine-learning models used for account-opening credit and fraud screening at regulated payment and lending institutions. Industry commentary submitted to the docket argues that models used to make credit or fraud screening decisions at account opening will still be covered under the current drafting, and that the threshold test of whether a model materially influences such a decision is unlikely to narrow the rules meaningful scope in many financial-services contexts. No final rule has been adopted; the exclusion boundary remains contested and open.

Read full brief

Lead Signal

Colorado has moved its Automated Decision-Making Technology (ADMT) and Chatbot Safety rulemaking into a live procedural phase that carries direct consequences for financial and payment firms. The Colorado Department of Law released a revised interim draft of the rules on 6 October 2026 and held a formal rulemaking hearing on 26 October 2026, with written comments accepted through the hearing date. The draft's definition of a covered Financial or Lending Service, and the boundary of its fraud-prevention and identity-verification exclusion, directly implicate artificial-intelligence and machine-learning models used for account-opening credit and fraud screening at regulated payment and lending institutions. Industry commentary submitted to the docket argues that models used to make credit or fraud screening decisions at account opening will still be covered under the current drafting, and that the threshold test of whether a model materially influences such a decision is unlikely to narrow the rules meaningful scope in many financial-services contexts. No final rule has been adopted; the exclusion boundary remains contested and open.

This is best read as an architecture-stage development rather than an enforcement incident. Colorado is not disciplining a firm for an existing failure; it is actively shaping the perimeter of a compliance-technology obligation that will determine, once finalised, which AI-driven decisioning systems inside payment and lending firms must carry disclosure and transparency duties. The absence of a finalised rule means no supervisory record yet exists, and the appropriate reading of this cycle is that the architecture is still being drawn, not that it is already being tested.

Other Developments

No other typology-domain movement was identified for this jurisdiction this cycle. Sanctions exposure, beneficial-ownership and corporate-transparency posture, enabler-jurisdiction dynamics, conflict-finance nexus, digital-asset integrity, and the core AML/CTF regime all remain on their established baselines, with no Colorado-specific development surfacing against any of them this cycle. That absence of movement is itself a function of a cycle that concentrated attention on the compliance-technology rulemaking rather than a confirmed finding that those domains are quiet; the position should be read as thin coverage rather than a settled null.

Cross-Monitor Connections

The compliance-technology dimension of this development routes naturally to assessments of payment-sector conduct and safeguarding obligations, since the same rulemaking record and the same contested exclusion boundary bear on how payment and lending firms deploy AI-driven decisioning at the point of account opening. It also carries a technology-architecture dimension: the rules, once finalised, will set a disclosure and transparency standard for automated decision systems that regulated financial entities will need to map against their existing fraud and credit models, regardless of which regulatory lens is applied to the underlying instrument.

Outlook

The Colorado Attorney General is expected to finalise the ADMT/Chatbot Safety implementing rules under 4 CCR 904-6 in the first quarter of 2027, as scheduled, though the precise timing carries the uncertainty inherent in an active rulemaking docket. The determinative question for financial-sector exposure is where the finalised rule draws the line on the fraud-prevention and identity-verification exclusion: a narrow exclusion would bring a wide range of account-opening credit and fraud-screening models within scope, while a broader exclusion would leave much of that same activity outside the disclosure regime. Firms operating AI-driven decisioning in this jurisdiction should expect the boundary to remain unsettled until the rule is finalised, and the compliance-technology posture of payment and lending firms here should be read as provisional rather than settled until that point.

Earlier periodic briefs (6)
3 Nov 2026 · fim-2026-11-03

Lead Signal

Colorado has moved its Automated Decision-Making Technology (ADMT) and Chatbot Safety rulemaking into a live procedural phase that carries direct consequences for financial and payment firms. The Colorado Department of Law released a revised interim draft of the rules on 6 October 2026 and held a formal rulemaking hearing on 26 October 2026, with written comments accepted through the hearing date. The draft's definition of a covered Financial or Lending Service, and the boundary of its fraud-prevention and identity-verification exclusion, directly implicate artificial-intelligence and machine-learning models used for account-opening credit and fraud screening at regulated payment and lending institutions. Industry commentary submitted to the docket argues that models used to make credit or fraud screening decisions at account opening will still be covered under the current drafting, and that the threshold test of whether a model materially influences such a decision is unlikely to narrow the rules meaningful scope in many financial-services contexts. No final rule has been adopted; the exclusion boundary remains contested and open.

This is best read as an architecture-stage development rather than an enforcement incident. Colorado is not disciplining a firm for an existing failure; it is actively shaping the perimeter of a compliance-technology obligation that will determine, once finalised, which AI-driven decisioning systems inside payment and lending firms must carry disclosure and transparency duties. The absence of a finalised rule means no supervisory record yet exists, and the appropriate reading of this cycle is that the architecture is still being drawn, not that it is already being tested.

Other Developments

No other typology-domain movement was identified for this jurisdiction. Sanctions exposure, beneficial-ownership and corporate-transparency posture, enabler-jurisdiction dynamics, conflict-finance nexus, digital-asset integrity, and the core AML/CTF regime all remain on their established baselines, with no Colorado-specific development surfacing against any of them. That absence of movement is itself a function of a cycle that concentrated attention on the compliance-technology rulemaking rather than a confirmed finding that those domains are quiet; the position should be read as thin coverage rather than a settled null.

Cross-Monitor Connections

The compliance-technology dimension of this development routes naturally to assessments of payment-sector conduct and safeguarding obligations, since the same rulemaking record and the same contested exclusion boundary bear on how payment and lending firms deploy AI-driven decisioning at the point of account opening. It also carries a technology-architecture dimension: the rules, once finalised, will set a disclosure and transparency standard for automated decision systems that regulated financial entities will need to map against their existing fraud and credit models, regardless of which regulatory lens is applied to the underlying instrument.

Outlook

The Colorado Attorney General is expected to finalise the ADMT/Chatbot Safety implementing rules under 4 CCR 904-6 in the first quarter of 2027, as scheduled, though the precise timing carries the uncertainty inherent in an active rulemaking docket. The determinative question for financial-sector exposure is where the finalised rule draws the line on the fraud-prevention and identity-verification exclusion: a narrow exclusion would bring a wide range of account-opening credit and fraud-screening models within scope, while a broader exclusion would leave much of that same activity outside the disclosure regime. Firms operating AI-driven decisioning in this jurisdiction should expect the boundary to remain unsettled until the rule is finalised, and the compliance-technology posture of payment and lending firms here should be read as provisional rather than settled until that point.

25 Oct 2026 · fim-2026-10-25

Lead Signal

Colorado's Division of Banking is a named party to a multistate Bank Secrecy Act and anti-money-laundering consent order against Coinme, Inc., the Seattle-based cryptocurrency money transmitter and kiosk operator, effective 7 October 2026. Thirty-four state financial regulatory agencies reached a 2.5 million dollar settlement with Coinme for violations of BSA and AML requirements, coordinated across more than thirty other states plus the District of Columbia and Puerto Rico. Colorado's allocated share of the settlement is 116,168.44 dollars, and the order requires Coinme to cease kiosk operations in Colorado by 1 January 2027 or face an additional 4 million dollar national penalty. The examination period covered by the multistate review ran from 31 March 2023 through 31 March 2025.

Other Developments

Standing AML/CTF architecture confirmed. Colorado has no state-level anti-money-laundering statute distinct from federal BSA obligations. Money transmitters, including crypto kiosk operators such as Coinme, are licensed under the state's Money Transmission Modernization Act, Title 11, Article 110, which took effect 6 August 2025. Casinos operating in Colorado are BSA-designated financial institutions under federal rule, required to file suspicious activity reports at a 5,000 dollar threshold and currency transaction reports at a 10,000 dollar per 24-hour threshold directly with FinCEN. This means Colorado's AML exposure for the crypto and money-transmission sector runs primarily through the federal examination and reporting architecture, with the state licensing regime operating as a parallel but not independently substantive AML layer.

Cross-Monitor Connections

The Coinme consent order sits at the intersection of payments conduct and money-laundering control failure: the same underlying facts that drive the AML settlement described here also inform a payments-sector reading of licensing and market-access risk for crypto kiosk operators, where the conduct history of a money transmitter licensee becomes a live supervisory concern for other states weighing continued authorisation. The absence of a Colorado-specific sanctions or enabler-jurisdiction signal this period means the state's exposure on those fronts continues to run through the federal OFAC and BIS posture rather than through any independent state-level variance.

Outlook

The operative date to watch is 1 January 2027, when Coinme must cease kiosk operations in Colorado or become liable for the additional 4 million dollar national penalty layered on top of the 2.5 million dollar multistate settlement. Whether Coinme exits the Colorado kiosk market voluntarily, negotiates an extension, or allows the additional penalty to attach will be the clearest signal of how multistate coordinated AML enforcement against crypto money transmitters is likely to play out in other jurisdictions carrying similar exposure.

18 Oct 2026 · fim-2026-10-18

Lead Signal

Colorado's Division of Banking joined thirty-three other state financial regulatory agencies in a 2.5 million dollar Settlement Agreement and Consent Order against Coinme Inc., a Seattle-based cryptocurrency money transmitter and kiosk operator, entered on 8 October 2026 for violations of Bank Secrecy Act and anti-money laundering laws. Coinme agreed to exit virtual-currency kiosk operations by 1 January 2027 or face an additional 4 million dollar penalty, and to retain an independent compliance consultant. The Colorado Division of Banking published the settlement on its own public-notices page, confirming direct state-level participation rather than mere deference to a lead state. Six days later, on 14 October 2026, Polygon Labs closed its acquisition of Coinme in a deal reportedly worth over 250 million dollars, first announced in January 2026, absorbing 37 state money-transmitter licenses, including Colorado's, and the consent-order obligations that came with them.

Other Developments

TabaPay financing to fund Transact Bank acquisition. TabaPay, Inc. announced on 2 September 2026 a 155 million dollar strategic growth financing led by FTV Capital, earmarked to fund its planned acquisition of Denver-based Transact Bank N.A. The deal is targeted to close in the fourth quarter of 2026, subject to review by the Office of the Comptroller of the Currency as a change-in-control matter; the status of that review is not yet known. The transaction was reported directly by the company via Business Wire and corroborated by trade press.

Cross-Monitor Connections

The Coinme enforcement action and subsequent acquisition sit squarely at the intersection of financial-integrity and crypto-monitor interests: the consent order is an AML/CFT architecture finding, while the Polygon Labs acquisition is a commercial-intelligence event that redistributes a licensed crypto money-transmitter's compliance obligations to a new corporate holder without requiring a fresh state application. World-payments readers tracking commercial intelligence in payments infrastructure should note both the Coinme-Polygon and TabaPay-Transact Bank transactions as discrete M&A events within the same reporting window, though the two are unrelated in substance.

Outlook

The near-term question is whether Colorado's Division of Banking issues its own confirmation of the specific mechanics by which Coinme's money-transmitter licence transferred to Polygon Labs; no such primary-source statement has been located this cycle. The 1 January 2027 kiosk-exit deadline, now Polygon Labs' obligation, is the clearest dated milestone to track for the crypto-kiosk enforcement thread. On the TabaPay side, the fourth-quarter 2026 target close for the Transact Bank acquisition, and the outcome of the Comptroller's change-in-control review, are the developments most likely to generate the next material signal for Colorado's payments and banking landscape.

28 Sep 2026 · fim-2026-09-28

Lead Signal

Colorado's Division of Banking issued interim guidance on December 18, 2025 clarifying that most crypto exchanges transmitting funds on behalf of users, facilitating fiat-to-crypto conversion, or issuing stablecoins require a Colorado Money Transmitter License under the Money Transmission Modernization Act (MTMA). This establishes a standing baseline for how Colorado treats virtual-currency businesses: not through a bespoke crypto statute, but through the general money-transmission licensing regime, with FinCEN MSB registration and a BSA/AML compliance program required as preconditions to licensure. The structural significance is that Colorado closes a potential regulatory gap for crypto-payment intermediaries by routing them into an existing, well-established supervisory architecture rather than leaving them in an ambiguous space pending future legislation.

Other Developments

FinCEN's national AML/CFT overhaul for casinos reaches into Colorado's licensed gaming sector. On April 10, 2026, FinCEN published a Notice of Proposed Rulemaking that would require casinos, including Colorado-licensed casino and sports-betting operators as BSA-defined financial institutions, to maintain effective risk-based AML/CFT programs, with the proposal distinguishing program-design failures from program-execution failures and requiring governance and board approval alongside a US-located responsible officer. This is federal rulemaking, and its Colorado relevance is downstream: the state's licensed gaming operators would need to build institutional-grade AML governance if the NPRM is finalized as proposed, layering a new federal compliance floor onto the state's existing licensing framework.

Cross-Monitor Connections

The Colorado MTMA guidance intersects directly with world-payments coverage of licensing and market access for virtual-currency money transmitters, and with the crypto monitor's coverage of Colorado's crypto-licensing and stablecoin regimes; all three readings draw on the same underlying interim-guidance finding but foreground different structural implications — payments-corridor architecture for world-payments, token/issuer-specific licensing exposure for crypto, and AML/CFT program-design implications here. The FinCEN casino NPRM connects to advennt's operational-obligations and cost-to-operate coverage of Colorado's licensed gaming sector, since a finalized rule would add a new compliance layer atop the state licensing regime that advennt already tracks.

Outlook

The FinCEN NPRM comment period closed June 9, 2026; a final rule has not yet been adopted, and its effective date remains unresolved pending FinCEN's rulemaking timeline. Watch for whether FinCEN moves to finalize the casino AML/CFT program requirements, which would convert this from a proposed compliance floor into a binding one for Colorado's licensed casino and sports-betting operators. On the crypto side, Colorado's interim guidance under the MTMA remains labeled interim rather than final, so operators should watch for the Division of Banking to issue final guidance that could adjust the scope of which crypto businesses require MTL licensure.

