United States — Indiana US-IN

Indiana sanctions exposure runs through the uniform federal OFAC architecture rather than any distinct state-level designation authority, and this cycle baseline documents a sanctions regime that remains structurally active on multiple fronts. OFAC removed the final remaining name from its Foreign Sanctions Evaders list on 18 December 2025, leaving the list empty, though new names may be added at any time; the mechanism has no direct European Union or United Kingdom equivalent, which is itself a structural divergence point in sanctions-list architecture with direct consequences for how US institutions, including Indiana-based BSA-covered entities, calibrate their screening protocols against a shrinking but still-live list. Designation activity did not slow during the same period: OFAC designated the Prince Group transnational criminal organization in October 2025, an action coordinated with UK sanctions and a simultaneous Department of Justice indictment, tied to Cambodia-based forced-labor scam compounds and accompanied by a fifteen billion dollar bitcoin forfeiture action, illustrating a close but imperfect alignment between the two allied sanctions regimes where the designation itself was coordinated but the forfeiture tool remains a purely domestic US mechanism. FinCEN separately designated the Cambodian Huione Group conglomerate as a foreign financial institution of primary money-laundering concern under Section 311 authority, severing its correspondent access to the US financial system after the network was found to have received over thirty-nine point six billion dollars in 2025 tied to scam and laundering networks with documented US victim exposure.

The most analytically significant finding in this domain this cycle, however, is not a designation but a divergence. OFAC designated two UK-registered digital asset exchanges, Zedcex Exchange and Zedxion Exchange, tied to an Iranian sanctions evader in January 2026, and no confirmed parallel UK Office of Financial Sanctions Implementation listing for the same corporate entities has been identified. Applying the architecture-over-incident principle, this is not read as an isolated gap in one listing round but as live evidence of a structural mismatch in listing scope between two closely coordinated sanctions regimes acting on the same underlying entities: US institutions with UK-domiciled virtual asset service provider counterparties, including any Indiana-based institution with such exposure, face compliance friction from a jurisdiction-by-jurisdiction rather than harmonized designation posture. This sits against a formal compliance backdrop that remains clean: the United States is absent from both the FATF Jurisdictions Under Increased Monitoring list and the Call for Action list as of the June 2026 plenary, and the jurisdiction profile for Indiana specifically records a compliant, tier-A status with no high-risk-third-country flag from either the EU or UK advisory notices. The domain trajectory is nonetheless assessed as deteriorating, reflecting the pattern of continued designation activity and an open regime-divergence question rather than any change in the formal FATF-adjacent status of the jurisdiction.

Three-pillar balance is worth stating explicitly here: the developments recorded this cycle sit predominantly within the AML and CTF pillars, with the Huione and Prince Group designations carrying clear anti-money-laundering and forced-labor-proceeds dimensions and the Zedcex and Zedxion action carrying a CTF classification tied to an Iranian sanctions evader. No CPF-specific development was identified in this jurisdiction-scoped baseline, a gap worth flagging rather than silently omitting, consistent with the standing correction for CTF and CPF under-weighting relative to AML enforcement volume. The jurisdiction risk tracker entry for Indiana records a mixed enforcement-versus-enablement balance precisely because the sanctions architecture itself is federal and uniformly applied, while the vulnerability documented elsewhere in this baseline concentrates in adjacent domains; no Indiana-specific sanctions-evasion nexus, such as dark-fleet, correspondent-banking, or commodity-rerouting activity, was identified this cycle.

Outlook

The next scheduled review point in the standing FATF process falls in October 2026, within an already-operative tri-annual list-update mechanism under which the United States is not currently grey- or black-listed; this is a periodic scrutiny point rather than an anticipated status change. Whether OFSI will issue a parallel listing for Zedcex and Zedxion remains an open question as of this baseline, and a direct check of the UK consolidated sanctions list in a subsequent cycle would confirm whether the listing-scope divergence has closed or persists. Continued OFAC designation activity against Cambodia-linked and Iran-linked networks should be expected to continue on the same cadence observed this cycle, consistent with the deteriorating trajectory rating of the domain, though this observation describes a pattern rather than a specific forecast of any named future designation.

