--- title: "United States — Colorado (US-CO) — Financial-Integrity Intelligence · Sentinel" canonical: https://sentinel.gi/jurisdictions/united-states-colorado/ source_html: /jurisdictions/united-states-colorado/index.html description: "Financial integrity intelligence for United States – Colorado (US-CO): sanctions, beneficial ownership, enabler jurisdictions, conflict finance, digital assets and compliance technology — with sourced findings." generated_at: 2026-11-08T04:46:02Z content_sha256: 859878331da781aaccb0b92c4c225554e0667b6226c863ff8801f3829ce47c8f generator: "fe-fleet/md-twin@1.0" --- # United States — Colorado (US-CO) — Financial-Integrity Intelligence · Sentinel Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. Financial Integrity Monitor # United States — Colorado US-CO Domains covered 8 of 8 Sources 143 Role actions 8 Horizon <90d 0 Jurisdiction profile FATF status: Compliant Tier: B Risk direction: Increasing Enablement vs enforcement: Mixed Colorado operates under the federal Bank Secrecy Act/AML framework administered by FinCEN, overlaid by state money-transmitter licensing (Colorado Money Transmitters Act, C.R.S. More Title 11-110) supervised by the Colorado Division of Banking (DORA). Federal Corporate Transparency Act BOI reporting for domestic entities was rescinded in March 2025, removing a key transparency backstop for Colorado-formed LLCs; state cannabis banking remains cash-intensive due to persistent federal-state conflict. Key deficiencies - Federal CTA rollback exempts all Colorado-domiciled domestic LLCs/corporations from beneficial ownership reporting, and Colorado's own Secretary of State registry does not independently collect BO data - No identified Colorado Attorney General enforcement action against crypto ATM/kiosk operators despite a nationwide multi-state litigation wave - Reduced federal (IRS/FinCEN) examiner capacity for MSB and virtual-asset AML supervision nationally, diminishing oversight reach into Colorado-domiciled nonbank financial institutions - Persistent cash-intensive cannabis banking gap in a state with one of the longest-running legal cannabis markets in the US Recent developments (18m) - FinCEN interim final rule (March 21/26, 2025) exempting all US domestic reporting companies, including Colorado-formed entities, from Corporate Transparency Act BOI reporting - FinCEN Notice FIN-2025-NTC1 (August 4, 2025) on convertible virtual currency kiosk illicit-activity risk, directly implicating Colorado's dense Bitcoin ATM network - FinCEN Section 311 designation of Huione Group as a foreign financial institution of primary money laundering concern (2025), binding on Colorado banks' correspondent-screening obligations - Bankruptcy filing of Bitcoin Depot (May 2026), the largest US crypto-ATM operator with machines sited in Colorado, amid multi-state regulatory pressure - FinCEN AML/CFT Program NPRM (April 7, 2026) proposing to reform risk-based AML/CFT program requirements applicable to all US BSA-regulated institutions, including Colorado-chartered entities United States federal law that applies in United States – Colorado is covered once, on the [United States](/jurisdictions/us/) page. This page covers United States – Colorado’s own layer: its own law, regulators and enforcement. Brief ## Lead signal #### Lead Signal Colorado has moved its Automated Decision-Making Technology (ADMT) and Chatbot Safety rulemaking into a live procedural phase that carries direct consequences for financial and payment firms. The Colorado Department of Law released a revised interim draft of the rules on 6 October 2026 and held a formal rulemaking hearing on 26 October 2026, with written comments accepted through the hearing date. The draft's definition of a covered Financial or Lending Service, and the boundary of its fraud-prevention and identity-verification exclusion, directly implicate artificial-intelligence and machine-learning models used for account-opening credit and fraud screening at regulated payment and lending institutions. Industry commentary submitted to the docket argues that models used to make credit or fraud screening decisions at account opening will still be covered under the current drafting, and that the threshold test of whether a model materially influences such a decision is unlikely to narrow the rules meaningful scope in many financial-services contexts. No final rule has been adopted; the exclusion boundary remains contested and open. Read full brief #### Lead Signal Colorado has moved its Automated Decision-Making Technology (ADMT) and Chatbot Safety rulemaking into a live procedural phase that carries direct consequences for financial and payment firms. The Colorado Department of Law released a revised interim draft of the rules on 6 October 2026 and held a formal rulemaking hearing on 26 October 2026, with written comments accepted through the hearing date. The draft's definition of a covered Financial or Lending Service, and the boundary of its fraud-prevention and identity-verification exclusion, directly implicate artificial-intelligence and machine-learning models used for account-opening credit and fraud screening at regulated payment and lending institutions. Industry commentary submitted to the docket argues that models used to make credit or fraud screening decisions at account opening will still be covered under the current drafting, and that the threshold test of whether a model materially influences such a decision is unlikely to narrow the rules meaningful scope in many financial-services contexts. No final rule has been adopted; the exclusion boundary remains contested and open. This is best read as an architecture-stage development rather than an enforcement incident. Colorado is not disciplining a firm for an existing failure; it is actively shaping the perimeter of a compliance-technology obligation that will determine, once finalised, which AI-driven decisioning systems inside payment and lending firms must carry disclosure and transparency duties. The absence of a finalised rule means no supervisory record yet exists, and the appropriate reading of this cycle is that the architecture is still being drawn, not that it is already being tested. #### Other Developments No other typology-domain movement was identified for this jurisdiction this cycle. Sanctions exposure, beneficial-ownership and corporate-transparency posture, enabler-jurisdiction dynamics, conflict-finance nexus, digital-asset integrity, and the core AML/CTF regime all remain on their established baselines, with no Colorado-specific development surfacing against any of them this cycle. That absence of movement is itself a function of a cycle that concentrated attention on the compliance-technology rulemaking rather than a confirmed finding that those domains are quiet; the position should be read as thin coverage rather than a settled null. #### Cross-Monitor Connections The compliance-technology dimension of this development routes naturally to assessments of payment-sector conduct and safeguarding obligations, since the same rulemaking record and the same contested exclusion boundary bear on how payment and lending firms deploy AI-driven decisioning at the point of account opening. It also carries a technology-architecture dimension: the rules, once finalised, will set a disclosure and transparency standard for automated decision systems that regulated financial entities will need to map against their existing fraud and credit models, regardless of which regulatory lens is applied to the underlying instrument. #### Outlook The Colorado Attorney General is expected to finalise the ADMT/Chatbot Safety implementing rules under 4 CCR 904-6 in the first quarter of 2027, as scheduled, though the precise timing carries the uncertainty inherent in an active rulemaking docket. The determinative question for financial-sector exposure is where the finalised rule draws the line on the fraud-prevention and identity-verification exclusion: a narrow exclusion would bring a wide range of account-opening credit and fraud-screening models within scope, while a broader exclusion would leave much of that same activity outside the disclosure regime. Firms operating AI-driven decisioning in this jurisdiction should expect the boundary to remain unsettled until the rule is finalised, and the compliance-technology posture of payment and lending firms here should be read as provisional rather than settled until that point. Earlier periodic briefs (6) 3 Nov 2026 · fim-2026-11-03 #### Lead Signal Colorado has moved its Automated Decision-Making Technology (ADMT) and Chatbot Safety rulemaking into a live procedural phase that carries direct consequences for financial and payment firms. The Colorado Department of Law released a revised interim draft of the rules on 6 October 2026 and held a formal rulemaking hearing on 26 October 2026, with written comments accepted through the hearing date. The draft's definition of a covered Financial or Lending Service, and the boundary of its fraud-prevention and identity-verification exclusion, directly implicate artificial-intelligence and machine-learning models used for account-opening credit and fraud screening at regulated payment and lending institutions. Industry commentary submitted to the docket argues that models used to make credit or fraud screening decisions at account opening will still be covered under the current drafting, and that the threshold test of whether a model materially influences such a decision is unlikely to narrow the rules meaningful scope in many financial-services contexts. No final rule has been adopted; the exclusion boundary remains contested and open. This is best read as an architecture-stage development rather than an enforcement incident. Colorado is not disciplining a firm for an existing failure; it is actively shaping the perimeter of a compliance-technology obligation that will determine, once finalised, which AI-driven decisioning systems inside payment and lending firms must carry disclosure and transparency duties. The absence of a finalised rule means no supervisory record yet exists, and the appropriate reading of this cycle is that the architecture is still being drawn, not that it is already being tested. #### Other Developments No other typology-domain movement was identified for this jurisdiction. Sanctions exposure, beneficial-ownership and corporate-transparency posture, enabler-jurisdiction dynamics, conflict-finance nexus, digital-asset integrity, and the core AML/CTF regime all remain on their established baselines, with no Colorado-specific development surfacing against any of them. That absence of movement is itself a function of a cycle that concentrated attention on the compliance-technology rulemaking rather than a confirmed finding that those domains are quiet; the position should be read as thin coverage rather than a settled null. #### Cross-Monitor Connections The compliance-technology dimension of this development routes naturally to assessments of payment-sector conduct and safeguarding obligations, since the same rulemaking record and the same contested exclusion boundary bear on how payment and lending firms deploy AI-driven decisioning at the point of account opening. It also carries a technology-architecture dimension: the rules, once finalised, will set a disclosure and transparency standard for automated decision systems that regulated financial entities will need to map against their existing fraud and credit models, regardless of which regulatory lens is applied to the underlying instrument. #### Outlook The Colorado Attorney General is expected to finalise the ADMT/Chatbot Safety implementing rules under 4 CCR 904-6 in the first quarter of 2027, as scheduled, though the precise timing carries the uncertainty inherent in an active rulemaking docket. The determinative question for financial-sector exposure is where the finalised rule draws the line on the fraud-prevention and identity-verification exclusion: a narrow exclusion would bring a wide range of account-opening credit and fraud-screening models within scope, while a broader exclusion would leave much of that same activity outside the disclosure regime. Firms operating AI-driven decisioning in this jurisdiction should expect the boundary to remain unsettled until the rule is finalised, and the compliance-technology posture of payment and lending firms here should be read as provisional rather than settled until that point. 