Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

Financial Integrity Monitor

United States — Iowa US-IA

Domains covered
8 of 8
Sources
140
Role actions
8
Horizon <90d
0
Jurisdiction profile
FATF status: Largely Compliant Tier: B Risk direction: Increasing Enablement vs enforcement: Mixed

Iowa AML/CTF oversight is federally anchored: money transmitters/MSBs register with FinCEN and license under Iowa Code ch.

More533C via the Iowa Division of Banking; beneficial ownership transparency runs through the federal Corporate Transparency Act (now largely inoperative for domestic entities). Iowa layered a 2025 crypto-ATM consumer-protection statute atop this framework after aggressive Attorney General litigation against kiosk operators.

Key deficiencies
  • No independent Iowa beneficial-ownership registry; state relies entirely on the now-narrowed federal CTA/BOI regime
  • No dedicated state AML examination cadre for MSBs beyond licensing; supervisory depth depends on federal delegation
  • Crypto-ATM transaction caps enacted 2025 have not stopped elder-fraud volumes rising nationally
  • Limited independent Iowa-specific investigative/NGO coverage outside national outlets referencing Iowa AG actions
Recent developments (18m)
  • Iowa Attorney General sued Bitcoin Depot and CoinFlip (Feb. 26, 2025) alleging the majority of Iowa transactions on their kiosks were scam-related
  • Iowa enacted crypto-ATM consumer protection law (transaction/fee caps) effective summer 2025
  • FinCEN issued national CVC Kiosk Notice FIN-2025-NTC1 (Aug. 4, 2025) citing the Iowa enforcement action as a model
  • Federal CTA/BOI interim final rule (March 26, 2025) exempted domestic reporting companies — including Iowa-formed LLCs/corporations — from beneficial ownership reporting
  • Bitcoin Depot, defendant in the Iowa suit, filed for bankruptcy (May 2026) after multi-state regulatory pressure
  • FinCEN proposed sweeping AML/CFT program reform NPRM (April 2026) affecting all federally regulated Iowa financial institutions

United States federal law that applies in United States – Iowa is covered once, on the United States page. This page covers United States – Iowa’s own layer: its own law, regulators and enforcement.

Brief

Lead signal

Lead Signal

The Iowa Supreme Court has ruled that the state's digital-asset-kiosk consumer-protection statute, Iowa Code §533C.1004, does not apply retroactively. In a decision filed 30 October 2026 in In the Matter of $11,500 Seized from Bitcoin Depot Operating, LLC, the court reversed the district court and remanded the case, holding that the statute cannot reach kiosk transactions or law-enforcement seizures that predate its effective date. The practical effect is an enforcement gap: victims of crypto-ATM fraud whose losses occurred before the statute took force have no recourse under it, regardless of how similar their circumstances are to conduct the statute now squarely covers. This is a structural finding about the architecture of the kiosk-oversight regime, not a one-off adverse ruling: it sets a durable boundary on how far the state's consumer-protection framework for digital-asset kiosks can reach backward in time, and it will shape how prosecutors and plaintiffs frame future kiosk-related claims in the state.

Read full brief

Lead Signal

The Iowa Supreme Court has ruled that the state's digital-asset-kiosk consumer-protection statute, Iowa Code §533C.1004, does not apply retroactively. In a decision filed 30 October 2026 in In the Matter of $11,500 Seized from Bitcoin Depot Operating, LLC, the court reversed the district court and remanded the case, holding that the statute cannot reach kiosk transactions or law-enforcement seizures that predate its effective date. The practical effect is an enforcement gap: victims of crypto-ATM fraud whose losses occurred before the statute took force have no recourse under it, regardless of how similar their circumstances are to conduct the statute now squarely covers. This is a structural finding about the architecture of the kiosk-oversight regime, not a one-off adverse ruling: it sets a durable boundary on how far the state's consumer-protection framework for digital-asset kiosks can reach backward in time, and it will shape how prosecutors and plaintiffs frame future kiosk-related claims in the state.

Alongside the ruling, the Iowa Insurance Division announced on 29 October 2026 that its Fraud Bureau had recovered more than three million dollars in cryptocurrency stolen from an older Iowan in a financial-exploitation scheme. The recovery was achieved through interagency blockchain tracing involving the Fraud Bureau, Ankeny Police, the FBI Virtual Assets Unit, the Polk County Attorney's Office, and a private blockchain-tracing firm. Taken together, the two developments describe a jurisdiction where the formal reach of consumer-protection statute is narrowing at the edges even as operational capacity to trace and claw back stolen digital assets is visibly strengthening.

Other Developments

Elder-fraud recovery via coordinated tracing. The three-million-dollar recovery is notable less for its size than for its demonstration of functioning interagency coordination: a state insurance regulator, municipal police, a federal virtual-assets unit, a county prosecutor and a private tracing firm worked together to intercept funds before they could be moved off-chain. That kind of coordination is the practical answer to the enforcement gap the Supreme Court's retroactivity ruling just created for statute-based claims: where the statute cannot reach backward, active tracing and interagency cooperation can still produce recovery for victims, provided the funds have not already exited traceable rails.

Retroactivity holding narrows, but does not eliminate, kiosk oversight. The Bitcoin Depot matter concerned funds seized before §533C.1004 took effect; the court's holding is specifically about the temporal reach of the statute, not about its substantive validity going forward. Kiosk operators remain subject to the statute's consumer-protection duties for conduct occurring after its effective date. The ruling is best read as a jurisdictional boundary-setting exercise rather than a weakening of the underlying regime.

Cross-Monitor Connections

The interagency recovery operation illustrates a theme with resonance for how compliance technology and active defence are assessed across the wider monitoring estate: public-sector capacity to trace and intercept digital-asset flows before off-ramping is a counterweight to gaps left by statute or jurisdiction. Where a consumer-protection statute cannot reach backward in time, as the Iowa Supreme Court's ruling now makes explicit, the presence or absence of exactly this kind of blockchain-tracing coordination becomes the determining factor in whether a victim sees any recovery at all. The same underlying facts also carry a digital-asset financial-innovation reading: a subnational jurisdiction's kiosk-sector oversight framework is being tested in court on its temporal boundaries at the same time its enforcement agencies are building out tracing capability, a pairing worth watching in other states with similar kiosk-registration statutes.

Outlook

The remand in the Bitcoin Depot matter means further proceedings at the district court level are expected, now bounded by the Supreme Court's holding that §533C.1004 operates only prospectively. Separately, whether the state's gaming regulator has taken any related action remains unconfirmed as at this writing. The more durable signal is the demonstrated interagency tracing capacity: if replicated, it offers a partial operational substitute for the statutory reach that the retroactivity ruling has now foreclosed for pre-enactment conduct, though it depends on funds remaining traceable and intervention occurring before off-ramping completes.

Earlier periodic briefs (4)
25 Oct 2026 · fim-2026-10-25

Lead Signal

Iowa's Attorney General has stepped into a federal asset-forfeiture dispute of unusual scale, leading a thirty-state bipartisan coalition in an amicus brief filed with the United States Supreme Court. The brief seeks the release of roughly 3.5 billion dollars in Treasury-frozen Da Afghanistan Bank funds held since the Taliban's return to power, arguing that the funds should be made available to satisfy judgments held by 9/11 terrorism victims and families. Those judgment-holders have accumulated roughly 17 billion dollars in final judgments entered by federal courts, many after decades of litigation. The coalition's position is that a federal appellate court misread the statute governing how blocked terrorist-party assets may be used to satisfy such judgments. This is not a sanctions designation or an enforcement action in the conventional sense; it is litigation pressure applied directly to the architecture that keeps designated-party assets frozen rather than distributed, and it tests how durable that architecture is when a sympathetic claimant class seeks to unlock it through the courts rather than through the designating authority itself.

The structural significance here lies in the precedent such a ruling could set for the broader blocked-asset regime that underpins sanctions enforcement generally. If the Supreme Court sides with the coalition, the case would establish a judicial pathway for private parties to access state-adjacent frozen assets outside the executive's ordinary sanctions-administration channel, a development state attorneys general evidently view as aligned with victim-compensation policy even as it introduces a new channel of pressure on the asset-blocking system.

Other Developments

A payments-sector acquisition closes the loop on a long-running Iowa fintech story. NMI, a global embedded-payments infrastructure provider, announced its acquisition of Des Moines-headquartered Dwolla, an account-to-account payments provider that had built significant institutional backing since its 2008 founding, including support from Andreessen Horowitz. The deal brings roughly 60 Dwolla employees and more than 400 customer contracts into NMI, lifting the combined entity's processed annual transaction volume to approximately 700 billion dollars. Financial terms were not disclosed. No sanctions or anti-money-laundering dimension has been reported in connection with the transaction; it registers here as a commercial consolidation event in the payments infrastructure space rather than as an integrity finding, but one worth tracking given Dwolla's account-to-account rails and the compliance surface area that scales with combined volume of that size.

Iowa's licensing statute continues to carry its standing sanctions and FATF exclusion test for money-transmission delegates. Iowa Code 533C.804 requires that an authorized delegate under the state's money-transmission licensing framework not be located in a country subject to OFAC sanctions, nor in a jurisdiction the Financial Action Task Force has designated as high-risk or non-cooperative. This is a baseline-descriptive feature of the state licensing gateway through which Iowa money-transmitters and their delegates operate, unchanged, and it remains the structural backstop that ties state-level money-transmission activity back into the federal sanctions and FATF-list architecture.

Cross-Monitor Connections

The frozen Taliban-asset litigation sits adjacent to payment-system and correspondent-banking considerations that a global payments monitor would track closely: any judicial reallocation of blocked central-bank-adjacent assets touches the plumbing through which blocked funds are held and could eventually be disbursed. The Dwolla acquisition is a commercial event with equally direct relevance to payments-industry structure and market-consolidation tracking, given Dwolla's account-to-account infrastructure and its absorption into a larger embedded-payments platform. Neither development carries a digital-asset or crypto dimension, and neither touches conflict-finance or beneficial-ownership architecture directly, but the amicus brief in particular is the kind of litigation-driven development that a legal and regulatory tracker focused on payment systems would want to watch for downstream effects on how blocked assets are eventually treated.

Outlook

The Supreme Court's eventual disposition of the Taliban-asset amicus effort is the item to watch going forward: a ruling favoring the coalition would mark a genuinely novel inroad into the asset-blocking architecture that sanctions regimes depend upon, while a ruling preserving the status quo would reaffirm that blocked assets remain under executive-branch control absent explicit statutory authorization for judgment-creditor access. On the commercial side, the Dwolla integration into NMI is likely to proceed as a routine post-acquisition consolidation; watch for any subsequent regulatory touchpoints as combined transaction volumes scale, though none have surfaced to date. No new sanctions, beneficial-ownership, enabler-jurisdiction, conflict-finance, crypto-integrity, compliance-technology or AML/CTF-regime developments specific to Iowa were identified beyond the baseline-descriptive licensing provision already noted.

28 Sep 2026 · fim-2026-09-28

Lead Signal

Iowa's digital-financial-asset-kiosk statute, Iowa Code section 533C.1004, remains in force with its wallet-verification and fee-cap provisions active, but the architecture behind how violations are punished is now under legislative reconsideration. A study bill, SSB3086, would strike the statute's bespoke $10,000-per-violation civil penalty and instead treat a violation as an unlawful practice under Iowa's general consumer-fraud statute, section 714.16, exposing violators of an Attorney General-obtained injunction to penalties of up to $100,000. This is a jurisdiction-bound, subnational dispatch: it speaks to Iowa's own kiosk-consumer-protection and money-transmission perimeter, not to any global sanctions or beneficial-ownership development.

Other Developments

Kiosk operators confirmed as money transmitters. Guidance from the Iowa Division of Banking states plainly that virtual-currency kiosk operators are money transmitters under section 533C.301(1) and section 533C.102(19) and (28), absent an enumerated exemption. This closes any ambiguity about whether kiosk operators sit inside Iowa's existing Chapter 533C licensing perimeter, and it does so through the same general money-transmitter regime that governs the state's broader payments sector rather than through a bespoke digital-asset licence.

Standing AML baseline unchanged. Iowa has no dedicated state-level AML or counter-terrorist-financing statute distinct from the federal Bank Secrecy Act and FinCEN framework. AML exposure for money-transmitter licensees, including kiosk operators, runs through the general Chapter 533C regime, administered by the Iowa Division of Banking, which requires licensees to operate a BSA/AML compliance programme. This baseline did not change this cycle and is carried forward as standing context.

Cross-Monitor Connections

The kiosk-statute wallet-verification duty functions as a customer-due-diligence-equivalent control even though it is codified inside a consumer-protection provision rather than an AML statute proper, and the pending SSB3086 enforcement recast is directly relevant to how payments and crypto-monitor colleagues price compliance risk for the same underlying regulated entities. The money-transmitter classification confirmed by the Division of Banking guidance sits at the intersection of payments licensing and digital-asset oversight, meaning any development here has a natural read-across to both the payments monitor's licensing perimeter and the crypto monitor's consumer-protection tracking of the same statute.

Outlook

SSB3086's disposition is the item to watch, with an estimated but highly uncertain 2027 Q1 horizon for any resolution. If enacted, the shift from a fixed civil-penalty schedule to an open-ended injunctive-relief framework under the general consumer-fraud statute would raise the ceiling on enforcement exposure for kiosk-law violations without changing the underlying wallet-verification or fee-cap obligations themselves. Primary bill text for SSB3086 has not yet been independently retrieved, and confirmation of its progress through the Iowa General Assembly remains an open item for the next dispatch.

14 Sep 2026 · fim-2026-09-14

Lead Signal

The defining architectural shift this cycle is FinCEN's final rule, effective 14 August 2026, permanently exempting US-formed companies and US persons from Corporate Transparency Act beneficial-ownership reporting, leaving only foreign reporting companies within scope. The underlying statute, 31 U.S.C. Section 5336, is not repealed; only the implementing regulation has been narrowed. This is a structural enablement development, not an enforcement one: the primary federal tool for unwinding opaque domestic shell-company structures has been substantially curtailed at the regulatory layer, even though the statutory authority to reinstate broader reporting remains intact. For Iowa specifically, this narrowing is the entire beneficial-ownership picture, since no Iowa-specific beneficial-ownership statute or registry exists; the state's transparency exposure is set wholly by the now-narrowed federal layer.

Other Developments

Cambodia's grey-list warning and the Prince Group aftermath. The National Bank of Cambodia's governor has publicly warned that Cambodia risks a third FATF grey-listing absent sustained action against casino- and scam-centre-linked money laundering, a probable finding corroborated by two independent Tier 3 sources though not yet confirmed by a Tier 1 or Tier 2 FATF document. This warning follows the arrest and extradition to China of Prince Group chairman Chen Zhi, with Prince Bank and related real-estate entities forced into liquidation after joint US-UK sanctions action against the Prince Group network. The enforcement-plus-sanctions convergence in this case is a comparatively rare pattern worth tracking as a structural signal of how enabler-jurisdiction pressure can translate into concrete asset unwinding.

