Financial Integrity Monitor

United States — Virginia US-VA

Domains (D1–D6)
3
Sources
8
Role actions
8
Jurisdiction profile
CompliantTier ARisk: IncreasingMixed

Virginia operates under the federal BSA/AML framework administered by FinCEN (headquartered in Vienna, VA) and OFAC, supplemented by state money-transmitter licensing through the SCC Bureau of Financial Institutions (Richmond).

MoreThe Eastern District of Virginia (Alexandria) is a principal DOJ national-security prosecution venue for sanctions-evasion and crypto cases. No state-level beneficial-ownership registry exists; federal BOI reporting for domestic entities was suspended in 2025.

Key deficiencies
  • No federal or Virginia state beneficial-ownership disclosure requirement for domestically-formed LLCs/corporations following the 2025 CTA domestic-entity exemption
  • Vacatur of the nationwide Residential Real Estate Rule leaves a reporting gap for Northern Virginia/DC-metro high-value cash real estate transactions previously covered only by expiring GTOs
  • State-level money transmitter licensing patchwork creates supervisory seams for MSBs and crypto firms operating across DC-Maryland-Virginia lines
Recent developments (18m)
  • FinCEN interim final rule (Mar 2025) exempted all US-formed 'domestic reporting companies' from CTA beneficial ownership reporting
  • DOJ unsealed indictment against Garantex crypto-exchange operators in the Eastern District of Virginia (Feb 27, 2025) and OFAC designated co-administrator Mira Serda (Aug 14, 2025)
  • FinCEN Consent Order against Richmond-headquartered Brink's for operating an unregistered money transmitting business (Feb 6, 2025)
  • FinCEN's Residential Real Estate Rule (effective Dec 1, 2025, postponed to Mar 1, 2026) was vacated by a federal court on Mar 19, 2026 and is under DOJ appeal, with legacy GTOs covering Virginia counties expiring Feb 28, 2026
  • Treasury published the 2026 National Money Laundering Risk Assessment (Mar 2026) and 2026 National Terrorist Financing Risk Assessment
  • FinCEN/OFAC issued a joint NPRM (Apr 2026) applying BSA/AML and sanctions-compliance obligations to GENIUS Act stablecoin issuers
Weekly brief

Lead signal

Lead Signal

Read full brief

Lead Signal

AMLA's formal absorption of the European Banking Authority's EU-level AML/CFT mandate, effective 1 January 2026, is the structural signal of this cycle (High confidence, Tier 1). The Authority has opened, and since closed on 27 January 2026, a consultation on the methodology it will use to select the approximately 40 high-risk cross-border entities it plans to supervise directly from 2028, while the AML Regulation single rulebook remains on track for direct EU-wide applicability from 10 July 2027. The mandate transfer is anchored in the AMLA Regulation (Reg (EU) 2024/1620), Article 54, which sets out the governance basis for the Authority's direct-supervision powers; the practical effect for the industry is that the highest-risk cross-border obliged entities will, from 2028, answer to Frankfurt rather than solely to their home-state regulator, even as day-to-day supervision of the vast majority of obliged entities remains national. That bifurcation, more than any single enforcement action, is the structural story of the EU AML architecture in 2026.

Other Developments

Cambodia's central bank went public with grey-list risk. The Governor of the National Bank of Cambodia warned that persistent scam-centre and illegal online-gambling proceeds could trigger a third FATF grey-list placement for the country, with a second national risk assessment now underway (Assessed confidence, Tier 3). Cambodia sits outside the EU AML Package's own perimeter, but the pattern is structurally comparable: a jurisdiction under sustained scrutiny opting to signal its own risk publicly rather than wait to be re-listed, which is itself a form of enablement-versus-enforcement signalling that financial-integrity analysis should weight independently of whether a formal re-listing follows.

US federal stablecoin rulemaking advanced on two tracks at once. The FDIC (7 April 2026) and the OCC (25 February 2026) both moved forward proposed rules implementing the GENIUS Act, establishing prudential, reserve, redemption, and custodial standards for payment stablecoin issuers (High confidence, Tier 1). The absence of a finalized rule a year past the statute's original one-year implementation clock is itself worth flagging under the enablement lens this monitor applies throughout: an extended proposed-rule period is not enforcement failure, but it does extend the window in which payment stablecoin issuers operate against standards that are proposed rather than binding.