25 Oct 2026 · fim-2026-10-25 #### Lead Signal Colorado's Division of Banking is a named party to a multistate Bank Secrecy Act and anti-money-laundering consent order against Coinme, Inc., the Seattle-based cryptocurrency money transmitter and kiosk operator, effective 7 October 2026. Thirty-four state financial regulatory agencies reached a 2.5 million dollar settlement with Coinme for violations of BSA and AML requirements, coordinated across more than thirty other states plus the District of Columbia and Puerto Rico. Colorado's allocated share of the settlement is 116,168.44 dollars, and the order requires Coinme to cease kiosk operations in Colorado by 1 January 2027 or face an additional 4 million dollar national penalty. The examination period covered by the multistate review ran from 31 March 2023 through 31 March 2025. #### Other Developments Standing AML/CTF architecture confirmed. Colorado has no state-level anti-money-laundering statute distinct from federal BSA obligations. Money transmitters, including crypto kiosk operators such as Coinme, are licensed under the state's Money Transmission Modernization Act, Title 11, Article 110, which took effect 6 August 2025. Casinos operating in Colorado are BSA-designated financial institutions under federal rule, required to file suspicious activity reports at a 5,000 dollar threshold and currency transaction reports at a 10,000 dollar per 24-hour threshold directly with FinCEN. This means Colorado's AML exposure for the crypto and money-transmission sector runs primarily through the federal examination and reporting architecture, with the state licensing regime operating as a parallel but not independently substantive AML layer. #### Cross-Monitor Connections The Coinme consent order sits at the intersection of payments conduct and money-laundering control failure: the same underlying facts that drive the AML settlement described here also inform a payments-sector reading of licensing and market-access risk for crypto kiosk operators, where the conduct history of a money transmitter licensee becomes a live supervisory concern for other states weighing continued authorisation. The absence of a Colorado-specific sanctions or enabler-jurisdiction signal this period means the state's exposure on those fronts continues to run through the federal OFAC and BIS posture rather than through any independent state-level variance. #### Outlook The operative date to watch is 1 January 2027, when Coinme must cease kiosk operations in Colorado or become liable for the additional 4 million dollar national penalty layered on top of the 2.5 million dollar multistate settlement. Whether Coinme exits the Colorado kiosk market voluntarily, negotiates an extension, or allows the additional penalty to attach will be the clearest signal of how multistate coordinated AML enforcement against crypto money transmitters is likely to play out in other jurisdictions carrying similar exposure. 18 Oct 2026 · fim-2026-10-18 #### Lead Signal Colorado's Division of Banking joined thirty-three other state financial regulatory agencies in a 2.5 million dollar Settlement Agreement and Consent Order against Coinme Inc., a Seattle-based cryptocurrency money transmitter and kiosk operator, entered on 8 October 2026 for violations of Bank Secrecy Act and anti-money laundering laws. Coinme agreed to exit virtual-currency kiosk operations by 1 January 2027 or face an additional 4 million dollar penalty, and to retain an independent compliance consultant. The Colorado Division of Banking published the settlement on its own public-notices page, confirming direct state-level participation rather than mere deference to a lead state. Six days later, on 14 October 2026, Polygon Labs closed its acquisition of Coinme in a deal reportedly worth over 250 million dollars, first announced in January 2026, absorbing 37 state money-transmitter licenses, including Colorado's, and the consent-order obligations that came with them. #### Other Developments TabaPay financing to fund Transact Bank acquisition. TabaPay, Inc. announced on 2 September 2026 a 155 million dollar strategic growth financing led by FTV Capital, earmarked to fund its planned acquisition of Denver-based Transact Bank N.A. The deal is targeted to close in the fourth quarter of 2026, subject to review by the Office of the Comptroller of the Currency as a change-in-control matter; the status of that review is not yet known. The transaction was reported directly by the company via Business Wire and corroborated by trade press. #### Cross-Monitor Connections The Coinme enforcement action and subsequent acquisition sit squarely at the intersection of financial-integrity and crypto-monitor interests: the consent order is an AML/CFT architecture finding, while the Polygon Labs acquisition is a commercial-intelligence event that redistributes a licensed crypto money-transmitter's compliance obligations to a new corporate holder without requiring a fresh state application. World-payments readers tracking commercial intelligence in payments infrastructure should note both the Coinme-Polygon and TabaPay-Transact Bank transactions as discrete M&A events within the same reporting window, though the two are unrelated in substance. #### Outlook The near-term question is whether Colorado's Division of Banking issues its own confirmation of the specific mechanics by which Coinme's money-transmitter licence transferred to Polygon Labs; no such primary-source statement has been located this cycle. The 1 January 2027 kiosk-exit deadline, now Polygon Labs' obligation, is the clearest dated milestone to track for the crypto-kiosk enforcement thread. On the TabaPay side, the fourth-quarter 2026 target close for the Transact Bank acquisition, and the outcome of the Comptroller's change-in-control review, are the developments most likely to generate the next material signal for Colorado's payments and banking landscape. 28 Sep 2026 · fim-2026-09-28 #### Lead Signal Colorado's Division of Banking issued interim guidance on December 18, 2025 clarifying that most crypto exchanges transmitting funds on behalf of users, facilitating fiat-to-crypto conversion, or issuing stablecoins require a Colorado Money Transmitter License under the Money Transmission Modernization Act (MTMA). This establishes a standing baseline for how Colorado treats virtual-currency businesses: not through a bespoke crypto statute, but through the general money-transmission licensing regime, with FinCEN MSB registration and a BSA/AML compliance program required as preconditions to licensure. The structural significance is that Colorado closes a potential regulatory gap for crypto-payment intermediaries by routing them into an existing, well-established supervisory architecture rather than leaving them in an ambiguous space pending future legislation. #### Other Developments FinCEN's national AML/CFT overhaul for casinos reaches into Colorado's licensed gaming sector. On April 10, 2026, FinCEN published a Notice of Proposed Rulemaking that would require casinos, including Colorado-licensed casino and sports-betting operators as BSA-defined financial institutions, to maintain effective risk-based AML/CFT programs, with the proposal distinguishing program-design failures from program-execution failures and requiring governance and board approval alongside a US-located responsible officer. This is federal rulemaking, and its Colorado relevance is downstream: the state's licensed gaming operators would need to build institutional-grade AML governance if the NPRM is finalized as proposed, layering a new federal compliance floor onto the state's existing licensing framework. #### Cross-Monitor Connections The Colorado MTMA guidance intersects directly with world-payments coverage of licensing and market access for virtual-currency money transmitters, and with the crypto monitor's coverage of Colorado's crypto-licensing and stablecoin regimes; all three readings draw on the same underlying interim-guidance finding but foreground different structural implications — payments-corridor architecture for world-payments, token/issuer-specific licensing exposure for crypto, and AML/CFT program-design implications here. The FinCEN casino NPRM connects to advennt's operational-obligations and cost-to-operate coverage of Colorado's licensed gaming sector, since a finalized rule would add a new compliance layer atop the state licensing regime that advennt already tracks. #### Outlook The FinCEN NPRM comment period closed June 9, 2026; a final rule has not yet been adopted, and its effective date remains unresolved pending FinCEN's rulemaking timeline. Watch for whether FinCEN moves to finalize the casino AML/CFT program requirements, which would convert this from a proposed compliance floor into a binding one for Colorado's licensed casino and sports-betting operators. On the crypto side, Colorado's interim guidance under the MTMA remains labeled interim rather than final, so operators should watch for the Division of Banking to issue final guidance that could adjust the scope of which crypto businesses require MTL licensure. 5 Sep 2026 · fim-2026-08-21 #### Lead Signal Colorado enacted two coordinated instruments that reached effective date this cycle and materially reshape the money-transmission and virtual-currency perimeter of the state. The Colorado Money Transmission Modernization Act (HB25-1201) repealed the prior Money Transmitters Act and replaced it with a framework built on the Conference of State Bank Supervisors multistate-licensing model, expanding the regulated-activity definition to expressly cover digital money movement and payroll processing and giving the Division of Banking stronger enforcement tools. In parallel, the Colorado Vending of Digital Assets Act (SB25-079) reached its own effective date of 2026-08-12, imposing disclosure and electronic-receipt duties on virtual-currency-kiosk operators and a conditional first-transaction refund obligation where a customer transaction moved funds to a wallet or exchange located outside the United States and fraud is reported within 60 days with law-enforcement contact. Both developments are assessed with Assessed-tier confidence against Tier 1 primary legislative sources and are now in force rather than merely proposed. Assessed together, these are architecture-level developments rather than incident-level enforcement actions: Colorado is building a state-level supervisory layer around fiat-linked virtual-currency transmission and kiosk-based conversion ahead of, and alongside, the federal Bank Secrecy Act framework that continues to govern money-services businesses generally. #### Other Developments The Colorado Division of Banking, within the Department of Regulatory Agencies, is confirmed as the supervisory authority administering money-transmitter licensing under Title 11, Article 110 of the Colorado Revised Statutes, including fiat-linked virtual-currency transmission. This is a standing supervisory-architecture fact rather than a new development in itself, but it is the authority against which compliance under both HB25-1201 and SB25-079 will be assessed going forward. No enforcement action or Division of Banking implementing guidance under either statute has yet been located this cycle; the regulatory horizon anticipates implementation or enforcement guidance from the Division of Banking in the third quarter of 2026, with the 60-day fraud-claim window under SB25-079 assessed as a novel compliance parameter not yet mirrored in most other states. This absence of enforcement is a genuine evidentiary gap rather than a signal that no enforcement is occurring: the absence reflects the short interval since the 2026-08-12 effective date rather than a substantive finding of regulatory forbearance. The overall risk trajectory for Colorado is assessed as stable, with an enablement rather than enforcement orientation and a structural rather than episodic character, reflecting a state building supervisory capacity ahead of any observed violation rather than reacting to one. #### Cross-Monitor Connections The same statutory