The most consequential development in this domain, and in this baseline overall, is a structural reversal rather than a discrete incident. All US-formed entities, including Indiana-formed LLCs and corporations, and their beneficial owners are now exempt from Corporate Transparency Act beneficial ownership information reporting under the March 2025 interim final rule, which redefines reporting company to cover only foreign entities registered to do business in a US state. This removes the principal federal transparency mechanism as it applied to domestic entities, and the Indiana Secretary of State business registry captures only basic incorporation data with no beneficial-ownership layer, meaning Indiana-formed entities now carry effectively no beneficial-ownership disclosure obligation at either the federal or the state level. Applying the architecture-over-incident principle, this is assessed as the single most significant D2 finding in the baseline: a structural transparency-mechanism reversal outweighs any individual enforcement episode, and the finding is held at high confidence on Tier 1 sourcing. This gap is held at high confidence because it rests on Tier 1 federal rulemaking sourcing rather than inference, distinguishing it from the possible-confidence supervisory-visibility gap documented elsewhere in this baseline.

This sits alongside a long-standing and distinct blind spot in the same domain: a substantial share, on the order of twenty to thirty percent, of US residential property purchases, including in Indiana, close without mortgage financing and therefore fall outside lender anti-money-laundering checks, while title agents, real estate agents, and closing attorneys remain structurally outside Bank Secrecy Act compliance-program obligations. Read together with the domestic beneficial-ownership exemption, this describes a jurisdiction in which two of the principal channels through which opaque ownership is typically surfaced, corporate registries and real estate closing intermediaries, both carry no beneficial-ownership disclosure requirement, even though the overall formal compliance status of the jurisdiction remains clean, recorded as FATF-compliant, tier A, with no high-risk-third-country flag from either the EU or UK advisory notices.

It is useful to read this Indiana-specific deterioration against the durable structural backdrop of how beneficial-ownership and corporate-transparency architecture is evolving elsewhere, since the contrast is itself analytically informative. The EU AML Package is built from three distinct instruments rather than a single measure: a directly applicable AML Regulation, Regulation (EU) 2024/1624, which requires no domestic transposition; a sixth AML Directive, transposed individually by each Member State; and a separate AMLA Regulation, Regulation (EU) 2024/1620, which establishes the Anti-Money Laundering Authority and progressively shifts supervision of higher-risk obliged entities from purely national authorities toward a hybrid EU-level regime through a direct and indirect supervision perimeter. This is standing architectural context rather than a new development in this cycle; interpreter tracking of the EU AML Package and AMLA notes this framework is not a domestic supervisory matter for Indiana as a US state, with its relevance for this jurisdiction limited to Indiana-headquartered firms with EU counterparties that will face AMLA-supervised enhanced due diligence as the centralized EU supervisor becomes operational. The structural contrast is nonetheless notable: where the EU is actively constructing a centralized, hybrid supervisory layer for beneficial-ownership and obliged-entity oversight, the US this cycle moved in the opposite direction for its principal domestic transparency mechanism.

Outlook

No litigation or congressional action restoring domestic beneficial ownership reporting was identified this cycle, and the March 2025 exemption remains in effect as an interim final rule pending finalization, with no confirmed timeline for that final rule surfaced in this baseline. No Indiana state-level beneficial-ownership registry initiative was identified that would independently fill the resulting gap. The all-cash real estate blind spot likewise shows no confirmed regulatory change on the horizon within this baseline window. Absent a final CTA rule, litigation outcome, or state registry initiative, the structural gap in Indiana corporate and real estate beneficial-ownership visibility should be read as a durable rather than transitional feature of the current profile of the jurisdiction.

Indiana exposure in this domain centers on a capacity gap rather than a distinct legal choice to permit illicit finance. Unlike roughly eighteen other US states, Indiana has no confirmed transaction-limit, mandatory-KYC, or operator-liability statute governing crypto kiosks, despite documented scam-transmission cases at Circle K-sited Bitcoin Depot kiosks within the state; Indiana consumers are left reliant solely on federal FinCEN guidance and general fraud statutes rather than any state-specific consumer-protection backstop. This is best read as an enabler-jurisdiction capacity deficit distinct from, and additive to, the federal advisory framework: the absence of a state statute does not itself constitute enforcement failure, but it removes a layer of protection that a substantial number of peer states have already put in place.