Cross-Monitor Connections

Cambodia's casino-linked laundering exposure sits at the intersection of enabler-jurisdiction risk and the kind of state-capacity questions typically tracked under a world-development lens: the National Bank's public warning is as much an admission about enforcement capacity against an entrenched scam-compound ecosystem as it is a financial-integrity finding. On the digital-asset side, the GENIUS Act's dual-track federal rulemaking creates a payments-sector regulatory seam worth watching in parallel with any payments-monitor coverage of stablecoin issuance and settlement infrastructure, since the custodial and reserve standards FDIC and OCC are proposing will shape how payment stablecoins move value across the same corridors payments monitors track for commercial dynamics. Neither connection implies a shared finding beyond what each domain's own evidence supports; the value of drawing the connection explicitly is to prevent the AML/CFT reading of Cambodia's exposure, or the prudential reading of the GENIUS Act rules, from being assessed in isolation from the broader enablement and payments-infrastructure context in which each development sits.

Outlook

The AMLA build-out has three dated markers ahead: the Authority's first work programme and supervisory methodology, expected in 2026 Q4; the AMLR's EU-wide direct applicability from 10 July 2027; and the start of direct supervision of the first cohort of high-risk entities in 2028 Q1, contingent on a selection methodology not yet finalized. On the digital-asset track, GENIUS Act implementing rules are not expected to finalize before 2027 Q1, meaning payment stablecoin issuers will operate under proposed-rule uncertainty through the balance of this year. Cambodia's second national risk assessment is the item to watch for any signal of an actual re-listing determination, which has not yet occurred. None of these three threads is close to resolution within the current cycle, and each carries multi-year or half-year uncertainty bands rather than near-term determinations.

weekly_brief_draft · JID US-VA
Domain intelligence (D1–D6)

D1 Sanctions

Not covered

Sanctions is not yet covered for this jurisdiction in this report.

D2 Beneficial Ownership and Corporate Transparency

Beneficial Ownership and Corporate Transparency

Continue reading

The durable backdrop against which this cycle's beneficial-ownership and corporate-transparency signal should be read is the architecture of the EU AML Package itself: three distinct instruments operating on three different tracks. The AML Regulation (AMLR, Regulation (EU) 2024/1624) is directly applicable across the EU without national transposition and is on track to take effect EU-wide from 10 July 2027. The sixth AML Directive (6AMLD) operates on a separate, per-Member-State transposition track, the status of which was not independently re-verified this cycle. And the AMLA Regulation (Regulation (EU) 2024/1620) establishes the Anti-Money Laundering Authority itself, the EU-level body now responsible for direct supervision of a defined cohort of high-risk obliged entities. These three instruments together are shifting the EU's AML/CFT supervisory perimeter from a purely national model toward a hybrid EU-national regime, and that structural shift, not any single enforcement action, is the frame within which the developments below sit.

This cycle's concrete development is AMLA's formal absorption of the European Banking Authority's EU-level AML/CFT mandate, effective 1 January 2026, corroborated by two independent EU primary sources at High confidence. The Authority has also opened, and subsequently closed on 27 January 2026, a consultation on the methodology it will use to select the approximately 40 high-risk cross-border entities it intends to supervise directly beginning in 2028. The obligation basis for this build-out is grounded in Article 54 of the AMLA Regulation, which establishes the governance framework for the Authority's direct-supervision powers over cross-border obliged entities, and the control-gap signal on that obligation is recorded as partial, reflecting that implementing detail is still being worked out rather than finalized.

For beneficial-ownership and corporate-transparency purposes specifically, the significance of the mandate transfer is less about a new disclosure requirement and more about who enforces existing ones. A supervisory body with a genuinely EU-wide vantage point, rather than national authorities each supervising their own slice of the market, is structurally better positioned to catch beneficial-ownership obscuration that relies on jurisdiction-shopping across Member States. AMLA's direct-supervision cohort, once selected, will be the test case for whether that structural advantage translates into practice. The Authority has not yet published its final selection criteria, and the Interpreter has logged that gap explicitly.

The AMLR single rulebook remains the other half of this cycle's D2 story. Its EU-wide direct applicability from 10 July 2027 will, for the first time, give every Member State the same beneficial-ownership and due-diligence baseline without relying on transposition choices that have historically produced meaningful divergence across the bloc. That divergence is precisely what 6AMLD's per-state transposition track has left open, and because that transposition status was not independently re-verified this cycle, this brief cannot say with confidence how far any given Member State remains from the AMLR baseline it will eventually be bound by regardless.

For obliged entities operating cross-border within the EEA, the practical near-term implication is preparatory rather than operational: until AMLA publishes its selection methodology and work programme, no institution can yet know with certainty whether it will fall within the approximately 40-entity direct-supervision cohort from 2028. The prudent posture in the interim is to treat the AMLR's 2027 direct-applicability date as the harder near-term deadline, since it applies EU-wide regardless of any institution's eventual supervisory assignment, while treating the AMLA direct-supervision question as a 2027-2028 planning item rather than an immediate compliance deadline.

