United States — Oregon US-OR

Lead Signal

Oregon's Division of Financial Regulation has joined a 34-state coalition in a $2.5 million settlement with crypto-kiosk operator Coinme Inc. over Bank Secrecy Act and anti-money-laundering violations tied to its physical cash-to-crypto kiosk network. Oregon's allocated share of the settlement is $101,425.34, and the settlement carries a forward-looking structural term: Coinme must terminate kiosk operations entirely by 1 January 2027 or face a further $4 million penalty. The action is best read as enforcement against a known physical-cash-to-crypto conversion channel rather than as a change to Oregon's underlying regulatory architecture, which continues to rely on its general money-transmitter licensing statute, ORS Chapter 717, to bring virtual-currency businesses within scope rather than a bespoke crypto AML regime.

The multistate coordination itself is the notable structural feature here: a single settlement allocated across 34 state regulators demonstrates a maturing cooperative enforcement posture against a typology — unattended cash kiosks facilitating crypto conversion — that has drawn sustained supervisory attention nationally. The kiosk-termination deadline functions as a de facto phase-out of a higher-risk cash-based on-ramp within the settling operator's footprint, achieved through settlement terms rather than through amendment of Oregon's statute book.

Other Developments

Coinbase securities action remains stayed. Oregon's securities-law enforcement action against Coinbase, filed in April 2025 and alleging the unregistered sale of 31 tokens, remains procedurally stayed in federal court. The last confirmed stay order extended proceedings to 16 September 2026, pending a joint status report from the parties, and no ruling on the merits has issued. Whether the stay was further extended, lifted, or resolved after that date could not be confirmed. This procedural dormancy sits alongside the active Coinme settlement as a reminder that enforcement tempo varies sharply by instrument and forum even within the same jurisdiction's crypto-asset docket.

Oregon's general money-transmitter statute remains the operative AML backstop for virtual-currency business. Oregon has not adopted a crypto-specific licensing or AML regime; instead, ORS Chapter 717 continues to apply its general money-transmitter licensing and customer-due-diligence obligations to virtual-currency businesses operating in the state, including kiosk operators and payment companies. This is a baseline-descriptive fact rather than a development, but it frames why the Coinme settlement proceeded through multistate regulatory coordination rather than through a standalone Oregon licensing proceeding: the state's crypto-asset oversight runs through its existing money-services-business perimeter.

Cross-Monitor Connections

The Coinme settlement and the dormant Coinbase securities action both concern retail-facing crypto-asset intermediaries and sit naturally alongside parallel monitoring of digital-asset market-structure and consumer-protection developments tracked elsewhere in this research family; no further cross-routing is indicated by the substrate available.

Outlook

The near-term marker to watch is the 1 January 2027 kiosk-termination deadline embedded in the Coinme settlement: whether Coinme exits the kiosk business cleanly or triggers the additional $4 million penalty will itself be a signal about multistate settlement terms as an enforcement tool against physical cash-to-crypto channels. Separately, the procedural status of the Oregon v. Coinbase securities action past its 16 September 2026 stay deadline remains unresolved in available reporting and is a gap for a future cycle to close rather than a development to project forward on. Absent new findings, Oregon's underlying AML/CTF architecture for virtual-currency business — general money-transmitter licensing under ORS Chapter 717 — is expected to remain the operative framework as scheduled, with no indication of a bespoke crypto AML statute in the pipeline.

Lead Signal

Oregons financial-integrity posture is defined by a single, well-evidenced development in the digital-asset space rather than by a broad shift across the monitors typology set. The Oregon Division of Financial Regulation joined thirty-three other state financial regulatory agencies in reaching a 2.5 million dollar multistate settlement with crypto-kiosk operator Coinme Inc., with Oregons own share of the recovery set at 101,425.34 dollars. The settlement was announced on 19 October 2026 and carries a forward-looking structural condition: Coinme must cease kiosk operations by 1 January 2027 or face a further 4 million dollar penalty. Read architecturally rather than as an isolated enforcement item, the action signals that state-level money-services regulators are converging on coordinated, multi-jurisdiction supervisory responses to physical crypto-cash-conversion infrastructure, using Bank Secrecy Act and state money-transmitter anti-money-laundering provisions as the operative legal basis rather than any bespoke virtual-currency statute.