5 Sep 2026 · fim-2026-08-21

Lead Signal

Colorado enacted two coordinated instruments that reached effective date this cycle and materially reshape the money-transmission and virtual-currency perimeter of the state. The Colorado Money Transmission Modernization Act (HB25-1201) repealed the prior Money Transmitters Act and replaced it with a framework built on the Conference of State Bank Supervisors multistate-licensing model, expanding the regulated-activity definition to expressly cover digital money movement and payroll processing and giving the Division of Banking stronger enforcement tools. In parallel, the Colorado Vending of Digital Assets Act (SB25-079) reached its own effective date of 2026-08-12, imposing disclosure and electronic-receipt duties on virtual-currency-kiosk operators and a conditional first-transaction refund obligation where a customer transaction moved funds to a wallet or exchange located outside the United States and fraud is reported within 60 days with law-enforcement contact. Both developments are assessed with Assessed-tier confidence against Tier 1 primary legislative sources and are now in force rather than merely proposed. Assessed together, these are architecture-level developments rather than incident-level enforcement actions: Colorado is building a state-level supervisory layer around fiat-linked virtual-currency transmission and kiosk-based conversion ahead of, and alongside, the federal Bank Secrecy Act framework that continues to govern money-services businesses generally.

Other Developments

The Colorado Division of Banking, within the Department of Regulatory Agencies, is confirmed as the supervisory authority administering money-transmitter licensing under Title 11, Article 110 of the Colorado Revised Statutes, including fiat-linked virtual-currency transmission. This is a standing supervisory-architecture fact rather than a new development in itself, but it is the authority against which compliance under both HB25-1201 and SB25-079 will be assessed going forward. No enforcement action or Division of Banking implementing guidance under either statute has yet been located this cycle; the regulatory horizon anticipates implementation or enforcement guidance from the Division of Banking in the third quarter of 2026, with the 60-day fraud-claim window under SB25-079 assessed as a novel compliance parameter not yet mirrored in most other states. This absence of enforcement is a genuine evidentiary gap rather than a signal that no enforcement is occurring: the absence reflects the short interval since the 2026-08-12 effective date rather than a substantive finding of regulatory forbearance. The overall risk trajectory for Colorado is assessed as stable, with an enablement rather than enforcement orientation and a structural rather than episodic character, reflecting a state building supervisory capacity ahead of any observed violation rather than reacting to one.

Cross-Monitor Connections

The same statutory package driving this cycle signal for Colorado carries direct relevance beyond the financial-integrity lens. The money-transmission licensing overhaul under HB25-1201 is a payments-market-structure development in its own right, bearing on how non-bank payment institutions and electronic-money issuers access the Colorado market, a reading that belongs properly to the world-payments monitor licensing and market-access analysis. Separately, the crypto-kiosk consumer-protection regime under SB25-079 is a crypto-licensing and consumer-protection development in the typology of the crypto monitor, distinct from but sourced to the same underlying statute this brief treats as an AML-adjacent and digital-asset-innovation development. No sanctions, conflict-finance, or beneficial-ownership signal was identified for Colorado this cycle; the D1 through D4 domains for Colorado remain properly assessed at the federal level for this US subnational jurisdiction, consistent with a delta-only research posture rather than a research gap. Consistent with the architecture-over-incident framing this monitor applies, the absence of enforcement volume under either new instrument is not itself evidence of low risk; it is, if anything, the expected posture in the first weeks after a supervisory framework effective date, and the test in the coming cycle will be whether enforcement volume develops commensurate with the expanded regulated-activity definition.

Outlook

The near-term marker to watch is whether the Colorado Division of Banking issues implementing or enforcement guidance under SB25-079 and HB25-1201 in the third quarter of 2026, as currently anticipated; such guidance would be the first indication of how the Division intends to apply the modernized licensing perimeter and the kiosk-operator refund mechanism in practice. Absent enforcement activity to date, the signal this cycle is structural rather than punitive: Colorado has built the architecture before testing it, and the coming cycle is where operator-facing enforcement exposure would first become visible if it materializes. Analysts should also track whether other Conference of State Bank Supervisors multistate-licensing-model states adopt a similar 60-day kiosk-refund parameter, since the Colorado approach is currently assessed as a novel compliance parameter nationally; convergence toward a common standard, or continued divergence, will shape the compliance burden facing multistate money-services businesses and crypto-kiosk operators alike.

11 Aug 2026 · fim-2026-08-05

Lead Signal

The clearest signal this cycle is the convergence of licensed casino infrastructure, human-trafficking-linked scam compounds, and digital-asset fraud in Cambodia. OFAC designated a sitting Cambodian senator, Kok An, along with twenty-eight affiliated individuals and entities, for a casino-linked scam-center network assessed to have laundered at least seventy-three million dollars from American victims. The designation is corroborated by TRM Labs and Amnesty International reporting, the latter finding that Cambodia's state casino-licensing regime continued to approve properties linked to scam compounds even as the government pursued a parallel crackdown that has produced over twenty-one thousand deportations. Read architecture-over-incident, this is not an isolated enforcement action against a rogue operator; it is evidence of state-adjacent protection of enabler infrastructure, with licensing and enforcement functions operating in tension within the same jurisdiction.

That Cambodia signal does not stand alone. TRM Labs separately assessed approximately one hundred fifty-eight billion dollars in illicit cryptocurrency flows in 2025, a one hundred forty-five percent increase year-on-year from sixty-four and a half billion dollars in 2024, substantially attributable to Southeast Asian scam-compound laundering — directly corroborating the digital-asset dimension of the Cambodia action on a global scale. Both findings anchor this cycle's Financial Integrity Monitor read: enabler-jurisdiction capture and digital-asset laundering scale are moving in the same direction, in the same region, in the same reporting window.

Other Developments

EU's 21st Russia sanctions package adopted two hundred eighteen new designations across banking, energy, crypto, and defense-industrial sectors, and for the first time targeted vessels that refuel shadow-fleet tankers at sea — a structural upgrade that closes an evasion-infrastructure gap left open by end-tanker-only designations under the oil-price-cap regime. Primary-source corroboration for the specific package text was not retrieved this cycle, so confidence is held at Assessed pending consilium.europa.eu confirmation.

FinCEN and OFAC acted jointly against CJNG fuel-theft financial infrastructure, with FinCEN issuing a supplemental alert on cartel fiscal fuel-smuggling and tax-evasion typologies alongside OFAC's designation of two Mexican nationals and nine entities tied to huachicol schemes. The alert builds on a May 2025 Cartel Oil Smuggling Alert and names complicit brokers and small US oil and gas companies as placement points for stolen-fuel proceeds. Separately, FinCEN's Section 311 special measures remain in effect prohibiting US covered financial institutions from transmitting funds to or from three identified Mexican financial institutions.

Colombia received its first "failed demonstrably" counternarcotics designation in roughly three decades on the FY2026 Majors List, citing record coca cultivation, though sanctions were waived on national-interest grounds — a finding sourced to a single secondary outlet this cycle and held at Assessed confidence pending the primary White House determination memorandum.

The US Corporate Transparency Act's domestic-exemption posture persists. The Eleventh Circuit upheld the CTA's constitutionality on December 16, 2025 without disturbing the exemption, and GAO found that over ninety-nine percent of previously-required reporting companies are now exempt from beneficial-ownership-information reporting.

AMLA completed its absorption of EBA's AML/CFT mandates on January 1, 2026, with a risk-assessment and entity-selection consultation closing January 27, 2026 ahead of 2028 direct supervision of approximately forty high-risk cross-border institutions. Lao PDR remains under FATF increased monitoring per the February 13, 2026 update, with no delisting or new deficiency finding this cycle. FATF's June 19, 2026 plenary added Iraq and Bosnia and Herzegovina to the grey list while removing Algeria and Namibia, holding the list at twenty-two jurisdictions under new FATF President Giles Thomson, who took over from Elisa de Anda Madrazo on July 1, 2026.

Cross-Monitor Connections

The Cambodia designation sits at the intersection of enabler-jurisdiction analysis and conflict/human-trafficking finance: casino licensing decisions by Cambodia's state gaming authority intersect directly with scam-compound trafficking findings that would ordinarily route to a state-capture or human-rights-adjacent monitor. The CJNG fuel-theft financial infrastructure connects fiscal crime, cartel financing, and correspondent-banking access restrictions in a single typology, relevant to any conflict-finance or commodity-flow tracking that follows Mexican fuel markets. Colombia's adverse FRAA designation, read alongside the CJNG findings, points to a broader deterioration in regional narco-finance capacity that spans two jurisdictions this cycle. The EU's shadow-fleet-refueling designations connect sanctions architecture to maritime and energy-trade monitoring of Russian oil flows.

Outlook

Watch for primary consilium.europa.eu text on the EU's 21st sanctions package to confirm the shadow-fleet-refueling designations at High confidence, and for the White House's FY2026 FRAA determination memorandum to corroborate Colombia's designation independently of secondary reporting. AMLA's methodology consultation outcomes, expected through 2026 and 2027, will shape which institutions fall under 2028 direct EU-level supervision. The next FATF plenary in the fourth quarter of 2026 is the standard checkpoint for further grey-list movement. Sub-Saharan African and Central Asian corridors were not surfaced with material findings this cycle and should be prioritized in the next monthly regional-balance pass.

Domain intelligence (D1–D8)

D1 Sanctions

stablestanding position

Sanctions Architecture and Evasion

Colorado inherits the full federal sanctions architecture, and this cycle two designations expand what that architecture requires of Colorado-domiciled institutions. FinCENs Section 311 designation of the Cambodia-based Huione Group as a foreign financial institution of primary money laundering concern, imposed in October 2025, triggers special measures binding Colorado banks and money services businesses to sever or restrict correspondent relationships tied to an entity assessed to have received an estimated 39.6 billion dollars in flows during 2025. This is a designation-driven expansion of screening obligation, not an enforcement action against any Colorado-based actor directly, but it lands on Colorados BSA-regulated population as a compliance cost regardless.

Continue reading

Alongside it, Executive Order 14157s January 2025 designation of major Mexican drug cartels as Foreign Terrorist Organizations and Specially Designated Global Terrorists fuses counter-terrorism and anti-money-laundering authorities, and a June 2026 FinCEN alert on fiscal fuel-theft financial networks specifically cites suspicious activity exceeding 7 billion dollars moving through corridors including Colorados I-25 and I-70 routes. Both designations expand correspondent-screening and material-support-liability exposure for Colorado institutions. Neither designation has an identified equivalent counterpart from EU or UK authorities in the research record, a divergence that creates asymmetric secondary-sanctions exposure for cross-border flows moving through Colorado corridors relative to peer financial centres operating under different sanctions regimes. Separately, FATFs June 2025 plenary added the British Virgin Islands and Bolivia to its increased-monitoring list and removed Croatia, Mali and Tanzania; the United States remains off both FATF lists, but FinCEN has instructed institutions to factor the plenary outcome into risk-based due diligence, meaning the list movement shapes Colorado obligations indirectly even without a designation touching the state itself.

The structural reading is that Colorados sanctions-architecture exposure is increasing through two vectors simultaneously: a Section 311 designation targeting a cross-border laundering conduit with correspondent-banking implications, and a domestic terrorism-designation regime targeting cartel finance moving through the states own transport corridors. Both are additive obligations layered onto an existing BSA compliance base, and both arrived without a confirmed international mirror, meaning Colorado institutions with cross-border correspondent relationships face a sanctions-compliance environment that is more stringent domestically than what counterpart jurisdictions currently require.

Outlook

The near-term sanctions-architecture horizon centers on the October 2026 FATF plenary, which will reassess both the Jurisdictions Under Increased Monitoring list and the High-Risk Call for Action list and will feed directly into subsequent FinCEN risk-based due-diligence advisories affecting Colorado institutions. Whether EU or UK authorities issue actions equivalent in scope to the Huione Group Section 311 designation or the EO 14157 cartel designations remains an open question in the current record; its resolution would materially change the divergence assessment offered here. Absent that confirmation, Colorado institutions should expect the current asymmetric exposure to persist through the next plenary cycle.

Cumulative analysis

Sanctions Architecture and Evasion — Cumulative Analysis

Across the baseline period established for Colorado, the states sanctions-architecture exposure has been shaped almost entirely by federal designation activity rather than any state-level sanctions authority, since Colorado as a US state has no independent sanctions-designation power and inherits the OFAC/FinCEN architecture in full. The two defining developments of this baseline are the October 2025 Section 311 designation of the Cambodia-based Huione Group as a foreign financial institution of primary money laundering concern, and the fusion of counter-terrorism and anti-money-laundering authorities against Mexican drug cartels via Executive Order 14157s January 2025 Foreign Terrorist Organization and Specially Designated Global Terrorist designations, reinforced by a June 2026 FinCEN alert quantifying more than 7 billion dollars in cartel-linked fiscal fuel-theft suspicious activity moving through corridors including Colorados I-25 and I-70 routes.

The structural significance of these two designations, read together, is that they impose materially different obligation types on the same Colorado BSA-regulated population within a single baseline window: the Huione designation is a correspondent-banking special-measures obligation targeting an offshore laundering conduit, while the cartel designations create a material-support-liability exposure layered onto existing suspicious-activity reporting duties for institutions operating along known trafficking and fuel-theft corridors. Neither has an identified equivalent action from EU or UK authorities in the research record compiled to date, and this asymmetry — a persistent feature across the baseline rather than a single-cycle anomaly — creates a sanctions-regime divergence that disproportionately burdens Colorado institutions with cross-border correspondent exposure relative to peer jurisdictions operating under different designation regimes.