package driving this cycle signal for Colorado carries direct relevance beyond the financial-integrity lens. The money-transmission licensing overhaul under HB25-1201 is a payments-market-structure development in its own right, bearing on how non-bank payment institutions and electronic-money issuers access the Colorado market, a reading that belongs properly to the world-payments monitor licensing and market-access analysis. Separately, the crypto-kiosk consumer-protection regime under SB25-079 is a crypto-licensing and consumer-protection development in the typology of the crypto monitor, distinct from but sourced to the same underlying statute this brief treats as an AML-adjacent and digital-asset-innovation development. No sanctions, conflict-finance, or beneficial-ownership signal was identified for Colorado this cycle; the D1 through D4 domains for Colorado remain properly assessed at the federal level for this US subnational jurisdiction, consistent with a delta-only research posture rather than a research gap. Consistent with the architecture-over-incident framing this monitor applies, the absence of enforcement volume under either new instrument is not itself evidence of low risk; it is, if anything, the expected posture in the first weeks after a supervisory framework effective date, and the test in the coming cycle will be whether enforcement volume develops commensurate with the expanded regulated-activity definition. #### Outlook The near-term marker to watch is whether the Colorado Division of Banking issues implementing or enforcement guidance under SB25-079 and HB25-1201 in the third quarter of 2026, as currently anticipated; such guidance would be the first indication of how the Division intends to apply the modernized licensing perimeter and the kiosk-operator refund mechanism in practice. Absent enforcement activity to date, the signal this cycle is structural rather than punitive: Colorado has built the architecture before testing it, and the coming cycle is where operator-facing enforcement exposure would first become visible if it materializes. Analysts should also track whether other Conference of State Bank Supervisors multistate-licensing-model states adopt a similar 60-day kiosk-refund parameter, since the Colorado approach is currently assessed as a novel compliance parameter nationally; convergence toward a common standard, or continued divergence, will shape the compliance burden facing multistate money-services businesses and crypto-kiosk operators alike. 11 Aug 2026 · fim-2026-08-05 #### Lead Signal The clearest signal this cycle is the convergence of licensed casino infrastructure, human-trafficking-linked scam compounds, and digital-asset fraud in Cambodia. OFAC designated a sitting Cambodian senator, Kok An, along with twenty-eight affiliated individuals and entities, for a casino-linked scam-center network assessed to have laundered at least seventy-three million dollars from American victims. The designation is corroborated by TRM Labs and Amnesty International reporting, the latter finding that Cambodia's state casino-licensing regime continued to approve properties linked to scam compounds even as the government pursued a parallel crackdown that has produced over twenty-one thousand deportations. Read architecture-over-incident, this is not an isolated enforcement action against a rogue operator; it is evidence of state-adjacent protection of enabler infrastructure, with licensing and enforcement functions operating in tension within the same jurisdiction. That Cambodia signal does not stand alone. TRM Labs separately assessed approximately one hundred fifty-eight billion dollars in illicit cryptocurrency flows in 2025, a one hundred forty-five percent increase year-on-year from sixty-four and a half billion dollars in 2024, substantially attributable to Southeast Asian scam-compound laundering — directly corroborating the digital-asset dimension of the Cambodia action on a global scale. Both findings anchor this cycle's Financial Integrity Monitor read: enabler-jurisdiction capture and digital-asset laundering scale are moving in the same direction, in the same region, in the same reporting window. #### Other Developments EU's 21st Russia sanctions package adopted two hundred eighteen new designations across banking, energy, crypto, and defense-industrial sectors, and for the first time targeted vessels that refuel shadow-fleet tankers at sea — a structural upgrade that closes an evasion-infrastructure gap left open by end-tanker-only designations under the oil-price-cap regime. Primary-source corroboration for the specific package text was not retrieved this cycle, so confidence is held at Assessed pending consilium.europa.eu confirmation. FinCEN and OFAC acted jointly against CJNG fuel-theft financial infrastructure , with FinCEN issuing a supplemental alert on cartel fiscal fuel-smuggling and tax-evasion typologies alongside OFAC's designation of two Mexican nationals and nine entities tied to huachicol schemes. The alert builds on a May 2025 Cartel Oil Smuggling Alert and names complicit brokers and small US oil and gas companies as placement points for stolen-fuel proceeds. Separately, FinCEN's Section 311 special measures remain in effect prohibiting US covered financial institutions from transmitting funds to or from three identified Mexican financial institutions. Colombia received its first "failed demonstrably" counternarcotics designation in roughly three decades on the FY2026 Majors List, citing record coca cultivation, though sanctions were waived on national-interest grounds — a finding sourced to a single secondary outlet this cycle and held at Assessed confidence pending the primary White House determination memorandum. The US Corporate Transparency Act's domestic-exemption posture persists. The Eleventh Circuit upheld the CTA's constitutionality on December 16, 2025 without disturbing the exemption, and GAO found that over ninety-nine percent of previously-required reporting companies are now exempt from beneficial-ownership-information reporting. AMLA completed its absorption of EBA's AML/CFT mandates on January 1, 2026, with a risk-assessment and entity-selection consultation closing January 27, 2026 ahead of 2028 direct supervision of approximately forty high-risk cross-border institutions. Lao PDR remains under FATF increased monitoring per the February 13, 2026 update, with no delisting or new deficiency finding this cycle. FATF's June 19, 2026 plenary added Iraq and Bosnia and Herzegovina to the grey list while removing Algeria and Namibia, holding the list at twenty-two jurisdictions under new FATF President Giles Thomson, who took over from Elisa de Anda Madrazo on July 1, 2026. #### Cross-Monitor Connections The Cambodia designation sits at the intersection of enabler-jurisdiction analysis and conflict/human-trafficking finance: casino licensing decisions by Cambodia's state gaming authority intersect directly with scam-compound trafficking findings that would ordinarily route to a state-capture or human-rights-adjacent monitor. The CJNG fuel-theft financial infrastructure connects fiscal crime, cartel financing, and correspondent-banking access restrictions in a single typology, relevant to any conflict-finance or commodity-flow tracking that follows Mexican fuel markets. Colombia's adverse FRAA designation, read alongside the CJNG findings, points to a broader deterioration in regional narco-finance capacity that spans two jurisdictions this cycle. The EU's shadow-fleet-refueling designations connect sanctions architecture to maritime and energy-trade monitoring of Russian oil flows. #### Outlook Watch for primary consilium.europa.eu text on the EU's 21st sanctions package to confirm the shadow-fleet-refueling designations at High confidence, and for the White House's FY2026 FRAA determination memorandum to corroborate Colombia's designation independently of secondary reporting. AMLA's methodology consultation outcomes, expected through 2026 and 2027, will shape which institutions fall under 2028 direct EU-level supervision. The next FATF plenary in the fourth quarter of 2026 is the standard checkpoint for further grey-list movement. Sub-Saharan African and Central Asian corridors were not surfaced with material findings this cycle and should be prioritized in the next monthly regional-balance pass. Domain intelligence (D1–D8) #### Sanctions Architecture and Evasion Colorado inherits the full federal sanctions architecture, and this cycle two designations expand what that architecture requires of Colorado-domiciled institutions. FinCENs Section 311 designation of the Cambodia-based Huione Group as a foreign financial institution of primary money laundering concern, imposed in October 2025, triggers special measures binding Colorado banks and money services businesses to sever or restrict correspondent relationships tied to an entity assessed to have received an estimated 39.6 billion dollars in flows during 2025. This is a designation-driven expansion of screening obligation, not an enforcement action against any Colorado-based actor directly, but it lands on Colorados BSA-regulated population as a compliance cost regardless. Continue reading Alongside it, Executive Order 14157s January 2025 designation of major Mexican drug cartels as Foreign Terrorist Organizations and Specially Designated Global Terrorists fuses counter-terrorism and anti-money-laundering authorities, and a June 2026 FinCEN alert on fiscal fuel-theft financial networks specifically cites suspicious activity exceeding 7 billion dollars moving through corridors including Colorados I-25 and I-70 routes. Both designations expand correspondent-screening and material-support-liability exposure for Colorado institutions. Neither designation has an identified equivalent counterpart from EU or UK authorities in the research record, a divergence that creates asymmetric secondary-sanctions exposure for cross-border flows moving through Colorado corridors relative to peer financial centres operating under different sanctions regimes. Separately, FATFs June 2025 plenary added the British Virgin Islands and Bolivia to its increased-monitoring list and removed Croatia, Mali and Tanzania; the United States remains off both FATF lists, but FinCEN has instructed institutions to factor the plenary outcome into risk-based due diligence, meaning the list movement shapes Colorado obligations indirectly even without a designation touching the state itself. The structural reading is that Colorados sanctions-architecture exposure is increasing through two vectors simultaneously: a Section 311 designation targeting a cross-border laundering conduit with correspondent-banking implications, and a domestic terrorism-designation regime targeting cartel finance moving through the states own transport corridors. Both are additive obligations layered onto an existing BSA compliance base, and both arrived without a confirmed international mirror, meaning Colorado institutions with cross-border correspondent relationships face a sanctions-compliance environment that is more stringent domestically than what counterpart jurisdictions currently require. #### Outlook The near-term sanctions-architecture horizon centers on the October 2026 FATF plenary, which will reassess both the Jurisdictions Under Increased Monitoring list and the High-Risk Call for Action list and will feed directly into subsequent FinCEN risk-based due-diligence advisories affecting Colorado institutions. Whether EU or UK authorities issue actions equivalent in scope to the Huione Group Section 311 designation or the EO 14157 cartel designations remains an open question in the current record; its resolution would materially change the divergence assessment offered here. Absent that confirmation, Colorado institutions should expect the current asymmetric exposure to persist through the next plenary cycle. #### Beneficial Ownership and Corporate Transparency Colorado is a US state, not an EEA Member State, and the EU AML Package is not the primary regulatory frame for its beneficial-ownership exposure. Globally, the EU AML Package sets the structural direction for beneficial-ownership transparency: it comprises three distinct instruments, the directly applicable AML Regulation (AMLR, Regulation (EU) 2024/1624), the sixth AML Directive (6AMLD) transposed on a per-Member-State basis, and the AMLA Regulation (Regulation (EU) 2024/1620) establishing the Anti-Money Laundering Authority, whose direct and indirect supervision perimeter is shifting the EU regime from purely national supervision toward a hybrid EU-level model. That architecture is durable global backdrop, but Colorado sits outside its direct perimeter entirely; the directly relevant development for Colorado this cycle is domestic and federal. Continue reading That development is FinCENs March 2025 interim final rule exempting all US domestic reporting companies, including the high volume of low-cost, fast-formation Colorado LLCs, from Corporate Transparency Act beneficial ownership reporting. Only foreign reporting companies retain the federal obligation, and the Colorado Secretary of State registry does not independently collect beneficial ownership data, meaning the exemption removes the sole federal transparency backstop for anonymous Colorado-formed entities without any compensating state-level mechanism. FinCEN intends to finalize this interim rule during 2026, which would entrench the exemption absent Congressional reversal. The compounding factor is Colorados cash-intensive cannabis sector, which continues to provide a state-licensed cover for cash deposits disproportionate to reported revenue, a persistent typology that predates the CTA rollback but now operates against a weaker federal beneficial-ownership backstop. The combination — anonymous-entity formation now unmonitored at the federal registry layer, plus an existing cash-intensive sector generating layering cover — describes a beneficial-ownership environment moving in the worsening direction on a structural rather than episodic basis. #### Outlook The defining watch item is FinCENs 2026 finalization of the domestic CTA exemption; final-rule text confirming permanence of the exemption would lock in the transparency gap for Colorado-formed entities absent Congressional action. No compensating Colorado state-level beneficial-ownership collection mechanism has been identified in the current record, meaning the gap will likely persist through the finalization window regardless of the federal rules ultimate form. #### Enabler Jurisdictions and Professional Facilitators Colorados enabler posture this cycle rests on two mutually reinforcing signals: a persistent cash-intensive cannabis sector functioning as a structuring cover, and a documented absence of state-level enforcement against crypto-ATM kiosk operators despite a substantial in-state footprint. Colorados legal cannabis operators, among the longest-established in the country, continue to deposit cash disproportionate to reported marijuana-related revenue for federal and state tax purposes, exploiting the persistent federal-state banking conflict that keeps much of the sector outside mainstream AML-monitored banking relationships. This is a structural, not episodic, feature of the states financial-integrity landscape, tied to one of the longest-running legal cannabis markets in the United States. Continue reading The second signal is an enforcement-absence gap: unlike Iowa, Massachusetts, Washington DC, Connecticut and Missouri, no Colorado Attorney General enforcement action against Bitcoin Depot, CoinFlip or Athena Bitcoin has been identified, despite Colorado hosting a substantial share of the roughly 32,000 US crypto-ATM kiosks implicated in scam facilitation and despite a retail and elderly population profile that mirrors the risk factors driving peer-state action. Enablement-as-signal analysis treats this absence as itself analytically significant: a jurisdiction with comparable exposure to five peer states that have all acted, yet has not acted itself, is functioning as a permissive node in the national kiosk-fraud architecture whether by capacity constraint or by choice. Both typologies are compounded by federal-level developments that raise the stakes of continued state inaction: FinCENs kiosk illicit-activity notice cites a 99 percent year-on-year rise in fraud complaints, and Bitcoin Depots May 2026 bankruptcy removed the largest national kiosk operator from the market, an industry-consolidation event that will likely reshape which operators remain active in Colorado absent any state-level intervention shaping that transition. #### Outlook Whether Colorados enforcement posture shifts will depend on data not currently available in the public record: a Colorado Attorney General enforcement dataset or state-level litigation record would clarify whether the absence of parallel action reflects a capacity deficit or a political choice, a distinction with direct implications for how this enabler assessment should be weighted going forward. Absent that clarification, Colorados enabler posture relative to peer states is assessed as worsening on a structural basis. #### Conflict Finance and Extractive-Industry Integrity This cycle's conflict-finance signal centers on a deteriorating narco-finance picture spanning two jurisdictions. Colombia received a "failed demonstrably" counternarcotics designation on the FY2026 Majors List, the first such adverse finding for Colombia in roughly three decades, citing record coca cultivation; sanctions attached to the designation were waived on national-interest grounds. This finding rests on a single secondary source this cycle — the primary White House FY2026 determination memorandum was not directly retrieved — so confidence is held at Assessed pending primary corroboration, but the substance of the finding, a first-in-a-generation adverse counternarcotics determination for a major US security partner, is itself analytically significant regardless of the sourcing tier, because it signals a documented divergence between narco-finance deterioration and continued diplomatic and economic engagement. Continue reading In Mexico, FinCEN's supplemental alert identifies fuel theft, or huachicol, as now the largest non-drug illicit revenue source for CJNG and other cartels, a finding issued concurrently with OFAC's designation of two Mexican nationals and nine entities tied to fuel-smuggling and tax-evasion schemes. This is a continuation and escalation of a fiscal-crime typology first flagged in FinCEN's May 2025 Cartel Oil Smuggling Alert, and it represents extractive-industry integrity risk in the specific sense that stolen fuel-supply-chain proceeds are being layered into the broader financial system via complicit brokers and small US oil and gas companies acting as placement points. Read together, the Colombia and Mexico findings describe a regional conflict-finance environment in which traditional drug-trafficking revenue is being supplemented, and in Mexico's case substantially supplanted, by extractive-industry-adjacent revenue streams — coca cultivation on one side of the ledger and stolen-fuel placement on the other — while the diplomatic and sanctions response in both cases remains calibrated by broader national-interest considerations rather than by the severity of the underlying finding alone. #### Outlook The primary near-term test for the Colombia finding is whether the White House's FY2026 determination memorandum becomes available for direct review, which would allow this finding to move from Assessed to a higher confidence tier; absent that, treat the coca-cultivation and "failed demonstrably" characterization as probable rather than confirmed. On the Mexican side, watch for further FinCEN typology alerts extending the fuel-theft finding to other extractive sectors, and for whether the two-individual, nine-entity OFAC designation this cycle expands to additional complicit brokers or companies identified through the placement-point typology. Both findings should be read as structural deterioration signals rather than episodic events, given the multi-year trend lines each draws on. #### Crypto / Digital Assets / Financial Innovation Colorado's crypto-sector exposure this period centres on a single, high-materiality enforcement event: the multistate Bank Secrecy Act and anti-money-laundering consent order against Coinme, Inc., the cryptocurrency money transmitter and kiosk operator headquartered in Seattle. Effective 7 October 2026, thirty-four state financial regulatory agencies, coordinated with Colorado and more than thirty other states plus the District of Columbia and Puerto Rico, reached a 2.5 million dollar settlement with Coinme over violations of Bank Secrecy Act and anti-money-laundering requirements. Colorado's Division of Banking is a named party, and the state's allocated share of the settlement is 116,168.44 dollars. The multistate examination that produced this order covered Coinme's activity across the period from 31 March 2023 through 31 March 2025, indicating a sustained, multi-year supervisory review rather than a response to a single incident. Continue reading The consent order's forward-looking term is the more consequential element for Colorado specifically: Coinme is required to cease kiosk operations in the state by 1 January 2027, or face an additional 4 million dollar penalty applied on a national basis. This structure, a jurisdiction-specific operational wind-down backed by an escalating national penalty, is a notable enforcement architecture choice. It gives Coinme a defined window to exit the Colorado kiosk market in an orderly way while attaching a severe financial consequence if it instead continues operating past the deadline, effectively using the threat of a disproportionate national penalty to enforce a state-specific operational outcome. This sits against the backdrop of Colorado's standing digital-asset regulatory architecture, which treats crypto kiosk and money-transmission activity through the general Money Transmission Modernization Act, Title 11, Article 110, effective 6 August 2025, rather than through any bespoke cryptocurrency statute. Crypto asset operators in Colorado are therefore examined and licensed as money service businesses first, with their crypto-specific activity layered onto that general framework rather than governed by a separate crypto-native regulatory track. The Coinme enforcement action illustrates how that general money-transmission licensing structure is being used in practice to discipline a crypto-sector licensee: the underlying violations are framed as Bank Secrecy Act and anti-money-laundering failures, the same category of violation that would attach to a conventional, non-crypto money transmitter, rather than as crypto-specific regulatory breaches. For digital-asset market participants more broadly, the signal from this action is that coordinated multistate AML enforcement against a crypto kiosk and money-transmission operator can proceed entirely through the existing state money-transmitter licensing and BSA/AML compliance architecture, without any crypto-specific statute being invoked. The 34-jurisdiction scope of the coordinated action also indicates that state financial regulators are capable of acting in concert at scale against a single multi-state-licensed crypto money services business, which raises the practical compliance stakes for any similarly structured kiosk or money-transmission operator carrying licenses across a comparable number of states. #### Outlook The date to watch is 1 January 2027, the deadline by which Coinme must cease Colorado kiosk operations under the consent order or become exposed to the additional 4 million dollar national penalty layered on top of the 2.5 million dollar multistate settlement. How Coinme responds, through an orderly wind-down, a negotiated extension, or continued operation into the penalty period, will be an early indicator of how multistate-coordinated AML enforcement against crypto money transmitters plays out operationally once the settlement terms come due. Colorado's underlying AML/CFT architecture, resting on the Money Transmission Modernization Act and federal BSA designation for casinos, remains structurally stable and is not itself under revision; what is changing is the enforcement posture applied within that existing architecture against a specific, multi-state-licensed crypto operator. #### Compliance Technology & Active Defence Colorado's Automated