Professional-facilitator infrastructure was also directly targeted at the federal level this cycle in a manner with binding consequences for Indiana. FinCEN issued a consent order against Brinks Global Services USA for moving bulk currency shipments across the US border without Bank Secrecy Act money-services-business registration, establishing a precedent binding on currency-transport MSBs operating in every state, including Indiana. This is a Tier 1 enforcement action against a professional-facilitator infrastructure provider rather than an end user, consistent with the standing focus of the domain on the intermediaries and jurisdictions that make illicit-finance channels function at scale rather than on the individual transactions that flow through them.

Indiana own supervisory visibility, however, is difficult to assess directly. No enforcement order, penalty, or license action specific to the Indiana Department of Financial Institutions was identified in open-source search despite the agency administering money-transmitter licensing under the state Uniform Money Services Act. This finding is held at only possible confidence because it is genuinely ambiguous between two distinct readings: either Indiana state-level enforcement volume against money-transmitter licensees is authentically low, or the state own regulatory reporting has a publication gap that open-source research could not penetrate. Enablement-as-signal reasoning would treat sustained non-enforcement in a state supervisory function as itself analytically significant, but the evidentiary basis here does not yet support choosing between a genuine enforcement gap and a transparency gap in the reporting of the state itself; this is flagged explicitly as a research gap rather than resolved in either direction.

Enabler-jurisdiction analysis in this baseline also intersects directly with the corporate-transparency finding recorded elsewhere in this brief: the Indiana Secretary of State registry captures only basic incorporation data with no beneficial-ownership layer, and title agents, real estate agents, and closing attorneys handling the twenty to thirty percent of US residential purchases completed without financing remain structurally outside Bank Secrecy Act compliance-program obligations. Both are professional-facilitator and registry-infrastructure gaps rather than the product of any single actor choice to enable illicit finance, and both meet the standard of the enabler-jurisdiction filter of assessing legal framework and enforcement capacity rather than actor intent.

Read through the F3 enabler-jurisdiction filter, the profile of Indiana requires assessing legal framework, enforcement history, and capacity against choice rather than treating any single gap as evidence of policy-level permissiveness. The crypto-kiosk gap, the unclear DFI enforcement record, and the non-differentiated real-estate professional-facilitator obligations of Indiana together produce a jurisdiction risk tracker classification of mixed enforcement-versus-enablement balance with a structural rather than episodic character. None of the three gaps identified this cycle reflects a discrete incident; each is a standing feature of the regulatory architecture of Indiana that predates this baseline and is likely to persist absent specific legislative or supervisory action.

Outlook

The legislative status of any Indiana General Assembly crypto-kiosk consumer-protection bill was not established in this baseline; direct tracking of state legislative records in a subsequent cycle would resolve whether Indiana is moving toward the statutory model already adopted by other states or remains without one. Direct verification against Indiana Department of Financial Institutions records would resolve whether the absence of a discoverable enforcement history reflects low enforcement volume or a publication gap, a distinction that materially changes the severity assessment of the domain. The Brinks consent-order precedent should be expected to inform supervisory expectations for currency-transport MSBs operating in Indiana going forward, independent of any state-specific legislative action.

No Indiana-nexus or new material conflict-finance development was identified in this jurisdiction-specific baseline this cycle. The standing coverage areas of the domain, Russian war-economy financing, Sahel conflict-minerals flows, and Democratic Republic of Congo mining-sector governance, are unaddressed in this cycle Indiana-scoped research, and the domain tracker records the domain as quiet with a stable trajectory and a monitored severity-preliminary rating rather than any active or deteriorating signal. This absence should be read honestly as a gap in the evidentiary base of this cycle specific to Indiana rather than as an assessment that conflict-finance risk is genuinely absent from the jurisdiction; a sub-national baseline of this kind is unlikely to surface conflict-finance nexus points unless a specific Indiana-headquartered entity, financial institution, or extractive-industry supply-chain participant appears in reporting tied to one of the standing coverage areas, and no such appearance was identified this cycle.