A secondary but structurally relevant thread is the FATF list-maintenance cycle: the June 2025 plenary addition of the British Virgin Islands and Bolivia to increased monitoring, and the removal of Croatia, Mali and Tanzania, did not touch the United States directly, which remains off both FATF lists, but FinCEN has directed Colorado institutions to factor plenary outcomes into risk-based due diligence, meaning the states sanctions-adjacent obligations move indirectly in step with a global list-maintenance process it does not otherwise participate in.

Taken as a whole, the cumulative picture for Colorados sanctions architecture through this baseline is one of accretive obligation-layering: each designation cycle adds a new compliance vector — correspondent-banking restriction, material-support liability, due-diligence-list sensitivity — without any corresponding removal of prior obligations, and without confirmed international reciprocity. The open evidentiary question that would most change this picture is whether EU or UK authorities move to match either the Huione or the cartel designations in scope; until that is resolved, the divergence assessment stands as the dominant structural feature of Colorados sanctions-architecture posture.

Outlook

The October 2026 FATF plenary is the next scheduled inflection point, with potential to add or remove jurisdictions from monitoring lists that will again propagate into Colorado risk-based due-diligence obligations via FinCEN advisory. Confirmation, or continued absence, of EU/UK equivalent designations to the Huione Group and cartel FTO/SDGT actions remains the single most consequential open variable for assessing whether Colorados current sanctions-exposure asymmetry narrows or persists into the next baseline period.

domain_sub_briefs · D1 · Cumulative analysis
Periodic updates (1)
11 Aug 2026 · fim-2026-08-05

Sanctions Architecture and Evasion

This cycle's sanctions signal operates on two fronts that together illustrate the architecture-over-incident principle: a structural upgrade to the EU's Russia sanctions regime, and continued OFAC designation activity against non-Russia enabler networks. The European Union adopted its twenty-first Russia sanctions package, comprising two hundred eighteen new designations spanning banking, energy, crypto-asset, and defense-industrial sectors. For the first time, the package targeted vessels that refuel shadow-fleet tankers at sea rather than only the tankers themselves — closing a structural evasion-infrastructure gap that had persisted under the oil-price-cap regime even as successive rounds of end-tanker designations accumulated. This is the kind of architecture-level finding that matters more than any single vessel seizure: it changes the economics of operating a shadow fleet by reaching the refueling logistics chain, not merely the visible endpoint. Primary-source corroboration from consilium.europa.eu was not retrieved this cycle, so this finding is held at Assessed confidence pending direct verification of the package text, and readers should treat the two-hundred-eighteen-designation figure and the refueling-vessel characterization as sourced to a single non-primary outlet for now.

Parallel to the Russia-sanctions architecture, OFAC continued designation activity against two distinct enabler networks this cycle. The first is the Cambodian casino-linked scam-center network, where OFAC designated a sitting Cambodian senator, Kok An, together with twenty-eight affiliated individuals and entities, for laundering at least seventy-three million dollars from American victims through casino-adjacent digital-asset fraud. This designation is corroborated by both TRM Labs and Amnesty International reporting at Tier 2, giving it a High confidence rating despite the absence of a second Tier 1 source, and it is treated here as a sanctions-architecture finding because the designation reaches an entire network — a senator, affiliated entities, and casino infrastructure — rather than a single individual. The second is the Mexican cartel-linked designation, where OFAC named two Mexican nationals and nine entities tied to CJNG fuel-smuggling, or huachicol, schemes, issued concurrently with a FinCEN supplemental alert on the same fiscal fuel-theft and tax-evasion typologies. The concurrent FinCEN-OFAC action is itself an architecture signal: it pairs a designation tool with a typology-education tool aimed at the broader financial sector, rather than relying on the designation alone.

A third, quieter sanctions-architecture data point concerns FinCEN's Section 311 special measures, which remain in effect prohibiting US covered financial institutions from transmitting funds to or from three identified Mexican financial institutions. This is a standing enforcement action rather than a new development this cycle, but its persistence alongside the fresh CJNG designations reinforces a consistent US posture toward Mexican financial-institution complicity in cartel fund flows, sourced this cycle via a Tier 3 law-firm client alert rather than a fresh FinCEN primary release. Taken together, these three sanctions-architecture developments — the EU's refueling-vessel upgrade, the Cambodia network designation, and the concurrent FinCEN-OFAC Mexican-cartel action — share a common feature: each targets the infrastructure and logistics that make evasion or laundering possible, rather than only the nominal violators. That is the architecture-over-incident distinction this monitor applies systematically: a shadow-fleet refueling vessel, a casino license, and a fuel-theft placement broker are each infrastructure nodes whose removal or disruption has a multiplier effect beyond the single transaction or vessel involved.

Outlook

The near-term test for the Russia-sanctions architecture finding is whether consilium.europa.eu publishes primary package text confirming the two-hundred-eighteen-designation count and the shadow-fleet-refueling-vessel characterization; until then, the finding should be treated as Assessed rather than High confidence, and any compliance-program updates keyed to the refueling-vessel designations should be validated against primary EU Official Journal text before implementation. On the Mexican cartel front, watch for further FinCEN advisories building on the fuel-theft alert, and for any expansion of the Section 311 special-measures list beyond the three currently named institutions. The Cambodia designation's durability depends on whether Cambodia's state casino-licensing authority changes its approval practices for scam-compound-linked properties; absent such a change, further OFAC action against additional Cambodian casino licensees within the same network is a reasonable near-term expectation given the state-adjacent-capture pattern already evidenced this cycle.

D2 Beneficial Ownership

stablestanding position

Beneficial Ownership and Corporate Transparency

Colorado is a US state, not an EEA Member State, and the EU AML Package is not the primary regulatory frame for its beneficial-ownership exposure. Globally, the EU AML Package sets the structural direction for beneficial-ownership transparency: it comprises three distinct instruments, the directly applicable AML Regulation (AMLR, Regulation (EU) 2024/1624), the sixth AML Directive (6AMLD) transposed on a per-Member-State basis, and the AMLA Regulation (Regulation (EU) 2024/1620) establishing the Anti-Money Laundering Authority, whose direct and indirect supervision perimeter is shifting the EU regime from purely national supervision toward a hybrid EU-level model. That architecture is durable global backdrop, but Colorado sits outside its direct perimeter entirely; the directly relevant development for Colorado this cycle is domestic and federal.

Continue reading

That development is FinCENs March 2025 interim final rule exempting all US domestic reporting companies, including the high volume of low-cost, fast-formation Colorado LLCs, from Corporate Transparency Act beneficial ownership reporting. Only foreign reporting companies retain the federal obligation, and the Colorado Secretary of State registry does not independently collect beneficial ownership data, meaning the exemption removes the sole federal transparency backstop for anonymous Colorado-formed entities without any compensating state-level mechanism. FinCEN intends to finalize this interim rule during 2026, which would entrench the exemption absent Congressional reversal.

The compounding factor is Colorados cash-intensive cannabis sector, which continues to provide a state-licensed cover for cash deposits disproportionate to reported revenue, a persistent typology that predates the CTA rollback but now operates against a weaker federal beneficial-ownership backstop. The combination — anonymous-entity formation now unmonitored at the federal registry layer, plus an existing cash-intensive sector generating layering cover — describes a beneficial-ownership environment moving in the worsening direction on a structural rather than episodic basis.

Outlook

The defining watch item is FinCENs 2026 finalization of the domestic CTA exemption; final-rule text confirming permanence of the exemption would lock in the transparency gap for Colorado-formed entities absent Congressional action. No compensating Colorado state-level beneficial-ownership collection mechanism has been identified in the current record, meaning the gap will likely persist through the finalization window regardless of the federal rules ultimate form.

Cumulative analysis

Beneficial Ownership and Corporate Transparency — Cumulative Analysis

Colorados position on beneficial ownership and corporate transparency must be read against two separate architectural backdrops, only one of which directly governs the state. The EU AML Package — comprising the directly applicable AML Regulation (AMLR, Regulation (EU) 2024/1624), the sixth AML Directive (6AMLD) transposed per Member State, and the AMLA Regulation (Regulation (EU) 2024/1620) establishing the Anti-Money Laundering Authority with its evolving direct and indirect supervision perimeter — represents the global structural direction of travel for beneficial-ownership reform, moving the EU from fragmented national supervision toward a hybrid EU-level regime. Colorado, as a US state, sits entirely outside this perimeter; 6AMLD transposition tracking is not applicable here, and the AMLA build-out is relevant to Colorado institutions only indirectly, through reciprocal due-diligence pressure on any Colorado entity with EU correspondent relationships as the 2025-2028 AMLA build-out continues.

The development that has actually shaped Colorados beneficial-ownership exposure across this baseline is domestic: FinCENs March 2025 interim final rule categorically exempting all US domestic reporting companies from Corporate Transparency Act beneficial ownership reporting. Because Colorado is one of the highest-volume, lowest-cost jurisdictions for LLC formation in the country, this exemption disproportionately affects Colorado-formed entities relative to states with less permissive formation regimes. Only foreign reporting companies retain the federal reporting obligation, and the Colorado Secretary of State does not independently collect beneficial-ownership data at the state registry layer, meaning the federal exemption removes the sole transparency backstop that previously existed for anonymous Colorado LLCs and corporations, with no compensating mechanism identified anywhere in the state's regulatory apparatus.

This federal-level rollback compounds with a long-standing, jurisdiction-specific typology: Colorados cash-intensive, federally-unbanked legal cannabis sector, one of the longest-running in the country, continues to generate cash deposits disproportionate to reported revenue, providing cover for layering illicit proceeds behind ostensibly licit, state-licensed businesses. The cannabis typology is not new to this baseline, but it now operates in an environment where the federal beneficial-ownership backstop that might otherwise have surfaced anomalous corporate structures behind cannabis-adjacent shell entities has been withdrawn. FinCEN intends to finalize the March 2025 interim rule during 2026; finalization would entrench the domestic exemption absent Congressional reversal, converting what is currently a rule subject to potential revision into a settled feature of the federal transparency architecture.

The cumulative trajectory across this baseline is unambiguously worsening on the transparency dimension specifically because Colorado combines high-volume anonymous-entity formation capacity with an existing cash-intensive sector prone to structuring, at precisely the moment the federal backstop that might have constrained the former has been removed. No Colorado-specific compensating measure — state BO registry, enhanced Division of Banking typology guidance, or equivalent — has been identified in the record to date.

Outlook

FinCENs 2026 finalization decision on the interim rule is the single most consequential near-term variable; confirmed final-rule text locking in the domestic exemption would remove any residual possibility of near-term reversal absent Congressional action. Separately, continued monitoring of whether Colorado or any US state moves to establish an independent beneficial-ownership collection mechanism would be the clearest indicator of whether the current gap is addressed at the state level in the absence of federal action.

domain_sub_briefs · D2 · Cumulative analysis
Periodic updates (1)
11 Aug 2026 · fim-2026-08-05

Beneficial Ownership and Corporate Transparency

Beneficial-ownership transparency is diverging structurally across the Atlantic this cycle. In the United States, the Corporate Transparency Act's domestic-entity exemption persists undisturbed: the Eleventh Circuit upheld the CTA's constitutionality on December 16, 2025 without touching the March 2025 exemption, and GAO subsequently found that over ninety-nine percent of previously-required reporting companies are now exempt from beneficial-ownership-information reporting to FinCEN. The practical effect is that the US beneficial-ownership register, conceived as a near-universal corporate-transparency tool, now functions as a narrow foreign-entity-focused register rather than the broad domestic-coverage instrument originally contemplated. In the European Union, the opposite trajectory is underway: the Anti-Money Laundering Authority, AMLA, completed the absorption of all AML/CFT supervisory mandates previously held by the European Banking Authority, effective January 1, 2026, and closed a risk-assessment and entity-selection consultation on January 27, 2026 ahead of assuming direct supervision of approximately forty high-risk cross-border institutions in 2028.

Standing beneath this cycle's specific developments is a durable structural fact about the EU's AML architecture that should inform how any BO or transparency signal from the bloc is read: the EU AML Package is not a single instrument but three distinct ones. The AML Regulation, or AMLR (Regulation (EU) 2024/1624), is directly applicable across all twenty-seven member states without national transposition and becomes directly applicable on July 10, 2027. The sixth AML Directive, 6AMLD, is transposed individually by each member state rather than applying uniformly. And the AMLA Regulation (Regulation (EU) 2024/1620) establishes the Anti-Money Laundering Authority itself, whose supervisory perimeter is shifting the EU from a purely national supervisory model toward a hybrid regime combining national authorities with direct EU-level supervision of the highest-risk cross-border institutions. This cycle's AMLA/EBA mandate-transfer development is a milestone within that structural direction rather than a one-off event, and every AMLA-related finding in future cycles should be read against this three-instrument backdrop rather than treated as a single unified "EU AML law."

The transatlantic contrast is stark: the US is narrowing its domestic beneficial-ownership-reporting perimeter at the same time the EU is centralizing and harmonizing its own. This divergence also has typology implications for enabler-jurisdiction analysis elsewhere in this brief: a corporate-registration environment with materially reduced beneficial-ownership visibility, such as the post-exemption US domestic register, is structurally more attractive to layering activity than a jurisdiction moving toward harmonized, EU-wide beneficial-ownership standards. Compliance teams relying on US corporate registries for counterparty due diligence should treat the absence of a BOI filing as uninformative for domestic entities post-exemption, rather than as an indicator of legitimacy. For obliged entities operating in the EU, the near-term compliance question is less about the AMLR's substantive standards, which largely track existing 6AMLD requirements, and more about the transition to a partially centralized supervisory relationship: institutions selected for 2028 direct AMLA supervision will need to prepare for joint supervisory teams blending national and EU-level examiners, a governance model without a full precedent in EU financial-crime supervision to date.