Decision-Making Technology and Chatbot Safety rulemaking has entered a live procedural phase with direct bearing on compliance-technology posture at regulated financial and payment firms. The Colorado Department of Law released a revised interim draft of the implementing rules, numbered 4 CCR 904-6, on 6 October 2026 and convened a formal rulemaking hearing on 26 October 2026, accepting written comments through that date. No final rule has been adopted; the matter remains open at the drafting stage. Continue reading The substantive point of contest is the scope of the rules Financial or Lending Service definition and the boundary of its fraud-prevention and identity-verification exclusion. Industry comment submitted to the docket, from the Financial Data and Technology Association, argues that the draft language leaves models used to make credit or fraud-screening decisions at account opening still covered, and that the threshold test for whether a model materially influences such a decision is unlikely to meaningfully narrow the rules reach in many financial-services contexts. That comment is advocacy from an affected industry body, not a determination by the rulemaking authority, but it usefully frames where the architecture of the obligation is still being drawn: the line between a permitted fraud-prevention tool and a covered automated decision system has not yet been fixed. This is a structural, architecture-stage finding rather than an enforcement-incident one. No firm has been found in breach of anything; the state is still defining what the obligation will cover once it exists. Read through the compliance-technology lens, the significance lies in which categories of AI-driven decisioning the finalised rule will bring within a disclosure and transparency regime, and which it will carve out as fraud-prevention tooling. For firms operating account-opening credit and fraud-screening systems that incorporate automated decisioning, the rulemaking record itself is the thing to watch: the positions staked out in the comment process indicate where the contested boundary currently sits, even though the outcome is not yet settled. The broader significance for active-defence posture is that this is an instance of a state regulator building an AI-governance obligation that layers directly onto existing fraud and credit-decisioning infrastructure, rather than creating a wholly separate AI-specific regime. Firms that already operate model governance and documentation practices for fraud and credit models will find the new obligation, once finalised, asks for transparency and disclosure on top of what already exists operationally, rather than a parallel compliance-technology build. The degree of overlap between what the rule will require and what firms already do for existing model-risk purposes is itself one of the open questions the rulemaking has not yet resolved. #### Outlook The Colorado Attorney General is expected to finalise the ADMT/Chatbot Safety implementing rules in the first quarter of 2027, as scheduled, subject to the normal uncertainty of an active rulemaking docket that has already seen one interim draft revision. The determinative question for financial-sector compliance-technology planning is where the final rule draws the fraud-prevention and identity-verification exclusion: a narrow exclusion would draw a substantial share of account-opening credit and fraud-screening systems into a disclosure and transparency regime, while a broader exclusion would leave much of that activity outside it. Until the rule is finalised, firms operating AI-driven decisioning systems in this jurisdiction should treat the scope of their compliance-technology obligations here as provisional, and the positions staked out in the current comment record as the best available indicator of where the contested boundary is likely to land. #### AML/CTF Regime The anti-money-laundering exposure of Colorado for money-services businesses continues to run primarily through the federal Bank Secrecy Act and FinCEN framework, with the modernized state money-transmission licensing regime under the Colorado Money Transmission Modernization Act (HB25-1201) now operating as a complementary supervisory layer. HB25-1201 repealed the prior Colorado Money Transmitters Act and replaced it with a Conference of State Bank Supervisors multistate-licensing model, modernizing control-threshold notifications and enforcement tools for money transmitters, including crypto-adjacent transmitters, and complementing rather than displacing federal BSA obligations. The Colorado Division of Banking, within the Department of Regulatory Agencies, is confirmed as the supervisory authority administering this licensing regime under Title 11, Article 110 of the Colorado Revised Statutes, including for fiat-linked virtual-currency transmission. This is a structural rather than episodic development: no enforcement action under the new framework has yet been identified, and the AML/CTF baseline of the state is best characterized as actively modernizing rather than reactively tightening in response to any specific violation. This state-level modernization is significant less for what it says about Colorado specifically than for what it signals about the broader trajectory of state money-transmission regulation: Colorado has chosen to align with the national multistate-licensing standard promoted by the Conference of State Bank Supervisors rather than maintain a bespoke state framework, a choice that reduces regulatory fragmentation for money-services businesses operating across multiple states even as it expands the scope of Colorado-regulated activity to include digital money movement and payroll processing specifically. Continue reading #### Outlook The principal marker for this domain going forward is whether the stronger enforcement tools of the Division of Banking under HB25-1201 translate into observable supervisory activity, and whether further Division guidance clarifies how the modernized licensing regime interacts with federal BSA and FinCEN obligations for multistate money-services businesses operating in Colorado. #### Commercial Activity Two distinct commercial events touch Colorado this cycle. The first is Polygon Labs' completed acquisition of Coinme Inc., which closed 14 October 2026 in a deal reportedly worth over 250 million dollars, first announced in January 2026. The acquisition brought Polygon Labs 37 state money-transmitter licenses, including Colorado's, and 11 exemptions, along with the kiosk-exit and compliance-consultant obligations Coinme had assumed under its 8 October 2026 multistate consent order just six days before the deal closed. The Colorado nexus here is a licence-portfolio transfer rather than a new market entry: an existing state licence changed corporate hands as part of a much larger national transaction. Continue reading The second is TabaPay, Inc.'s announcement on 2 September 2026 of a 155 million dollar strategic growth financing led by FTV Capital, explicitly earmarked to fund TabaPay's planned acquisition of Denver-based Transact Bank N.A. The deal is targeted to close in the fourth quarter of 2026, subject to review by the Office of the Comptroller of the Currency as a change-in-control matter; the status of that regulatory review is not yet known. This transaction, reported directly via the company's own Business Wire release and corroborated by trade press, represents a payments company seeking to acquire a federally chartered bank, a structurally different commercial move than the Coinme-Polygon licence absorption and one with its own distinct regulatory-approval pathway. #### Outlook For the Coinme-Polygon transaction, the open question is whether Colorado's Division of Banking treats the licence transfer as requiring its own confirmation or review process; none has been identified this cycle. For TabaPay-Transact Bank, the fourth-quarter 2026 target close and the outcome of the Comptroller's change-in-control review are the two developments most likely to generate the next material signal, with the bank-acquisition structure carrying materially different regulatory stakes than a money-transmitter licence transfer. Regulatory horizon Consultation 2027-Q1 · ±quarter ### Colorado ADMT/Chatbot Safety Rules Finalisation Finalised rules will settle the scope of the fraud-prevention/identity-verification exclusion for AI-driven decisioning models used in account-opening credit and fraud screening. [Source](https://fdata.global/fdata-submits-comments-on-colorado-admt-rules/) 1 dated · 3 pending date · baseline financial-integrity-2026-07-05 Role action cards Compliance ### Colorado has not yet finalised the boundary of its ADMT/Chatbot Safety fraud-prevention exclusion, leaving open which AI-driven account-opening models will require disclosure once the rule is adopted. The scope of a future compliance-technology obligation for fraud and credit decisioning models remains unsettled following the 26 October 2026 hearing. Industry comment indicates the current draft is likely to cover a broad range of account-opening decisioning models despite the stated exclusion. 1 evidence refs Board ### A Colorado rulemaking now underway could extend disclosure obligations to AI-driven fraud and credit decisioning at account opening. This is a procedural, not yet final, development that bears on the strategic posture of any payment or lending operation using automated decisioning in this jurisdiction. No obligation attaches until the rule is finalised, expected in the first quarter of 2027, as scheduled. 1 evidence refs CTO ### Draft Colorado rules under live consultation would impose disclosure and transparency duties on automated decision-making technology used in account-opening credit and fraud screening. Technical architecture for fraud and credit decisioning models may need to support disclosure and transparency requirements once the rule is finalised. The exact scope depends on where the fraud-prevention and identity-verification exclusion boundary is ultimately drawn. 1 evidence refs Risk ### An emerging compliance-technology obligation in Colorado could reshape model-governance requirements for AI-driven fraud and credit decisioning. This is a structural, architecture-stage development rather than an incident; it signals a possible new layer of model-governance exposure for firms with account-opening decisioning systems operating in this jurisdiction. 1 evidence refs Audit ### Documentation of fraud and credit decisioning models should be monitored against an unsettled Colorado disclosure rule still in consultation. Until the rule is finalised, the adequacy of existing model documentation against a future disclosure standard cannot be assessed with certainty; the scope of the fraud-prevention exclusion remains contested in the rulemaking record. 1 evidence refs Scenario sketches ### Illustrative pathway: supervisory bifurcation under a national AML architecture transitioning toward centralised oversight Illustrative only: as jurisdictions layer AI-governance and compliance-technology disclosure obligations onto existing financial-crime control frameworks, a possible structural effect is divergence between sub-national rulemaking (such as a state-level ADMT regime) and any later federal or cross-border harmonisation effort. In this illustrative sketch, a payment firm operating across multiple state-level regimes could face differing disclosure thresholds for the same underlying fraud-decisioning model depending on which state's exclusion boundary applies, creating an incentive to design model documentation to the most restrictive standard rather than per-jurisdiction. This is architecture-over-incident framing: a possible structural mechanism, not an observed fact or prediction. Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact. Standing trackers (T1–T6) Tracker Status Note T1 · Russian Sanctions-Evasion Architecture stable T2 · EU AML Package / AMLA stable T3 · FATF Grey List stable T4 · Beneficial-Ownership Register Status stable T5 · Crypto & Digital-Asset Integrity stable T6 · Sanctions Regime Divergence stable Registers ### Enforcement actions - 4 Aug 2025 - 1 Oct 2025 - 1 Jun 2026 - 21 Jul 2025 - 8 Oct 2026 - 7 Oct 2026 - FinCEN issued Notice FIN-2025-NTC1 urging financial institutions to identify and report suspicious CVC kiosk activity, citing a 99% year-on-year rise in kiosk-related fraud complaints and directly binding Colorado-based Bitcoin Depot, CoinFlip and Athena Bitcoin machines to enhanced BSA reporting expectations. 