FATF grey-list composition change. At the June 2026 Plenary, Iraq and Bosnia and Herzegovina were added to the FATF list of jurisdictions under increased monitoring, while Algeria and Namibia were removed, bringing the total under increased monitoring to twenty-two. The blacklist of Iran, North Korea, and Myanmar is unchanged. This is a confirmed, Tier 1 sourced list-composition transition typical of routine plenary cycles.

OCC preemption ruling on Iowa's money-transmitter licensing. An OCC interpretive letter dated 12 May 2026 held that the National Bank Act preempts Iowa's money-transmitter licensing requirement, and OCC's exclusive visitorial authority, as applied to Fidelity Digital Assets, N.A., a national trust bank offering crypto-custody services. This is a probable but Tier 1 sourced finding with material precedent implications for state-level AML and licensing leverage over bank-chartered crypto custodians nationally, since a state's ability to compel licensing and inspection of such institutions is now constrained by federal preemption doctrine at the point where a national trust charter is involved.

OFAC Iran-related designation and wind-down licence. OFAC designated additional Turkiye-based entities under its Iran sanctions program on 4 September 2026 and issued Iran General License CC, authorising wind-down of transactions involving certain blocked persons. This is a confirmed, routine designation-plus-wind-down-licence action consistent with standing sanctions-administration practice.

Cross-Monitor Connections

The OCC preemption ruling sits directly at the intersection of financial-integrity and payments-monitor concerns: a ruling that curtails a state's licensing reach over a bank-chartered crypto custodian has implications for how AML and licensing supervision of digital-asset infrastructure is distributed between federal and state authorities going forward, a question equally relevant to conduct-and-market-access monitoring. The Cambodia development connects to conflict-adjacent enforcement themes insofar as the Prince Group network's liquidation follows joint sanctions action, illustrating how sanctions architecture and enabler-jurisdiction AML failure can converge into a single enforcement event. The federal BOI narrowing is a structural enablement signal with no direct sanctions or conflict-finance nexus this cycle, but it bears watching for whether it increases reliance on state-level or private due-diligence tools to fill the transparency gap it leaves behind.

Outlook

Watch for whether FinCEN issues any follow-on guidance addressing the gap left by the domestic BOI exemption, and whether a Tier 1 FATF document confirms or forecloses the Cambodia re-listing risk that is currently only a central-bank-level warning. The OCC preemption precedent for Fidelity Digital Assets warrants continued tracking for whether other states attempt to reassert money-transmitter licensing jurisdiction over nationally chartered crypto-custody banks, and whether the reasoning is extended or narrowed in subsequent OCC interpretive letters.

14 Jul 2026 · fim-2026-07-14

Lead Signal

Iowa this cycle presents a structural paradox that the financial-integrity architecture-over-incident principle is built to surface: the same jurisdiction that produced a nationally cited enforcement model against crypto-ATM operators is simultaneously absorbing a federal beneficial-ownership rollback that widens corporate opacity for every Iowa-formed entity. The Iowa Attorney General announced consumer-fraud actions against Bitcoin Depot and CoinFlip on 26 February 2025, alleging that the majority of examined Iowa kiosk transactions were scam-related, and FinCEN cited these actions in its August 2025 national CVC Kiosk Notice as a template for red-flag supervisory expectations. Yet the enforcement architecture that made Iowa a reference point is already narrowing: Bitcoin Depot, the largest named defendant and formerly the largest North American kiosk operator, filed for Chapter 11 bankruptcy on 18 May 2026 and took its network of more than 9,000 kiosks offline, contracting Iowa-specific exposure even as the underlying elder-fraud typology persists nationally through remaining operators such as CoinFlip.

Running in parallel, and analytically the more consequential of the two developments, is the 26 March 2025 interim final rule that exempted all United States-formed entities, including Iowa LLCs and corporations, from FinCEN beneficial-ownership information reporting. Only foreign entities registering to do business in Iowa remain in scope. This is a structural reversal of gains credited to the 2021 Corporate Transparency Act, compounding gaps in timely beneficial-ownership access that the Financial Action Task Force had already flagged in its seventh Enhanced Follow-up Report of March 2024. A parallel and newly documented exposure vector, the DPRK IT-worker fraudulent-employment scheme, generated nearly 800 million dollars in 2024 through remote employment obtained under stolen identities, with nationwide targeting that plausibly reaches Iowa-based employers of contracted remote information-technology labour.

Other Developments

Federal beneficial-ownership retreat compounds a standing FATF finding. The exemption of domestic reporting companies from FinCEN reporting obligations directly undercuts the remediation the Financial Action Task Force had credited toward closing serious gaps in timely beneficial-ownership access under Recommendations 24 and 25, a trajectory the eighth Enhanced Follow-up Report, anticipated around 2027, will re-examine.

Farmland ownership opacity draws USDA and CFIUS attention. The United States Department of Agriculture is partnering with the Committee on Foreign Investment in the United States and state lawmakers to close gaps that allow entities linked to countries of concern to acquire American farmland through layered corporate ownership, an exposure amplified in Iowa dense agricultural land market by the same beneficial-ownership rollback described above.

AML program reform proposed even as an adviser rule is delayed. FinCEN issued an April 2026 Notice of Proposed Rulemaking that would require board approval, a risk-based four-pillar program framework, and a United States-based AML/CFT Officer for all federally regulated institutions, including those operating in Iowa, with the comment period closed 9 June 2026 and a final rule pending. At the same time, FinCEN postponed the effective date of the Investment Adviser AML Rule from 1 January 2026 to 1 January 2028, delaying a planned control uplift for registered investment advisers operating in or from Iowa.

A transaction cap addresses symptom, not architecture. Iowa own crypto-ATM consumer-protection statute, effective summer 2025 and cited by FinCEN as a national model, caps kiosk transaction and fee amounts, yet national fraud-complaint and loss data continued rising sharply afterward, indicating that point-of-transaction caps alone do not substitute for upstream AML and know-your-customer controls at kiosk operators and their liquidity providers.

State examination capacity remains structurally thin. Iowa money-services businesses register with FinCEN and license under Iowa Code chapter 533C through the Iowa Division of Banking, but the state maintains no dedicated AML examination cadre beyond registration and licensing, leaving supervisory depth dependent on federal delegation relative to the scale of money-services-business and crypto-ATM activity in the state.

Sanctions architecture shows both divergence and convergence. United States courts forced OFAC to delist the Tornado Cash mixing protocol in March 2025 after ruling that OFAC lacked authority to sanction an immutable smart contract, a judicial constraint not mirrored in European Union or United Kingdom frameworks. By contrast, the October 2025 designation of the Prince Group Transnational Criminal Organization and 146 associated targets, including Chen Zhi, was coordinated jointly by OFAC, FinCEN, and the United Kingdom Foreign, Commonwealth and Development Office, with OFSI concurrently sanctioning the related Byex Exchange, an unusually convergent instance against the more typical pattern of transatlantic sanctions-regime divergence.

A standing coordination channel persists. A Memorandum of Understanding between OFAC and the State of Iowa, likely operating through the Iowa Insurance Division, establishes a formal state-federal sanctions-coordination instrument, though no Iowa-specific dark-fleet, shadow-banking, or export-diversion enforcement action was identified in the eighteen-month research window.

Cross-Monitor Connections

The DPRK IT-worker fraudulent-employment scheme carries direct routing relevance beyond this monitor. Its state-directed character, in which North Korean operatives use stolen identities and United States-based laptop-farm facilitators to obtain remote employment before funnelling wages through overseas crypto over-the-counter facilitators back to weapons programs, is a proliferation-financing data point relevant to macro-level sanctions-effectiveness tracking, and separately constitutes a state-directed illicit-finance network relevant to monitoring of state-capture architecture. Both connections are logged this cycle at medium confidence pending fuller corroboration of the Iowa-specific employer nexus.

Outlook

Three forward-looking instruments will shape the next several cycles of Iowa exposure. The FinCEN AML/CFT Program Reform Notice of Proposed Rulemaking, with an estimated 2027 impact date, would reorganise program governance around board approval and a four-pillar risk-based structure for all federally regulated institutions operating in Iowa. The Investment Adviser AML Rule, now pushed to a 1 January 2028 effective date, leaves a two-year gap in dedicated federal AML program obligations for registered investment advisers. And the outcome of the Iowa Attorney General litigation against CoinFlip and Bitcoin Depot, expected around 2027, will help settle whether state Attorney General authority over crypto-ATM operator liability becomes a durable precedent, notwithstanding that the Bitcoin Depot bankruptcy has already partially mooted claims against that specific defendant. None of these are certainties; each remains at consultation, in-force-pending, or litigation stage respectively, and the underlying elder-fraud and beneficial-ownership-opacity typologies are structural enough that they are likely to persist regardless of how any single instrument resolves.

Domain intelligence (D1–D8)

D1 Sanctions

no_changestanding position

Sanctions

Iowa's Attorney General, Brenna Bird, has led a thirty-state bipartisan coalition in filing an amicus brief with the United States Supreme Court, seeking the release of roughly 3.5 billion dollars in Treasury-frozen Da Afghanistan Bank funds to 9/11 terrorism judgment-holders. Those judgment-holders carry roughly 17 billion dollars in final judgments entered by federal courts, many after decades of litigation, and the coalition's position is that the Second Circuit misread the statute governing how blocked terrorist-party assets may be used to satisfy such judgments. The underlying funds are central-bank assets of the former Afghan state, frozen under Treasury's asset-blocking authority following the Taliban's return to power, and their disposition sits at the intersection of sanctions architecture, state-asset immunity doctrine, and private judgment-enforcement rights.

Continue reading

The analytical significance of this development is structural rather than incident-driven. It is not a new sanctions designation, nor is it an enforcement action against a regulated entity; it is a coordinated, multi-state effort to use the courts to unlock funds that an executive-branch blocking order currently holds frozen. This represents a genuinely novel pressure point on the asset-blocking architecture underlying the US sanctions regime: rather than contesting a designation or seeking its removal, the coalition is contesting how already-blocked assets may be distributed to private claimants once the designation has achieved its blocking purpose. A ruling in the coalition's favor would establish a judicial pathway for judgment-creditors to reach state-adjacent blocked assets that does not depend on the executive branch's own sanctions-administration discretion, a shift with implications well beyond the immediate Afghan central-bank funds at issue.

Separately, Iowa's money-transmission licensing statute continues to carry its own sanctions-architecture dimension: a licensed money-transmitter's authorized delegates must not be located in a country subject to OFAC sanctions, nor in a jurisdiction the Financial Action Task Force has designated as high-risk or non-cooperative, under Iowa Code 533C.804. This is unchanged baseline architecture rather than a new development, but it illustrates how Iowa's state-level licensing gateway incorporates and depends upon the federal sanctions list and the FATF high-risk/non-cooperative designations as a structural precondition for authorized-delegate eligibility, reinforcing how deeply federal sanctions architecture is embedded even in state-level commercial licensing frameworks that otherwise have nothing to do with foreign-policy enforcement.

No FATF call-for-action or grey-list development, no EU high-risk-third-country listing change, and no new comprehensive or sectoral sanctions action touching Iowa-based entities were identified this cycle. The amicus filing is litigation activity rather than a rule change or designation, and it should be read as such: an attempt to reshape how existing blocked-asset law is applied, not evidence of a new or altered sanctions program.

Outlook

The matter now rests with the Supreme Court's decision on whether to grant review and, if so, how it resolves the underlying statutory question. As scheduled, the case's trajectory will depend on the Court's own calendar, and no firm date for a cert decision or ruling has been reported. A ruling favoring the coalition would be a genuinely significant structural development, opening a judicial channel for private access to blocked state-adjacent assets that sits outside ordinary sanctions administration; a ruling preserving the status quo would reaffirm that disposition of blocked assets remains an executive-branch prerogative absent explicit statutory authorization. Either outcome would have implications reaching well beyond the roughly 3.5 billion dollars in Afghan central-bank funds immediately at issue, given how directly the question bears on the durability of the broader asset-blocking framework that underpins the US sanctions regime. In the interim, Iowa's statutory sanctions and FATF exclusion test for money-transmission delegates remains in force unchanged and continues to function as the state-level enforcement mechanism tying licensed payment activity back into the federal sanctions and FATF-list architecture.

Cumulative analysis

Sanctions Architecture and Evasion — Cumulative Analysis

This is the first interpretation cycle in which Iowa sanctions-architecture exposure has been documented in this record, and the baseline established here centres on two structurally distinct findings that together describe a jurisdiction positioned as a jurisdiction of exposure rather than a jurisdiction of active enforcement or enablement. The first and more consequential finding is the OFAC designation of six individuals and two entities, including a DPRK IT-management company, for facilitating a fraudulent remote-employment scheme that generated nearly 800 million dollars in 2024 for DPRK weapons programs. North Korean operatives, using stolen identities and United States-based laptop-farm facilitators, obtained remote information-technology employment with American companies nationwide, a targeting pattern broad enough to plausibly reach Iowa-based employers of contracted remote labour, though no Iowa-specific case has yet been confirmed. Wages obtained through this scheme are converted through overseas crypto over-the-counter facilitators in China, Vietnam, Laos, and the United Arab Emirates, evading sanctions while exposing host companies to malware and intellectual-property theft as a secondary harm.

The second finding, structural rather than episodic, is the standing Memorandum of Understanding between OFAC and the State of Iowa, likely administered through the Iowa Insurance Division, which establishes a formal state-federal sanctions-coordination channel. Notably, across the eighteen-month research window underlying this baseline, no Iowa-specific dark-fleet, shadow-banking, or export-diversion enforcement action has been identified despite this coordination instrument being in place. Read together, this describes a jurisdiction that inherits full federal sanctions obligations and participates in institutional coordination infrastructure, but whose substantive sanctions-relevant development this cycle arrived through a national OFAC action rather than Iowa-originated casework.

The analytical significance of this baseline lies in what it establishes about the limits of current evidence rather than in any confirmed Iowa-specific enforcement pattern. The DPRK IT-worker exposure is carried at Possible confidence specifically because the Iowa employer nexus is inferential, extrapolated from nationwide targeting rather than direct evidence, and this caveat should persist across future cycles until either a confirmed Iowa case emerges or the inference is formally downgraded. Similarly, the absence of enforcement activity through the OFAC-Iowa coordination channel should be tracked as a standing enablement-as-signal data point: either a genuine absence of qualifying Iowa-specific sanctions-evasion activity, or an unresolved capacity question about how effectively the coordination instrument translates into active investigative work at the state level.

Going forward, this domain baseline should be read alongside the crypto-assets domain finding on Prince Group and Tornado Cash, since both illustrate the same underlying federal sanctions-architecture within which any future Iowa-specific development would sit; the coordinated OFAC-FinCEN-OFSI action against Prince Group demonstrates that transatlantic convergence is achievable in specific cases, even against the backdrop of the judicial constraint that forced the Tornado Cash delisting. As subsequent cycles accumulate, the priority tracking items for this domain are: whether the DPRK IT-worker scheme produces a confirmed Iowa employer case; whether the OFAC-Iowa MOU produces any documented casework; and whether any Iowa-specific export-control or shadow-banking enforcement action emerges that would shift the domain trajectory from its current worsening-on-exposure, stable-on-enforcement mixed posture.

domain_sub_briefs · D1 · Cumulative analysis
Standing baseline position

Iowa Attorney General Brenna Bird led a 30-state bipartisan amicus brief (filed/announced 2026-10-05) asking the US Supreme Court to permit 9/11 terrorism judgment-holders (collectively holding ~$17bn in federal judgments) to reach $3.5bn in Treasury-frozen Da Afghanistan Bank/Taliban-controlled funds, contesting a Second Circuit statutory interpretation.