Outlook

Watch for AMLA's common risk-assessment methodology, currently being tested with national supervisors through 2026 and 2027, to clarify which cross-border institutions will fall under 2028 direct supervision; the entity-selection criteria remain unsettled pending further consultation outcomes. On the US side, the CTA's domestic exemption is a settled legal question following the Eleventh Circuit's ruling, but the beneficial-ownership-coverage gap it leaves is likely to remain a standing feature of the US register rather than a transitional one, absent new legislative action. AMLR's July 10, 2027 direct-applicability date is the next major EU milestone and should be tracked for institutional-readiness gaps between current national-directive practice and the AMLR's uniform customer-due-diligence and beneficial-ownership standards. Any future Colombian, Mexican, or Cambodian corporate-vehicle findings elsewhere in this brief should be cross-checked against this transatlantic beneficial-ownership backdrop, since enabler-jurisdiction shell structures often route through exactly the low-visibility corporate registries this divergence describes.

D3 Enabler Jurisdictions

stablestanding position

Enabler Jurisdictions and Professional Facilitators

Colorados enabler posture this cycle rests on two mutually reinforcing signals: a persistent cash-intensive cannabis sector functioning as a structuring cover, and a documented absence of state-level enforcement against crypto-ATM kiosk operators despite a substantial in-state footprint. Colorados legal cannabis operators, among the longest-established in the country, continue to deposit cash disproportionate to reported marijuana-related revenue for federal and state tax purposes, exploiting the persistent federal-state banking conflict that keeps much of the sector outside mainstream AML-monitored banking relationships. This is a structural, not episodic, feature of the states financial-integrity landscape, tied to one of the longest-running legal cannabis markets in the United States.

Continue reading

The second signal is an enforcement-absence gap: unlike Iowa, Massachusetts, Washington DC, Connecticut and Missouri, no Colorado Attorney General enforcement action against Bitcoin Depot, CoinFlip or Athena Bitcoin has been identified, despite Colorado hosting a substantial share of the roughly 32,000 US crypto-ATM kiosks implicated in scam facilitation and despite a retail and elderly population profile that mirrors the risk factors driving peer-state action. Enablement-as-signal analysis treats this absence as itself analytically significant: a jurisdiction with comparable exposure to five peer states that have all acted, yet has not acted itself, is functioning as a permissive node in the national kiosk-fraud architecture whether by capacity constraint or by choice.

Both typologies are compounded by federal-level developments that raise the stakes of continued state inaction: FinCENs kiosk illicit-activity notice cites a 99 percent year-on-year rise in fraud complaints, and Bitcoin Depots May 2026 bankruptcy removed the largest national kiosk operator from the market, an industry-consolidation event that will likely reshape which operators remain active in Colorado absent any state-level intervention shaping that transition.

Outlook

Whether Colorados enforcement posture shifts will depend on data not currently available in the public record: a Colorado Attorney General enforcement dataset or state-level litigation record would clarify whether the absence of parallel action reflects a capacity deficit or a political choice, a distinction with direct implications for how this enabler assessment should be weighted going forward. Absent that clarification, Colorados enabler posture relative to peer states is assessed as worsening on a structural basis.

Cumulative analysis

Enabler Jurisdictions and Professional Facilitators — Cumulative Analysis

Colorados standing as an enabler jurisdiction, as opposed to a purely enforcement-driven one, rests on a consistent pattern across this baseline: two structurally distinct typologies, one legacy and one emergent, both persisting without a compensating state-level enforcement or transparency response. The legacy typology is the states cash-intensive, federally-unbanked legal cannabis sector, among the longest-running in the United States, where licensed operators continue depositing cash disproportionate to reported marijuana-related revenue, a pattern first documented in FinCEN guidance dating back over a decade and one that persists because the federal-state banking conflict has never been fully resolved, leaving much of the sector outside mainstream AML-monitored banking relationships even as it operates as a nominally licit, state-licensed business.

The emergent typology is Colorados posture on crypto-ATM kiosk enforcement. Across this baseline, five peer states — Iowa, Massachusetts, Washington DC, Connecticut and Missouri — have each brought enforcement action against major kiosk operators including Bitcoin Depot, CoinFlip and Athena Bitcoin, while no equivalent Colorado Attorney General action has been identified, despite Colorado hosting a substantial share of the roughly 32,000 US kiosks now implicated in a national elder-fraud-to-offshore laundering pipeline. This is not a data gap so much as a documented absence: Colorados retail and elderly population profile mirrors the risk factors that drove peer-state litigation, yet the state has not moved. Read through the enablement-as-signal principle, this absence functions as a structural feature of Colorados risk profile in its own right — a jurisdiction that inherits the same federal notices and fraud-complaint data as its peers, but has chosen not to convert that data into state-level enforcement, is functioning as a permissive node regardless of whether the underlying driver is a capacity deficit or a deliberate policy choice. The evidentiary record compiled to date cannot fully distinguish between those two explanations, though the pattern is more consistent with a political choice than a pure capacity deficit.

Both typologies interact with broader federal-level shifts recorded across this baseline: the CTA domestic beneficial-ownership exemption removes a federal transparency check that might otherwise have surfaced anomalous cannabis-adjacent corporate structures, while Bitcoin Depots May 2026 bankruptcy, removing approximately 9,700 kiosks nationally, marks a consolidation event in the kiosk channel that Colorado has thus far allowed to unfold without independent state-level shaping.

The cumulative assessment is that Colorados enabler posture has worsened across this baseline on a structural basis, driven by the compounding of a persistent legacy typology with a newly documented enforcement-absence gap, rather than by any single new incident.

Outlook

The single most consequential open question remains whether a Colorado Attorney General enforcement dataset, or equivalent state-level litigation record, will emerge to clarify the capacity-versus-choice distinction underlying the kiosk enforcement gap. A dedicated Colorado state-level national risk assessment or typology report, if published, would materially improve the granularity of this enabler-jurisdiction assessment beyond what federal baseline material currently supports.

domain_sub_briefs · D3 · Cumulative analysis
Periodic updates (1)
11 Aug 2026 · fim-2026-08-05

Enabler Jurisdictions and Professional Facilitators

Two enabler-jurisdiction findings this cycle illustrate the same underlying pattern from different angles: professional and institutional facilitators embedded within otherwise licensed or legitimate infrastructure enabling illicit finance at scale. In Cambodia, OFAC's designation of a sitting senator, Kok An, together with twenty-eight affiliated individuals and entities, ties licensed casino infrastructure directly to a trafficking-linked scam-compound network that laundered at least seventy-three million dollars from American victims. This is corroborated by Amnesty International's parallel finding that Cambodia's state casino-licensing authority continued to approve properties linked to scam compounds even amid an official, ongoing crackdown that had produced over twenty-one thousand deportations by mid-2026. The coexistence of active enforcement and continued state licensing of implicated properties is itself the enabler-jurisdiction signal: it indicates that enforcement and enablement are operating simultaneously within the same regulatory apparatus, rather than enablement having been definitively displaced by enforcement.

In Mexico, FinCEN's supplemental alert on CJNG fuel-theft and tax-evasion typologies names complicit brokers and small US oil and gas companies as placement points for cartel-stolen fuel proceeds — professional and commercial facilitators operating at the placement stage of the laundering cycle rather than large financial institutions. This complements FinCEN's standing Section 311 special measures against three named Mexican financial institutions, which remain in effect and represent a longer-running facilitator-jurisdiction finding predating this cycle. Together, the Cambodia and Mexico findings span the professional-facilitator spectrum from a sitting legislator embedded in casino licensing to small commercial brokers embedded in fuel-supply chains, illustrating that enabler-jurisdiction risk is not confined to any single tier of facilitator sophistication.

Enabler-jurisdiction risk of this kind typically manifests through one of three channels: complicit licensing authorities that continue to approve or renew credentials for implicated entities, professional intermediaries such as brokers or company-formation agents who structure placement and layering on behalf of illicit actors, and financial institutions that provide access despite red flags. This cycle's evidence base covers the first two channels directly — Cambodia's casino-licensing authority and Mexico's fuel-theft placement brokers — while the third, financial-institution complicity, is evidenced separately this cycle through FinCEN's standing Section 311 measures against three Mexican institutions rather than through any new designation. The professional-facilitator dimension of the Cambodia network merits particular attention: OFAC's twenty-nine-entity designation implies a network of intermediaries beyond the senator himself, consistent with the scale of a seventy-three-million-dollar laundering operation, which would typically require company-formation agents, nominee arrangements, and payment-processing intermediaries operating alongside the casino infrastructure itself, though the specific roles of the twenty-eight affiliated entities were not individually detailed in the evidence reviewed this cycle. The state-adjacent-capture reading of the Cambodia designation is the more structurally significant of the two findings: a sitting senator's direct implication in scam-compound finance, evidenced at High confidence via a Tier 1 Treasury designation corroborated by Tier 2 sources, suggests protection reaching into the legislative apparatus itself rather than mere regulatory-capacity gaps at the licensing-agency level.

Outlook

Watch for further OFAC action against additional Cambodian casino licensees connected to the same scam-compound network, given the state-adjacent-capture pattern already evidenced; the persistence of state casino licensing for implicated properties suggests this designation is unlikely to be the last in the series. On the Mexican side, monitor for expansion of the Section 311 special-measures list beyond the three currently named institutions, and for further FinCEN alerts building on the fuel-theft typology identified this cycle. Both jurisdictions should be treated as structural, not episodic, enabler-jurisdiction risks for the foreseeable near term.

D4 Conflict Finance

stablestanding position

Conflict Finance and Extractive-Industry Integrity

This cycle's conflict-finance signal centers on a deteriorating narco-finance picture spanning two jurisdictions. Colombia received a "failed demonstrably" counternarcotics designation on the FY2026 Majors List, the first such adverse finding for Colombia in roughly three decades, citing record coca cultivation; sanctions attached to the designation were waived on national-interest grounds. This finding rests on a single secondary source this cycle — the primary White House FY2026 determination memorandum was not directly retrieved — so confidence is held at Assessed pending primary corroboration, but the substance of the finding, a first-in-a-generation adverse counternarcotics determination for a major US security partner, is itself analytically significant regardless of the sourcing tier, because it signals a documented divergence between narco-finance deterioration and continued diplomatic and economic engagement.

Continue reading

In Mexico, FinCEN's supplemental alert identifies fuel theft, or huachicol, as now the largest non-drug illicit revenue source for CJNG and other cartels, a finding issued concurrently with OFAC's designation of two Mexican nationals and nine entities tied to fuel-smuggling and tax-evasion schemes. This is a continuation and escalation of a fiscal-crime typology first flagged in FinCEN's May 2025 Cartel Oil Smuggling Alert, and it represents extractive-industry integrity risk in the specific sense that stolen fuel-supply-chain proceeds are being layered into the broader financial system via complicit brokers and small US oil and gas companies acting as placement points.

Read together, the Colombia and Mexico findings describe a regional conflict-finance environment in which traditional drug-trafficking revenue is being supplemented, and in Mexico's case substantially supplanted, by extractive-industry-adjacent revenue streams — coca cultivation on one side of the ledger and stolen-fuel placement on the other — while the diplomatic and sanctions response in both cases remains calibrated by broader national-interest considerations rather than by the severity of the underlying finding alone.

Outlook

The primary near-term test for the Colombia finding is whether the White House's FY2026 determination memorandum becomes available for direct review, which would allow this finding to move from Assessed to a higher confidence tier; absent that, treat the coca-cultivation and "failed demonstrably" characterization as probable rather than confirmed. On the Mexican side, watch for further FinCEN typology alerts extending the fuel-theft finding to other extractive sectors, and for whether the two-individual, nine-entity OFAC designation this cycle expands to additional complicit brokers or companies identified through the placement-point typology. Both findings should be read as structural deterioration signals rather than episodic events, given the multi-year trend lines each draws on.

D5 Crypto / Digital Assets / Financial Innovation

stablestanding position

Crypto / Digital Assets / Financial Innovation

Colorado's crypto-sector exposure this period centres on a single, high-materiality enforcement event: the multistate Bank Secrecy Act and anti-money-laundering consent order against Coinme, Inc., the cryptocurrency money transmitter and kiosk operator headquartered in Seattle. Effective 7 October 2026, thirty-four state financial regulatory agencies, coordinated with Colorado and more than thirty other states plus the District of Columbia and Puerto Rico, reached a 2.5 million dollar settlement with Coinme over violations of Bank Secrecy Act and anti-money-laundering requirements. Colorado's Division of Banking is a named party, and the state's allocated share of the settlement is 116,168.44 dollars. The multistate examination that produced this order covered Coinme's activity across the period from 31 March 2023 through 31 March 2025, indicating a sustained, multi-year supervisory review rather than a response to a single incident.

Continue reading

The consent order's forward-looking term is the more consequential element for Colorado specifically: Coinme is required to cease kiosk operations in the state by 1 January 2027, or face an additional 4 million dollar penalty applied on a national basis. This structure, a jurisdiction-specific operational wind-down backed by an escalating national penalty, is a notable enforcement architecture choice. It gives Coinme a defined window to exit the Colorado kiosk market in an orderly way while attaching a severe financial consequence if it instead continues operating past the deadline, effectively using the threat of a disproportionate national penalty to enforce a state-specific operational outcome.