The coordinated character of the settlement, spanning thirty-four state regulators acting in concert, is itself the more durable signal. A single states enforcement action against a kiosk operator would be an incident; thirty-four regulators reaching the same settlement on the same instrument is a structural alignment in how crypto-cash-conversion risk is being supervised across the United States, with Oregon positioned as one of the coordinating jurisdictions rather than a standalone actor.

Other Developments

Coinbase securities litigation remains procedurally stayed. The State of Oregon v. Coinbase, Inc. matter, an Oregon securities-law enforcement action against the exchange, remains stayed in the United States District Court for the District of Oregon, with the operative docket entry recording a stay until 16 September 2026 and a requirement that the parties file a formal joint status report by that date. This is a continuation of a procedural posture rather than a new development, and it sits alongside the Coinme settlement as a second, separate thread of state-level digital-asset accountability activity touching Oregon, this one unresolved rather than concluded.

Standing money-transmitter baseline unchanged. Oregon continues to regulate virtual-currency businesses through its general money-transmitter licensing statute, ORS Chapter 717, rather than through a bespoke crypto anti-money-laundering regime. This baseline did not move, but it is the backdrop against which the Coinme settlement should be read: the enforcement instrument used against the kiosk operator draws on the same general money-services-AML architecture, applied in coordination with other states, rather than on any Oregon-specific digital-asset statute.

Cross-Monitor Connections

The Coinme settlement has a direct connective thread to monitors concerned with compliance-technology posture at crypto-asset operators, since the deficiency underlying a multistate Bank Secrecy Act and anti-money-laundering settlement of this scale typically speaks to the adequacy of a kiosk operators transaction-monitoring and customer-identification controls, even though no compliance-technology-specific finding was reported for Oregon. The coordinated, thirty-four-regulator character of the action also has a bearing on how commodity- and asset-flow monitors should read the broader state-level regulatory environment for physical cash-to-crypto conversion points, which have historically been a lower-friction entry point into the financial system for layering illicit proceeds. The stayed Coinbase securities matter, while not independently active, remains relevant to any cross-monitor tracking of exchange-level accountability actions building across multiple states, since a lifted stay and resumed litigation would represent a distinct escalation separate from the kiosk-specific settlement.

Outlook

The most concrete forward marker is the 1 January 2027 deadline by which Coinme must cease kiosk operations or face a further 4 million dollar penalty; whether the firm exits the kiosk business, restructures its compliance programme, or accepts the additional penalty will be the clearest near-term test of whether this settlement functions as a genuine behavioural constraint or as a cost of continued operation. The Coinbase securities litigation carries its own near-term marker, the 16 September 2026 joint status report, a date that, given the timing of this cycles research, has already passed by the time of the most recent docket entry recorded here; whether the stay was lifted, extended, or the case otherwise progressed is not resolved in the material available and should be treated as outstanding rather than settled in either direction. Taken together, Oregon sanctions, beneficial-ownership, enabler-jurisdiction, and conflict-finance exposure remain quiet, consistent with a state-level jurisdiction that does not operate an independent sanctions or beneficial-ownership-registry regime, leaving digital-asset enforcement as the one domain carrying active movement.

Lead Signal

Oregon carries one standout commercial-activity signal this cycle: Workday, Inc. signed a definitive agreement on 12 October 2026 to acquire C1 (ConductorOne, Inc.), a Portland, Oregon-headquartered identity-governance firm founded in 2020. The deal terms are undisclosed and the target close sits in Workday's fiscal Q4 2027, as scheduled. The transaction is corroborated across Tier-3 secondary sources rather than a directly retrieved primary filing, so the probable-tier framing holds: Workday is understood to have signed to acquire ConductorOne for undisclosed terms, with an SEC Form 8-K reported as filed on 13 October 2026.

The analytical significance of this transaction for a financial-integrity readership sits less in the deal mechanics than in the subject matter being acquired. ConductorOne operates in the identity-governance space -- the control layer that determines who can touch what inside an enterprise's systems -- and its absorption into a much larger HR and finance-platform vendor is a compliance-technology consolidation event. Architecture-over-incident framing applies directly here: a single acquisition is not, by itself, a regulatory development, but the pattern of identity-governance and access-control tooling being pulled into platform-scale vendors is a structural shift in how enterprise compliance technology gets built, sold and standardized.