Periodic updates (2)
25 Oct 2026 · fim-2026-10-25

Sanctions

Iowa's Attorney General, Brenna Bird, has led a thirty-state bipartisan coalition in filing an amicus brief with the United States Supreme Court, seeking the release of roughly 3.5 billion dollars in Treasury-frozen Da Afghanistan Bank funds to 9/11 terrorism judgment-holders. Those judgment-holders carry roughly 17 billion dollars in final judgments entered by federal courts, many after decades of litigation, and the coalition's position is that the Second Circuit misread the statute governing how blocked terrorist-party assets may be used to satisfy such judgments. The underlying funds are central-bank assets of the former Afghan state, frozen under Treasury's asset-blocking authority following the Taliban's return to power, and their disposition sits at the intersection of sanctions architecture, state-asset immunity doctrine, and private judgment-enforcement rights.

The analytical significance of this development is structural rather than incident-driven. It is not a new sanctions designation, nor is it an enforcement action against a regulated entity; it is a coordinated, multi-state effort to use the courts to unlock funds that an executive-branch blocking order currently holds frozen. This represents a genuinely novel pressure point on the asset-blocking architecture underlying the US sanctions regime: rather than contesting a designation or seeking its removal, the coalition is contesting how already-blocked assets may be distributed to private claimants once the designation has achieved its blocking purpose. A ruling in the coalition's favor would establish a judicial pathway for judgment-creditors to reach state-adjacent blocked assets that does not depend on the executive branch's own sanctions-administration discretion, a shift with implications well beyond the immediate Afghan central-bank funds at issue.

Separately, Iowa's money-transmission licensing statute continues to carry its own sanctions-architecture dimension: a licensed money-transmitter's authorized delegates must not be located in a country subject to OFAC sanctions, nor in a jurisdiction the Financial Action Task Force has designated as high-risk or non-cooperative, under Iowa Code 533C.804. This is unchanged baseline architecture rather than a new development, but it illustrates how Iowa's state-level licensing gateway incorporates and depends upon the federal sanctions list and the FATF high-risk/non-cooperative designations as a structural precondition for authorized-delegate eligibility, reinforcing how deeply federal sanctions architecture is embedded even in state-level commercial licensing frameworks that otherwise have nothing to do with foreign-policy enforcement.

No FATF call-for-action or grey-list development, no EU high-risk-third-country listing change, and no new comprehensive or sectoral sanctions action touching Iowa-based entities were identified. The amicus filing is litigation activity rather than a rule change or designation, and it should be read as such: an attempt to reshape how existing blocked-asset law is applied, not evidence of a new or altered sanctions program.

Outlook

The matter now rests with the Supreme Court's decision on whether to grant review and, if so, how it resolves the underlying statutory question. As scheduled, the case's trajectory will depend on the Court's own calendar, and no firm date for a cert decision or ruling has been reported. A ruling favoring the coalition would be a genuinely significant structural development, opening a judicial channel for private access to blocked state-adjacent assets that sits outside ordinary sanctions administration; a ruling preserving the status quo would reaffirm that disposition of blocked assets remains an executive-branch prerogative absent explicit statutory authorization. Either outcome would have implications reaching well beyond the roughly 3.5 billion dollars in Afghan central-bank funds immediately at issue, given how directly the question bears on the durability of the broader asset-blocking framework that underpins the US sanctions regime. In the interim, Iowa's statutory sanctions and FATF exclusion test for money-transmission delegates remains in force unchanged and continues to function as the state-level enforcement mechanism tying licensed payment activity back into the federal sanctions and FATF-list architecture.

14 Jul 2026 · fim-2026-07-14

Sanctions Architecture and Evasion

Iowa entry into the sanctions-architecture domain this cycle is defined less by direct enforcement action than by exposure inference. OFAC designated six individuals and two entities, including a DPRK IT-management company, along with 21 crypto addresses, for facilitating a fraudulent remote-employment scheme that generated nearly 800 million dollars in 2024 for weapons programs. The scheme relies on stolen identities and United States-based laptop-farm facilitators to obtain remote information-technology employment with American companies nationwide. Iowa exposure is inferred from this nationwide targeting pattern rather than confirmed through an Iowa-specific case, and the finding should be read as a plausible but unconfirmed proliferation-financing vector for Iowa-based employers of contracted remote labour, consistent with the Possible-confidence framing applied to the jurisdiction-specific dimension of this scheme.

Structurally, this is a proliferation-financing exposure vector layered onto an ordinary corporate-employment relationship: an Iowa firm engaging remote IT contractors has no obvious reason to suspect a sanctions nexus, which is precisely the architecture-over-incident lesson. The wages obtained through this fraudulent employment are converted through overseas crypto over-the-counter facilitators based in China, Vietnam, Laos, and the United Arab Emirates before returning to fund DPRK weapons programs, evading sanctions while exposing host companies to malware and intellectual-property theft as a secondary harm. Multiple independent sources, including the OFAC primary designation together with commercial blockchain-forensics and financial-press corroboration, support this finding at High confidence for the scheme itself, even where the Iowa-specific employer nexus remains only assessed as plausible.

Standing alongside this newly documented exposure is the Memorandum of Understanding between OFAC and the State of Iowa, a formal state-federal sanctions-coordination instrument likely administered through the Iowa Insurance Division. This is a structural rather than episodic finding: it establishes an institutional channel for coordination but has not, in the eighteen-month research window, produced any Iowa-specific dark-fleet, shadow-banking, or export-diversion enforcement action. The absence of enforcement activity through an existing coordination channel is itself an analytically relevant data point under the enablement-as-signal principle, indicating either a genuine absence of qualifying activity in Iowa or a capacity gap in translating the coordination instrument into active casework, a distinction the current evidence base cannot resolve.

Seen together, these two findings describe a sanctions-architecture posture for Iowa that is more passive-exposure than active-enforcement in character. Iowa participates in the national sanctions-compliance infrastructure through the OFAC coordination channel and inherits the same federal sanctions obligations as any other United States jurisdiction, but the substantive development this cycle, the DPRK IT-worker designation, arrived through a national OFAC action rather than an Iowa-originated case. This positions Iowa as a target jurisdiction in the sanctions-evasion architecture rather than an enabler or an active enforcer, a role classification that should inform how remote-employment screening obligations are prioritised for Iowa-domiciled employers going forward.

Outlook

The near-term trajectory for this domain depends substantially on whether further OFAC designations or Treasury guidance specify Iowa-based employer instances within the DPRK IT-worker scheme, which would upgrade the current Possible-confidence jurisdictional inference to a confirmed exposure. Absent that, the domain is likely to remain structurally stable: the OFAC-Iowa coordination channel persists as an institutional fact, but no near-term regulatory horizon item specific to Iowa sanctions enforcement was identified this cycle. The broader federal sanctions-architecture picture, including the judicial constraint on DeFi-protocol designations and the coordinated Prince Group action logged under the crypto-assets domain, will continue to shape the environment in which any future Iowa-specific sanctions exposure would be assessed.

D2 Beneficial Ownership

no_changestanding position

Beneficial Ownership and Corporate Transparency

For Iowa, a United States state rather than a European Union or European Economic Area jurisdiction, the directly relevant beneficial-ownership development this cycle is domestic and federal in origin: the 26 March 2025 interim final rule that exempted all United States-formed entities, including Iowa LLCs and corporations, from FinCEN beneficial-ownership information reporting obligations under the Corporate Transparency Act framework. Only foreign entities registering to do business in Iowa remain within scope. This is a structural rather than episodic finding under the architecture-over-incident principle: it restores a beneficial-ownership opacity gap in Iowa-formed vehicles that can be layered into shell or nominee ownership chains, reversing gains the 2021 Corporate Transparency Act had been credited with delivering.

Continue reading

A second, related exposure compounds this gap in an Iowa-specific sector. The United States Department of Agriculture is partnering with the Committee on Foreign Investment in the United States and state lawmakers to close gaps allowing entities linked to countries of concern to acquire United States farmland through layered corporate ownership. Iowa dense agricultural land market and limited state-level foreign-ownership disclosure regime create an exposure that the federal beneficial-ownership rollback directly amplifies, since the domestic entities used to structure such acquisitions are now themselves outside FinCEN reporting scope. This second finding is carried at Assessed rather than High confidence, reflecting single-source Bloomberg reporting without independent corroboration in the current evidence base.

Globally, the European Union AML Package sets the structural direction against which beneficial-ownership regimes elsewhere are increasingly measured, and it is worth stating as durable backdrop even though Iowa sits outside its direct perimeter. The package comprises three distinct instruments: the AML Regulation, or AMLR (Regulation (EU) 2024/1624), which is directly applicable across Member States without national transposition; the sixth AML Directive, or 6AMLD, which each Member State transposes into domestic law; and the AMLA Regulation (Regulation (EU) 2024/1620), which establishes the Anti-Money Laundering Authority. AMLA supervision shifts the European architecture from a purely national model toward a hybrid regime in which AMLA will directly supervise a defined population of high-risk cross-border obliged entities while indirectly overseeing the remainder through coordination with national supervisors. Iowa is a United States state, not an EEA Member State, so 6AMLD transposition tracking and AMLA direct-supervision selection do not apply to this jurisdiction; the comparison is offered as backdrop against which the divergent trajectory of the United States beneficial-ownership regime, contracting even as the EU regime consolidates supervisory reach, can be read.

The Financial Action Task Force seventh Enhanced Follow-up Report, published in March 2024, had already identified serious gaps in timely beneficial-ownership access for the United States under Recommendations 24 and 25. The March 2025 rollback removes a remediation step FATF had credited toward closing those gaps, meaning the eighth Enhanced Follow-up Report, anticipated around 2027, will need to assess a beneficial-ownership environment that has moved backward rather than forward since the last review, specifically for Iowa-formed entities among all United States-formed entities nationwide.

Outlook

The defining question for this domain over coming cycles is whether Iowa, or any United States state, moves to establish an independent state-level beneficial-ownership disclosure mechanism to partially offset the federal rollback, a development not indicated in any regulatory horizon item identified this cycle. Absent such a state-level response, the structural opacity gap for Iowa-formed entities is likely to persist until the federal rule is revisited, and the farmland-ownership exposure compounding it will remain dependent on USDA-CFIUS coordination outcomes not yet resolved. The FATF eighth Enhanced Follow-up Report, expected around 2027, is the most concrete forward marker against which this trajectory will next be formally assessed.

Cumulative analysis

Beneficial Ownership and Corporate Transparency — Cumulative Analysis

This baseline establishes Iowa position in the beneficial-ownership and corporate-transparency domain as one of the more clearly worsening structural trajectories in the current record, anchored in a federal rule change with direct and immediate effect on every Iowa-formed entity. The 26 March 2025 interim final rule exempted all United States-formed domestic reporting companies, including Iowa LLCs and corporations, from FinCEN beneficial-ownership information reporting requirements under the Corporate Transparency Act, leaving only foreign entities registering to do business in Iowa within scope. This reverses transparency gains the 2021 Corporate Transparency Act had been credited with delivering and restores a structural opacity gap into which shell or nominee ownership chains can be layered without federal visibility.

A second and Iowa-specific exposure compounds this federal gap: USDA, working with CFIUS and state lawmakers, is attempting to close routes by which entities linked to countries of concern acquire United States farmland through layered corporate ownership, an exposure this baseline treats as Assessed confidence given single-source reporting, but one made structurally more difficult to close precisely because the domestic corporate vehicles used in such transactions are now outside FinCEN beneficial-ownership reporting scope. Iowa dense agricultural land market makes this a jurisdiction of particular relevance for any future farmland-ownership transparency initiative.

As standing context against which this Iowa-specific trajectory should be read, the European Union AML Package continues to establish the global direction of beneficial-ownership regulatory travel, even though it has no direct jurisdictional bearing on Iowa. The package rests on three distinct instruments: the directly applicable AML Regulation (Regulation (EU) 2024/1624); the sixth AML Directive requiring Member State transposition; and the AMLA Regulation (Regulation (EU) 2024/1620) establishing the Anti-Money Laundering Authority, which is progressively shifting European supervision from a purely national model toward a hybrid regime combining direct AMLA supervision of high-risk cross-border obliged entities with indirect oversight of the remainder. The contrast between a European architecture consolidating supervisory reach and a United States architecture contracting beneficial-ownership visibility for domestic entities is the central structural juxtaposition this domain baseline establishes, and it is a contrast likely to persist across future cycles absent a reversal of either trajectory.

The Financial Action Task Force seventh Enhanced Follow-up Report of March 2024 had flagged serious gaps in timely beneficial-ownership access for the United States under Recommendations 24 and 25; the March 2025 rollback removes a remediation step credited toward closing those gaps. This means the anticipated eighth Enhanced Follow-up Report, expected around 2027, becomes the key forward marker for this domain: it will need to assess a United States beneficial-ownership environment, and by extension an Iowa beneficial-ownership environment, that has moved backward since the prior review rather than forward. Future cycles should track whether any state-level beneficial-ownership disclosure mechanism emerges to partially offset the federal contraction, whether the USDA-CFIUS farmland initiative produces concrete Iowa-relevant outcomes, and whether the eighth FATF Enhanced Follow-up Report formally documents the regression this baseline has identified.

domain_sub_briefs · D2 · Cumulative analysis
Standing baseline position

US federal BOI registry narrowed to foreign reporting companies only, effective 2026-08-14; domestic entities exempt.

Periodic updates (1)
14 Sep 2026 · fim-2026-09-14

Beneficial Ownership and Corporate Transparency

The EU AML Package stands as a structural global backdrop against which beneficial-ownership developments are read, but it is not the primary subject matter for Iowa, a non-EEA jurisdiction. Globally, the package comprises three distinct instruments: the AML Regulation, or AMLR, Regulation (EU) 2024/1624, which is directly applicable across Member States without national transposition; the sixth AML Directive, or 6AMLD, which requires transposition per Member State; and the AMLA Regulation, Regulation (EU) 2024/1620, which establishes the Anti-Money Laundering Authority and shifts supervision from purely national authorities toward a hybrid EU-level regime through a direct and indirect-supervision perimeter. This standing architecture continues to reshape EU beneficial-ownership supervision structurally, but it has no direct application to a US state jurisdiction. No AMLA horizon anchors specific to this cycle were carried in the interpreter's regulatory_horizon for this development; the architecture is stated from standing context, and this sub-brief is flagged for limited signal on that specific point.