This sits against the backdrop of Colorado's standing digital-asset regulatory architecture, which treats crypto kiosk and money-transmission activity through the general Money Transmission Modernization Act, Title 11, Article 110, effective 6 August 2025, rather than through any bespoke cryptocurrency statute. Crypto asset operators in Colorado are therefore examined and licensed as money service businesses first, with their crypto-specific activity layered onto that general framework rather than governed by a separate crypto-native regulatory track. The Coinme enforcement action illustrates how that general money-transmission licensing structure is being used in practice to discipline a crypto-sector licensee: the underlying violations are framed as Bank Secrecy Act and anti-money-laundering failures, the same category of violation that would attach to a conventional, non-crypto money transmitter, rather than as crypto-specific regulatory breaches.

For digital-asset market participants more broadly, the signal from this action is that coordinated multistate AML enforcement against a crypto kiosk and money-transmission operator can proceed entirely through the existing state money-transmitter licensing and BSA/AML compliance architecture, without any crypto-specific statute being invoked. The 34-jurisdiction scope of the coordinated action also indicates that state financial regulators are capable of acting in concert at scale against a single multi-state-licensed crypto money services business, which raises the practical compliance stakes for any similarly structured kiosk or money-transmission operator carrying licenses across a comparable number of states.

Outlook

The date to watch is 1 January 2027, the deadline by which Coinme must cease Colorado kiosk operations under the consent order or become exposed to the additional 4 million dollar national penalty layered on top of the 2.5 million dollar multistate settlement. How Coinme responds, through an orderly wind-down, a negotiated extension, or continued operation into the penalty period, will be an early indicator of how multistate-coordinated AML enforcement against crypto money transmitters plays out operationally once the settlement terms come due. Colorado's underlying AML/CFT architecture, resting on the Money Transmission Modernization Act and federal BSA designation for casinos, remains structurally stable and is not itself under revision; what is changing is the enforcement posture applied within that existing architecture against a specific, multi-state-licensed crypto operator.

Cumulative analysis

Crypto, Digital Assets, and Financial Innovation — Cumulative Analysis

Colorados digital-asset risk profile across this baseline is defined overwhelmingly by its role as a target jurisdiction within a national crypto-ATM kiosk pipeline rather than by any distinct Colorado-specific regulatory framework; the states own approach to virtual-asset-service-provider oversight has not generated independent developments in the record, leaving federal action as the primary driver of Colorados digital-asset exposure. The core scheme is a crypto ATM elder-fraud-to-offshore laundering pipeline in which scammers direct victims, disproportionately elderly, to convert cash into cryptocurrency at unattended kiosks, with funds moving within hours through intermediary wallets to offshore exchanges and onward to Chinese and Southeast Asian money-laundering networks for cash-out at scale. Colorado functions as a target jurisdiction in this architecture, hosting a substantial share of the roughly 32,000 US kiosks implicated nationally.

Three developments across this baseline mark structural inflection points in that pipeline. First, FinCEN Notice FIN-2025-NTC1, issued August 2025, formally recognized the scale of the problem, citing a 99 percent year-on-year rise in kiosk-related fraud complaints and imposing enhanced Bank Secrecy Act reporting expectations on Colorado-sited Bitcoin Depot, CoinFlip and Athena Bitcoin machines — the first primary-source federal acknowledgment directly binding Colorados kiosk operators to heightened compliance duty. Second, Bitcoin Depots bankruptcy filing on May 18, 2026 removed the largest national operator from the market, taking approximately 9,700 kiosks offline nationally amid mounting multi-state regulatory pressure; because Bitcoin Depot machines were sited in Colorado, this is a direct market-structure shock to the states kiosk-based laundering channel, though its net effect on risk — reduction through capacity loss, versus risk migration to successor operators — is not yet resolved in the available record. Third, and forward-looking, is the proposed GENIUS Act stablecoin Customer Identification Program rule, a joint FinCEN/OCC/Federal Reserve/FDIC/NCUA rulemaking expected in 2027 that would impose CIP-equivalent onboarding controls on stablecoin issuers, directly relevant to any Colorado-domiciled fintech or crypto issuer considering entry into that market, though it remains at the proposed stage.

What threads all three developments together, when read against Colorados broader enabler posture recorded elsewhere in this baseline, is the absence of any Colorado-specific state-level enforcement or regulatory response to the kiosk typology specifically — the entire corrective apparatus operating on Colorados digital-asset risk to date has been federal, whether through FinCEN advisory, national bankruptcy proceedings, or prospective joint-agency stablecoin rulemaking, while Colorados own Attorney General has not joined the peer-state litigation wave against kiosk operators.

Outlook

The principal open question is what fills the capacity vacuum left by Bitcoin Depots exit — successor-operator entry, consolidation among remaining kiosk networks, or a state legislative response — none of which is yet confirmed. The GENIUS Act stablecoin CIP rule, expected in 2027, remains the more structurally significant medium-term watch item for any Colorado entity contemplating stablecoin issuance.

domain_sub_briefs · D5 · Cumulative analysis
Standing baseline position

Colorado's Division of Banking (Dec 2025 interim guidance) interprets the MTMA (HB25-1201, eff. Aug 6 2025) as generally requiring a money-transmitter license, with BSA/AML program conditions, for virtual-currency buying/selling/transfer businesses operating in the state.

SB25-079 requires virtual-currency kiosk operators to disclose terms, issue electronic transaction receipts, and refund a customer's first transaction to an out-of-US wallet/exchange if reported fraudulent within 60 days.

Colorado Division of Banking joined a 34-state $2.5M BSA/AML consent order against Coinme Inc. (8 Oct 2026); Coinme must exit virtual-currency kiosk operations in Colorado by 1 Jan 2027 or face an additional $4M penalty; Polygon Labs closed its acquisition of Coinme on 14 Oct 2026, absorbing the Colorado licence and remediation obligations.

Periodic updates (4)
18 Oct 2026 · fim-2026-10-18

Crypto, Digital Assets, and Financial Innovation

Colorado's crypto-integrity signal this cycle is a two-step sequence. First, on 8 October 2026, the Colorado Division of Banking joined thirty-three other state financial regulatory agencies in a 2.5 million dollar Settlement Agreement and Consent Order against Coinme Inc., a Seattle-based cryptocurrency money transmitter and kiosk operator, resolving violations of Bank Secrecy Act and anti-money-laundering requirements. Coinme agreed to exit virtual-currency kiosk operations by 1 January 2027, facing an additional 4 million dollar penalty if it fails to do so, and to retain an independent BSA/AML compliance consultant. The Colorado Division of Banking published the settlement directly on its own public-notices page, which is itself a signal: the state was an active, named participant in a coordinated multistate action rather than a jurisdiction merely deferring to a lead regulator elsewhere.

Second, only six days later, on 14 October 2026, Polygon Labs closed its acquisition of Coinme (and Sequence), a deal reportedly worth over 250 million dollars and first announced in January 2026. The acquisition brought with it 37 state money-transmitter licenses and 11 exemptions, including Coinme's Colorado licence, and with that licence came the consent order's kiosk-exit deadline and compliance-consultant requirement, now attaching to Polygon Labs as the new licence holder. No primary-source statement from the Colorado Division of Banking confirming the specific mechanics of this licence transfer has been located this cycle; the transfer is inferred from the acquisition's reported scope, corroborated across multiple secondary outlets. This sequence illustrates a live risk pattern worth naming explicitly: a BSA/AML enforcement obligation created against one corporate entity can transfer, largely intact, to an acquirer through a licence-portfolio acquisition closing within days of the settlement, raising the practical question of whether supervisory attention follows the obligation as closely as the licence number does.

Outlook

The clearest thing to watch is whether the Colorado Division of Banking issues any further public statement addressing the licence transfer to Polygon Labs specifically, which would resolve the sourcing gap in this cycle's record. The 1 January 2027 kiosk-exit deadline is the operative date; whether Polygon Labs meets it, and whether the independent compliance consultant requirement is substantively fulfilled under the new ownership, will be the next test of whether this consent order's remediation terms survive a change of corporate control.

28 Sep 2026 · fim-2026-09-28

Crypto, Digital Assets, and Financial Innovation

Colorado's Division of Banking issued interim guidance on December 18, 2025 establishing that most crypto exchanges transmitting funds on behalf of users, facilitating fiat-to-crypto conversion, or issuing stablecoins fall within the scope of the Colorado Money Transmission Modernization Act (MTMA), and therefore require a Colorado Money Transmitter License. This is a structurally significant finding: rather than legislating a bespoke crypto framework, Colorado has extended its general money-transmission perimeter to capture virtual-currency businesses, a pattern consistent with the broader US state-level trend of regulating crypto through existing money-transmitter architecture rather than novel statute. The guidance requires FinCEN MSB registration and a documented BSA/AML compliance program as preconditions to state licensure, meaning a crypto business seeking to operate in Colorado must satisfy both the federal registration layer and the state licensing layer before beginning operations.

The architecture-over-incident read here is that Colorado has resolved, at the interim-guidance level, a question that many US states have left ambiguous: whether existing money-transmitter statutes apply to crypto exchanges and stablecoin issuers by default. Colorado's answer is yes, for most virtual-currency businesses, absent a specific statutory exemption. This is a durable structural signal for any crypto-payment intermediary assessing US state-by-state licensing exposure, because it removes interpretive ambiguity that operators in other states may still face. The guidance being labeled interim rather than final, however, means the scope determination could still be refined; the underlying statutory basis (the MTMA, effective August 6, 2025) is not itself in question, but interim guidance historically carries a lower durability profile than final rules or statute text.

The compliance implication for affected firm types — crypto-asset operators and payment companies — is that Colorado licensure is not a standalone requirement but sits atop an existing federal AML/CFT foundation. A firm cannot obtain a Colorado MTL for virtual-currency transmission without first (or concurrently) satisfying FinCEN Money Services Business registration and demonstrating a functioning BSA/AML program, which effectively imports federal Bank Secrecy Act customer due diligence obligations into the state licensing gate. This dual-layer structure is typical of the US money-transmission regulatory model but is worth stating explicitly for stablecoin issuers and exchange operators newly assessing Colorado as an entry jurisdiction: the state licence and the federal AML infrastructure are not sequential options but a combined precondition.

This cycle's research was concentrated on D5/D7 and did not extend to a fresh review of D1-D4 for Colorado; no sanctions, beneficial-ownership, enabler-jurisdiction or conflict-finance material specific to Colorado was surfaced or is being asserted here.

Outlook

The interim status of the Division of Banking's December 2025 guidance is the key item to watch: a transition from interim to final guidance could adjust the precise scope of which virtual-currency business models require MTL licensure, particularly around any stablecoin-specific exemption structure. Operators and compliance teams tracking Colorado as a crypto-payments jurisdiction should monitor the Division of Banking's guidance page for a finalized version, and should not assume the interim scope determination is the last word on which crypto business models are captured.

5 Sep 2026 · fim-2026-08-21

Crypto / Digital Assets / Financial Innovation

The digital-asset perimeter of Colorado tightened this cycle through two coordinated instruments reaching effective date on 2026-08-12. The Colorado Vending of Digital Assets Act (SB25-079) requires virtual-currency-kiosk operators to provide customer disclosures and electronic receipts for each transaction, and to refund a customer first transaction where funds moved to a wallet or exchange located outside the United States and the customer reports suspected fraud within 60 days with law-enforcement contact. This is a narrowly scoped but binding consumer-protection and fraud-typology control layered onto the money-transmission perimeter of Colorado specifically for kiosk-based crypto conversion, assessed at Assessed confidence against a Tier 1 primary source. Alongside it, the Colorado Money Transmission Modernization Act (HB25-1201) repealed the prior Money Transmitters Act and adopted the Conference of State Bank Supervisors multistate-licensing model, expanding regulated activity to cover digital money movement and payroll processing and strengthening the enforcement tools of the Division of Banking; this is the operative framework governing fiat-linked virtual-currency transmission in Colorado going forward. No enforcement action or Division of Banking implementing guidance under either statute has yet been located this cycle, and this absence is best read as a timing gap following a recent effective date rather than a substantive finding. Both instruments sit within the AML pillar of the financial-integrity architecture of Colorado, reflecting a state-level effort to build supervisory capacity around digital-asset conversion points ahead of any observed violation.

Outlook

The Division of Banking is anticipated to issue implementation or enforcement guidance under SB25-079 in the third quarter of 2026. The 60-day kiosk-refund claim window in Colorado is assessed as a novel compliance parameter not yet mirrored in most other states, and whether other CSBS-model jurisdictions adopt comparable provisions is a marker worth tracking for multistate kiosk operators. The near-term test for this domain is whether enforcement volume develops under the expanded HB25-1201 licensing perimeter now that the modernized framework is in force.

11 Aug 2026 · fim-2026-08-05

Crypto / Digital Assets / Financial Innovation

TRM Labs assessed approximately one hundred fifty-eight billion dollars in illicit cryptocurrency flows in 2025, a one hundred forty-five percent increase year-on-year from sixty-four and a half billion dollars in 2024 — the highest illicit-flow figure in five years on TRM's methodology — with the increase substantially attributable to Southeast Asian scam-compound laundering. This finding directly corroborates the digital-asset dimension of this cycle's Cambodia enabler-jurisdiction designation: the same scam-compound infrastructure implicated in the Kok An network designation is the kind of operation TRM's estimate attributes much of the year-on-year increase to, tying a global aggregate figure to a specific, geographically concrete enforcement action within the same reporting window. The finding is sourced to a single Tier 2 source this cycle, and the multi-source threshold for a High confidence rating was not met; it is held at Assessed confidence accordingly. No FinCEN, FCA, or equivalent primary-regulator crypto-specific guidance was identified this cycle to corroborate or extend the TRM estimate. The pig-butchering wallet typology, in which victims are induced into fraudulent cryptocurrency investment schemes over an extended relationship-building period, is the operational mechanism TRM's reporting associates with sophisticated on-chain laundering behind the scam-compound share of the total. Compliance teams at crypto-asset service providers should treat elevated Southeast Asian counterparty-linked wallet activity as a heightened-risk signal in light of both this global flow estimate and the concurrent Cambodia enforcement action.