4 Aug 2025 - FinCEN designated Huione Group a foreign financial institution of primary money laundering concern, triggering Section 311 special measures that require Colorado-domiciled banks and MSBs to sever or restrict correspondent and processing relationships tied to the entity, which received over $39.6 billion in 2025. 1 Oct 2025 - Following the January 2025 designation of major cartels as Foreign Terrorist Organizations under EO 14157, FinCEN issued a supplemental alert alongside an OFAC sanctions action targeting fiscal fuel theft schemes, part of a broader financial-intelligence campaign against cartel non-drug revenue streams that traverse Colorado as a distribution corridor. 1 Jun 2026 ### Sanctions changes - 20 Jan 2025 - 23 Apr 2026 - 23 Apr 2026 - 30 Jun 2026 - 23 Jul 2026 - Huione Group designated a foreign financial institution of primary money laundering concern under Section 311, requiring Colorado-domiciled BSA-regulated institutions to implement correspondent-account restrictions. 1 Oct 2025 - FATF's June 2025 plenary added the British Virgin Islands and Bolivia to its Jurisdictions Under Increased Monitoring list and removed Croatia, Mali and Tanzania; FinCEN issued a notice instructing US financial institutions, including those in Colorado, to factor the update into risk-based due diligence. 13 Jun 2025 - Executive Order 14157 (January 20, 2025) designated major Mexican drug cartels as Foreign Terrorist Organizations/Specially Designated Global Terrorists, exposing Colorado financial institutions to expanded material-support liability for any dealings traced to cartel-linked fuel-theft or trafficking proceeds moving through the state's distribution corridors. 20 Jan 2025 ### Regulatory horizon (register) - Colorado Vending of Digital Assets Act — implementation/enforcement guidance - FinCEN AML/CFT Program NPRM (casinos/card clubs in scope) - Colorado ADMT/Chatbot Safety Rules Finalisation - FinCEN AML/CFT Program NPRM finalization - GENIUS Act stablecoin Customer Identification Program rule - Corporate Transparency Act interim rule finalization - FATF next plenary review of grey/high-risk lists ### Active schemes - [HIGH] Crypto ATM/kiosk elder-fraud-to-offshore laundering pipeline - Cannabis cash-intermediation and revenue-inflation typology - [HIGH] Domestic LLC beneficial-ownership opacity post-CTA rollback Sources - [US Treasury/OFAC](https://home.treasury.gov/news/press-releases/jy2204) - [Amnesty International](https://www.amnesty.org/en/latest/news/2026/04/cambodia-casinos-get-state-approval-despite-links-to-human-rights-abuse-at-scamming-compounds/) - [iGamiX/iGamist](https://igamist.com/news/cambodia-intensifies-casino-and-fraud-crackdown) - [FATF](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-february-2026.html) - [FinCEN](https://www.fincen.gov/boi) - [Federal Register / FinCEN](https://www.federalregister.gov/documents/2026/04/10/2026-07033/anti-money-laundering-and-countering-the-financing-of-terrorism-programs) - [TRM Labs](https://www.trmlabs.com/resources/blog/ofac-sanctions-cambodian-senator-and-scam-center-network-targeting-americans-with-digital-asset-fraud) - [Colorado Bar Association / Colorado Lawyer](https://cl.cobar.org/features/anti-money-laundering-rules/) - [GGRAsia](https://www.ggrasia.com/72-cambodian-casinos-shut-amid-year-long-crackdown-on-scam-centres-reports) - [Miller & Chevalier](https://www.millerchevalier.com/publication/where-fto-designated-cartels-operate-2026-update) - [Crowell & Moring](https://www.crowell.com/en/insights/client-alerts/focus-on-transnational-cartels-continues-fincen-targets-three-mexican-financial-institutions-with-special-measures-restricting-their-access-to-us-financial-system) - [Washington Trade & Tariff Letter](https://www.wttlonline.com/stories/colombia-designated-major-trafficker-in-fraa-review,14278) - [Zigram](https://www.zigram.tech/article/fatf-grey-list-june-2026/) - [AMLA (EU)](https://www.amla.europa.eu/amla-takes-major-step-toward-harmonised-eu-supervision_en) - [Holland & Knight](https://www.hklaw.com/en/insights/publications/2026/06/what-happened-to-fincens-corporate-transparency-act) - [Greenberg Traurig](https://www.gtlaw.com/en/insights/2026/1/cta-update-eleventh-circuit-declares-cta-constitutional-beneficial-ownership-reporting-requirements-remain-unchanged) - [Tech Times](https://www.techtimes.com/articles/321441/20260723/eu-passes-218-russia-sanctions-targets-vessels-that-refuel-shadow-fleet-tankers.htm) - [UK Home Office (gov.uk)](https://assets.publishing.service.gov.uk/media/67f8ef1845705eb1a1513f35/Failure+to+Prevent+Fraud+Guidance+-+English+Language+v1.6.pdf) - [https://leg.colorado.gov/bills/hb25-1201](https://leg.colorado.gov/bills/hb25-1201) - [https://leg.colorado.gov/bills/sb25-079](https://leg.colorado.gov/bills/sb25-079) - [https://banking.colorado.gov/industry/money-transmitters](https://banking.colorado.gov/industry/money-transmitters) - [https://www.sheppard.com/insights/blogs/colorado-overhauls-money-transmission-law-to-align-with-multistate-licensing-standards](https://www.sheppard.com/insights/blogs/colorado-overhauls-money-transmission-law-to-align-with-multistate-licensing-standards) - [https://cryptoslate.com/crypto-laws/colorado-money-transmission-virtual-currency-regime/](https://cryptoslate.com/crypto-laws/colorado-money-transmission-virtual-currency-regime/) - [https://banking.colorado.gov/sites/banking/files/documents/Interim_Guidance_Cryptocurrency_and_the_MTMA_Final_12.18.25.pdf](https://banking.colorado.gov/sites/banking/files/documents/Interim_Guidance_Cryptocurrency_and_the_MTMA_Final_12.18.25.pdf) - [https://www.fincen.gov/](https://www.fincen.gov/) - [https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-february-2026.html](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-february-2026.html) - [https://checklynx.com/en/resources/knowledge-base/fatf-grey-list](https://checklynx.com/en/resources/knowledge-base/fatf-grey-list) - [https://www.bhfs.com/insight/fincen-proposes-sweeping-aml-cft-reforms-what-casinos-need-to-know/](https://www.bhfs.com/insight/fincen-proposes-sweeping-aml-cft-reforms-what-casinos-need-to-know/) - [https://www.ballardspahr.com/insights/alerts-and-articles/2026/04/how-casinos-should-prepare-for-fincens-2026-aml-cft-overhaul](https://www.ballardspahr.com/insights/alerts-and-articles/2026/04/how-casinos-should-prepare-for-fincens-2026-aml-cft-overhaul) - [https://banking.colorado.gov/](https://banking.colorado.gov/) - [https://banking.colorado.gov/public-notices](https://banking.colorado.gov/public-notices) - [https://troutman.com/insights/digital-assets-blockchain-newsletter-october-16-2026](https://troutman.com/insights/digital-assets-blockchain-newsletter-october-16-2026) - [https://www.cryptopolitan.com/polygon-labs-closes-coinme-deal/](https://www.cryptopolitan.com/polygon-labs-closes-coinme-deal/) - [https://www.streetinsider.com/Business+Wire/TabaPay+Closes+$155+Million+Strategic+Growth+Financing+Led+by+FTV+Capital+and+Announces+Planned+Acquisition+of+Transact+Bank/27016735.html](https://www.streetinsider.com/Business+Wire/TabaPay+Closes+$155+Million+Strategic+Growth+Financing+Led+by+FTV+Capital+and+Announces+Planned+Acquisition+of+Transact+Bank/27016735.html) - [https://www.bankingdive.com/news/tabapay-to-buy-transact-bank-ftv-capital-155-million-investment-occ-charter/829459/](https://www.bankingdive.com/news/tabapay-to-buy-transact-bank-ftv-capital-155-million-investment-occ-charter/829459/) - [Georgia Department of Banking and Finance](https://dbf.georgia.gov/press-releases/2026-10-08/consent-order-entered-coinme-inc) - [Oregon Division of Financial Regulation (publishing the multistate Settlement Agreement and Consent Order)](https://dfr.oregon.gov/AdminOrders/Final%20Agreement%20with%20redactions.pdf) - [Conference of State Bank Supervisors](https://www.csbs.org/newsroom/state-financial-regulators-reach-25-million-settlement-crypto-kiosk-operator) - [US National Archives (eCFR), Treasury/FinCEN rule text](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1021) - [FDATA](https://fdata.global/fdata-submits-comments-on-colorado-admt-rules/) - [Troutman Pepper Locke](https://www.consumerfinancialserviceslawmonitor.com/2026/10/colorado-releases-interim-draft-rules-for-automated-decision-making-technology-and-chatbot-safety-what-changed-and-how-it-affects-financial-services-institutions/) - [Definition of Money Transmitter (Merchant Payment Processor) | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/administrative-rulings/definition-money-transmitter-merchant-payment) - [1 Financial Crimes Enforcement Network (FinCEN)](https://www.fincen.gov/system/files/2026-05/FinCEN-Year-in-Review-2025.pdf) - [As crypto industry expands, US slashes office examining dirty money safeguards of cryptocurrency exchanges - ICIJ](https://www.icij.org/investigations/coin-laundry/as-crypto-industry-expands-u-s-slashes-office-examining-dirty-money-safeguards-of-cryptocurrency-exchanges/) - [FinCEN Notice, FIN-2025-NTC1, August 4, 2025](https://www.fincen.gov/system/files/2025-08/FinCEN-Notice-CVCKIOSK.pdf) - [From Pilot to Crypto Compliance Pioneer: Building and Scaling Risk Management with Brandi Reynolds](https://www.trmlabs.com/resources/trm-talks/from-pilot-to-crypto-compliance-pioneer-building-and-scaling-risk-management-with-brandi-reynolds) - [Press Releases | FinCEN.gov](https://www.fincen.gov/news/press-releases?page=7) - [Advisories | FinCEN.gov](https://www.fincen.gov/resources/advisoriesbulletinsfact-sheets/advisories) - [Application of FinCEN’s Regulations to Virtual Currency Mining Operations | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/administrative-rulings/application-fincens-regulations-virtual-0) - [FinCEN Issues Notice on the Use of Convertible Virtual Currency Kiosks for Scam Payments and Other Illicit Activity | FinCEN.gov](https://www.fincen.gov/news/news-releases/fincen-issues-notice-use-convertible-virtual-currency-kiosks-scam-payments-and) - [Money Services Business (MSB) Registration | FinCEN.gov](https://www.fincen.gov/resources/money-services-business-msb-registration) - [Enforcement Actions | FinCEN.gov](https://www.fincen.gov/news/enforcement-actions) - [Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering, Countering the Financing of Terrorism, and Counter-Proliferation Finance Deficiencies | FinCEN.gov](https://www.fincen.gov/news/news-releases/financial-action-task-force-identifies-jurisdictions-anti-money-laundering-3) - [Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering, Combating the Financing of Terrorism, and Counter-Proliferation Finance Deficiencies | FinCEN.gov](https://www.fincen.gov/news/news-releases/financial-action-task-force-identifies-jurisdictions-anti-money-laundering-2) - [Treasury Convenes Financial Institutions and Law Enforcement to Identify and Dismantle Money Laundering Networks | FinCEN.gov](https://www.fincen.gov/news/news-releases/treasury-convenes-financial-institutions-and-law-enforcement-identify-and) - [FinCEN Announces Data-Driven Border Operation to Address Potential Money Laundering | FinCEN.gov](https://www.fincen.gov/news/news-releases/fincen-announces-data-driven-border-operation-address-potential-money-laundering) - [About FinCEN | FinCEN.gov](https://www.fincen.gov/about-fincen) - [1st Review of the Suspicious Activity Reporting System (SARS) | FinCEN.gov](https://www.fincen.gov/1st-review-suspicious-activity-reporting-system-sars) - [Enforcement Actions for Failure to Register as a Money Services Business | FinCEN.gov](https://www.fincen.gov/enforcement-actions-failure-register-money-services-business) - [The Anti-Money Laundering Act of 2020 | FinCEN.gov](https://www.fincen.gov/resources/statutes-and-regulations/anti-money-laundering-act-2020) - [The DOJ's NCET Disbanded: What This Means for Digital Assets - Chainalysis](https://www.chainalysis.com/blog/ncet-blanche-memo/) - [Financial Fraud Enforcement Task Force (FFETF) | FinCEN.gov](https://www.fincen.gov/financial-fraud-enforcement-task-force-ffetf) - [2026 Crypto Crime Report – Illicit Crypto Trends & Typologies | TRM Labs](https://www.trmlabs.com/reports-and-whitepapers/2026-crypto-crime-report) - [Press Releases | FinCEN.gov](https://www.fincen.gov/news/press-releases) - [2026 Crypto Crime Report: Scams](https://www.chainalysis.com/blog/crypto-scams-2026/) - [Fact Sheet: Proposed Rule to Strengthen and Modernize ...](https://www.fincen.gov/system/files/shared/Program-NPRM-FactSheet-508.pdf) - [Questions swirl around US plans for record $15B Prince Group crypto seizure - ICIJ](https://www.icij.org/investigations/coin-laundry/questions-swirl-around-us-plans-for-record-15b-prince-group-crypto-seizure/) - [News | FinCEN.gov](https://www.fincen.gov/news) - [1 1. See 31 U.S.C. § 5312(a)(2); 31 C.F.R. § 1010.100(t). 