For Iowa and the United States, the directly relevant development this cycle is domestic: FinCEN's final rule, effective 14 August 2026, permanently exempts US-formed companies and US persons from Corporate Transparency Act beneficial-ownership reporting, leaving only foreign reporting companies within scope. The underlying statute, 31 U.S.C. Section 5336, remains on the books; only the implementing regulation has been narrowed by the final rule. This is a confirmed, Tier 1 sourced structural change that removes the principal federal tool available for surfacing the beneficial owners of domestically formed corporate structures, a category that includes the overwhelming majority of shell-company vehicles used in layering and concealment typologies.

Iowa itself carries no state-specific beneficial-ownership statute or registry. This is a probable finding drawn from the absence of any state-layer instrument identified against the federal action, meaning Iowa-incorporated entities' beneficial-ownership transparency exposure is now set entirely by the narrowed federal layer with no state-level backstop. This is a meaningful structural gap: an entity incorporated in Iowa for domestic purposes now faces no beneficial-ownership disclosure obligation at either the state or federal level, whereas a foreign reporting company operating through Iowa remains within the federal CTA's narrowed but still-active foreign-entity scope.

The practical effect is a widening of the enablement gap for domestic shell structures precisely at the state level where no substitute transparency mechanism exists. Investigators, financial institutions conducting customer due diligence, and law enforcement pursuing beneficial-ownership leads for Iowa-formed entities can no longer rely on the FinCEN BOI registry as a source for that information, and must fall back on state incorporation records, which in Iowa's case do not carry a comparable beneficial-ownership disclosure requirement.

Outlook

Watch for whether FinCEN issues follow-on guidance or rulemaking addressing the transparency gap the domestic exemption leaves for law-enforcement and financial-institution due-diligence purposes, and whether any US state moves to fill that gap with its own beneficial-ownership registry requirement. For the EU architecture, watch for the pace of AMLA's direct and indirect-supervision perimeter build-out as a separate, non-Iowa-specific structural thread to monitor in parallel.

D3 Enabler Jurisdictions

no_changestanding position

Enabler Jurisdictions

Iowa's digital-asset-kiosk statute, Iowa Code section 533C.1004, has now received its first appellate test, and the result is a transition-period enforcement gap rather than a gap in the statute's design going forward. The Iowa Supreme Court held in In the Matter of $11,500 Seized from Bitcoin Depot Operating, LLC (No. 25-1639, decided October 30, 2026) that the statute's consumer-protection provisions do not reach kiosk transactions, or the law-enforcement seizures that followed from them, predating the statute's effective date. The court reversed the district court and remanded the case, meaning the kiosk operator's claim to the seized funds prevailed over the claim of the defrauded depositor for this pre-statute conduct.

Continue reading

Viewed through an enabler-jurisdiction lens, the significant fact is not that Iowa regulates digital-asset kiosks poorly; the statute itself carries an explicit consumer-facing warning that kiosk transactions are irreversible, indicating the legislature anticipated fraud risk directly. The significant fact is that any newly enacted state-level oversight regime for a cash-to-crypto conversion channel necessarily has a start date, and conduct before that date sits outside the regime's reach unless the statute says otherwise. Fraud that occurred through an Iowa kiosk before section 533C.1004 took effect is, as a matter of the Supreme Court's reading, not something the new statute can be mobilized against. That is a structural observation about how transition periods function in state crypto-kiosk oversight generally, and Iowa is simply the jurisdiction where it has now been tested and resolved by the state's highest court.

This matters for enabler-jurisdiction analysis because digital-asset kiosks are a channel repeatedly associated with elder-fraud and romance-scam proceeds moving from cash into cryptocurrency with minimal friction. A state that legislates against this channel only prospectively leaves a window, bounded by the statute's effective date, during which victims of the exact harm the statute targets have no statutory recourse against the kiosk operator under that statute. Whether other remedies exist outside section 533C.1004 is not addressed in the court's ruling as reported, and the available record does not state one.

Outlook

The ruling settles the retroactivity question for conduct before the statute's effective date; it does not disturb the statute's application to kiosk transactions occurring after that date, where the full protective framework should operate without the boundary problem just litigated. As scheduled, whether other states with analogous crypto-kiosk statutes face the same retroactivity question, and whether any amend their statutes to close the transition-period gap explicitly, is a pattern worth tracking rather than a change already observed in the record available this cycle.

Cumulative analysis

Enabler Jurisdictions and Professional Facilitators — Cumulative Analysis

This baseline establishes the enabler-jurisdiction posture of Iowa around a single, durable structural finding: the absence of dedicated state-level AML examination capacity for money-services businesses beyond registration and licensing functions administered through Iowa Code chapter 533C and the Iowa Division of Banking. Supervisory depth for Bank Secrecy Act compliance in Iowa depends on federal delegation rather than independent state examination infrastructure, a High-confidence finding supported by a strong primary FinCEN source. This is not, on its own, evidence of active facilitation of illicit finance through Iowa; federal delegation is a common and legitimate supervisory model across United States states. It is, however, a structural precondition worth tracking, because it means that any facilitation activity occurring below the threshold that triggers federal examination attention would likely go undetected at the state level.

The analytical value of this baseline lies in its interaction with the crypto-assets domain finding this same cycle. Iowa was cited nationally by FinCEN as a model jurisdiction for crypto-ATM enforcement following Attorney General actions against Bitcoin Depot and CoinFlip, yet those actions were brought under general consumer-fraud legal authority rather than a dedicated AML examination function. This juxtaposition, a jurisdiction praised for enforcement outcomes while lacking the supervisory architecture that would make such outcomes systematic rather contingent on prosecutorial initiative, is the central enabler-jurisdiction observation this baseline preserves. It raises an open and currently unresolved question: whether the Iowa enforcement model is replicable in other states lacking similarly motivated prosecutorial attention, or whether it depended on circumstances not tied to durable supervisory capacity.

No evidence collected across this baseline period indicates that professional facilitators have actively exploited the Iowa examination-capacity gap, and the domain trajectory is accordingly assessed as stable rather than worsening, in contrast to the clearly worsening trajectories documented in the beneficial-ownership and crypto-assets domains this same cycle. This distinction matters: Iowa is not documented this cycle as an active enabler jurisdiction in the sense of demonstrated facilitation, but as a jurisdiction whose supervisory architecture creates latent capacity for undetected facilitation, a distinction the enablement-as-signal principle requires this record to state explicitly rather than to elide.

Going forward, the priority tracking items for this domain are whether any future multi-state or federal examination coordination initiative, potentially connected to the FinCEN AML/CFT Program Reform Notice of Proposed Rulemaking currently at consultation stage, extends more systematic supervisory attention to Iowa-licensed money-services businesses without requiring independent state-level examination capacity; and whether any evidence emerges in future cycles of the capacity gap having been actively exploited, which would require reclassifying this jurisdiction trajectory from stable to worsening.

domain_sub_briefs · D3 · Cumulative analysis
Standing baseline position

Cambodia flagged at increasing risk of a third FATF grey-listing amid casino/scam-centre crackdown; Prince Group chairman extradited, Prince Bank in liquidation.

Periodic updates (3)
3 Nov 2026 · fim-2026-11-01

Enabler Jurisdictions

Iowa's digital-asset-kiosk statute, Iowa Code section 533C.1004, has now received its first appellate test, and the result is a transition-period enforcement gap rather than a gap in the statute's design going forward. The Iowa Supreme Court held in In the Matter of $11,500 Seized from Bitcoin Depot Operating, LLC (No. 25-1639, decided October 30, 2026) that the statute's consumer-protection provisions do not reach kiosk transactions, or the law-enforcement seizures that followed from them, predating the statute's effective date. The court reversed the district court and remanded the case, meaning the kiosk operator's claim to the seized funds prevailed over the claim of the defrauded depositor for this pre-statute conduct.

Viewed through an enabler-jurisdiction lens, the significant fact is not that Iowa regulates digital-asset kiosks poorly; the statute itself carries an explicit consumer-facing warning that kiosk transactions are irreversible, indicating the legislature anticipated fraud risk directly. The significant fact is that any newly enacted state-level oversight regime for a cash-to-crypto conversion channel necessarily has a start date, and conduct before that date sits outside the regime's reach unless the statute says otherwise. Fraud that occurred through an Iowa kiosk before section 533C.1004 took effect is, as a matter of the Supreme Court's reading, not something the new statute can be mobilized against. That is a structural observation about how transition periods function in state crypto-kiosk oversight generally, and Iowa is simply the jurisdiction where it has now been tested and resolved by the state's highest court.

This matters for enabler-jurisdiction analysis because digital-asset kiosks are a channel repeatedly associated with elder-fraud and romance-scam proceeds moving from cash into cryptocurrency with minimal friction. A state that legislates against this channel only prospectively leaves a window, bounded by the statute's effective date, during which victims of the exact harm the statute targets have no statutory recourse against the kiosk operator under that statute. Whether other remedies exist outside section 533C.1004 is not addressed in the court's ruling as reported, and the available record does not state one.

Outlook

The ruling settles the retroactivity question for conduct before the statute's effective date; it does not disturb the statute's application to kiosk transactions occurring after that date, where the full protective framework should operate without the boundary problem just litigated. As scheduled, whether other states with analogous crypto-kiosk statutes face the same retroactivity question, and whether any amend their statutes to close the transition-period gap explicitly, is a pattern worth tracking rather than a change already observed in the record available.

14 Sep 2026 · fim-2026-09-14

Enabler Jurisdictions and Professional Facilitators

Cambodia is this cycle's clearest enabler-jurisdiction signal. The National Bank of Cambodia's governor has publicly warned that Cambodia risks a third FATF grey-listing absent sustained action against money laundering linked to casino and scam-centre operations. This is a probable finding, corroborated by two independent Tier 3 sources, though no Tier 1 or Tier 2 FATF document confirming an actual re-listing was located this cycle; the warning itself, not a confirmed re-listing, is the substantiated fact. The activities in question have been linked to money laundering, large undeclared cash movements, and cross-border payment abuse, characteristics consistent with the casino- and scam-centre-adjacent enabler-jurisdiction pattern seen elsewhere in the region.

The warning follows a significant enforcement-plus-sanctions convergence event: Prince Group chairman Chen Zhi was arrested and extradited to China, and Prince Bank together with related real-estate entities were forced into liquidation, following joint US-UK sanctions action against the Prince Group network. This is a probable finding at Tier 3 sourcing, but it represents an unusually concrete enforcement outcome for an enabler-jurisdiction case, where sanctions designation converted into an actual arrest, extradition, and forced liquidation rather than remaining at the level of designation alone. This convergence is analytically significant under an architecture-over-incident lens: it demonstrates that Cambodia's domestic enforcement apparatus can act decisively once a sanctioned network's exposure becomes acute, even as the broader grey-list risk warning suggests the underlying structural AML weaknesses that allowed the network to operate persist.

Separately, the FATF's June 2026 Plenary made routine list-composition changes: Iraq and Bosnia and Herzegovina were added to the list of jurisdictions under increased monitoring, while Algeria and Namibia were removed, bringing the total under increased monitoring to twenty-two, with the blacklist of Iran, North Korea, and Myanmar unchanged. This is a confirmed, Tier 1 sourced development that recalibrates the standing enabler-jurisdiction watch list independent of the Cambodia-specific warning.

No Iowa-specific or United States enabler-jurisdiction finding was identified this cycle; the enabler-jurisdiction signal this cycle is exclusively international, centred on Cambodia and the FATF list-composition change.

Outlook

Watch for a Tier 1 FATF statement that either confirms or forecloses the Cambodia re-listing risk currently substantiated only at the level of a central-bank warning, and for further developments in the Prince Group liquidation proceedings that might surface additional enabler-network detail. The broader FATF grey-list composition, now at twenty-two jurisdictions under increased monitoring, remains the standing reference point against which any future Cambodia movement would be measured.

14 Jul 2026 · fim-2026-07-14

Enabler Jurisdictions and Professional Facilitators

The defining finding for Iowa in this domain is a capacity deficit rather than an active facilitation pattern. Iowa money-services businesses register with FinCEN and license under Iowa Code chapter 533C through the Iowa Division of Banking, but the state maintains no dedicated AML examination cadre beyond this registration and licensing function. Supervisory depth for Bank Secrecy Act compliance depends structurally on federal delegation rather than independent state capacity, a finding supported by a strong primary FinCEN source, the national MSB state-contact directory, at High confidence.

This capacity deficit is analytically significant precisely because of its interaction with the scale of relevant activity in Iowa. The crypto-ATM elder-fraud typology documented under the digital-assets domain this cycle, and the Iowa Attorney General enforcement response to it, both occurred against a backdrop in which the state itself has no independent proactive-detection mechanism for the money-services-business sector in which crypto-ATM operators are licensed. The Iowa Attorney General enforcement actions against Bitcoin Depot and CoinFlip were consumer-fraud actions brought under general state legal authority, not products of a dedicated AML examination function, which is a meaningful distinction for assessing whether the Iowa enforcement model is replicable elsewhere or contingent on unusually motivated prosecutorial attention rather than durable supervisory infrastructure.

The enablement-as-signal principle is directly relevant here: the absence of independent state AML examination capacity is not itself an enforcement failure, since federal delegation is a legitimate and common supervisory model across United States states, but it does mean that any facilitation occurring through Iowa-licensed money-services businesses that falls below the threshold of federal examination attention would likely go undetected at the state level. No evidence collected this cycle indicates that this gap has been actively exploited by professional facilitators operating through Iowa, but the structural precondition for such exploitation, thin independent supervisory capacity relative to sector scale, is documented and should be tracked.

This finding should also be read against the national FinCEN CVC Kiosk Notice, which cited Iowa enforcement action as a model despite Iowa lacking dedicated AML examination infrastructure specifically for the crypto-ATM sector that generated the underlying fraud pattern. This juxtaposition, a state praised nationally for consumer-protection-driven enforcement outcomes while lacking the supervisory architecture that would make such enforcement systematic rather than episodic, is itself an architecture-over-incident observation worth preserving in the standing record for this jurisdiction.

Outlook

No regulatory horizon item identified this cycle proposes to establish a dedicated Iowa state-level AML examination function, so this capacity gap is likely to persist as a structural feature of the jurisdiction absent a state legislative initiative not currently indicated in the evidence base. The relevant forward marker to track is whether any future multi-state or federal examination coordination effort, potentially connected to the FinCEN AML/CFT Program Reform Notice of Proposed Rulemaking logged under the compliance-technology domain, extends more systematic supervisory attention to Iowa-licensed money-services businesses, including crypto-ATM operators, without requiring the state itself to build independent examination capacity.

D4 Conflict Finance

no_changestanding position

Conflict Finance and Extractive-Industry Integrity

No material Iowa-specific conflict-finance or extractive-industry finding was identified in this cycle evidence base. The standing conflict-finance coverage areas tracked more broadly by this monitor, including Russian war-economy financing, Sahel minerals, and DRC governance, are not directly implicated by the Iowa-specific sub-national evidence assembled this cycle. The only tangential connection is the farmland-ownership national-security exposure logged under the Beneficial Ownership and Corporate Transparency domain this cycle, in which entities linked to countries of concern may acquire Iowa agricultural land through layered corporate structures; this finding is properly a beneficial-ownership and national-security issue rather than a conflict-finance one, and it is cross-referenced here for completeness rather than treated as an independent D4 development. In accordance with the honesty-over-coverage principle, this domain sub-brief is intentionally thin: no invented findings are substituted for the absence of Iowa-specific conflict-finance material this cycle.