Outlook

Watch for a primary-source or second independent estimate of 2025 illicit crypto flows to corroborate TRM's one-hundred-fifty-eight-billion-dollar figure at a higher confidence tier, and for any FinCEN or international-body guidance specifically addressing Southeast Asian scam-compound crypto laundering, which would connect this domain more directly to the standing Cambodia enabler-jurisdiction finding tracked elsewhere in this brief.

D6 Compliance Technology & Active Defence

watch

Compliance Technology & Active Defence

Colorado's Automated Decision-Making Technology and Chatbot Safety rulemaking has entered a live procedural phase with direct bearing on compliance-technology posture at regulated financial and payment firms. The Colorado Department of Law released a revised interim draft of the implementing rules, numbered 4 CCR 904-6, on 6 October 2026 and convened a formal rulemaking hearing on 26 October 2026, accepting written comments through that date. No final rule has been adopted; the matter remains open at the drafting stage.

Continue reading

The substantive point of contest is the scope of the rules Financial or Lending Service definition and the boundary of its fraud-prevention and identity-verification exclusion. Industry comment submitted to the docket, from the Financial Data and Technology Association, argues that the draft language leaves models used to make credit or fraud-screening decisions at account opening still covered, and that the threshold test for whether a model materially influences such a decision is unlikely to meaningfully narrow the rules reach in many financial-services contexts. That comment is advocacy from an affected industry body, not a determination by the rulemaking authority, but it usefully frames where the architecture of the obligation is still being drawn: the line between a permitted fraud-prevention tool and a covered automated decision system has not yet been fixed.

This is a structural, architecture-stage finding rather than an enforcement-incident one. No firm has been found in breach of anything; the state is still defining what the obligation will cover once it exists. Read through the compliance-technology lens, the significance lies in which categories of AI-driven decisioning the finalised rule will bring within a disclosure and transparency regime, and which it will carve out as fraud-prevention tooling. For firms operating account-opening credit and fraud-screening systems that incorporate automated decisioning, the rulemaking record itself is the thing to watch: the positions staked out in the comment process indicate where the contested boundary currently sits, even though the outcome is not yet settled.

The broader significance for active-defence posture is that this is an instance of a state regulator building an AI-governance obligation that layers directly onto existing fraud and credit-decisioning infrastructure, rather than creating a wholly separate AI-specific regime. Firms that already operate model governance and documentation practices for fraud and credit models will find the new obligation, once finalised, asks for transparency and disclosure on top of what already exists operationally, rather than a parallel compliance-technology build. The degree of overlap between what the rule will require and what firms already do for existing model-risk purposes is itself one of the open questions the rulemaking has not yet resolved.

Outlook

The Colorado Attorney General is expected to finalise the ADMT/Chatbot Safety implementing rules in the first quarter of 2027, as scheduled, subject to the normal uncertainty of an active rulemaking docket that has already seen one interim draft revision. The determinative question for financial-sector compliance-technology planning is where the final rule draws the fraud-prevention and identity-verification exclusion: a narrow exclusion would draw a substantial share of account-opening credit and fraud-screening systems into a disclosure and transparency regime, while a broader exclusion would leave much of that activity outside it. Until the rule is finalised, firms operating AI-driven decisioning systems in this jurisdiction should treat the scope of their compliance-technology obligations here as provisional, and the positions staked out in the current comment record as the best available indicator of where the contested boundary is likely to land.

Cumulative analysis

Compliance Technology and Active Defence — Cumulative Analysis

Colorados compliance-technology posture across this baseline is shaped by no independent state-level initiative but rather by two counter-directional federal developments that together define the states supervisory environment for BSA-regulated institutions. The first is FinCENs AML/CFT Program NPRM, issued April 7, 2026, which proposes to reform risk-based AML/CFT program requirements for all US BSA-regulated institutions and explicitly encourages adoption of innovative, technology-enabled compliance approaches, including RegTech and AI-enabled monitoring; its comment period closed June 9, 2026 and a final rule is expected between the third quarter of 2026 and the first quarter of 2027. This is the most consequential prospective structural shift recorded in this baseline for compliance methodology in Colorado: a move from checklist-driven control design toward demonstrably effective, risk-based program design, applicable to every Colorado BSA-regulated institution regardless of sector.

The second, counter-directional development is a capacity contraction: IRS staffing dedicated to AML examination of crypto firms and money transmitters fell 33 percent in 2025, from 208 agents nationally in 2024 to 139, narrowing federal supervisory reach into Colorado-domiciled nonbank financial institutions and crypto money services businesses. This contraction occurred during the same period that kiosk-related fraud complaints rose 99 percent year-on-year nationally, meaning the federal examiner base tasked with verifying whether Colorados nonbank and crypto-adjacent institutions are actually detecting and reporting the fraud typologies documented elsewhere in this baseline was shrinking precisely as the underlying risk was growing.

The cumulative structural picture is therefore one of a widening gap between regulatory ambition and regulatory capacity: FinCEN is proposing to hold Colorado institutions to a higher, technology-enabled standard of program effectiveness, while the federal apparatus responsible for examining compliance with that standard has less capacity to do so than it did in the prior year. Whether this gap narrows or widens further will depend on two independent variables — the substance of the NPRMs eventual final-rule text, and whether IRS examiner staffing is restored — neither of which is resolved in the current record.

Outlook

Post-finalization text of the FinCEN AML/CFT Program NPRM, expected between Q3 2026 and Q1 2027, would confirm whether the RegTech and AI-monitoring encouragement language survives into binding form, a key open item for this domain going forward. Separately, whether IRS examiner capacity stabilizes or continues to contract will determine whether any finalized program-effectiveness standard can be meaningfully supervised for Colorados nonbank financial institutions and crypto money services businesses.

domain_sub_briefs · D6 · Cumulative analysis

D7 AML/CTF Regime

stablestanding position

AML/CTF Regime

The anti-money-laundering exposure of Colorado for money-services businesses continues to run primarily through the federal Bank Secrecy Act and FinCEN framework, with the modernized state money-transmission licensing regime under the Colorado Money Transmission Modernization Act (HB25-1201) now operating as a complementary supervisory layer. HB25-1201 repealed the prior Colorado Money Transmitters Act and replaced it with a Conference of State Bank Supervisors multistate-licensing model, modernizing control-threshold notifications and enforcement tools for money transmitters, including crypto-adjacent transmitters, and complementing rather than displacing federal BSA obligations. The Colorado Division of Banking, within the Department of Regulatory Agencies, is confirmed as the supervisory authority administering this licensing regime under Title 11, Article 110 of the Colorado Revised Statutes, including for fiat-linked virtual-currency transmission. This is a structural rather than episodic development: no enforcement action under the new framework has yet been identified, and the AML/CTF baseline of the state is best characterized as actively modernizing rather than reactively tightening in response to any specific violation. This state-level modernization is significant less for what it says about Colorado specifically than for what it signals about the broader trajectory of state money-transmission regulation: Colorado has chosen to align with the national multistate-licensing standard promoted by the Conference of State Bank Supervisors rather than maintain a bespoke state framework, a choice that reduces regulatory fragmentation for money-services businesses operating across multiple states even as it expands the scope of Colorado-regulated activity to include digital money movement and payroll processing specifically.

Continue reading

Outlook

The principal marker for this domain going forward is whether the stronger enforcement tools of the Division of Banking under HB25-1201 translate into observable supervisory activity, and whether further Division guidance clarifies how the modernized licensing regime interacts with federal BSA and FinCEN obligations for multistate money-services businesses operating in Colorado.

Standing baseline position

FinCEN's April 10, 2026 NPRM would require casinos, including Colorado-licensed operators, to maintain effective risk-based AML/CFT programs with board governance and a US-located responsible officer; comment period closed June 9, 2026.

Periodic updates (1)
28 Sep 2026 · fim-2026-09-28

AML/CTF Regime

Two distinct developments define this cycle's D7 picture for Colorado, operating at different regulatory layers. At the state layer, Colorado's Money Transmission Modernization Act, as clarified by the Division of Banking's December 18, 2025 interim guidance, requires most virtual-currency money transmitters to maintain a BSA/AML compliance program and FinCEN MSB registration as a precondition to state licensure — establishing AML/CFT program requirements for crypto businesses as a standing baseline feature of Colorado's regulatory architecture, layered on top of (not separate from) the federal Bank Secrecy Act framework.

At the federal layer, FinCEN published a Notice of Proposed Rulemaking on April 10, 2026 that would materially raise the AML/CFT program bar specifically for casinos and card clubs nationally, a category that directly captures Colorado's licensed casino and sports-betting operators as BSA-defined financial institutions. The NPRM would require these operators to maintain programs assessed as genuinely "effective" on a risk basis, explicitly distinguishing between a program that is well-designed on paper and one that functions effectively in practice — a distinction that raises the evidentiary bar for demonstrating compliance beyond simply having a written program. The proposal also requires governance and board-level approval of the AML/CFT program and mandates a US-located responsible officer, both of which are new structural requirements not uniformly present in current casino AML programs, which have historically followed banking-modeled practice under existing Part 1021 rules without an explicit program-execution effectiveness test.

The three-pillar balance point worth surfacing is that both developments this cycle sit within the AML pillar; no Colorado-specific CTF or CPF development was identified this cycle, and this absence should be read as a research-scope limitation (search effort was concentrated on D5/D6/D7) rather than as an indication that no CTF/CPF exposure exists in Colorado's gaming or payments sector.

The FinCEN NPRM remains at the proposed-rulemaking stage; it has not been finalized, and Colorado-licensed operators are not yet bound by its specific program-execution and governance requirements. The confidence in the NPRM's existence and April 2026 date rests on two independent Tier-3 law-firm analyses rather than a directly retrieved FinCEN primary text this cycle, which is reflected in the Probable confidence tier rather than Confirmed. By contrast, the Colorado MTMA/virtual-currency AML requirement is Confirmed, resting on direct retrieval of the Division of Banking's own interim guidance document.

Outlook

The FinCEN NPRM comment period closed June 9, 2026. Whether and when FinCEN finalizes the casino AML/CFT program rule is the central item to watch: a final rule would convert the current Probable-confidence proposed requirement into a binding federal compliance floor for Colorado's licensed casino and sports-betting operators, with governance and US-located-officer requirements that would need to be built into existing compliance programs. Separately, watch for the Colorado Division of Banking to move its interim virtual-currency guidance to final status, which would settle the current standing baseline with greater durability.

D8 Commercial Activity

stablestanding position

Commercial Activity

Two distinct commercial events touch Colorado this cycle. The first is Polygon Labs' completed acquisition of Coinme Inc., which closed 14 October 2026 in a deal reportedly worth over 250 million dollars, first announced in January 2026. The acquisition brought Polygon Labs 37 state money-transmitter licenses, including Colorado's, and 11 exemptions, along with the kiosk-exit and compliance-consultant obligations Coinme had assumed under its 8 October 2026 multistate consent order just six days before the deal closed. The Colorado nexus here is a licence-portfolio transfer rather than a new market entry: an existing state licence changed corporate hands as part of a much larger national transaction.

Continue reading

The second is TabaPay, Inc.'s announcement on 2 September 2026 of a 155 million dollar strategic growth financing led by FTV Capital, explicitly earmarked to fund TabaPay's planned acquisition of Denver-based Transact Bank N.A. The deal is targeted to close in the fourth quarter of 2026, subject to review by the Office of the Comptroller of the Currency as a change-in-control matter; the status of that regulatory review is not yet known. This transaction, reported directly via the company's own Business Wire release and corroborated by trade press, represents a payments company seeking to acquire a federally chartered bank, a structurally different commercial move than the Coinme-Polygon licence absorption and one with its own distinct regulatory-approval pathway.

Outlook

For the Coinme-Polygon transaction, the open question is whether Colorado's Division of Banking treats the licence transfer as requiring its own confirmation or review process; none has been identified this cycle. For TabaPay-Transact Bank, the fourth-quarter 2026 target close and the outcome of the Comptroller's change-in-control review are the two developments most likely to generate the next material signal, with the bank-acquisition structure carrying materially different regulatory stakes than a money-transmitter licence transfer.

Regulatory horizon
Consultation2027-Q1 · ±quarter

Colorado ADMT/Chatbot Safety Rules Finalisation

Finalised rules will settle the scope of the fraud-prevention/identity-verification exclusion for AI-driven decisioning models used in account-opening credit and fraud screening.
Source
1 dated · 3 pending date · baseline financial-integrity-2026-07-05
Role action cards
Compliance

Colorado has not yet finalised the boundary of its ADMT/Chatbot Safety fraud-prevention exclusion, leaving open which AI-driven account-opening models will require disclosure once the rule is adopted.

The scope of a future compliance-technology obligation for fraud and credit decisioning models remains unsettled following the 26 October 2026 hearing. Industry comment indicates the current draft is likely to cover a broad range of account-opening decisioning models despite the stated exclusion.

1 evidence refs
Board

A Colorado rulemaking now underway could extend disclosure obligations to AI-driven fraud and credit decisioning at account opening.

This is a procedural, not yet final, development that bears on the strategic posture of any payment or lending operation using automated decisioning in this jurisdiction. No obligation attaches until the rule is finalised, expected in the first quarter of 2027, as scheduled.

1 evidence refs
CTO

Draft Colorado rules under live consultation would impose disclosure and transparency duties on automated decision-making technology used in account-opening credit and fraud screening.