Other Developments

Unlicensed debt-collection enforcement. Oregon's Division of Financial Regulation is probably understood to have imposed a civil penalty on a company for operating as a debt collector without the required Oregon registration. Under the reported consent order, the company must cease and desist from further violations and pay $40,000 of a total $181,500 civil penalty, with the balance apparently suspended contingent on compliance. This is a licensing-enforcement action rather than an AML/CTF-specific finding, but it illustrates that Oregon's financial-services licensing apparatus continues to generate enforcement activity against unregistered actors.

BNPL licensing guidance remains at the consultation stage. Oregon's Division of Financial Regulation has proposed guidance reminding nonbank buy-now-pay-later lenders and certain BNPL service providers that they must use the Nationwide Multistate Licensing System to obtain payday or consumer-finance licensure, depending on repayment terms. The comment period on this bulletin closed on 14 September 2026, and any resulting rules would take effect 180 days after adoption, as scheduled. Industry commentary has questioned whether this guidance requires formal rulemaking under Oregon's Administrative Procedures Act rather than issuance as a bulletin, so its path to finalization remains unresolved.

Cross-Monitor Connections

The Workday-ConductorOne transaction sits naturally at the boundary between this monitor's commercial-activity tracking and compliance-technology vendor consolidation more broadly: identity-governance tooling is foundational infrastructure for access controls that AML, sanctions-screening and data-governance functions all depend on. No sanctions-nexus, conflict-finance, or cross-border enabler signal was found for Oregon this cycle, so no routing to those typologies is warranted at this time.

Outlook

The Workday-ConductorOne transaction is probable-tier and bears watching through to its expected close in Workday's fiscal Q4 2027, as scheduled, including whether a primary SEC filing becomes available to firm up the terms. The BNPL licensing guidance remains unresolved pending Oregon DFR's decision on whether to proceed by bulletin or formal rulemaking; its practical effect, if finalized, would fall 180 days after adoption. The debt-collection consent order's suspended-penalty structure implies continued compliance monitoring by Oregon DFR over the multi-year suspension period.

Lead Signal

Oregon's financial-integrity architecture saw one confirmed, dated instrument change this cycle: HB 4116, effective June 5, 2026, closes a rate-export loophole under the federal Depository Institutions Deregulation and Monetary Control Act of 1980 that had allowed internet consumer lenders partnering with out-of-state banks to charge Oregon borrowers interest rates above the state's 36 percent usury cap. This is properly read as an enabler-jurisdiction development rather than a core AML/CTF instrument change: the loophole functioned as a rate-arbitrage pathway that let non-bank lending arrangements route around Oregon's consumer-protection ceiling by leaning on a partner bank's home-state rate authority, and its closure removes one enabling mechanism from the state's consumer-finance landscape.

This sits alongside Oregon's confirmed baseline AML/CTF-adjacent control, the money-transmitter licensing regime under ORS 717.205, which remained unchanged in substance this cycle and continues to operate as the sole state-specific layer beneath the federal Bank Secrecy Act and FinCEN framework that governs Oregon-licensed money-services businesses.

Other Developments

HB 4116's DIDMCA loophole closure is the confirmed development of note. Effective June 5, 2026, the statute closes the rate-export gap that had allowed internet lenders partnering with out-of-state banks to exceed Oregon's 36 percent usury limit, removing a rate-arbitrage enabler pathway that predatory or aggressive consumer-lending operations had relied upon. The Oregon Division of Financial Regulation characterizes the change as closing a loophole that had permitted rates in excess of the state limit.

Oregon's money-transmitter licensing architecture was confirmed but not independently re-verified for change this cycle. ORS 717.205 requires a license from the Division of Financial Regulation for any money transmission business operating in the state, backed by a surety bond under ORS 717.225 and quarterly money-services-business call reports. The statute's definition of money is stated by the state to cover the evolving landscape of virtual currency, including Bitcoin, meaning crypto-asset businesses transmitting value in Oregon fall under this same general licensing regime rather than a bespoke crypto statute.