Continue reading

Outlook

This domain trajectory is assessed as stable, reflecting an absence of material Iowa-specific signal rather than a confirmed finding of no risk. Future cycles should continue to monitor for any Iowa-specific nexus to conflict-affected commodity supply chains or armed-group financing, including through the agricultural or extractive sectors, and should upgrade this domain sub-brief from limited-signal status only if such a nexus is directly evidenced.

Cumulative analysis

Conflict Finance and Extractive-Industry Integrity — Cumulative Analysis

Across the research window synthesised into this first baseline, no material Iowa-specific conflict-finance or extractive-industry integrity finding has been identified. This domain sits structurally apart from the other five domains in the current Iowa record: the standing conflict-finance coverage areas this monitor tracks at a broader level, including Russian war-economy financing, Sahel minerals, and DRC governance, have no direct Iowa-specific nexus documented in the evidence assembled to date. The single tangential connection identified, the farmland-ownership exposure in which entities linked to countries of concern may acquire Iowa agricultural land through layered corporate structures, is properly classified as a beneficial-ownership and national-security finding rather than an independent conflict-finance development, and is cross-referenced here rather than treated as substantive D4 signal.

Consistent with the honesty-over-coverage principle governing this record, this cumulative entry remains intentionally limited rather than padded with speculative content. The absence of signal is itself the finding: Iowa, as a sub-national United States jurisdiction with a large agricultural economy but no documented extractive-industry or conflict-adjacent commodity exposure in the current evidence base, does not present a conflict-finance profile comparable to jurisdictions more directly implicated in this monitor standing coverage. This should not be read as an assurance of zero risk, only as an accurate reflection of the evidence collected to date.

Future cycles should test this limited-signal status against any emerging evidence of Iowa-specific supply-chain exposure to conflict-affected commodities, any agricultural-sector nexus to sanctioned or conflict-adjacent entities beyond the farmland-ownership finding already logged under the beneficial-ownership domain, and any extractive-industry integrity question that may arise from Iowa role in broader United States agricultural or mineral supply chains. Absent such evidence, this domain trajectory should remain assessed as stable with limited signal.

domain_sub_briefs · D4 · Cumulative analysis

D5 Crypto / Digital Assets / Financial Innovation

watch

Crypto, Digital Assets, and Financial Innovation

Iowa's kiosk-oversight framework for digital financial assets has had its temporal boundaries set by the state's highest court. On 30 October 2026, the Iowa Supreme Court held in In the Matter of $11,500 Seized from Bitcoin Depot Operating, LLC that Iowa Code §533C.1004 does not apply retroactively to kiosk transactions or law-enforcement seizures that predate the statute's effective date. The district court judgment was reversed and the case remanded. For a regime that imposes consumer-protection duties on digital-asset-transaction-kiosk operators, including the irrevocability warnings the statute mandates kiosks display, this ruling draws a clean line: conduct before the statute's effective date sits outside its reach, however closely it resembles conduct the statute plainly covers today.

Continue reading

The ruling arrives in the same window as a demonstration of what can still be done for pre-statute or statute-adjacent harm through means other than the kiosk statute itself. The Iowa Insurance Division's 29 October 2026 announcement that its Fraud Bureau recovered more than three million dollars in cryptocurrency stolen from an older Iowan shows that blockchain tracing and interagency coordination, rather than the kiosk statute, can be the operative tool for recovering value lost to digital-asset fraud. The Fraud Bureau worked with Ankeny Police, the FBI Virtual Assets Unit, the Polk County Attorney's Office, and a private blockchain-tracing firm to intercept the stolen funds. Read together, the two developments describe a digital-asset environment in Iowa where statutory consumer protection is temporally bounded but operational capacity to trace and recover illicitly moved crypto assets is growing, and where the latter may increasingly substitute for the former in cases the statute cannot reach.

For firms and advisers tracking subnational digital-asset regulation in the United States, the Iowa case is a reminder that kiosk-specific consumer-protection statutes of this type, several of which have been enacted across states in recent cycles, are being tested in court specifically on questions of temporal reach rather than substantive validity. The holding does not weaken the statute going forward; it clarifies that the statute's duties, including the mandated irrevocability warning language, bind only conduct occurring after the statute took effect.

Outlook

Further proceedings in the Bitcoin Depot matter are expected at the district court level following remand, now constrained by the Supreme Court's holding that §533C.1004 operates prospectively only. Whether other kiosk-statute states see comparable retroactivity litigation, and whether Iowa's interagency tracing model is replicated elsewhere, are open questions this cycle's record does not resolve.

Cumulative analysis

Crypto, Digital Assets, and Financial Innovation — Cumulative Analysis

This first baseline for Iowa in the digital-assets domain centres on a genuinely Iowa-originated enforcement story rather than a passive application of national or global crypto-asset regulatory developments. The Iowa Attorney General lawsuits against Bitcoin Depot and CoinFlip, announced 26 February 2025, alleged that a majority of examined Iowa kiosk transactions involving Bitcoin Depot, and roughly ninety percent involving CoinFlip, were scam-related, with every one of the top twenty Iowa CoinFlip users identified as a scam victim. CoinFlip disputed these allegations in an April 2026 court filing. FinCEN subsequently cited these Iowa-originated actions in its August 2025 national CVC Kiosk Notice as evidence of the scale of kiosk-enabled elder fraud, establishing Iowa as a genuine national reference point for crypto-ATM AML red-flag expectations, a rare instance of a sub-national enforcement record shaping federal supervisory guidance.

The most consequential development to have unfolded since that initial enforcement wave is structural rather than episodic: Bitcoin Depot, the largest named defendant and formerly the largest crypto-ATM operator in North America, filed for Chapter 11 bankruptcy on 18 May 2026 and took its network of over 9,000 kiosks offline nationally. This narrows Iowa-specific kiosk exposure materially, even though the underlying elder-fraud typology persists nationally through remaining operators such as CoinFlip, whose litigation with the Iowa Attorney General continues. Iowa own 2025 crypto-ATM transaction and fee-cap statute, cited nationally by FinCEN as a model, illustrates the limits of point-of-transaction regulation: national fraud-complaint and loss data continued rising sharply after its enactment, a pattern this baseline reads as evidence that transactional caps address symptom rather than the upstream AML and know-your-customer architecture at kiosk operators and their liquidity providers.

A second and structurally distinct Iowa-relevant exposure in this domain is the DPRK IT-worker wage-conversion channel, in which wages obtained through fraudulent remote employment, potentially including at Iowa-based employers, are laundered through overseas crypto over-the-counter facilitators in China, Vietnam, Laos, and the United Arab Emirates. This channel connects the digital-assets domain directly to the sanctions-architecture domain baseline established this same cycle. As global backdrop against which Iowa exposure should be read, two federal developments illustrate the wider United States digital-asset sanctions environment: the March 2025 judicial delisting of Tornado Cash, reflecting a United States-specific judicial constraint on DeFi-protocol sanctions not mirrored in European Union or United Kingdom frameworks, and the October 2025 coordinated OFAC-FinCEN-OFSI designation of the Prince Group Transnational Criminal Organization, an unusually convergent transatlantic sanctions action against crypto-enabled fraud infrastructure.

Going forward, the CoinFlip litigation outcome, expected around 2027, is the clearest forward marker for this domain, since the parallel Bitcoin Depot claims are already partially mooted by that operator market exit. Future cycles should track whether the elder-fraud typology migrates cleanly to remaining or new kiosk operators following Bitcoin Depot departure, whether Iowa transaction-cap model is adopted elsewhere or superseded by AML-architecture-focused reform, and whether the DPRK IT-worker wage-conversion channel produces any confirmed Iowa-specific employer case.

domain_sub_briefs · D5 · Cumulative analysis
Standing baseline position

OCC interpretive letter (2026-05-12) holds National Bank Act preempts Iowa MTL licensing for Fidelity Digital Assets N.A., a crypto-custody national trust bank.

Iowa's digital-asset-kiosk consumer-protection regime (§533C.1004) remains in force with wallet-verification and fee-cap duties; a pending study bill (SSB3086) would recast enforcement from a bespoke $10,000-per-violation penalty into the general consumer-fraud statute (§714.16), with injunction-violation penalties up to $100,000.

Iowa Supreme Court holds Iowa Code §533C.1004 is not retroactive (30 Oct 2026); Iowa Insurance Division recovers $3M+ stolen crypto via blockchain tracing (29 Oct 2026).

Periodic updates (4)
3 Nov 2026 · fim-2026-11-01

Crypto / Digital Assets / Financial Innovation

Two developments from Iowa bear directly on the oversight and defence of digital-asset channels. First, the Iowa Supreme Court ruled on October 30, 2026 in In the Matter of $11,500 Seized from Bitcoin Depot Operating, LLC (No. 25-1639) that Iowa Code section 533C.1004, the state's digital-asset-kiosk statute, cannot be applied retroactively to kiosk transactions and related law-enforcement seizures predating the statute's effective date. The court reversed the district court and remanded. Second, and separately, the Iowa Insurance Division Fraud Bureau announced on October 29, 2026 that it had recovered more than three million dollars in stolen cryptocurrency belonging to an older Iowan, achieved through interagency blockchain tracing involving the FBI Virtual Assets Unit, Ankeny Police, and the Polk County Attorney's Office.

The statutory ruling narrows the practical reach of section 533C.1004, which governs digital financial asset transaction kiosks and requires the posted warning that kiosk transactions are irreversible. The holding means a kiosk operator's claim to funds seized before the statute's effective date prevails over a defrauded depositor's claim under the statute, because the statute's protective machinery simply was not in force at the relevant time. This is a finding about statutory timing, not about the adequacy of the kiosk-oversight framework once it is in force.

The recovery announcement describes a capability finding rather than a statutory one: a three-million-dollar cryptocurrency recovery achieved through coordinated blockchain tracing across a state insurance-fraud bureau, a federal virtual-asset unit, municipal police, and a county prosecutor. That combination of actors recovering stolen crypto on behalf of a specific elder-fraud victim demonstrates that, independent of what the kiosk statute does or does not reach retroactively, Iowa has operational interagency capacity to trace and recover digital-asset fraud proceeds in cases that are brought to its attention.

Taken together, the two developments describe a digital-asset enforcement landscape in Iowa that is maturing on the capability side even as its statutory perimeter has just been tested and narrowed at the margins by the state's highest court. Neither development concerns stablecoins, central bank digital currency, or federal-level financial innovation policy; both are specific to cash-to-crypto kiosk infrastructure and state-level recovery capacity.

Outlook

The non-retroactivity holding is now settled law for conduct before section 533C.1004's effective date; its application to post-enactment kiosk transactions remains the live and more consequential question going forward. Whether the interagency recovery model demonstrated in the three-million-dollar case becomes Iowa's standard operating approach to crypto-fraud cases, or remains particular to this one matter, is not established in the available record and bears watching as a repeatable or non-repeatable capability.

28 Sep 2026 · fim-2026-09-28

Crypto / Digital Assets / Financial Innovation

Iowa's digital-financial-asset-kiosk regime centres on Iowa Code section 533C.1004, enforceable since 1 July 2025 and amended by SF 2296 on 6 May 2026. The statute requires kiosk operators to verify that the receiving wallet belongs to the customer for every transaction and caps daily transaction and fee amounts, functioning as a targeted anti-fraud control at the point of a kiosk transaction. Underpinning this is a broader classification question that guidance from the Iowa Division of Banking has now settled: virtual-currency kiosk operators are money transmitters under section 533C.301(1) and section 533C.102(19) and (28), absent an enumerated exemption. That places kiosk operators inside Iowa's general Chapter 533C money-transmission licensing perimeter rather than leaving them in a regulatory grey zone, and it is the clearest statement to date of how the state's existing financial-services licensing architecture extends to digital-asset infrastructure.

The more consequential development for the innovation and enforcement-design angle is a pending study bill, SSB3086, which would restructure how a section 533C.1004 violation is punished. Currently, the statute carries its own bespoke civil penalty of $10,000 per violation. SSB3086 would strike that bespoke schedule and instead fold enforcement into Iowa's general consumer-fraud statute, section 714.16, under which violating an Attorney General-obtained injunction carries penalties of up to $100,000. This is a study bill at the pre-enactment stage, and its primary text has not been independently retrieved this cycle; the description here rests on secondary bill-tracking coverage.

Read architecturally rather than as an isolated incident, this pairing — a settled money-transmitter classification alongside an open question about enforcement design — describes a state regulator and legislature treating digital-asset kiosks as a distinct financial-innovation surface requiring bespoke rules, even while routing licensing itself through the pre-existing general money-transmission framework rather than creating a parallel crypto-specific licence. That is a structurally significant choice: Iowa is not building new licensing infrastructure for digital assets, but it is willing to legislate bespoke substantive protections and, potentially, bespoke enforcement mechanics on top of the general licence.

Outlook

The primary open question is whether SSB3086 advances past the study-bill stage, with an estimated but wide-uncertainty-band horizon of 2027 Q1. Its enactment would not alter the underlying wallet-verification or fee-cap duties, which remain fixed obligations regardless of enforcement mechanics, but it would materially raise the ceiling on penalty exposure for a violation from a fixed $10,000 figure to an injunction-backed framework capable of reaching $100,000. Confirmation of primary bill text and tracking of the bill's progress through the Iowa General Assembly are the two items most likely to resolve this uncertainty in a future cycle.

14 Sep 2026 · fim-2026-09-14

Crypto / Digital Assets / Financial Innovation

The lead digital-asset development this cycle is directly anchored to Iowa's own regulatory perimeter: an OCC interpretive letter dated 12 May 2026 held that the National Bank Act preempts Iowa's money-transmitter licensing requirement, and OCC's exclusive visitorial authority, as applied to Fidelity Digital Assets, N.A., a national trust bank offering crypto-custody services. This is a probable finding, sourced from a Tier 1 OCC primary document, that resolves a direct jurisdictional conflict between Iowa's state banking regulator and the OCC over supervisory authority for a bank-chartered crypto custodian operating within the state.

The precedent implication extends well beyond Iowa. Because the OCC's reasoning rests on National Bank Act preemption doctrine rather than any Iowa-specific statutory feature, the ruling is a template with implications for state-level AML and licensing leverage over bank-chartered crypto custodians nationally. Any state seeking to impose money-transmitter licensing, inspection, or visitorial requirements on a nationally chartered trust bank offering digital-asset custody now faces a federal preemption argument with a live interpretive letter behind it. From a financial-integrity perspective, this narrows the set of levers available to state authorities for imposing state-specific AML or consumer-protection conditions on this category of institution, concentrating supervisory authority at the federal, OCC level instead.

This development sits at a genuine architecture-over-incident inflection point: it is not an enforcement action against a bad actor but a structural reallocation of supervisory authority between state and federal regulators over a category of institution, crypto-custody national trust banks, that did not exist in comparable form when existing money-transmitter licensing statutes were drafted. The practical AML consequence is that Iowa's own capacity to compel licensing-linked AML conditions on this specific institutional category is now curtailed, with OCC's federal supervisory framework substituting for whatever state-specific conditions Iowa might otherwise have imposed.