Technical architecture for fraud and credit decisioning models may need to support disclosure and transparency requirements once the rule is finalised. The exact scope depends on where the fraud-prevention and identity-verification exclusion boundary is ultimately drawn.

1 evidence refs
Risk

An emerging compliance-technology obligation in Colorado could reshape model-governance requirements for AI-driven fraud and credit decisioning.

This is a structural, architecture-stage development rather than an incident; it signals a possible new layer of model-governance exposure for firms with account-opening decisioning systems operating in this jurisdiction.

1 evidence refs
Audit

Documentation of fraud and credit decisioning models should be monitored against an unsettled Colorado disclosure rule still in consultation.

Until the rule is finalised, the adequacy of existing model documentation against a future disclosure standard cannot be assessed with certainty; the scope of the fraud-prevention exclusion remains contested in the rulemaking record.

1 evidence refs
Scenario sketches

Illustrative pathway: supervisory bifurcation under a national AML architecture transitioning toward centralised oversight

Illustrative only: as jurisdictions layer AI-governance and compliance-technology disclosure obligations onto existing financial-crime control frameworks, a possible structural effect is divergence between sub-national rulemaking (such as a state-level ADMT regime) and any later federal or cross-border harmonisation effort. In this illustrative sketch, a payment firm operating across multiple state-level regimes could face differing disclosure thresholds for the same underlying fraud-decisioning model depending on which state's exclusion boundary applies, creating an incentive to design model documentation to the most restrictive standard rather than per-jurisdiction. This is architecture-over-incident framing: a possible structural mechanism, not an observed fact or prediction.

Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.

Standing trackers (T1–T6)
TrackerStatusNote
T1 · Russian Sanctions-Evasion Architecturestable
T2 · EU AML Package / AMLAstable
T3 · FATF Grey Liststable
T4 · Beneficial-Ownership Register Statusstable
T5 · Crypto & Digital-Asset Integritystable
T6 · Sanctions Regime Divergencestable
Registers

Enforcement actions

  • 4 Aug 2025
  • 1 Oct 2025
  • 1 Jun 2026
  • 21 Jul 2025
  • 8 Oct 2026
  • 7 Oct 2026
  • FinCEN issued Notice FIN-2025-NTC1 urging financial institutions to identify and report suspicious CVC kiosk activity, citing a 99% year-on-year rise in kiosk-related fraud complaints and directly binding Colorado-based Bitcoin Depot, CoinFlip and Athena Bitcoin machines to enhanced BSA reporting expectations. 4 Aug 2025
  • FinCEN designated Huione Group a foreign financial institution of primary money laundering concern, triggering Section 311 special measures that require Colorado-domiciled banks and MSBs to sever or restrict correspondent and processing relationships tied to the entity, which received over $39.6 billion in 2025. 1 Oct 2025
  • Following the January 2025 designation of major cartels as Foreign Terrorist Organizations under EO 14157, FinCEN issued a supplemental alert alongside an OFAC sanctions action targeting fiscal fuel theft schemes, part of a broader financial-intelligence campaign against cartel non-drug revenue streams that traverse Colorado as a distribution corridor. 1 Jun 2026

Sanctions changes

  • 20 Jan 2025
  • 23 Apr 2026
  • 23 Apr 2026
  • 30 Jun 2026
  • 23 Jul 2026
  • Huione Group designated a foreign financial institution of primary money laundering concern under Section 311, requiring Colorado-domiciled BSA-regulated institutions to implement correspondent-account restrictions. 1 Oct 2025
  • FATF's June 2025 plenary added the British Virgin Islands and Bolivia to its Jurisdictions Under Increased Monitoring list and removed Croatia, Mali and Tanzania; FinCEN issued a notice instructing US financial institutions, including those in Colorado, to factor the update into risk-based due diligence. 13 Jun 2025
  • Executive Order 14157 (January 20, 2025) designated major Mexican drug cartels as Foreign Terrorist Organizations/Specially Designated Global Terrorists, exposing Colorado financial institutions to expanded material-support liability for any dealings traced to cartel-linked fuel-theft or trafficking proceeds moving through the state's distribution corridors. 20 Jan 2025

Regulatory horizon (register)

  • Colorado Vending of Digital Assets Act — implementation/enforcement guidance
  • FinCEN AML/CFT Program NPRM (casinos/card clubs in scope)
  • Colorado ADMT/Chatbot Safety Rules Finalisation
  • FinCEN AML/CFT Program NPRM finalization
  • GENIUS Act stablecoin Customer Identification Program rule
  • Corporate Transparency Act interim rule finalization
  • FATF next plenary review of grey/high-risk lists