None of this cycle's D2 finding rests on Tier 3 or Tier 4 sourcing: both the mandate-transfer fact and its Article 54 governance basis trace to Tier 1 EU primary sources, which is the appropriate sourcing standard for a structural finding of this consequence.

Outlook

Three dated markers define the D2 horizon. AMLA is expected to publish its first work programme and supervisory methodology in 2026 Q4, which should clarify near-term supervisory priorities ahead of any direct-supervision activity. The AMLR's EU-wide direct applicability arrives in 2027 Q3 alongside the 6AMLD transposition deadline, a milestone this brief flags as a genuine state-of-play event rather than a routine date given the historical divergence in Member State transposition. And AMLA's direct supervision of its first cohort of high-risk cross-border entities begins in 2028 Q1, contingent on a selection methodology whose final criteria remain unpublished. Watch for the AMLA work programme publication as the most immediate signal of how the Authority intends to operationalize its new mandate, and for any interim update on 6AMLD transposition status, which remains a logged gap rather than a confirmed null finding.

D3 Enabler Jurisdictions and Professional Facilitators

Enabler Jurisdictions and Professional Facilitators

Continue reading

Cambodia's central bank put a specific warning on the record this cycle. The Governor of the National Bank of Cambodia publicly warned that persistent scam-centre and illegal online-gambling proceeds could trigger a third FATF grey-list placement for the country, and disclosed that a second national risk assessment is now underway (Assessed confidence, Tier 3, corroborated by two independent trade-press sources). This is a comparatively thin evidentiary base for this cycle - a single primary claim resting on Tier 3 sourcing rather than a Tier 1 FATF statement - and this brief flags that limitation rather than overstating what the warning establishes.

What the warning does establish, on the architecture-over-incident principle this monitor applies, is that Cambodia's casino- and remittance-sector laundering exposure has not resolved despite reported enforcement activity including licence revocations and asset freezes. A regulator volunteering its own re-listing risk in public, ahead of any FATF determination, is itself an enablement-versus-enforcement signal worth weighting independently: it suggests the National Bank assesses its own enforcement capacity as still inadequate against an entrenched scam-compound ecosystem, rather than resolved by the enforcement actions already reported. No FATF re-listing has actually occurred as of this cycle, and this brief does not treat the Governor's warning as equivalent to a determination.

Outlook

The item to watch is the outcome of Cambodia's second national risk assessment, which is the mechanism through which any actual re-listing risk would be substantiated ahead of a FATF Plenary determination. No dated horizon marker for this specific development was available in the Interpreter's regulatory-horizon set this cycle; this brief will look for either a Tier 1 FATF statement or confirmation of the national risk assessment's completion in a future cycle before upgrading this finding beyond Assessed confidence.

D4 Conflict Finance

Not covered

Conflict Finance is not yet covered for this jurisdiction in this report.

D5 Crypto, Digital Assets, and Financial Innovation

Crypto, Digital Assets, and Financial Innovation

Continue reading

US federal stablecoin regulation advanced on two separate agency tracks this cycle, converging on the same statutory mandate but proceeding independently. The FDIC's Board of Directors approved a notice of proposed rulemaking on 7 April 2026 implementing GENIUS Act requirements and standards for payment stablecoin issuers, and the OCC issued its own implementing bulletin on 25 February 2026 (High confidence, Tier 1, corroborated by two independent federal primary sources). Together, the two proposals establish prudential, reserve, redemption, and custodial-safekeeping standards for permitted payment stablecoin issuers, with the underlying statutory obligation traced to 12 U.S.C. 5904(c) and recorded at an in-force-pending citation stage with a partial control-gap signal, reflecting that the implementing detail is still being finalized rather than settled.

The architecture-over-incident read here is that this is not a single enforcement action against a specific stablecoin issuer, but the build-out of the prudential perimeter that will eventually govern the entire payment-stablecoin sector in the United States. That the perimeter is being built by two separate prudential regulators rather than one is itself structurally significant: it means payment stablecoin issuers touching both FDIC-supervised and OCC-supervised institutions face two rulemaking tracks that must eventually be reconciled.

Timing is the second half of this cycle's D5 story. The GENIUS Act's own statutory implementation clock called for final rules within roughly one year of enactment in July 2025; neither the FDIC's nor the OCC's proposal has yet finalized, and the Interpreter's own gap assessment records that the statutory one-year deadline is likely to slip into 2027 based on industry retrospective analysis, with the OCC's own comment period on its rulemaking having closed 1 May 2026. This is a genuine and disclosed regulatory delay, and this brief treats it as such rather than characterizing the delay as more consequential than the record supports.