No other Iowa-specific digital-asset or crypto development was identified this cycle; the OCC preemption ruling is the sole substantiated finding in this domain for this jurisdiction.

Outlook

Watch for whether other states attempt to reassert money-transmitter licensing jurisdiction over nationally chartered crypto-custody banks following this ruling, and whether subsequent OCC interpretive letters extend or narrow the preemption reasoning established here. Also watch for whether Iowa's Division of Banking issues any public response or seeks legislative or administrative avenues to preserve some form of state-level oversight over this institutional category.

14 Jul 2026 · fim-2026-07-14

Crypto, Digital Assets, and Financial Innovation

Iowa own regulatory and enforcement environment for digital assets is the lead story in this domain, not the global crypto-asset regulatory backdrop. The Iowa Attorney General announced consumer-fraud lawsuits against Bitcoin Depot and CoinFlip on 26 February 2025, alleging that a majority of examined Iowa kiosk transactions involving Bitcoin Depot, and roughly ninety percent involving CoinFlip, were scam-related, with all of the top twenty Iowa CoinFlip users identified as scam victims. CoinFlip disputed these allegations in an April 2026 court filing, and the exact court-filing date for both actions, as distinct from the public announcement date, remains an open item in the current evidence base. These Iowa-originated actions were cited by FinCEN in its August 2025 national CVC Kiosk Notice as evidence of the scale of kiosk-enabled fraud, making Iowa a genuine national reference point for crypto-ATM AML red-flag expectations rather than a passive recipient of federal guidance.

The most significant structural development since that enforcement wave is the narrowing of Iowa-specific kiosk exposure: Bitcoin Depot, the largest named defendant, filed for Chapter 11 bankruptcy on 18 May 2026 and took its national network of more than 9,000 kiosks offline. This is a market-structure outcome traceable in part to sustained multi-state regulatory pressure in which Iowa was an early mover, and it materially contracts the Iowa-specific footprint of the underlying scheme even as the elder-fraud typology persists nationally through remaining operators such as CoinFlip. Iowa own 2025 consumer-protection statute, which caps crypto-ATM kiosk transaction and fee amounts and was cited by FinCEN as a national model, represents a proactive state-level regulatory layer, though national fraud-complaint and loss data continued rising sharply after its enactment, indicating that transaction-cap regulation addresses symptom rather than the underlying AML and know-your-customer architecture at kiosk operators and their upstream liquidity providers.

A separate but connected Iowa-relevant digital-asset exposure is the DPRK IT-worker wage-conversion channel: wages obtained by DPRK IT operatives through fraudulent remote employment, potentially including Iowa-based employers, are converted through overseas crypto over-the-counter facilitators in China, Vietnam, Laos, and the United Arab Emirates, evading sanctions while exposing host companies to malware and intellectual-property theft. As global backdrop rather than the Iowa-specific lead, two federal developments illustrate the broader United States digital-asset sanctions environment within which Iowa exposure sits: the March 2025 judicial delisting of the Tornado Cash mixing protocol, after a United States court ruled OFAC lacked authority to sanction an immutable smart contract, a constraint not mirrored in European Union or United Kingdom frameworks; and the October 2025 coordinated OFAC-FinCEN-OFSI designation of the Prince Group Transnational Criminal Organization and the related Byex Exchange, illustrating that United States-United Kingdom sanctions convergence on crypto-enabled fraud networks is achievable in specific cases.

Outlook

The litigation outcome for the ongoing CoinFlip suit, expected around 2027, will be the most concrete near-term marker for this domain, given that the Bitcoin Depot claims have already been partially mooted by that operator bankruptcy. The broader question this domain must continue to track is whether the underlying elder-fraud typology migrates cleanly to remaining and future kiosk operators as Bitcoin Depot exits the market, and whether Iowa transaction-cap model is adopted or superseded by more AML-architecture-focused state or federal measures, including the FinCEN AML/CFT Program Reform Notice of Proposed Rulemaking logged under the compliance-technology domain this cycle.

D6 Compliance Technology & Active Defence

improving

Compliance Technology and Active Defence

The Iowa Insurance Division's recovery of more than three million dollars in stolen cryptocurrency, announced 29 October 2026, is a demonstration of active-defence capacity operating at state level. The Fraud Bureau coordinated with Ankeny Police, the FBI Virtual Assets Unit, the Polk County Attorney's Office, and a private blockchain-tracing firm to trace and intercept funds stolen from an older Iowan in a financial-exploitation scheme before those funds could be moved beyond reach. This is precisely the kind of cross-agency, technology-enabled intervention that the architecture-over-incident framing of this field is built to surface: the significance lies not in the dollar figure alone but in the fact that a state insurance regulator, municipal police, a federal virtual-assets unit, a county prosecutor's office, and a private tracing vendor were able to act together quickly enough to intercept funds before off-ramping.

Continue reading

This development sits in instructive tension with the same cycle's Iowa Supreme Court ruling that the state's digital-asset-kiosk consumer-protection statute does not reach backward to cover pre-enactment conduct. Where statute cannot reach, active tracing capability can still produce recovery, provided intervention happens before the stolen assets exit traceable rails. That is an important qualifier: the Fraud Bureau's success depended on timing and on the involvement of a private tracing firm with the technical capability to follow the funds on-chain. It is not a general substitute for statutory coverage, and its replicability in a case where funds move faster, or offshore, or through mixing services, is untested by what this cycle's record shows.

The absence of any comparable active-defence announcement in other domains this cycle does not indicate inactivity elsewhere; the record for this cycle surfaces only the Iowa Insurance Division matter as a clear active-defence data point. The coordination model itself, spanning a state regulator, municipal and federal law enforcement, a county prosecutor, and a private-sector tracing capability, is the structural finding worth carrying forward: it is a template for recovery in jurisdictions where statutory consumer-protection coverage has gaps, whether those gaps are temporal, as in Iowa's case, or jurisdictional.

Outlook

Whether this interagency tracing model becomes a standing capability invoked in future Iowa crypto-fraud cases, or was convened for this case alone, is not established by what this cycle's record shows. Its value as a counterweight to the enforcement gap just confirmed by the Supreme Court's retroactivity ruling will depend on whether it can be invoked with comparable speed in future matters.

Cumulative analysis

Compliance Technology and Active Defence — Cumulative Analysis

This first baseline for Iowa compliance-technology posture is defined by a genuine tension between advancing and receding federal control requirements, arriving within the same research window. FinCEN April 2026 Notice of Proposed Rulemaking proposes to fundamentally reform AML/CFT program requirements for all federally regulated financial institutions, including those operating in Iowa, introducing board approval, a risk-based four-pillar structure, and a mandatory United States-based AML/CFT Officer in place of the existing five-pillar framework. The comment period closed 9 June 2026 with a final rule pending, meaning Iowa-domiciled banks and payment companies now face a known but not yet finalised structural governance change to plan against.

Moving in the opposite direction, FinCEN postponement of the Investment Adviser AML Rule effective date from 1 January 2026 to 1 January 2028 extends by two full years the period during which registered investment advisers and exempt reporting advisers operating in or from Iowa carry no dedicated federal AML program obligation. This baseline treats this postponement as a worsening risk-direction data point rather than a neutral extension, since it delays a control uplift that had already been finalised and scheduled, rather than simply preserving a pre-existing gap.

At the state level, Iowa 2025 crypto-ATM transaction and fee-cap statute stands as an early example of proactive state compliance-technology innovation, cited nationally by FinCEN as a model. The persistence and continued sharp rise of national fraud-complaint and loss data after this statute enactment is a durable finding this baseline preserves: transaction-level caps, however well-intentioned and proactively adopted, do not substitute for upstream AML and know-your-customer architecture at the kiosk-operator and liquidity-provider level. This finding should inform how any future evaluation of Iowa consumer-protection model, including in the pending CoinFlip and Bitcoin Depot litigation, weighs the model effectiveness.

The cumulative picture this baseline establishes is one of genuine directional tension rather than uniform improvement or uniform decline: a sweeping governance reform advancing toward finalisation for banks and payment companies, an adviser-sector control uplift being pushed back by two years, and a state-level consumer-protection measure whose limits are becoming empirically clearer even as it is held up as a national model. Future cycles should track the AML/CFT Program Reform NPRM final-rule outcome, expected around 2027, as the single most consequential compliance-technology development for Iowa institutions, alongside the lower-uncertainty 1 January 2028 Investment Adviser AML Rule effective date, and should continue to monitor whether Iowa or other states move beyond transaction caps toward upstream AML-architecture reform for crypto-ATM operators.

domain_sub_briefs · D6 · Cumulative analysis
Standing baseline position

Iowa Insurance Division Fraud Bureau, with FBI Virtual Assets Unit, Ankeny Police and Polk County Attorney's Office, recovered over $3 million in stolen cryptocurrency via blockchain tracing, announced 29 October 2026.

Periodic updates (2)
3 Nov 2026 · fim-2026-11-01

Compliance Technology & Active Defence

The Iowa Insurance Division Fraud Bureau announced on October 29, 2026 that it recovered more than three million dollars in stolen cryptocurrency belonging to an older Iowan who had been targeted in a financial-exploitation scam. The recovery was achieved through interagency blockchain tracing, coordinated among the Fraud Bureau, the FBI Virtual Assets Unit, the Ankeny Police Department, and the Polk County Attorney's Office. This is an active-defence finding: it describes a working pipeline for tracing cryptocurrency across the chain from a victim's loss to a recoverable position, and for coordinating the state, federal, and local actors needed to execute on that trace.

From an active-defence perspective the notable element is not the dollar figure alone but the breadth of the coordinating actors. A state insurance-fraud bureau, ordinarily associated with insurance-claim fraud rather than cryptocurrency, functioned as the lead or convening actor in a case requiring blockchain-tracing expertise, federal virtual-asset investigative capacity, municipal policing, and county-level prosecution. That combination suggests an interagency architecture capable of being assembled around a specific elder-fraud cryptocurrency case rather than a standing, dedicated crypto-fraud unit operating independently. Whether this was an ad hoc assembly for this case or draws on an established standing protocol is not stated in the available record.

This development sits alongside, but is analytically distinct from, the same week's Iowa Supreme Court ruling narrowing the retroactive reach of the state's digital-asset-kiosk statute. The statutory ruling concerns the legal perimeter within which a kiosk operator can be held to consumer-protection obligations; the Fraud Bureau recovery concerns the operational capacity to trace and recover proceeds once fraud has occurred, independent of which kiosk or channel the funds moved through. The two together describe an environment where legal exposure for kiosk operators tied to historical conduct has just been narrowed, while the capacity to pursue recovery of fraud proceeds through non-statutory, investigative means continues to develop.

The case also illustrates a recurring active-defence pattern: elder-targeted financial-exploitation scams routed through cryptocurrency are being met with blockchain-tracing responses that cross agency and jurisdictional lines, from a state regulator through federal investigators to local police and prosecutors, within a single case.

Outlook

Whether the interagency model demonstrated in this recovery becomes a standing, repeatable capability for Iowa's handling of crypto-enabled elder fraud, or remains tied to the specific actors and circumstances of this case, is not yet established from the available record. As scheduled, future cycles may show whether the Fraud Bureau formalizes this interagency approach into a standard response protocol for similar cases going forward.

14 Jul 2026 · fim-2026-07-14

Compliance Technology and Active Defence

Iowa federally regulated institutions face a genuinely mixed near-term compliance-technology posture this cycle, defined by one forward-moving and one backward-moving federal instrument arriving nearly simultaneously. FinCEN issued an April 2026 Notice of Proposed Rulemaking that would require board approval, a risk-based four-pillar program framework, and a United States-based AML/CFT Officer for all federally regulated financial institutions, including those operating in Iowa, with the comment period closed 9 June 2026 and a final rule pending. This is a structural reform proposal that would meaningfully change program-governance requirements away from the existing five-pillar framework, and Iowa-domiciled banks and payment companies would need to begin planning for board-level AML governance ahead of finalisation, even though the instrument remains at consultation stage and its final form is not yet settled.

Simultaneously, and moving in the opposite risk direction, FinCEN postponed the effective date of the Investment Adviser AML Rule from its originally planned 1 January 2026 date to 1 January 2028, a two-year extension of the period during which registered investment advisers and exempt reporting advisers operating in or from Iowa have no dedicated federal AML program requirement. This is a worsening risk-direction data point precisely because it delays a planned control uplift rather than merely maintaining an existing baseline, extending a known gap in adviser-sector AML program coverage for a further two years.

At the state level, Iowa own 2025 crypto-ATM consumer-protection statute, which caps kiosk transaction and fee amounts, represents an early proactive compliance-technology layer that most states have not adopted, and FinCEN cited it as a national model. However, the fact that national fraud-complaint and loss data continued rising sharply after this statute enactment is itself a compliance-technology finding: it demonstrates that transaction-level controls, however proactive, cannot substitute for upstream AML and know-your-customer architecture at the kiosk-operator and liquidity-provider level. This is a useful corrective for compliance functions considering point-of-transaction controls as a primary rather than supplementary defence layer.

Taken together, these three developments describe an Iowa compliance-technology environment in genuine tension: a sweeping federal program-governance reform moving toward finalisation, a federal adviser-sector control uplift being delayed, and a state-level consumer-protection measure demonstrating the limits of transactional controls alone. This mixed picture should inform how Iowa-domiciled institutions of different types, banks and payment companies facing the AML/CFT Program Reform NPRM, investment advisers facing a further two-year gap, and crypto-asset operators facing state transaction caps, each calibrate their compliance-technology investment priorities differently rather than treating this as a single uniform regulatory trajectory.

Outlook

The AML/CFT Program Reform NPRM final rule, with an estimated 2027 impact date, is the most consequential near-term compliance-technology development to track, given its board-approval and four-pillar governance requirements would apply across all federally regulated Iowa institutions. The Investment Adviser AML Rule 1 January 2028 effective date is a second, lower-uncertainty marker, given its quarter-level uncertainty band reflects an already-finalised postponement rather than a pending proposal. Whether Iowa or other states move to strengthen crypto-ATM AML architecture beyond transaction caps, in response to continued national fraud-loss growth despite existing caps, remains an open question not resolved by any regulatory horizon item identified this cycle.

D7 AML/CTF Regime

no_change

Standing AML/CTF record (money-transmission licensing under Iowa Code ch.533C, IDOB as designated supervisor) persists unchanged this cycle.

D8 Commercial Activity

no_changestanding position

Commercial Activity

NMI, a global embedded-payments infrastructure provider, announced its acquisition of Des Moines-headquartered Dwolla, an account-to-account payments provider that had built significant institutional backing since its 2008 founding, including support from Andreessen Horowitz. The acquisition brings roughly 60 Dwolla employees and more than 400 customer contracts into NMI's platform, and the combined business is reported to process approximately 700 billion dollars in annual transaction volume. Financial terms of the transaction were not disclosed.