The closest adjacent finding elsewhere in this baseline is the Prince Group transnational criminal organization designation recorded in the Sanctions Architecture and Evasion domain, which involves forced-labor scam compounds in Cambodia rather than conflict-mineral or armed-group financing in the strict sense of the standing coverage of this domain, and is treated there rather than folded into this domain to avoid overstating a conflict-finance nexus that the evidence does not establish. Consistent with the honesty-over-coverage principle, this sub-brief is being flagged as limited signal rather than padded with content not supported by the structured findings of this cycle.

Outlook

No forward-looking conflict-finance or extractive-industry development specific to Indiana was identified in this baseline. A subsequent cycle with broader research scope, or a specific Indiana-nexus finding tied to export-control compliance at Indiana-headquartered manufacturers with exposure to the standing Russian sanctions-evasion architecture, would be the most likely route by which this domain regains active signal for this jurisdiction.

Indiana is a documented physical node in the national crypto-ATM scam ecosystem. Bitcoin Depot kiosks installed inside Indiana Circle K convenience stores allow rapid cash-to-crypto conversion, and weak on-site know-your-customer procedures and limited operator screening allow remote scammers to direct victims to deposit cash that is instantly converted to bitcoin and routed to offshore or scammer-controlled wallets beyond the reach of domestic law enforcement; a specific Indiana victim case was documented in Tier 2 investigative reporting and corroborated by a Tier 1 FinCEN typology notice describing the same convertible-virtual-currency-kiosk pattern nationally.

The operator of that kiosk network is now itself under acute financial and regulatory pressure. The Connecticut Department of Banking issued an emergency suspension of the Bitcoin Depot money-transmitter license, citing anti-money-laundering control lapses and fee violations, with a corrected order date of 9 March 2026 that compresses the interval to the subsequent Chapter 11 bankruptcy filing in May 2026 to roughly two months, a substantially tighter causal sequence than an earlier baseline research figure had implied. Bitcoin Depot filed for Chapter 11 protection amid multi-state legal and regulatory pressure, a filing that directly touches the kiosk network operating inside Indiana retail locations and raises an unresolved question of ownership continuity for those kiosks going forward.

This acute, entity-specific pressure sits alongside a nationally advancing regulatory response for the broader digital-asset sector. FinCEN and OFAC have jointly proposed a rule under the GENIUS Act that would treat Permitted Payment Stablecoin Issuers as Bank Secrecy Act financial institutions with anti-money-laundering and counter-financing-of-terrorism program obligations, a forward-looking development that would directly affect any Indiana-touching stablecoin activity and the downstream compliance expectations of firms handling it. Read against the kiosk-network distress documented in this baseline, the domain presents a familiar pattern in digital-asset financial-integrity assessment: acute, node-specific enforcement pressure against a single operator coexists with a slower-moving but structurally more consequential regulatory build-out for the sector as a whole.

The underlying typology is documented at the federal level independent of the fate of any single operator: a FinCEN advisory notice addressing convertible virtual currency kiosks describes the same cash-deposit-to-instant-conversion pattern exploited in the Indiana case, and the associated obligation is classified as a partial control-gap signal, reflecting that screening obligations exist in guidance form but operator-level implementation and enforcement remain uneven across the kiosk-operator sector nationally. This distinguishes the Indiana finding as an instance of a documented, federally recognized typology rather than an isolated or novel scheme, which is itself relevant to how the finding should be weighted: the risk is structural to the crypto-kiosk business model as currently regulated, not specific to a single Indiana location or a single scammer network.

Three-pillar balance is worth stating directly in this domain: the crypto-ATM findings and the Bitcoin Depot enforcement cascade are predominantly AML-classified, consistent with the general pattern of the domain of AML developments outnumbering CTF and CPF findings; no CPF-specific digital-asset development was identified in this Indiana-scoped baseline, a gap that should be read as an absence of evidence rather than an assessment that no CPF-relevant digital-asset risk exists in the jurisdiction.