Active schemes

  • [HIGH] Crypto ATM/kiosk elder-fraud-to-offshore laundering pipeline
  • Cannabis cash-intermediation and revenue-inflation typology
  • [HIGH] Domestic LLC beneficial-ownership opacity post-CTA rollback
Sources
  1. US Treasury/OFAC
  2. Amnesty International
  3. iGamiX/iGamist
  4. FATF
  5. FinCEN
  6. Federal Register / FinCEN
  7. TRM Labs
  8. Colorado Bar Association / Colorado Lawyer
  9. GGRAsia
  10. Miller & Chevalier
  11. Crowell & Moring
  12. Washington Trade & Tariff Letter
  13. Zigram
  14. AMLA (EU)
  15. Holland & Knight
  16. Greenberg Traurig
  17. Tech Times
  18. UK Home Office (gov.uk)
  19. https://leg.colorado.gov/bills/hb25-1201
  20. https://leg.colorado.gov/bills/sb25-079
  21. https://banking.colorado.gov/industry/money-transmitters
  22. https://www.sheppard.com/insights/blogs/colorado-overhauls-money-transmission-law-to-align-with-multistate-licensing-standards
  23. https://cryptoslate.com/crypto-laws/colorado-money-transmission-virtual-currency-regime/
  24. https://banking.colorado.gov/sites/banking/files/documents/Interim_Guidance_Cryptocurrency_and_the_MTMA_Final_12.18.25.pdf
  25. https://www.fincen.gov/
  26. https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-february-2026.html
  27. https://checklynx.com/en/resources/knowledge-base/fatf-grey-list
  28. https://www.bhfs.com/insight/fincen-proposes-sweeping-aml-cft-reforms-what-casinos-need-to-know/
  29. https://www.ballardspahr.com/insights/alerts-and-articles/2026/04/how-casinos-should-prepare-for-fincens-2026-aml-cft-overhaul
  30. https://banking.colorado.gov/
  31. https://banking.colorado.gov/public-notices
  32. https://troutman.com/insights/digital-assets-blockchain-newsletter-october-16-2026
  33. https://www.cryptopolitan.com/polygon-labs-closes-coinme-deal/
  34. https://www.streetinsider.com/Business+Wire/TabaPay+Closes+$155+Million+Strategic+Growth+Financing+Led+by+FTV+Capital+and+Announces+Planned+Acquisition+of+Transact+Bank/27016735.html
  35. https://www.bankingdive.com/news/tabapay-to-buy-transact-bank-ftv-capital-155-million-investment-occ-charter/829459/
  36. Georgia Department of Banking and Finance
  37. Oregon Division of Financial Regulation (publishing the multistate Settlement Agreement and Consent Order)
  38. Conference of State Bank Supervisors
  39. US National Archives (eCFR), Treasury/FinCEN rule text
  40. FDATA
  41. Troutman Pepper Locke
  42. Definition of Money Transmitter (Merchant Payment Processor) | FinCEN.gov
  43. 1 Financial Crimes Enforcement Network (FinCEN)
  44. As crypto industry expands, US slashes office examining dirty money safeguards of cryptocurrency exchanges - ICIJ
  45. FinCEN Notice, FIN-2025-NTC1, August 4, 2025
  46. From Pilot to Crypto Compliance Pioneer: Building and Scaling Risk Management with Brandi Reynolds
  47. Press Releases | FinCEN.gov
  48. Advisories | FinCEN.gov
  49. Application of FinCEN’s Regulations to Virtual Currency Mining Operations | FinCEN.gov
  50. FinCEN Issues Notice on the Use of Convertible Virtual Currency Kiosks for Scam Payments and Other Illicit Activity | FinCEN.gov
  51. Money Services Business (MSB) Registration | FinCEN.gov
  52. Enforcement Actions | FinCEN.gov
  53. Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering, Countering the Financing of Terrorism, and Counter-Proliferation Finance Deficiencies | FinCEN.gov
  54. Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering, Combating the Financing of Terrorism, and Counter-Proliferation Finance Deficiencies | FinCEN.gov
  55. Treasury Convenes Financial Institutions and Law Enforcement to Identify and Dismantle Money Laundering Networks | FinCEN.gov
  56. FinCEN Announces Data-Driven Border Operation to Address Potential Money Laundering | FinCEN.gov
  57. About FinCEN | FinCEN.gov
  58. 1st Review of the Suspicious Activity Reporting System (SARS) | FinCEN.gov
  59. Enforcement Actions for Failure to Register as a Money Services Business | FinCEN.gov
  60. The Anti-Money Laundering Act of 2020 | FinCEN.gov
  61. The DOJ's NCET Disbanded: What This Means for Digital Assets - Chainalysis
  62. Financial Fraud Enforcement Task Force (FFETF) | FinCEN.gov
  63. 2026 Crypto Crime Report – Illicit Crypto Trends & Typologies | TRM Labs
  64. Press Releases | FinCEN.gov
  65. 2026 Crypto Crime Report: Scams
  66. Fact Sheet: Proposed Rule to Strengthen and Modernize ...
  67. Questions swirl around US plans for record $15B Prince Group crypto seizure - ICIJ
  68. News | FinCEN.gov
  69. 1 1. See 31 U.S.C. § 5312(a)(2); 31 C.F.R. § 1010.100(t). 2.
  70. Amid a scam crackdown, crypto giants keep fueling bitcoin ATMs - ICIJ
  71. FinCEN Calls for Vigilance on Crypto Kiosk Activities | OCCRP
  72. Retailers keep cashing in on crypto ATMs as scams surge - ICIJ
  73. How Crypto ATMs in the U.S. Became A Favorite Tool for Scammers | OCCRP
  74. Rate of Illicit Activity at Crypto ATMs is Double That of Overall Crypto Industry | TRM Labs
  75. Fraud and scams involving Bitcoin ATMs
  76. Crypto ATM operator Bitcoin Depot files for bankruptcy - ICIJ
  77. TRM Labs Resources | Crypto Investigations, Compliance, and Policy Insights
  78. FinCEN Notice, FIN-2025-NTC1, August 4, 2025
  79. Flip Book: Investigating Crypto Scams | TRM Labs
  80. Cryptocurrency Field Guide for Law Enforcement
  81. Massachusetts sues Bitcoin Depot, alleging the crypto ATM operator knowingly facilitated crypto scams - ICIJ
  82. 3 Things Law Enforcement Agencies Need to Know About Cryptocurrency - Chainalysis
  83. MSB Registrant Search | FinCEN.gov
  84. Fact Sheet on MSB Registration Rule | FinCEN.gov
  85. F I N C E N G U I D A N C E 1
  86. Application of the Definition of Money Transmitter to Brokers and Dealers in Currency and Other Commodities | FinCEN.gov
  87. Definition of Money Services Business (Debt Management Company) | FinCEN.gov
  88. Whether a Company that Provides Online Real-Time Deposit, Settlement, and Payment Services for Banks, Businesses and Consumers is a Money Transmitter rather | FinCEN.gov
  89. 2024 Pig Butchering Crypto Scam Revenue Grows 40% YoY as Industry Increases Sophistication
  90. BSA Expectations Regarding Marijuana-Related Businesses | FinCEN.gov
  91. Frequently Requested FOIA-Processed Records | FinCEN.gov
  92. FinCEN Issues Guidance to Financial Institutions on Marijuana Businesses | FinCEN.gov
  93. Guidance | FinCEN.gov
  94. Marijuana With High THC Levels Draws Scrutiny in Colorado, Washington - Bloomberg
  95. 1 The U.S. Department of the Treasury’s (Treasury)
  96. Marijuana Banking Is Moving Forward Despite Federal Uncertainty - Bloomberg
  97. Marijuana Dispensaries Put Colorado Banks in a Bind - Bloomberg
  98. REQUEST ID SUMMARY OF REQUEST DATE RECEIVED REQUESTER GoFOIA # 19-001-F
  99. Marijuana Banking Update
  100. Bitcoin Depot Goes Bankrupt, Signaling Demise of Crypto ATMs - Bloomberg
  101. Bitcoin ATMs are a legal and fast-growing part of the crypto world, despite flying under the regulatory radar
  102. Law enforcement, banks warn of money laundering gaps in major US crypto bill - ICIJ
  103. Definition of Money Services Business (Money Transmitter/Currency Dealer or Exchanger) | FinCEN.gov
  104. White House Releases Report on Digital Assets | TRM Labs
  105. GUIDANCE TO MONEY SERVICES BUSINESSES ON OBTAINING AND MAINTAINING BANKING SERVICES | FinCEN.gov
  106. Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies | FinCEN.gov
  107. Application of Money Services Business Regulations to a Company that Offers Escrow Services to a Buyer and Seller in a Given Internet Sale of Goods or Services | FinCEN.gov
  108. Administrative Ruling on the Application of FinCEN Regulations to Currency Transporters, Including Armored Car Services, and Exceptive Relief | FinCEN.gov
  109. Advisory on Illicit Activity Involving Convertible Virtual ...
  110. Application of FinCEN’s Regulations to Persons Issuing Physical or Digital Negotiable Certificates of Ownership of Precious Metals | FinCEN.gov
  111. Request for Administrative Ruling on the Application of FinCEN’s Regulations to a Virtual Currency Trading Platform | FinCEN.gov
  112. 1 FinCEN Advisory United States Department of the Treasury
  113. Administrative Ruling on Whether a Company that Offers a Payment Mechanism Based on Payable-Through Drafts to its Commercial Customers is a Money Transmitter | FinCEN.gov
  114. Beneficial Ownership Information Reporting | FinCEN.gov
  115. Frequently Asked Questions | FinCEN.gov
  116. Beneficial Ownership Information Reporting Rule Fact Sheet | FinCEN.gov
  117. Beneficial Ownership Reporting Outreach and Education Toolkit | FinCEN.gov
  118. Beneficial Ownership Information Report (BOIR) - BOI E-FILING
  119. BOI Newsroom | FinCEN.gov
  120. Fact Sheet: Beneficial Ownership Information Reporting Notice of Proposed Rulemaking (NPRM) | FinCEN.gov
  121. Prepared Remarks of FinCEN Deputy Director Jimmy Kirby During Beneficial Ownership Information Reporting Event in Lakewood, Colorado | FinCEN.gov
  122. FinCEN Removes Beneficial Ownership Reporting Requirements for U.S. Companies and U.S. Persons, Sets New Deadlines for Foreign Companies | FinCEN.gov
  123. Quick Reference | FinCEN.gov
  124. Application of Money Services Business regulations to the rental of computer systems for mining virtual currency | FinCEN.gov
  125. Application of FinCEN’s Regulations to Virtual Currency Software Development and Certain Investment Activity | FinCEN.gov
  126. Request for Administrative Ruling on the Application of FinCEN’s Regulations to a Virtual Currency Payment System | FinCEN.gov
  127. Crypto regulatory affairs: US Treasury releases national financial crime risk assessments
  128. Treasury Department Publishes National Money Laundering Risk Assessment and National Terrorist Financing Risk Assessment | FinCEN.gov
  129. New US Treasury strategy targets crypto scams and real estate money laundering - ICIJ
  130. MONEY LAUNDERING NATIONAL RISK ASSESSMENT TOOLKIT – ANNEXES A-C
  131. Fact Sheet: Proposed Rule to Fundamentally Reform Financial
  132. HM Treasury national risk assessment 2025
  133. What Is Money Laundering? Definition, Stages, and Crypto Laundering Methods - Chainalysis
  134. FATF launches National Risk Assessment toolkit to help countries identify greatest money laundering risks
  135. 1 The U.S. Department of the Treasury’s (Treasury) Financial
  136. Financial Crimes Enforcement Network (FinCEN), U.S. Department of the Treasury
  137. Financial Crimes Enforcement Network (FinCEN), U.S. Department of the Treasury
  138. Colorado Department of Regulatory Agencies (DORA) — Division of Banking
  139. International Consortium of Investigative Journalists (ICIJ)
  140. U.S. Department of the Treasury
  141. Financial Crimes Enforcement Network (FinCEN), U.S. Department of the Treasury
  142. TRM Labs
  143. International Consortium of Investigative Journalists (ICIJ)
Coverage gaps
fim-int-2026-07-07-G001: A Colorado Attorney General enforce…
fim-int-2026-07-07-G001: A Colorado Attorney General enforcement dataset or state-level crypto-ATM litigation record would clarify whether the absence of parallel state action reflects a capacity deficit or a political choice. [resolved]
fim-int-2026-07-07-G002: A dedicated Colorado state-level na…
fim-int-2026-07-07-G002: A dedicated Colorado state-level national risk assessment or typology report would improve the granularity of Colorado-specific financial-crime risk tracking beyond federal baseline material. [resolved]
fim-int-2026-07-07-G003: Confirmation of whether the EU or U…
fim-int-2026-07-07-G003: Confirmation of whether the EU or UK have issued equivalent designations to the Section 311 Huione Group action or the EO 14157 cartel FTO/SDGT designation would resolve the divergence-note uncertainty in sanctions tracking. [resolved]
fim-int-2026-07-07-G004: Post-finalization text of the FinCE…
fim-int-2026-07-07-G004: Post-finalization text of the FinCEN AML/CFT Program NPRM would confirm whether the RegTech/AI-monitoring encouragement language survives into the final rule. [resolved]
fim-int-2026-07-07-G005: Named designated entities within th…
fim-int-2026-07-07-G005: Named designated entities within the EO 14157 cartel FTO/SDGT action were not collected in Research material; specific cartel names would sharpen structured-claims precision on this designation. [resolved]
fim-int-2026-07-14-G001: No EU AML Package (AMLR/6AMLD/AMLA)…
fim-int-2026-07-14-G001: No EU AML Package (AMLR/6AMLD/AMLA) transposition or supervisory-perimeter development was located this cycle; research effort was concentrated on US/CO and Tier-D jurisdictions. [resolved]
fim-int-2026-07-14-G002: No new EU/US/UK sanctions-regime di…
fim-int-2026-07-14-G002: No new EU/US/UK sanctions-regime divergence or cross-bloc delisting asymmetry was located this cycle. [resolved]
fim-int-2026-07-14-G003: No D4 Conflict Finance substantive …
fim-int-2026-07-14-G003: No D4 Conflict Finance substantive finding located this cycle beyond the adjacent Mexico cartel fuel-smuggling item classified under D3. [resolved]
fim-int-2026-07-14-G004: The obligation_refs.framework close…
fim-int-2026-07-14-G004: The obligation_refs.framework closed enum has no value corresponding to the US Corporate Transparency Act (distinct from the UK's ECCTA2023); obligation_refs was left empty on claim fim-2026-W29-005 to avoid a mis-mapped framework tag. [resolved]
fim-int-2026-08-05-G001: No primary consilium.europa.eu text…
fim-int-2026-08-05-G001: No primary consilium.europa.eu text retrieved this cycle for the EU 21st Russia sanctions package; confidence capped at Assessed pending primary corroboration. [resolved]
fim-int-2026-08-05-G002: OFSI Yemen/Houthi sanctions channel…
fim-int-2026-08-05-G002: OFSI Yemen/Houthi sanctions channel lacked a T1 anchor this cycle. [resolved]
fim-int-2026-08-05-G003: No fresh FinCEN, FCA/JMLSG, or equi…
fim-int-2026-08-05-G003: No fresh FinCEN, FCA/JMLSG, or equivalent AI/ML/perpetual-KYC guidance identified this cycle for D6. [resolved]
fim-int-2026-08-05-G004: Sub-Saharan Africa and Central Asia…
fim-int-2026-08-05-G004: Sub-Saharan Africa and Central Asia corridors were not surfaced with material findings this cycle and should be prioritized in the next monthly regional-balance pass. [resolved]
fim-int-2026-08-05-G005: Primary White House FY2026 FRAA det…
fim-int-2026-08-05-G005: Primary White House FY2026 FRAA determination memorandum text was not directly retrieved for the Colombia designation; single T3 secondary source only. [resolved]
fim-int-2026-08-20-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-08-20-G001 ({'scheme': 'financial_integrity', 'value': 'D5'}): No enforcement action or Division of Banking guidance yet located under either HB25-1201 or SB25-079 this cycle. [resolved]
fim-int-2026-08-20-G002: D1/D2/D3/D4 show no US-CO-specific …
fim-int-2026-08-20-G002: D1/D2/D3/D4 show no US-CO-specific variance this cycle; these domains are properly assessed at the federal level for a US subnational jurisdiction, and thin coverage reflects the delta-only research posture rather than a research failure. [resolved]
fim-int-2026-09-05-G001: This dispatch was JID-scoped to US-…
fim-int-2026-09-05-G001: This dispatch was JID-scoped to US-CO under the union DR pass; the global D1-D4/D6 substantive-finding floor and Tier-D sweep (KH/LA/MX/CO-Colombia) were not independently pursued this cycle. [resolved]
fim-int-2026-09-05-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-05-G002 ({'scheme': 'financial_integrity', 'value': 'D5'}): SB25-079's precise effective date and whether the Division of Banking's December 2025 interim guidance is finalized into permanent rule were not confirmed this cycle. [resolved]
fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', 'value': 'D1'}): D1-D4 (sanctions architecture, beneficial ownership, enabler jurisdictions, conflict finance) were not independently re-searched for US-CO this cycle; search effort concentrated on D5/D6/D7 and the Tier D watch. [resolved]
fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', 'value': 'D3'}): Golden Triangle corridor/VASP typology research for Laos (casino-linked remittance, TBML, narco-finance) was not independently conducted this cycle. [resolved]
fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', 'value': 'D5'}): Colorado-specific mechanics of the Coinme-to-Polygon money-transmitter licence transfer are not confirmed by a Colorado- or company-issued primary statement this cycle. [resolved]
fim-int-2026-10-18-G002: Tier D jurisdiction checks (Cambodi…
fim-int-2026-10-18-G002: Tier D jurisdiction checks (Cambodia, Laos, Mexico, Colombia) were not actively searched this cycle given the pooled search budget was prioritised to US-CO. [resolved]
fim-int-2026-10-25-G001: No CO-specific sanctions-evasion ar…
fim-int-2026-10-25-G001: No CO-specific sanctions-evasion architecture or enabler-jurisdiction signal (D1, D3) surfaced this cycle; Colorado inherits federal OFAC/BIS posture without independent variance identified. [open]
fim-int-2026-10-25-G002: D6 (Compliance Technology and Activ…
fim-int-2026-10-25-G002: D6 (Compliance Technology and Active Defence) CO-specific AI/ML transaction-monitoring supervisory development not located this cycle. [open]
fim-int-2026-11-01-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G001 ({'scheme': 'financial_integrity', 'value': 'D6'}): No Tier-1 primary instrument (the AG's own rule text or hearing transcript) was directly retrieved this pass for the ADMT/Chatbot Safety rulemaking; confidence capped at Probable. [open]
fim-int-2026-11-01-G002: D1-D5 and D7 were not actively re-s…
fim-int-2026-11-01-G002: D1-D5 and D7 were not actively re-swept this cycle for US-CO; no Colorado-specific nexus identified but coverage is thin, not confirmed-quiet. [open]
FIM-GAP-001 (D5): No Colorado Attorney General enforcement a…
FIM-GAP-001 (D5): No Colorado Attorney General enforcement action against major crypto ATM/kiosk operators was identified in the window, despite a nationwide wave of state actions (Iowa, Massachusetts, Washington DC, Connecticut, Missouri) alleging that a majority of transactions on some kiosk networks were scam-related.
FIM-GAP-002 (D2): The March 2025 CTA interim final rule perm…
FIM-GAP-002 (D2): The March 2025 CTA interim final rule permanently exempts all Colorado-formed domestic LLCs and corporations from federal beneficial ownership reporting, and the Colorado Secretary of State's business entity registry does not independently collect beneficial ownership information, creating a dual-layer transparency vacuum.
FIM-GAP-003 (D5): IRS examiner staffing dedicated to AML ove…
FIM-GAP-003 (D5): IRS examiner staffing dedicated to AML oversight of crypto firms and other money transmitters fell 33% in 2025 (to 139 agents nationally, down from 208 in 2024), reducing federal supervisory reach into Colorado-domiciled nonbank financial institutions and crypto MSBs at a time of rising kiosk-related fraud volume.
FIM-GAP-004 (D3): No dedicated Colorado state-level national…
FIM-GAP-004 (D3): No dedicated Colorado state-level national/sub-national risk assessment, typology report, or state AG financial-crime enforcement dataset was located within the window; this baseline necessarily relies primarily on national US Treasury/FinCEN material rather than Colorado-specific enforcement or typology data.

Evidence

Confidence-tiered claims

Coinme Inc. entered a Settlement Agreement & Consent Order with 34 state financial regulators, including the Colorado Division of Banking, on 8 October 2026, paying $2.5M and agreeing to exit virtual-currency kiosk operations by 1 January 2027 or face an additional $4M penalty. [Source 1]
Probable · 1 source
Colorado's Division of Banking published the Coinme Settlement Agreement & Consent Order on its own public-notices page for October 2026, confirming direct state-level enforcement participation. [Source 1]
Probable · 1 source
Polygon Labs closed its acquisition of Coinme (and Sequence) on 14 October 2026, a deal reportedly worth over $250 million first announced January 2026, gaining 37 state money-transmitter licenses and 11 exemptions, including Colorado. [Source 1]
Probable · 1 source
TabaPay announced on 2 September 2026 a $155 million strategic growth financing led by FTV Capital, earmarked to fund its planned acquisition of Denver-based Transact Bank N.A., targeted to close in Q4 2026 subject to OCC/Federal Reserve approval. [Source 1]
Probable · 1 source
Coinme, Inc. entered a $2.5M, 34+-jurisdiction BSA/AML settlement, effective Oct. 7, 2026, naming Colorado Division of Banking; Colorado's allocated share is $116,168.44. Coinme must cease Colorado kiosk operations by Jan. 1, 2027 or face an additional $4M national penalty. [Source 1]
Probable · 1 source
Colorado has no state-level AML statute distinct from federal BSA obligations; money transmitters are licensed under Title 11, Art. 110 MTMA (HB25-1201, effective Aug. 6, 2025); casinos are BSA-designated financial institutions under 31 CFR Part 1021, filing SARs ($5,000 threshold) and CTRs ($10,000/24hr threshold) with FinCEN. [Source 1]
Probable · 1 source
Colorado Department of Law held a formal rulemaking hearing on 2026-10-26 on revised ADMT/Chatbot Safety draft rules, released 2026-10-06, with comments accepted through the hearing date. [Source 1]
Probable · 1 source
Revised ADMT/Chatbot Safety interim draft rules (4 CCR 904-6) released 2026-10-06, with a formal public rulemaking hearing held 2026-10-26 and written comments accepted through that date; bears on AI/ML models used for account-opening credit and fraud screening by regulated financial firms. [Source 1]
Probable · 1 source