Continue reading

From a financial-integrity perspective, this registers as a commercial consolidation event in the payments infrastructure sector rather than as an enforcement, sanctions, or beneficial-ownership finding. No sanctions nexus, anti-money-laundering dimension, or compliance deficiency has been reported in connection with the deal. Dwolla's account-to-account rails and its position as an Iowa-headquartered payments provider with a substantial customer base make the transaction notable primarily for how it concentrates payment-processing volume and compliance-program scope within the combined entity; account-to-account infrastructure of this kind typically carries its own transaction-monitoring and customer-due-diligence obligations under the Bank Secrecy Act framework, and that obligation set travels with the Dwolla business into NMI's broader compliance architecture rather than disappearing on acquisition.

The absence of any reported AML or sanctions dimension to the deal is itself worth noting under an enablement-and-architecture lens: large-scale consolidation in payments infrastructure typically proceeds through standard regulatory and compliance due diligence without drawing adverse attention, and this transaction appears to fit that pattern. There is no indication in the available sourcing that Dwolla's existing licensing, state money-transmission registrations, or BSA compliance posture raised issues that affected deal terms or structure; the deal description emphasizes commercial scale and strategic fit (expanding NMI's account-to-account and open-banking capability) rather than remediation of any compliance gap.

This transaction sits within a broader pattern of consolidation among mid-sized payments infrastructure providers, where acquirers seek to add complementary rails (in this case, account-to-account transfer capability) to existing card-centric or merchant-acquiring businesses. The scale of combined annual volume, at roughly 700 billion dollars, places meaningful transaction-monitoring and sanctions-screening responsibility on the combined entity going forward, even though no finding to that effect has surfaced in available sourcing to date.

Outlook

Integration of Dwolla's approximately 60 employees and 400-plus customer contracts into NMI is likely to proceed as a standard post-acquisition consolidation process. Watch for whether the combined entity's expanded transaction volume and account-to-account rail exposure draws any subsequent regulatory attention, state money-transmission licensing updates, or sanctions-screening program adjustments, though none have been reported as at this cycle. No further Iowa-specific commercial transactions with a financial-integrity dimension were identified this cycle.

Regulatory horizon
1 dated · 3 pending date · baseline fim-2026-07-05
Role action cards
MLRO

An Iowa Supreme Court ruling narrows the temporal reach of the state's crypto-kiosk consumer-protection statute, while state regulators demonstrate successful blockchain-tracing recovery of stolen crypto.

Suspicious-activity exposure tied to pre-statute kiosk conduct in Iowa falls outside §533C.1004 recourse, but the demonstrated interagency tracing capability shows that reportable-activity follow-through involving law enforcement and private tracing firms can still produce recovery outcomes worth noting in filings concerning Iowa-linked elder-fraud typologies.

2 evidence refs
Compliance

Iowa's kiosk consumer-protection statute has been held non-retroactive by the state Supreme Court, clarifying the statute's effective scope for obliged kiosk operators.

Operators should understand that duties under §533C.1004, including the mandated irrevocability warning, bind only conduct from the statute's effective date forward; pre-effective-date exposure sits outside the statute's reach as confirmed by the court.

1 evidence refs
Legal

The Iowa Supreme Court reversed and remanded a case testing whether §533C.1004 can apply to pre-enactment kiosk seizures, holding that it cannot.

The decision in In the Matter of $11,500 Seized from Bitcoin Depot Operating, LLC sets binding precedent on the statute's temporal reach and will shape litigation strategy for any client-facing matter involving pre-statute kiosk conduct in Iowa.

1 evidence refs
Board

Iowa state authorities demonstrated successful interagency recovery of over three million dollars in stolen cryptocurrency, even as a court ruling narrowed the reach of the state's kiosk consumer-protection statute.

The pairing of a narrowed statutory remedy with strengthened operational tracing capacity reflects a reputational and strategic environment in which active-defence coordination, not statute alone, increasingly determines recovery outcomes for digital-asset fraud.

2 evidence refs
CTO

A state insurance regulator's Fraud Bureau used interagency blockchain tracing, including a private tracing firm, to intercept stolen cryptocurrency before off-ramping.

The successful intercept illustrates the technical dependency of active-defence recovery on timely on-chain tracing and coordination among regulators, law enforcement, and private vendors, relevant to any platform-side or infrastructure risk assessment of digital-asset flows touching Iowa.

1 evidence refs
Risk

The Iowa Supreme Court's retroactivity ruling creates a confirmed enforcement gap for pre-statute crypto-kiosk fraud exposure in the state.

Exposure concentration tied to pre-effective-date kiosk conduct in Iowa cannot be mitigated through §533C.1004 itself; the interagency tracing recovery offers a partial operational offset but is not a structural substitute for statutory coverage.

2 evidence refs
Operations

Confirmed elder-fraud crypto recovery in Iowa involved interagency blockchain tracing intercepting funds before off-ramping.

The operational pattern, rapid coordination among a state regulator, municipal and federal law enforcement, and a private tracing firm, is relevant to screening and monitoring workflows for Iowa-linked elder-fraud typologies involving digital-asset kiosks.

1 evidence refs
Audit

The Iowa Supreme Court's ruling on statute retroactivity and the Insurance Division's tracing-based recovery together clarify the current scope and operational reach of Iowa's crypto-kiosk oversight regime.

Control-testing scope for Iowa-related crypto-kiosk exposure should reflect the confirmed temporal limit on §533C.1004 and should account for interagency tracing recovery as a documented alternative recovery pathway outside the statute.

2 evidence refs
Standing trackers (T1–T6)
TrackerStatusNote
T1 · Russian Sanctions-Evasion Architectureno_changeNo material change found at the US-IA layer this cycle.
T2 · EU AML Package / AMLAno_changeNot applicable to a US subnational jurisdiction.
T3 · FATF Grey Listno_changeNo plenary outcome affecting US FATF membership at the US-IA layer this cycle.
T4 · Beneficial-Ownership Register Statusno_changeNo US-IA-specific beneficial-ownership registry development found this cycle.
T5 · Crypto & Digital-Asset IntegritywatchIowa Supreme Court ruled §533C.1004 not retroactive (30 Oct 2026); Iowa Insurance Division recovered $3M+ in stolen crypto via interagency blockchain tracing (29 Oct 2026).
T6 · Sanctions Regime Divergenceno_changeNo US-IA-specific divergence signal this cycle.
Registers

Enforcement actions

  • 26 Feb 2025
  • 26 Feb 2025
  • 4 Aug 2025
  • 12 Mar 2026
  • 25 Jun 2025
  • 15 Oct 2025
  • 14 Oct 2025
  • Iowa AG filed suit alleging Bitcoin Depot's kiosks in the state were instruments of massive fraud, with an analysis of Iowa transactions between October 2021 and July 2024 suggesting more than half involved scams, costing Iowans over $20 million. 26 Feb 2025
  • Iowa AG sued CoinFlip alleging roughly 90% of transactions examined on its Iowa ATM network were scam-related and that all of its top 20 Iowa users were scam victims, calling the firm a 'willfully blind participant' in victimizing Iowans. 26 Feb 2025
  • FinCEN issued Notice FIN-2025-NTC1, a national advisory on illicit finance risks at crypto ATMs, explicitly citing the Iowa Attorney General's February 2025 lawsuits as evidence of the scale of kiosk-enabled fraud and setting AML/CFT red-flag expectations for financial institutions. 4 Aug 2025
  • OFAC designated facilitators of DPRK government-orchestrated IT worker fraud schemes that generated nearly $800 million in 2024 for DPRK weapons programs, including 21 cryptocurrency addresses; the scheme systematically targets US businesses nationwide, creating exposure for Iowa-based employers of contracted remote IT labor. 12 Mar 2026

Sanctions changes

  • 12 Mar 2026
  • 1 Mar 2025
  • 14 Oct 2025
  • 16 Jun 2026
  • 19 Mar 2026
  • 16 Jan 2026
  • 4 Sep 2026
  • 9 Sep 2026
  • OFAC designated six individuals and two entities, including Vietnam- and China-based currency converters and a DPRK IT-management company (Amnokgang Technology Development Company), for facilitating DPRK IT-worker fraud schemes funding WMD/ballistic missile programs, with 21 crypto addresses listed. 12 Mar 2026
  • US Treasury delisted the Tornado Cash mixer in March 2025, following a US court ruling that OFAC lacked authority to sanction the immutable smart-contract protocol, reversing the original 2022 designation. 1 Mar 2025
  • OFAC, jointly with FinCEN and in coordination with the UK's FCDO, designated the Prince Group Transnational Criminal Organization and 146 associated targets (including Chen Zhi) for operating massive 'pig butchering' scam and money-laundering operations — the same laundering-network typology into which US crypto-ATM (including Iowa) scam proceeds are shown to flow. 14 Oct 2025

Regulatory horizon (register)

  • MiCA CASP transitional-period expiry
  • FinCEN follow-on BOI rulemaking narrowing scope further
  • UK ECCTA 2023 failure-to-prevent-fraud offence phase-in
  • SSB3086 — recast digital-asset kiosk enforcement under general consumer-fraud statute
  • Resolution of Iowa AG litigation vs. CoinFlip/Bitcoin Depot
  • FinCEN AML/CFT Program reform NPRM comment deadline
  • Investment Adviser AML Rule new effective date
  • US FATF 8th Enhanced Follow-up Report (BO access gaps)