Cross-Monitor Connections

The DIDMCA loophole closure under HB 4116 principally intersects with consumer-protection and lending-conduct oversight rather than a typical AML/CTF typology, but the underlying mechanism, rate arbitrage achieved by routing consumer credit through an out-of-state bank partnership, shares structural features with enabler-jurisdiction analysis tracked elsewhere in the fleet: a permissive cross-border (in this case cross-state) legal architecture being used to route around a stricter home jurisdiction's rule. No direct connection to world-payments or crypto-monitor findings was evidenced this cycle for the Oregon MTL baseline.

Outlook

The practical significance of HB 4116 will depend on how actively Oregon enforces the closed loophole against internet lenders that had previously relied on out-of-state bank partnerships to exceed the 36 percent cap; no enforcement action under the new provision was identified this cycle. Separately, six standing fleet-wide trackers (T1 through T6) were not independently re-verified against the Oregon-specific sweep this cycle, and Oregon's crypto-asset variance under the general MTL regime remains on watch status pending any bespoke state crypto statute or enforcement action, neither of which was identified this cycle.

Lead Signal

Oregon's Attorney General has emerged this cycle as a deliberate backstop against contracting federal consumer-financial-protection capacity. Leading a 46-state settlement, Oregon DOJ secured $45 million from Block, Inc. over Cash App's misrepresented account-safety features and failures to deliver fraud-protection and resolution obligations to users, with Oregon's own share set at $3 million. The Oregon Department of Justice explicitly framed the action in terms of reduced enforcement activity at the federal Consumer Financial Protection Bureau, a framing this brief treats as an assessed, high-confidence signal rather than an isolated incident: it sits inside Oregon's broader enabler-jurisdiction posture, where the state itself is acting as an enforcer filling a federal gap rather than functioning as an enabler of illicit activity. That distinction matters for how the finding should be read — this is state capacity substituting for federal capacity, not a facilitation risk being tolerated. The 2025 creation of an Economic Justice Section inside Oregon DOJ, explicitly positioned to pursue further payments- or crypto-adjacent matters, reinforces the assessment that this is a structural shift in state posture rather than a single settlement. This finding carries a High-confidence rating anchored in a Tier-1 Oregon Department of Justice press release, and it aligns with the jurisdiction's broader risk trajectory: Oregon's overall risk direction this cycle is assessed as increasing, with enforcement — rather than enablement — as the dominant character of that risk, and a structural-episodic profile assessed as mixed, meaning both a genuine institutional shift and an episodic settlement event are contributing to the present picture.

Other Developments

Coinbase's unregistered-securities action remains stayed pending a March 2026 status report. Oregon's action against Coinbase, alleging the unregistered offer and sale of 31 tokens including XRP, was removed to federal court and stayed until March 16, 2026, with a joint status report due from the parties. This assessed-confidence finding continues to represent a state-level securities-enforcement theory that diverges from the federal Securities and Exchange Commission's current de-regulatory posture toward digital-asset platforms nationally — a genuine architecture-level divergence between state and federal financial-integrity postures, not merely a procedural footnote. The underlying docket entries are procedural and carry a Tier-2 sourcing designation, though the original filing is corroborated by an Oregon DOJ press release; readers should treat the litigation's trajectory, rather than any single docket entry, as the operative signal. For any digital-asset platform serving Oregon residents, the practical consequence is continued classification uncertainty until the stay resolves.

UCC Article 12 continues in force alongside, rather than in tension with, the enforcement posture. Oregon's 2025 enactment of UCC Article 12 via SB 167, which establishes digital assets as usable commercial-law collateral, remains a separate and unaffected instrument, sourced this cycle at Tier 3. The state has therefore built an enabling commercial-law framework for digital-asset transactions at the same time it pursues an unresolved securities theory against a major exchange — two structurally distinct postures coexisting rather than resolving one another, and each should be read on its own terms rather than netted against the other.