2.](https://www.fincen.gov/system/files/2026-06/FinCEN-Alert-Fiscal-Fuel-Theft.pdf) - [Amid a scam crackdown, crypto giants keep fueling bitcoin ATMs - ICIJ](https://www.icij.org/investigations/coin-laundry/amid-a-scam-crackdown-crypto-giants-keep-fueling-bitcoin-atms/) - [FinCEN Calls for Vigilance on Crypto Kiosk Activities | OCCRP](https://www.occrp.org/en/news/fincen-calls-for-vigilance-on-crypto-kiosk-activities) - [Retailers keep cashing in on crypto ATMs as scams surge - ICIJ](https://www.icij.org/investigations/coin-laundry/retailers-keep-cashing-in-on-crypto-atms-as-scams-surge/) - [How Crypto ATMs in the U.S. Became A Favorite Tool for Scammers | OCCRP](https://www.occrp.org/en/feature/how-crypto-atms-in-the-us-became-a-favorite-tool-for-scammers) - [Rate of Illicit Activity at Crypto ATMs is Double That of Overall Crypto Industry | TRM Labs](https://www.trmlabs.com/resources/blog/illicit-activity-involving-crypto-atms-is-double-that-of-overall-crypto-industry) - [Fraud and scams involving Bitcoin ATMs](https://www.elliptic.co/blog/analysis/fraud-and-scams-involving-bitcoin-atms) - [Crypto ATM operator Bitcoin Depot files for bankruptcy - ICIJ](https://www.icij.org/investigations/coin-laundry/crypto-atm-operator-bitcoin-depot-files-for-bankruptcy/) - [TRM Labs Resources | Crypto Investigations, Compliance, and Policy Insights](https://www.trmlabs.com/resources) - [FinCEN Notice, FIN-2025-NTC1, August 4, 2025](https://www.fincen.gov/sites/default/files/shared/FinCEN-Notice-CVCKIOSK.pdf) - [Flip Book: Investigating Crypto Scams | TRM Labs](https://www.trmlabs.com/guides/investigating-crypto-scams-flip-book) - [Cryptocurrency Field Guide for Law Enforcement](https://www.chainalysis.com/blog/law-enforcement-crypto-field-guide/) - [Massachusetts sues Bitcoin Depot, alleging the crypto ATM operator knowingly facilitated crypto scams - ICIJ](https://www.icij.org/investigations/coin-laundry/massachusetts-sues-bitcoin-depot-alleging-the-crypto-atm-operator-knowingly-facilitated-crypto-scams/) - [3 Things Law Enforcement Agencies Need to Know About Cryptocurrency - Chainalysis](https://www.chainalysis.com/blog/law-enforcement-agencies-cryptocurrency/) - [MSB Registrant Search | FinCEN.gov](https://www.fincen.gov/resources/msb-state-selector) - [Fact Sheet on MSB Registration Rule | FinCEN.gov](https://www.fincen.gov/fact-sheet-msb-registration-rule) - [F I N C E N G U I D A N C E 1](https://www.fincen.gov/system/files/2019-05/FinCEN%20CVC%20Guidance%20FINAL.pdf) - [Application of the Definition of Money Transmitter to Brokers and Dealers in Currency and Other Commodities | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/guidance/application-definition-money-transmitter-brokers-and) - [Definition of Money Services Business (Debt Management Company) | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/administrative-rulings/definition-money-services-business-debt) - [Whether a Company that Provides Online Real-Time Deposit, Settlement, and Payment Services for Banks, Businesses and Consumers is a Money Transmitter rather | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/administrative-rulings/whether-company-provides-online-real-time) - [2024 Pig Butchering Crypto Scam Revenue Grows 40% YoY as Industry Increases Sophistication](https://www.chainalysis.com/blog/2024-pig-butchering-scam-revenue-grows-yoy/) - [BSA Expectations Regarding Marijuana-Related Businesses | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/guidance/bsa-expectations-regarding-marijuana-related-businesses) - [Frequently Requested FOIA-Processed Records | FinCEN.gov](https://www.fincen.gov/frequently-requested-foia-processed-records) - [FinCEN Issues Guidance to Financial Institutions on Marijuana Businesses | FinCEN.gov](https://www.fincen.gov/news/news-releases/fincen-issues-guidance-financial-institutions-marijuana-businesses) - [Guidance | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/guidance?page=2) - [Marijuana With High THC Levels Draws Scrutiny in Colorado, Washington - Bloomberg](https://www.bloomberg.com/news/features/2023-08-16/marijuana-with-high-thc-levels-draws-scrutiny-in-colorado-washington) - [1 The U.S. Department of the Treasury’s (Treasury)](https://www.fincen.gov/system/files/2025-08/FinCEN-Advisory-CMLN-508.pdf) - [Marijuana Banking Is Moving Forward Despite Federal Uncertainty - Bloomberg](https://www.bloomberg.com/news/newsletters/2022-01-18/marijuana-banking-is-moving-forward-despite-federal-uncertainty) - [Marijuana Dispensaries Put Colorado Banks in a Bind - Bloomberg](https://www.bloomberg.com/news/articles/2013-06-06/marijuana-dispensaries-put-colorado-banks-in-a-bind) - [REQUEST ID SUMMARY OF REQUEST DATE RECEIVED REQUESTER GoFOIA # 19-001-F](https://www.fincen.gov/system/files/shared/FY19_FOIA_Log.pdf) - [Marijuana Banking Update](https://www.fincen.gov/sites/default/files/shared/508_299423_MJ%20Banking%20Update%201st%20QTR%20FY2021_Public_Final.pdf) - [Bitcoin Depot Goes Bankrupt, Signaling Demise of Crypto ATMs - Bloomberg](https://www.bloomberg.com/news/articles/2026-05-18/bitcoin-depot-goes-bankrupt-signaling-demise-of-crypto-atms) - [Bitcoin ATMs are a legal and fast-growing part of the crypto world, despite flying under the regulatory radar](https://www.bloomberg.com/features/2018-bitcoin-atm-money-laundering/) - [Law enforcement, banks warn of money laundering gaps in major US crypto bill - ICIJ](https://www.icij.org/investigations/coin-laundry/law-enforcement-banks-warn-of-money-laundering-gaps-in-major-us-crypto-bill/) - [Definition of Money Services Business (Money Transmitter/Currency Dealer or Exchanger) | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/administrative-rulings/definition-money-services-business-money) - [White House Releases Report on Digital Assets | TRM Labs](https://www.trmlabs.com/resources/blog/white-house-releases-report-on-digital-assets) - [GUIDANCE TO MONEY SERVICES BUSINESSES ON OBTAINING AND MAINTAINING BANKING SERVICES | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/guidance/guidance-money-services-businesses-obtaining-and) - [Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/guidance/application-fincens-regulations-persons-administering) - [Application of Money Services Business Regulations to a Company that Offers Escrow Services to a Buyer and Seller in a Given Internet Sale of Goods or Services | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/administrative-rulings/application-money-services-business-1) - [Administrative Ruling on the Application of FinCEN Regulations to Currency Transporters, Including Armored Car Services, and Exceptive Relief | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/administrative-rulings/administrative-ruling-application-fincen) - [Advisory on Illicit Activity Involving Convertible Virtual ...](https://www.fincen.gov/system/files/advisory/2019-05-10/FinCEN%20Advisory%20CVC%20FINAL%20508.pdf) - [Application of FinCEN’s Regulations to Persons Issuing Physical or Digital Negotiable Certificates of Ownership of Precious Metals | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/administrative-rulings/application-fincens-regulations-persons) - [Request for Administrative Ruling on the Application of FinCEN’s Regulations to a Virtual Currency Trading Platform | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/administrative-rulings/request-administrative-ruling-application-0) - [1 FinCEN Advisory United States Department of the Treasury](https://www.fincen.gov/system/files/advisory/advissu7.pdf) - [Administrative Ruling on Whether a Company that Offers a Payment Mechanism Based on Payable-Through Drafts to its Commercial Customers is a Money Transmitter | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/administrative-rulings/administrative-ruling-whether-company-offers) - [Beneficial Ownership Information Reporting | FinCEN.gov](https://www.fincen.gov/boi) - [Frequently Asked Questions | FinCEN.gov](https://www.fincen.gov/boi-faqs) - [Beneficial Ownership Information Reporting Rule Fact Sheet | FinCEN.gov](https://www.fincen.gov/beneficial-ownership-information-reporting-rule-fact-sheet) - [Beneficial Ownership Reporting Outreach and Education Toolkit | FinCEN.gov](https://www.fincen.gov/boi/toolkit) - [Beneficial Ownership Information Report (BOIR) - BOI E-FILING](https://boiefiling.fincen.gov/fileboir) - [BOI Newsroom | FinCEN.gov](https://www.fincen.gov/boi/newsroom) - [Fact Sheet: Beneficial Ownership Information Reporting Notice of Proposed Rulemaking (NPRM) | FinCEN.gov](https://www.fincen.gov/news/news-releases/fact-sheet-beneficial-ownership-information-reporting-notice-proposed-rulemaking) - [Prepared Remarks of FinCEN Deputy Director Jimmy Kirby During Beneficial Ownership Information Reporting Event in Lakewood, Colorado | FinCEN.gov](https://www.fincen.gov/news/speeches/prepared-remarks-fincen-deputy-director-jimmy-kirby-during-beneficial-ownership) - [FinCEN Removes Beneficial Ownership Reporting Requirements for U.S. Companies and U.S. Persons, Sets New Deadlines for Foreign Companies | FinCEN.gov](https://www.fincen.gov/news/news-releases/fincen-removes-beneficial-ownership-reporting-requirements-us-companies-and-us) - [Quick Reference | FinCEN.gov](https://www.fincen.gov/boi/quick-reference) - [Application of Money Services Business regulations to the rental of computer systems for mining virtual currency | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/administrative-rulings/application-money-services-business-0) - [Application of FinCEN’s Regulations to Virtual Currency Software Development and Certain Investment Activity | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/administrative-rulings/application-fincens-regulations-virtual) - [Request for Administrative Ruling on the Application of FinCEN’s Regulations to a Virtual Currency Payment System | FinCEN.gov](https://www.fincen.gov/resources/statutes-regulations/administrative-rulings/request-administrative-ruling-application) - [Crypto regulatory affairs: US Treasury releases national financial crime risk assessments](https://www.elliptic.co/blog/crypto-regulatory-affairs-us-treasury-releases-national-financial-crime-risk-assessments) - [Treasury Department Publishes National Money Laundering Risk Assessment and National Terrorist Financing Risk Assessment | FinCEN.gov](https://www.fincen.gov/news/news-releases/treasury-department-publishes-national-money-laundering-risk-assessment-and) - [New US Treasury strategy targets crypto scams and real estate money laundering - ICIJ](https://www.icij.org/investigations/fincen-files/new-us-treasury-strategy-targets-crypto-scams-and-real-estate-money-laundering/) - [MONEY LAUNDERING NATIONAL RISK ASSESSMENT TOOLKIT – ANNEXES A-C](https://www.fatf-gafi.org/en/publications/Methodsandtrends/Money-Laundering-National-Risk-Assessment-Toolkit-Annexes.html) - [Fact Sheet: Proposed Rule to Fundamentally Reform Financial](https://www.fincen.gov/system/files/2026-04/Program-NPRM-FactSheet.pdf) - [HM Treasury national risk assessment 2025](https://www.gamblingcommission.gov.uk/licensees-and-businesses/notice/hm-treasury-national-risk-assessment-2025) - [What Is Money Laundering? Definition, Stages, and Crypto Laundering Methods - Chainalysis](https://www.chainalysis.com/glossary/money-laundering/) - [FATF launches National Risk Assessment toolkit to help countries identify greatest money laundering risks](https://www.fatf-gafi.org/en/publications/Fatfgeneral/FATF-launches-National-Risk-Assessment-toolkit-to-help-countries-identify-greatest-money-laundering-risks.html) - [1 