Outlook

The joint FinCEN-OFAC GENIUS Act stablecoin rule carries an estimated 2026 Q4 impact date on a year-scale uncertainty band, and its finalization would bring Permitted Payment Stablecoin Issuers within BSA program obligations nationally, including for any Indiana-touching activity. The Bitcoin Depot Chapter 11 process itself remains the most immediate open question for this jurisdiction: whether the kiosk network operating inside Indiana Circle K locations continues under new ownership, is wound down, or is acquired by another operator was not resolved in this baseline and would materially change the forward risk profile of the domain depending on the outcome. No confirmed change to the underlying vulnerability that allowed the documented scam pattern, cash deposited at a kiosk following remote telephone instruction and converted instantly to bitcoin routed outside domestic reach, was identified this cycle independent of the financial distress of the operator. Because the FinCEN advisory notice underlying this typology is guidance rather than a binding rule with kiosk-specific transaction limits, the practical effect of the GENIUS Act stablecoin rulemaking and the FinCEN AML and CFT program modernization on kiosk-level controls specifically will depend on how each final rule risk-based standard is applied to crypto-asset operators as a firm type, a question this baseline cannot resolve in advance of finalization.

This cycle clearest D6 signal is a proposed federal rule that would fundamentally reframe how effectiveness is defined for BSA-covered compliance programs. FinCEN proposed rule would require anti-money-laundering and counter-financing-of-terrorism programs to be effective, risk-based, and reasonably designed, with explicit allowance for innovative and technology-based compliance approaches; the public comment period closed 9 June 2026 with finalization still pending. This is a forward-looking horizon item rather than an active enforcement development, and it is assessed as improving the trajectory of the domain precisely because it would reset the compliance baseline for every BSA-covered institution, including Indiana-based institutions, away from prescriptive, tick-box program design and toward outcomes-based, technology-enabled compliance architecture. This finding is held at assessed confidence on Tier 1 sourcing, reflecting that the substance of the proposal is well documented even though its ultimate final form remains open.

Read against the other developments recorded in this baseline, the significance of the proposed rule is structural rather than incremental. The domestic beneficial-ownership exemption recorded in the Beneficial Ownership and Corporate Transparency domain and the crypto-ATM scam-conduit and kiosk-operator distress recorded in the Crypto, Digital Assets, and Financial Innovation domain both describe gaps in the current compliance and transparency architecture; the FinCEN program-modernization proposal is the one development this cycle that speaks directly to how the compliance-technology layer itself is expected to evolve in response to that kind of gap, by permitting institutions greater latitude to design technology-based controls calibrated to the risks a jurisdiction like Indiana actually presents rather than a uniform, prescriptive standard applied identically everywhere.

The joint FinCEN-OFAC GENIUS Act stablecoin rulemaking, while classified in this baseline under the Crypto, Digital Assets, and Financial Innovation domain because of its direct subject matter, also carries a compliance-technology dimension worth noting here: bringing Permitted Payment Stablecoin Issuers within BSA program obligations for the first time will require those issuers to build AML and CFT compliance-technology infrastructure from a comparatively immature baseline, a build-out that will be shaped by whatever risk-based standard the parallel program-modernization rule ultimately establishes. Similarly, the Brinks consent order recorded in the Enabler Jurisdictions domain, while an enforcement action rather than a technology development, establishes a registration and program-design precedent that currency-transport MSBs will need to satisfy using whatever compliance-technology approach the finalized program rule ultimately sanctions.

No Indiana-specific active-defence or compliance-technology deployment, such as a state supervisory technology initiative or a documented Indiana Department of Financial Institutions technology-modernization program, was identified in this baseline; the Indiana-specific content of the domain is therefore limited to how the BSA-covered institutions of the jurisdiction will be affected by a national rulemaking rather than any state-level compliance-technology development of its own.

Outlook

The FinCEN AML and CFT Program Rule modernization carries an estimated 2026 Q4 impact date on a year-scale uncertainty band; its finalized text and effective date are not yet available, and Federal Register publication of the final rule would firm up the forward assessment of this domain considerably. Until finalization, institutions operating in Indiana and nationally continue to operate under the current prescriptive program-design standard, meaning the improving trajectory rating of the domain reflects an anticipated rather than realized shift. The ultimate treatment of technology-based compliance approaches by the rule will also materially shape how stablecoin issuers newly brought within BSA obligations under the GENIUS Act rulemaking, and currency-transport MSBs operating under the Brinks consent-order precedent, are expected to design their compliance programs going forward.