Cross-Monitor Connections

The Block/Cash App settlement is a shared finding with the World Payments Monitor, which addresses the same underlying facts from a payments-conduct and consumer-protection lens; this brief's framing foregrounds the enabler-jurisdiction gap-filling dimension of the same enforcement action. The Coinbase enforcement action and the UCC Article 12 framework are likewise shared findings with the Crypto monitor's token-classification and on-chain-activity-regime coverage; here the emphasis is the financial-integrity dimension of a state-level securities theory diverging from federal posture, relevant to firms assessing jurisdiction-specific compliance exposure rather than token-level classification risk alone.

Outlook

The single most consequential near-term event for Oregon's crypto posture is the outcome of the March 16, 2026 joint status report in State of Oregon v. Coinbase: either the stay lifts and the underlying securities theory proceeds toward substantive resolution, or the litigation's present uncertainty persists. A related open item is Coinbase's separate public-records suit against Governor Kotek, which could surface material affecting the state's broader crypto-policy narrative. On the enabler-jurisdiction side, the Economic Justice Section is the structural item to watch: whether its case selection over coming cycles constitutes a sustained pattern of state-level backstop enforcement against payments and crypto firms, or a one-off intervention tied to the Block settlement specifically, will determine whether Oregon's enabler-jurisdiction profile continues escalating. Both the broader enabler-jurisdiction sweep beyond the Block settlement, and the substantive outcome of the Coinbase stay, remain explicitly flagged evidentiary gaps this cycle pending further primary-source confirmation.

Lead Signal

The FATF June 2026 plenary reset the global grey-list baseline, adding Bosnia and Herzegovina and Iraq while removing Algeria and Namibia, holding the monitored-jurisdiction count steady at twenty-two. This action, confirmed at High confidence from a Tier-1 FATF source, is the lead signal this cycle because it recalibrates the country-risk backdrop against which enabler-jurisdiction exposure is read globally, rather than representing an isolated country action. The plenary result is best read as continued active recalibration of the monitored list rather than a stabilizing trend, since the list churns rather than merely growing or shrinking.

Other Developments

Sanctions architecture sustained a high operational tempo. OFAC issued the largest-to-date package against the Ansarallah, or Houthi, financial network, designating twenty-one individuals and entities and identifying one vessel tied to oil-smuggling, procurement, and financial-facilitation activity; this finding is Assessed, corroborated only at Tier 3, since no direct Treasury press release was retrieved for the specific action. Separately, OFAC extended General License 131H, authorizing continued wind-down and divestment activity related to Lukoil International GmbH, through August 22, 2026, a High-confidence, Tier-1-sourced development that keeps a structured off-ramp open even as the broader Russia sanctions architecture holds.

Beneficial-ownership transparency is moving on a mixed and staggered timeline. In the European Union, the Anti-Money Laundering Authority has been operational since July 1, 2025, but roughly one third of member states missed the Article 74 transposition deadline under the sixth Anti-Money Laundering Directive, set for July 10, 2025, triggering Commission infringement proceedings against eleven states; core beneficial-ownership register provisions are due July 10, 2026, with the Regulation reaching full application on July 10, 2027. This finding is Assessed, capped by the absence of a retrieved europa.eu or AMLA primary source this cycle. In the United States, the domestic beneficial-ownership reporting exemption for domestic companies and US persons, introduced by a FinCEN March 2025 interim final rule, remains in force; the Eleventh Circuit affirmed the constitutionality of the Corporate Transparency Act on December 16, 2025, and a May 2026 GAO report found that the exemption removed more than ninety-nine percent of previously covered entities. This is a High-confidence, Tier-1-sourced finding.

Enabler-jurisdiction enforcement is visibly widening its aperture. In Cambodia, the central bank governor publicly warned that the country faces renewed FATF grey-relisting risk tied to casino and scam-centre laundering exposure, prompting a coordinated domestic crackdown; this is Assessed at Tier 3. In the United States, FinCEN issued a Notice of Proposed Rulemaking proposing a Section 311 special measure against ten identified Mexico-based gambling establishments tied to Sinaloa Cartel proceeds, a High-confidence, Tier-1 finding that extends an enforcement perimeter previously anchored in designated banks into the gaming sector directly.