The U.S. Department of the Treasury’s (Treasury) Financial](https://www.fincen.gov/system/files/2026-03/FinCEN-Advisory-Health-Care-Fraud.pdf) - [Financial Crimes Enforcement Network (FinCEN), U.S. Department of the Treasury](https://www.fincen.gov/system/files/2025-08/FinCEN-Notice-CVCKIOSK.pdf) - [Financial Crimes Enforcement Network (FinCEN), U.S. Department of the Treasury](https://www.fincen.gov/boi) - [Colorado Department of Regulatory Agencies (DORA) — Division of Banking](https://dora.colorado.gov) - [International Consortium of Investigative Journalists (ICIJ)](https://www.icij.org/investigations/coin-laundry/retailers-keep-cashing-in-on-crypto-atms-as-scams-surge/) - [U.S. Department of the Treasury](https://home.treasury.gov/system/files/246/2026-NMLRA.pdf) - [Financial Crimes Enforcement Network (FinCEN), U.S. Department of the Treasury](https://www.fincen.gov/news/news-releases/financial-action-task-force-identifies-jurisdictions-anti-money-laundering-3) - [TRM Labs](https://www.trmlabs.com/reports-and-whitepapers/2026-crypto-crime-report) - [International Consortium of Investigative Journalists (ICIJ)](https://www.icij.org/investigations/coin-laundry/as-crypto-industry-expands-u-s-slashes-office-examining-dirty-money-safeguards-of-cryptocurrency-exchanges/) Coverage gaps fim-int-2026-07-07-G001: A Colorado Attorney General enforce… fim-int-2026-07-07-G001: A Colorado Attorney General enforcement dataset or state-level crypto-ATM litigation record would clarify whether the absence of parallel state action reflects a capacity deficit or a political choice. [resolved] fim-int-2026-07-07-G002: A dedicated Colorado state-level na… fim-int-2026-07-07-G002: A dedicated Colorado state-level national risk assessment or typology report would improve the granularity of Colorado-specific financial-crime risk tracking beyond federal baseline material. [resolved] fim-int-2026-07-07-G003: Confirmation of whether the EU or U… fim-int-2026-07-07-G003: Confirmation of whether the EU or UK have issued equivalent designations to the Section 311 Huione Group action or the EO 14157 cartel FTO/SDGT designation would resolve the divergence-note uncertainty in sanctions tracking. [resolved] fim-int-2026-07-07-G004: Post-finalization text of the FinCE… fim-int-2026-07-07-G004: Post-finalization text of the FinCEN AML/CFT Program NPRM would confirm whether the RegTech/AI-monitoring encouragement language survives into the final rule. [resolved] fim-int-2026-07-07-G005: Named designated entities within th… fim-int-2026-07-07-G005: Named designated entities within the EO 14157 cartel FTO/SDGT action were not collected in Research material; specific cartel names would sharpen structured-claims precision on this designation. [resolved] fim-int-2026-07-14-G001: No EU AML Package (AMLR/6AMLD/AMLA)… fim-int-2026-07-14-G001: No EU AML Package (AMLR/6AMLD/AMLA) transposition or supervisory-perimeter development was located this cycle; research effort was concentrated on US/CO and Tier-D jurisdictions. [resolved] fim-int-2026-07-14-G002: No new EU/US/UK sanctions-regime di… fim-int-2026-07-14-G002: No new EU/US/UK sanctions-regime divergence or cross-bloc delisting asymmetry was located this cycle. [resolved] fim-int-2026-07-14-G003: No D4 Conflict Finance substantive … fim-int-2026-07-14-G003: No D4 Conflict Finance substantive finding located this cycle beyond the adjacent Mexico cartel fuel-smuggling item classified under D3. [resolved] fim-int-2026-07-14-G004: The obligation_refs.framework close… fim-int-2026-07-14-G004: The obligation_refs.framework closed enum has no value corresponding to the US Corporate Transparency Act (distinct from the UK's ECCTA2023); obligation_refs was left empty on claim fim-2026-W29-005 to avoid a mis-mapped framework tag. [resolved] fim-int-2026-08-05-G001: No primary consilium.europa.eu text… fim-int-2026-08-05-G001: No primary consilium.europa.eu text retrieved this cycle for the EU 21st Russia sanctions package; confidence capped at Assessed pending primary corroboration. [resolved] fim-int-2026-08-05-G002: OFSI Yemen/Houthi sanctions channel… fim-int-2026-08-05-G002: OFSI Yemen/Houthi sanctions channel lacked a T1 anchor this cycle. [resolved] fim-int-2026-08-05-G003: No fresh FinCEN, FCA/JMLSG, or equi… fim-int-2026-08-05-G003: No fresh FinCEN, FCA/JMLSG, or equivalent AI/ML/perpetual-KYC guidance identified this cycle for D6. [resolved] fim-int-2026-08-05-G004: Sub-Saharan Africa and Central Asia… fim-int-2026-08-05-G004: Sub-Saharan Africa and Central Asia corridors were not surfaced with material findings this cycle and should be prioritized in the next monthly regional-balance pass. [resolved] fim-int-2026-08-05-G005: Primary White House FY2026 FRAA det… fim-int-2026-08-05-G005: Primary White House FY2026 FRAA determination memorandum text was not directly retrieved for the Colombia designation; single T3 secondary source only. [resolved] fim-int-2026-08-20-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-08-20-G001 ({'scheme': 'financial_integrity', 'value': 'D5'}): No enforcement action or Division of Banking guidance yet located under either HB25-1201 or SB25-079 this cycle. [resolved] fim-int-2026-08-20-G002: D1/D2/D3/D4 show no US-CO-specific … fim-int-2026-08-20-G002: D1/D2/D3/D4 show no US-CO-specific variance this cycle; these domains are properly assessed at the federal level for a US subnational jurisdiction, and thin coverage reflects the delta-only research posture rather than a research failure. [resolved] fim-int-2026-09-05-G001: This dispatch was JID-scoped to US-… fim-int-2026-09-05-G001: This dispatch was JID-scoped to US-CO under the union DR pass; the global D1-D4/D6 substantive-finding floor and Tier-D sweep (KH/LA/MX/CO-Colombia) were not independently pursued this cycle. [resolved] fim-int-2026-09-05-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-09-05-G002 ({'scheme': 'financial_integrity', 'value': 'D5'}): SB25-079's precise effective date and whether the Division of Banking's December 2025 interim guidance is finalized into permanent rule were not confirmed this cycle. [resolved] fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', 'value': 'D1'}): D1-D4 (sanctions architecture, beneficial ownership, enabler jurisdictions, conflict finance) were not independently re-searched for US-CO this cycle; search effort concentrated on D5/D6/D7 and the Tier D watch. [resolved] fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', 'value': 'D3'}): Golden Triangle corridor/VASP typology research for Laos (casino-linked remittance, TBML, narco-finance) was not independently conducted this cycle. [resolved] fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-10-18-G001 ({'scheme': 'financial_integrity', 'value': 'D5'}): Colorado-specific mechanics of the Coinme-to-Polygon money-transmitter licence transfer are not confirmed by a Colorado- or company-issued primary statement this cycle. [resolved] fim-int-2026-10-18-G002: Tier D jurisdiction checks (Cambodi… fim-int-2026-10-18-G002: Tier D jurisdiction checks (Cambodia, Laos, Mexico, Colombia) were not actively searched this cycle given the pooled search budget was prioritised to US-CO. [resolved] fim-int-2026-10-25-G001: No CO-specific sanctions-evasion ar… fim-int-2026-10-25-G001: No CO-specific sanctions-evasion architecture or enabler-jurisdiction signal (D1, D3) surfaced this cycle; Colorado inherits federal OFAC/BIS posture without independent variance identified. [open] fim-int-2026-10-25-G002: D6 (Compliance Technology and Activ… fim-int-2026-10-25-G002: D6 (Compliance Technology and Active Defence) CO-specific AI/ML transaction-monitoring supervisory development not located this cycle. [open] fim-int-2026-11-01-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-11-01-G001 ({'scheme': 'financial_integrity', 'value': 'D6'}): No Tier-1 primary instrument (the AG's own rule text or hearing transcript) was directly retrieved this pass for the ADMT/Chatbot Safety rulemaking; confidence capped at Probable. [open] fim-int-2026-11-01-G002: D1-D5 and D7 were not actively re-s… fim-int-2026-11-01-G002: D1-D5 and D7 were not actively re-swept this cycle for US-CO; no Colorado-specific nexus identified but coverage is thin, not confirmed-quiet. [open] FIM-GAP-001 (D5): No Colorado Attorney General enforcement a… FIM-GAP-001 (D5): No Colorado Attorney General enforcement action against major crypto ATM/kiosk operators was identified in the window, despite a nationwide wave of state actions (Iowa, Massachusetts, Washington DC, Connecticut, Missouri) alleging that a majority of transactions on some kiosk networks were scam-related. FIM-GAP-002 (D2): The March 2025 CTA interim final rule perm… FIM-GAP-002 (D2): The March 2025 CTA interim final rule permanently exempts all Colorado-formed domestic LLCs and corporations from federal beneficial ownership reporting, and the Colorado Secretary of State's business entity registry does not independently collect beneficial ownership information, creating a dual-layer transparency vacuum. FIM-GAP-003 (D5): IRS examiner staffing dedicated to AML ove… FIM-GAP-003 (D5): IRS examiner staffing dedicated to AML oversight of crypto firms and other money transmitters fell 33% in 2025 (to 139 agents nationally, down from 208 in 2024), reducing federal supervisory reach into Colorado-domiciled nonbank financial institutions and crypto MSBs at a time of rising kiosk-related fraud volume. FIM-GAP-004 (D3): No dedicated Colorado state-level national… FIM-GAP-004 (D3): No dedicated Colorado state-level national/sub-national risk assessment, typology report, or state AG financial-crime enforcement dataset was located within the window; this baseline necessarily relies primarily on national US Treasury/FinCEN material rather than Colorado-specific enforcement or typology data. ## Evidence #### Confidence-tiered claims Coinme Inc. entered a Settlement Agreement & Consent Order with 34 state financial regulators, including the Colorado Division of Banking, on 8 October 2026, paying $2.5M and agreeing to exit virtual-currency kiosk operations by 1 January 2027 or face an additional $4M penalty. [[Source 1]](#sec-sources) Probable · 1 source Colorado's Division of Banking published the Coinme Settlement Agreement & Consent Order on its own public-notices page for October 2026, confirming direct state-level enforcement participation. [[Source 1]](#sec-sources) Probable · 1 source Polygon Labs closed its acquisition of Coinme (and Sequence) on 14 October 2026, a deal reportedly worth over $250 million first announced January 2026, gaining 37 state money-transmitter licenses and 11 exemptions, including Colorado. [[Source 1]](#sec-sources) Probable · 1 source TabaPay announced on 2 September 2026 a $155 million strategic growth financing led by FTV Capital, earmarked to fund its planned acquisition of Denver-based Transact Bank N.A., targeted to close in Q4 2026 subject to OCC/Federal Reserve approval. [[Source 1]](#sec-sources) Probable · 1 source Coinme, Inc. entered a $2.5M, 34+-jurisdiction BSA/AML settlement, effective Oct. 7, 2026, naming Colorado Division of Banking; Colorado's allocated share is $116,168.44. Coinme must cease Colorado kiosk operations by Jan. 1, 2027 or face an additional $4M national penalty. [[Source 1]](#sec-sources) Probable · 1 source Colorado has no state-level AML statute distinct from federal BSA obligations; money transmitters are licensed under Title 11, Art. 110 MTMA (HB25-1201, effective Aug. 6, 2025); casinos are BSA-designated financial institutions under 31 CFR Part 1021, filing SARs ($5,000 threshold) and CTRs ($10,000/24hr threshold) with FinCEN. [[Source 1]](#sec-sources) Probable · 1 source Colorado Department of Law held a formal rulemaking hearing on 2026-10-26 on revised ADMT/Chatbot Safety draft rules, released 2026-10-06, with comments accepted through the hearing date. [[Source 1]](#sec-sources) Probable · 1 source Revised ADMT/Chatbot Safety interim draft rules (4 CCR 904-6) released 2026-10-06, with a formal public rulemaking hearing held 2026-10-26 and written comments accepted through that date; bears on AI/ML models used for account-opening credit and fraud screening by regulated financial firms. [[Source 1]](#sec-sources) Probable · 1 source