Active schemes

  • Scammers direct victims, disproportionately elderly, to convert cash into cryptocurrency at unmonitored kiosks operated by firms such as Bitcoin Depot and CoinFlip, hosted in Iowa convenience and grocery stores; funds move irreversibly on-chain and increasingly off-ramp through Southeast Asia-based complex money-laundering networks before any suspicious-activity review occurs.
  • North Korean IT operatives use stolen identities and fabricated personas, aided by US-based laptop-farm facilitators, to obtain remote employment with American companies nationwide, potentially including Iowa-based employers; wages are funnelled through overseas OTC crypto facilitators back to DPRK weapons programs.
  • Following the March 2025 interim final rule, all US-formed entities, including Iowa LLCs and corporations, and their beneficial owners are exempt from FinCEN BOI reporting; only foreign-formed entities registering to do business in a US state remain in scope, restoring a structural opacity gap for layering shell or nominee ownership chains.
  • USDA is partnering with CFIUS and state lawmakers to close gaps allowing entities linked to countries of concern to acquire US farmland through layered corporate ownership; Iowa dense farmland market and limited state foreign-ownership disclosure regime create exposure amplified by the CTA rollback.
Sources
  1. Latest News from ICIJ | The Global Muckraker
  2. https://www.fincen.gov/news/news-releases/fincen-permanently-ends-beneficial-ownership-reporting-requirements-millions
  3. https://home.treasury.gov/news/press-releases/sb0603
  4. https://www.fatf-gafi.org/en/publications/Fatfgeneral/outcomes-fatf-plenary-june-2026.html
  5. https://agbrief.com/news/cambodia/26/01/2026/cambodia-battles-to-avoid-third-fatf-grey-list-placement-amid-scam-crackdown/
  6. https://sigma.world/news/cambodia-anti-gambling-drive-fatf-grey-list/
  7. https://ofac.treasury.gov/recent-actions/20260904
  8. https://www.occ.gov/topics/charters-and-licensing/interpretations-and-decisions/2026/int1192.pdf
  9. https://idob.iowa.gov/media/169/download?inline=
  10. https://www.legis.iowa.gov/docs/ico/chapter/533C.pdf
  11. https://cryptoslate.com/crypto-laws/iowa-digital-financial-asset-transaction-kiosk-fee-law/
  12. https://www.billtrack50.com/billdetail/1950208
  13. https://www.discern.com/resources/iowa-financial-services-compliance
  14. https://www.iowaattorneygeneral.gov/newsroom/attorney-general-brenna-bird-leads-coalition-demanding-911-victims-and-families-get-frozen-taliban
  15. https://www.nmi.com/about-us/news/nmi-acquires-dwolla/
  16. https://www.fintechfutures.com/m-a/nmi-acquires-dwolla
  17. https://www.legis.iowa.gov/docs/code/533C.804.pdf
  18. CourtListener / Iowa Supreme Court
  19. Justia
  20. Iowa Insurance Division
  21. Iowa Legislature
  22. https://www.courtlistener.com/opinion/11050327/in-the-matter-of-11500-seized-from-bitcoin-depot-operating-llc/
  23. https://law.justia.com/cases/iowa/supreme-court/2026/25-1639.html
  24. https://iid.iowa.gov/press-release/2026-10-29/iowa-insurance-division-recovers-over-3-million-stolen-cryptocurrency-major-senior-financial
  25. https://www.legis.iowa.gov/docs/code/2026/533C.html
  26. Law Enforcement Overview | FinCEN.gov
  27. MEMORANDUM OF UNDERSTANDING U.s. Department of ...
  28. Enforcement Actions | FinCEN.gov
  29. Secretary Bessent Announces Initiatives to Combat Rampant Fraud in Minnesota | FinCEN.gov
  30. Whether a Company that Provides Online Real-Time Deposit, Settlement, and Payment Services for Banks, Businesses and Consumers is a Money Transmitter rather | FinCEN.gov
  31. Application of the Definition of Money Transmitter to Brokers and Dealers in Currency and Other Commodities | FinCEN.gov
  32. 1 FinCEN Advisory United States Department of the Treasury
  33. Section 314(a) | FinCEN.gov
  34. News Releases on Unregistered Money Transmitter Enforcement Actions | FinCEN.gov
  35. Application of Money Services Business regulations to the rental of computer systems for mining virtual currency | FinCEN.gov
  36. Beneficial Ownership Information Reporting | FinCEN.gov
  37. Beneficial Ownership Information Reporting Rule Fact Sheet | FinCEN.gov
  38. Frequently Asked Questions | FinCEN.gov
  39. Treasury Department won’t enforce beneficial ownership rule under the Corporate Transparency Act - ICIJ
  40. FinCEN Removes Beneficial Ownership Reporting Requirements for U.S. Companies and U.S. Persons, Sets New Deadlines for Foreign Companies | FinCEN.gov
  41. Corporate Transparency Act
  42. U.S. Beneficial Ownership Information Registry Now Accepting Reports | FinCEN.gov
  43. U.S. Department of the Treasury Financial Crimes Enforcement Network
  44. FinCEN Issues Notice to Financial Institution Customers on Beneficial Ownership Information Requirements | FinCEN.gov
  45. FinCEN Issues Proposed Rule for Beneficial Ownership Reporting to Counter Illicit Finance and Increase Transparency | FinCEN.gov
  46. Retailers keep cashing in on crypto ATMs as scams surge - ICIJ
  47. 1 FIN-2022-A002 June 15, 2022 Advisory on Elder Financial Exploitation
  48. Amid a scam crackdown, crypto giants keep fueling bitcoin ATMs - ICIJ
  49. Massachusetts sues Bitcoin Depot, alleging the crypto ATM operator knowingly facilitated crypto scams - ICIJ
  50. Elder Financial Exploitation: Threat Pattern & Trend ...
  51. FinCEN Notice, FIN-2025-NTC1, August 4, 2025
  52. 2026 Crypto Crime Report: Scams
  53. Recognizing Imposter Scams | FinCEN.gov
  54. Crypto ATM operator Bitcoin Depot files for bankruptcy - ICIJ
  55. Fraud Warning
  56. Confessions of a Laptop Farmer: How an American Helped North Korea’s Wild Remote Worker Scheme
  57. Watch North Korea’s Hidden Remote IT Scheme - Bloomberg
  58. US Treasury Sanctions North Korean Cyber Facilitator Linked to IT Worker Scheme | TRM Labs
  59. OFAC Targets DPRK IT Workers Using Crypto
  60. US Sanctions Target North Korean Fake-Tech-Worker Scheme - Bloomberg
  61. US Charges North Koreans in Plot to Dupe More Than 100 Firms - Bloomberg
  62. Guidance on the Democratic People's Republic of Korea ...
  63. Video: The Secret North Korean Workforce Inside US Companies - Bloomberg
  64. Publication of North Korea Information Technology Workers Advisory | Office of Foreign Assets Control
  65. North Korea IT Workers: Inside the DPRK’s Crypto Laundering Network
  66. US Acts on Foreign Ownership of Farmland Amid China Tension - Bloomberg
  67. Don’t Ban Chinese Investment in US Farmland - Bloomberg
  68. US Laws Blocking Chinese Ownership of Farmland Are Unnecessary - Bloomberg
  69. E/CN.15/2023/CRP.12 23 November 2023 Original: Arabic/Chinese/English/
  70. EU agricultural land prices and rents: huge contrasts - News articles - Eurostat
  71. Federal Register Notices | FinCEN.gov
  72. Small Entity Compliance Guide | FinCEN.gov
  73. Senator Jon Tester Calls for Ban on Chinese Land Purchases After Report - Bloomberg
  74. Enforcement Actions for Failure to Register as a Money Services Business | FinCEN.gov
  75. Important Information for MSBs | FinCEN.gov
  76. STATE CONTACT INFORMATION FOR MSBs
  77. Money Services Business (MSB) Registration | FinCEN.gov
  78. Money Services Businesses | FinCEN.gov
  79. Application of Money Services Business Regulations to a Company Acting as an Independent Sales Organization and Payment Processor | FinCEN.gov
  80. Fincen
  81. Interagency Interpretive Guidance on Providing Banking Services to Money Services Businesses Operating in the United States | FinCEN.gov
  82. Special Notice RMSB Posting
  83. OFAC Consolidated Frequently Asked Questions | Office of Foreign Assets Control
  84. 495 | Office of Foreign Assets Control
  85. Frequently Asked Questions | Office of Foreign Assets Control
  86. department of the treasury - Office of Foreign Assets Control
  87. Federal Register/Vol. 70, No. 37/Friday, February 25, 2005/ ...
  88. Combined Nomenclature - Taxation and Customs Union - European Commission
  89. Open access land: management, rights and responsibilities - GOV.UK
  90. 902 | Office of Foreign Assets Control
  91. Mutual Evaluations
  92. Mutual Evaluation of the United States
  93. Consolidated Processes and Procedures for Mutual Evaluations and Follow-Up Universal Procedures
  94. Assessments
  95. Consolidated assessment ratings
  96. United States
  97. U.S. RECEIVES ‘OUTSTANDING’ EVALUATION FOR ANTI-MONEY LAUNDERING EFFORT | FinCEN.gov
  98. The FATF Recommendations
  99. Publications
  100. 2022 Procedures for the FATF AML/CFT/CPF Mutual Evaluations, Follow-Up and ICRG
  101. Crypto regulatory affairs: CLARITY Act Senate delay creates uncertainty
  102. Crypto regulatory affairs: US Crypto Week delivers as GENIUS Act becomes law, CLARITY Act moves to Senate
  103. Law enforcement, banks warn of money laundering gaps in major US crypto bill - ICIJ
  104. Crypto regulatory affairs: CLARITY Act advances from Senate Banking Committee
  105. 2025 Regulatory outlook: It’s crunch time for the US Congress on crypto legislation
  106. Landmark cryptocurrency legislation passes US House, to be signed into law by President Trump - ICIJ
  107. Global Crypto Policy Review Outlook 2025/26 Report | TRM Labs
  108. Definition of Money Transmitter (Merchant Payment Processor) | FinCEN.gov
  109. Definition of Money Services Business (Money Transmitter/Currency Dealer or Exchanger) | FinCEN.gov
  110. The Bank Secrecy Act | FinCEN.gov
  111. Registration and De-Registration of Money Services Businesses | FinCEN.gov
  112. Definition of Money Services Business (Debt Management Company) | FinCEN.gov
  113. MSB Registrant Search | FinCEN.gov
  114. CONSENT ORDER IMPOSING CIVIL MONEY PENALTY
  115. Canaccord-Consent-Order-No-2026-01. ...
  116. FinCEN Consent Order Imposing Civil Money Penalty, ...
  117. 1 Exemptive Relief Order to Delay the Effective Date of the
  118. FinCEN Issues Final Rule to Postpone Effective Date of Investment Adviser Rule to 2028 | FinCEN.gov
  119. SAR-FAQs-October-2025.pdf
  120. PPSI-AMLCFT-NPRM.pdf
  121. Fact Sheet: Proposed Rule to Fundamentally Reform Financial
  122. Federal Register/Vol. 91, No. 69/Friday, April 10, 2026/ ...
  123. DOJ Seizes $15 Billion in Bitcoin
  124. DOJ and FBI Phoenix Seize $112M in Proceeds from Crypto-related Scams
  125. Questions swirl around US plans for record $15B Prince Group crypto seizure - ICIJ
  126. Settlement Agreement between the U.S. Department of the Treasury's Office of Foreign Assets Control and Bittrex, Inc. | Office of Foreign Assets Control
  127. Warren Seeks Details on Binance Compliance With 2023 Settlement - Bloomberg
  128. Trump administration curbs state oversight of crypto industry - ICIJ
  129. DOJ and FBI Phoenix Seize $112M in Proceeds from Crypto-related Scams
  130. 1 1. See 31 U.S.C. § 5312(a)(2); 31 CFR § 1010.100(t). 2.
  131. Bitcoin Depot Goes Bankrupt, Signaling Demise of Crypto ATMs - Bloomberg
  132. Latest News from ICIJ | The Global Muckraker
  133. Financial Crimes Enforcement Network (FinCEN)
  134. Office of Foreign Assets Control (OFAC) / State of Iowa
  135. International Consortium of Investigative Journalists (ICIJ)
  136. Financial Action Task Force (FATF)
  137. Financial Crimes Enforcement Network (FinCEN)
  138. Chainalysis
  139. Bloomberg
  140. Bloomberg
Coverage gaps
fim-int-2026-07-05-G001: The exact court-filing date for the…
fim-int-2026-07-05-G001: The exact court-filing date for the Iowa Attorney General suits against Bitcoin Depot and CoinFlip remains unconfirmed and distinct from the 26 February 2025 public announcement date. [resolved]
fim-int-2026-07-05-G002: An updated field assessment of Iowa…
fim-int-2026-07-05-G002: An updated field assessment of Iowa-specific crypto-ATM kiosk footprint following the Bitcoin Depot bankruptcy and network shutdown would refine the current narrowing status of FIM-SCHEME-001. [resolved]
fim-int-2026-07-05-G003: Independent Iowa-specific investiga…
fim-int-2026-07-05-G003: Independent Iowa-specific investigative or NGO reporting remains sparse beyond national crypto-ATM and CTA coverage, though the challenger review located one direct Iowa Attorney General primary source not previously verified. [resolved]
fim-int-2026-07-05-G004: Outcome data for the ongoing CoinFl…
fim-int-2026-07-05-G004: Outcome data for the ongoing CoinFlip litigation and the anticipated US FATF eighth Enhanced Follow-up Report are both pending, limiting certainty in the T3 and T5 tracker trajectories. [resolved]
fim-int-2026-07-05-G005: The research-stage publication gate…
fim-int-2026-07-05-G005: The research-stage publication gate for this cycle recorded schema_valid as false and jurisdiction_source_floor_met as false, indicating upstream data-quality flags not yet resolved and warranting caution before treating this as a fully clean baseline. [resolved]
fim-int-2026-07-05-G006: No Iowa-specific dark-fleet, shadow…
fim-int-2026-07-05-G006: No Iowa-specific dark-fleet, shadow-banking, or export-control enforcement case data exists to substantiate the T1 tracker stable trajectory beyond the documented existence of the OFAC-Iowa Memorandum of Understanding. [resolved]
fim-int-2026-07-14-G001: Colombia (Tier-D watch jurisdiction…
fim-int-2026-07-14-G001: Colombia (Tier-D watch jurisdiction) yielded no qualifying signal this cycle; recorded as an explicit gap rather than a silent omission. [resolved]
fim-int-2026-07-14-G002: SR 26-2 primary Federal Reserve/OCC…
fim-int-2026-07-14-G002: SR 26-2 primary Federal Reserve/OCC/FDIC guidance text was not directly retrieved this cycle; confidence capped at Assessed on the AI-scope-exclusion claim pending primary-text retrieval. [resolved]
fim-int-2026-07-14-G003: Per-Member-State 6AMLD transpositio…
fim-int-2026-07-14-G003: Per-Member-State 6AMLD transposition status was not individually established this cycle; an explicit 'not established' beats a fabricated transposition date. [resolved]
fim-int-2026-07-14-G004: Laos's specific FATF listing was no…
fim-int-2026-07-14-G004: Laos's specific FATF listing was not directly retrieved from fatf-gafi.org this cycle; sourced only via a Tier-4 aggregator. [resolved]
fim-int-2026-07-14-G005: No direct Tier-1 EBA/ESMA primary t…
fim-int-2026-07-14-G005: No direct Tier-1 EBA/ESMA primary text was retrieved for the MiCA dual-licensing opinion this cycle; sourced only at Tier 4. [resolved]
fim-int-2026-09-14-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-14-G001 ({'scheme': 'financial_integrity', 'value': 'D3'}): Laos, Mexico and Colombia (remaining Tier D watch set) were not independently searched this cycle due to pooled web-search budget constraints. [resolved]
fim-int-2026-09-14-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-14-G002 ({'scheme': 'financial_integrity', 'value': 'D3'}): No T1 FATF statement confirming an actual Cambodia grey-list re-listing was located this cycle; risk-warning status only. [resolved]
fim-int-2026-09-14-G003 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-14-G003 ({'scheme': 'financial_integrity', 'value': 'D7'}): D7 (AML/CTF Regime) Iowa-specific record was not independently re-verified against a primary source this cycle. [resolved]
fim-int-2026-09-28-G001: This dispatch is jurisdiction-bound…
fim-int-2026-09-28-G001: This dispatch is jurisdiction-bound to US-IA per the union DR contract; FIM's own mandatory Tier-D global watch (Cambodia, Laos, Mexico, Colombia) and EU AML Package tracking could not be meaningfully advanced this cycle. [resolved]
fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', 'value': 'D5'}): Primary bill text for SSB3086 was not independently retrieved this cycle; only secondary bill-tracking summary available. [resolved]
fim-int-2026-10-25-G001: No Iowa-specific source identified …
fim-int-2026-10-25-G001: No Iowa-specific source identified for T1-T6 standing trackers beyond the T5 crypto note; a single-JID dispatch could not independently verify Russian/EU/FATF/BO/sanctions-divergence trackers for this state. [resolved]
fim-int-2026-10-25-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-25-G002 ({'scheme': 'financial_integrity', 'value': 'D1'}): No FATF/AML obligation_refs citation was located for the D1 Taliban-funds amicus brief finding this cycle; it is litigation activity rather than a rule citation. [resolved]
fim-int-2026-11-01-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G001 ({'scheme': 'financial_integrity', 'value': 'D1'}): No US-IA-specific signal located for D1 (sanctions), D2 (beneficial ownership), D4 (conflict finance) this cycle; coverage was thin given the sub-national scope of this JID. [open]
fim-int-2026-11-01-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G002 ({'scheme': 'financial_integrity', 'value': 'D3'}): Whether the Iowa Racing and Gaming Commission has issued any cease-and-desist order relevant to financial-integrity concerns since SF 2289 took effect was not confirmed this cycle. [open]
FIM-GAP-001 (D3): Iowa has no independent state AML examinat…
FIM-GAP-001 (D3): Iowa has no independent state AML examination cadre for licensed money-services businesses beyond registration/licensing under Iowa Code ch. 533C; supervisory depth for BSA compliance depends on federal delegation (FinCEN/federal banking agencies), leaving state-level supervisory capacity thin relative to the scale of MSB/crypto-ATM activity within the state.
FIM-GAP-002 (D2): The March 2025 federal CTA/BOI interim fin…
FIM-GAP-002 (D2): The March 2025 federal CTA/BOI interim final rule exempted all US-formed entities, including Iowa LLCs and corporations, from beneficial ownership reporting to FinCEN, restoring a beneficial-ownership opacity gap that Iowa has no independent state-level registry to fill.
FIM-GAP-003 (D5): Despite Iowa's 2025 crypto-ATM transaction…
FIM-GAP-003 (D5): Despite Iowa's 2025 crypto-ATM transaction-cap and fee-cap statute, national FBI IC3 data show crypto-ATM fraud complaints and losses continuing to rise sharply (99% complaint increase in 2024, losses projected to exceed $380 million in 2025), indicating state-level transactional caps alone have not closed the underlying enforcement/detection gap.
FIM-GAP-004 (D3): Independent Iowa-specific investigative/NG…
FIM-GAP-004 (D3): Independent Iowa-specific investigative/NGO reporting (OCCRP, Global Witness, ICIJ standalone Iowa-focused pieces) is sparse; available Iowa-specific findings largely surface as secondary references within national crypto-ATM and CTA coverage rather than dedicated Iowa-focused investigations, and no direct Iowa.gov primary URL for the AG's press release was independently verified in this research pass.

Evidence

Confidence-tiered claims

Led 30-state bipartisan coalition amicus brief to US Supreme Court seeking release of $3.5bn frozen Da Afghanistan Bank (Taliban) funds to 9/11 terrorism judgment-holders holding ~$17bn in federal judgments. [Source 1]
Probable · 1 source
NMI acquired Des Moines-headquartered account-to-account payments provider Dwolla, adding ~60 employees and 400+ customer contracts; combined volume ~$700bn annually; terms undisclosed. [Source 1]
Probable · 1 source
Authorized delegates under Iowa's money-transmission licensing framework must not be located in a country subject to OFAC sanctions nor in a FATF-designated high-risk or non-cooperative jurisdiction. [Source 1]
Probable · 1 source
In the Matter of $11,500 Seized from Bitcoin Depot Operating, LLC, No. 25-1639, decided 2026-10-30 [Source 1]
Probable · 1 source
More than $3 million recovered, announced 2026-10-29 [Source 1]
Probable · 1 source
Not retroactive; Iowa Supreme Court held on 30 October 2026 that the statute does not apply to kiosk transactions or seizures predating its effective date. [Source 1]
Probable · 1 source
Recovered more than $3 million in stolen cryptocurrency for an older Iowan via interagency blockchain tracing, announced 29 October 2026. [Source 1]
Probable · 1 source