Conflict-finance findings this cycle span two distinct corridors. FinCEN issued a supplemental alert on a fiscal fuel-theft, or huachicoleo, trade-based money-laundering scheme linked to the CJNG cartel, generating tens of billions of dollars annually through cross-border smuggling; this is High confidence and Tier-1 sourced. The Houthi financial-network designation described above also carries a conflict-finance reading, since oil-smuggling revenue is a direct input to the weapons-procurement capacity of the network.

Crypto and digital-asset oversight passed a structural threshold. The Markets in Crypto-Assets Regulation transitional period across the European Union ended on July 1, 2026, requiring full Crypto-Asset Service Provider authorization across the bloc; Binance withdrew its Greek MiCA application and restricted onboarding for European Union customers in response, and cumulative MiCA fines were reported above five hundred forty million euros. This finding is Assessed, since it rests on Tier 3 and Tier 4 sourcing with no Tier-1 or Tier-2 anchor retrieved this cycle.

Cross-Monitor Connections

The Houthi oil-smuggling designation and the CJNG fiscal fuel-theft alert both sit at the intersection of financial-integrity and commodity-flow analysis, since the underlying revenue architecture in each case depends on physical fuel or oil movement rather than pure financial layering; this is the kind of finding that a commodity-flow-focused monitor would read as a supply-chain integrity signal rather than a purely financial one. The expansion of the FinCEN enforcement perimeter into Mexico-based gambling establishments similarly sits adjacent to conflict-finance analysis, since Sinaloa Cartel proceeds are the underlying subject of the Section 311 special-measure proposal. The Cambodia grey-relisting warning, tied explicitly to casino and scam-centre laundering, is the kind of enabler-jurisdiction finding that connects most directly to state-capture-oriented analysis, given the public acknowledgment by the central bank itself. None of these connections change the underlying financial-integrity findings; they are noted here as routing signals for adjacent monitors.

Outlook

The coming cycle turns on several concrete dates. The Anti-Money Laundering Authority of the European Union must submit approximately twenty-three regulatory and implementing technical standards to the Commission by July 10, 2026, and the beneficial-ownership register core provisions fall due the same day, both of which will materially firm up the currently Assessed-confidence reading of the transposition status of the EU package. The full application date of the Regulation, July 10, 2027, remains the horizon marker for the eventual end of the current staggered-transposition period. On sanctions, the Lukoil International wind-down authorization runs through August 22, 2026, a date worth tracking for whether it is extended again or allowed to lapse. On crypto oversight, the pending penalty-methodology consultation of the European Banking Authority and the broader post-transitional MiCA enforcement and DeFi-policy review, expected in the fourth quarter of 2026, are the next concrete markers for whether the current MiCA uncertainty around decentralised finance and staking activity resolves toward expansion or restraint.

Lead Signal

The financial-integrity exposure of Oregon this cycle is anchored in a federal beneficial-ownership rollback compounding a widening crypto-sanctions divergence. FinCEN revised the Corporate Transparency Act reporting-company definition to exempt every US-formed domestic reporting company, including Oregon-formed LLCs and corporations, from beneficial-ownership-information reporting, with the rule effective upon Federal Register publication on 26 March 2025. Oregon lacks any state-level beneficial ownership registry, leaving no backstop to the narrowed federal regime for Oregon-formed entities, a structural transparency gap rather than an isolated event.

On 20 May 2026 OFAC designated more than a dozen individuals and entities operating a Sinaloa Cartel Los Chapitos cash-to-stablecoin laundering cell that converted bulk cash proceeds from US fentanyl sales into stablecoins for cross-border transfer to Mexico. Neither the EU nor the UK has mirrored this designation, a gap producing divergent enhanced-due-diligence exposure for EU- and UK-regulated virtual-asset service providers interacting with the same designated addresses. Separately, TRM Labs attributes USD 1.92 billion in 2025 cryptocurrency theft to DPRK-linked actors, laundered via chain-hopping and Chinese OTC broker networks, sustaining a proliferation-financing corridor whose settlement architecture, not any single theft, is the persistent structural fact of concern.

Other Developments

The severance of Huione Group from the US financial system unfolded as FinCEN designated the Cambodia-based conglomerate under Section 311 as a foreign financial institution of primary money-laundering concern, after the entity and successor entities processed more than USD 39.6 billion in 2025; the Section 311 special-measures authority used here has no direct EU/UK statutory equivalent, leaving EU/UK institutions discretionary on Huione-linked exposure absent parallel listings.

A narrowed federal prosecutorial posture for crypto-related BSA violations emerged as a Deputy Attorney General memorandum disbanded the National Cryptocurrency Enforcement Team and directed prosecutors to deprioritize standalone or unwitting Bank Secrecy Act regulatory violations absent willful misconduct, while explicitly preserving enforcement where knowing and willful violations are evidenced.

A forthcoming stablecoin onboarding-control mandate is taking shape as FinCEN, the OCC, the Federal Reserve, the FDIC, and the NCUA jointly proposed a GENIUS Act Customer Identification Program rule for stablecoin issuers and participants, expected in force around the fourth quarter of 2026 and reaching Oregon-chartered institutions and Oregon Division of Financial Regulation-licensed virtual-asset service providers alike.

A prolonged due-diligence gap for private-fund structures persists because the effective date of the Investment Adviser AML/CDD Rule was postponed to 2028, prolonging a beneficial-ownership-linked due-diligence compliance gap exploitable via private-fund layering structures reachable from Oregon.

The February 2026 FATF plenary outcome added Kuwait and Papua New Guinea to the Increased Monitoring list, while Iran, DPRK, and Burma remain on the Call for Action list; the United States is not listed on either list.

A national elder-fraud cash-out vector is described in FinCEN Notice FIN-2025-NTC1, issued in August 2025, which flags scam networks directing victims, including the elderly, to deposit cash at crypto ATMs via QR code for rapid sweep to scammer-controlled wallets.

A documented domestic enabler architecture persists in the low-disclosure Oregon LLC formation regime, since a domestic shell-company assessment by FinCEN cites an Oregon-based fraudulent-loan-scheme case as illustrative of a national anonymous-entity vulnerability, a vulnerability widened by the 2025 CTA domestic exemption.

Geographic-scope exclusion, not enforcement anomaly describes the position of Oregon relative to the expanded Southwest Border Geographic Targeting Order, since the 2026 expanded GTO covers designated counties and ZIP codes in Arizona, California, New Mexico, and Texas by definition of border proximity, and the exclusion of Oregon follows from this defined scope, though it leaves enhanced MSB reporting tools uncalibrated for Portland-area fentanyl cash-to-crypto exposure.

Growing on-chain attribution of terror-designated entities compounds exposure, as cryptocurrency addresses attributable to already-designated terror-financing entities, including the IRGC, a Hamas-linked exchange, and Ansarallah and Houthi networks, increasingly transact on-chain, a forensic-attribution improvement that is itself a downstream sanctions-exposure signal for US virtual-asset service providers, including Oregon-licensed money transmitters.

Cross-Monitor Connections

The unmirrored OFAC cartel crypto-cell designation is flagged for GMM sanctions-as-macro-variable tracking, since designation-scope divergence between the US and EU/UK regimes shapes correspondent-banking and enhanced-due-diligence exposure beyond the sanctions function itself. The DPRK proliferation-financing corridor and the continuing on-chain attribution of terror-designated entities sit at the intersection of counter-proliferation and counter-terrorist-financing pillars that this monitor tracks structurally, a framing intended to correct the volume bias that AML enforcement activity otherwise imposes on CTF and CPF signal within a single-jurisdiction brief.

Outlook

Three forward-looking items dominate the horizon for Oregon-facing institutions. The proposed GENIUS Act stablecoin Customer Identification Program rule is expected in force around the fourth quarter of 2026, tightening onboarding-control obligations for banks and money-services businesses including Oregon-licensed virtual-asset service providers. The Investment Adviser AML/CDD Rule remains adopted but its substantive applicability is deferred to 2028, prolonging the private-fund due-diligence gap described above. FATF is expected to conduct its next grey-list review at the October 2026 plenary, a moment relevant to correspondent-banking enhanced-due-diligence triggers even though the United States itself is not expected to be listed. A further, lower-confidence item concerns a potential federal reclassification of marijuana to a less restrictive schedule, which if finalised could ease federal banking access for the licensed cannabis industry of Oregon and reduce cash-intensive trade-based money-laundering exposure associated with that sector.