For payment stablecoin issuers and the banks that support them, the practical effect of a dual-track, not-yet-final rulemaking process is an extended compliance-planning window under uncertainty: reserve, redemption, and custodial-safekeeping standards can be anticipated in broad outline from the proposed rules, but firms cannot yet build to a finalized standard. The absence of a finalized rule also has a knock-on effect for state-level money-transmission regimes that intersect with stablecoin activity: institutions operating across both federal and state licensing perimeters must currently track a moving federal target while state regimes proceed on their own timelines.

No sanctions or illicit-finance typology observation was tied to either the FDIC or OCC rulemaking this cycle; the D5 finding here is exclusively a prudential-architecture development, and this brief does not extend it into an illicit-finance risk assessment beyond what the underlying claim supports. Confidence in both the FDIC and OCC developments is High, reflecting two independent Tier 1 federal primary sources rather than secondary reporting, which is the appropriate confidence level for a structural rulemaking development of this consequence; this brief does not extend that confidence to any inference about the eventual content of the final rules, which remain, by definition, proposed rather than settled as of this cycle.

Outlook

The GENIUS Act implementing rules are expected to finalize in 2027 Q1 at the earliest. Watch for either agency issuing a final rule ahead of the other, which would itself signal how the FDIC-OCC reconciliation question is likely to resolve, and for any Federal Reserve action joining the FDIC and OCC on the implementing-rules track, since the Interpreter's horizon entry for this development names all three prudential regulators as eventual parties to finalization.

D6 Compliance Technology & Active Defence

Not covered

Compliance Technology & Active Defence is not yet covered for this jurisdiction in this report.

D7 AML/CTF Regime

Not covered

AML/CTF Regime is not yet covered for this jurisdiction in this report.

Regulatory horizon
No dated horizon items this cycle. 3 items tracked without a confirmed date.
3 pending date · baseline financial-integrity-2026-07-05
Role action cards
MLROHigh

AMLA absorbed the EBA AML/CFT mandate and Cambodia flagged its own grey-list exposure this cycle.

The EU supervisory perimeter for the highest-risk cross-border entities is beginning a multi-year shift toward AMLA direct supervision from 2028, while Cambodia's central bank has publicly acknowledged renewed grey-list risk tied to scam-centre and illegal online-gambling proceeds, both of which are relevant to ongoing jurisdictional and entity-level risk assessment.

2 evidence refs
ComplianceHigh

AMLA's mandate absorption and Cambodia's risk warning both signal jurisdictional-supervision change.

AMLA formally took over the EBA's EU-level AML/CFT tasks effective 1 January 2026, with a consultation closed on direct-supervision selection methodology; separately, Cambodia's public grey-list warning is a jurisdictional risk signal for any control framework weighting enabler-jurisdiction exposure.

2 evidence refs
LegalPossible

No material change this cycle.

No material change for this persona this cycle

BoardHigh

AMLA's absorption of the EBA mandate marks a structural first step toward EU-level AML supervision.

From 2028, the highest-risk cross-border obliged entities will answer to AMLA directly rather than solely to national regulators, a strategic-level shift in the EU AML supervisory landscape that institutions with EU cross-border exposure should track.

1 evidence refs
CTOHigh

FDIC and OCC advanced GENIUS Act stablecoin rulemakings on separate tracks this cycle.

Proposed prudential, reserve, redemption, and custodial-safekeeping standards for payment stablecoin issuers are advancing via two agencies rather than one, meaning any stablecoin-adjacent infrastructure should be built with awareness that reconciliation between the two proposals has not yet occurred and neither rule is final.

1 evidence refs
RiskHigh

Cambodia's grey-list warning and the GENIUS Act's dual-track rulemaking are both emerging exposure signals.

Cambodia's central bank publicly assessed its own renewed grey-list risk as unresolved despite enforcement activity, and US stablecoin prudential rules remain in proposed form roughly a year past the statute's original implementation clock, both representing exposure concentrations to monitor rather than resolved risks.

2 evidence refs
OperationsPossible

No material change this cycle.

No material change for this persona this cycle

AuditHigh

AMLA's supervisory methodology consultation closed without published final selection criteria.

The Authority's direct-supervision selection methodology, tied to Article 54 governance obligations, remains at a partial control-gap stage, which is relevant to audit scoping for institutions assessing eventual EU-level supervisory exposure.

1 evidence refs
Decision lens
MLRO

AMLA absorbed the EBA AML/CFT mandate and Cambodia flagged its own grey-list exposure this cycle.

Compliance

AMLA's mandate absorption and Cambodia's risk warning both signal jurisdictional-supervision change.

Legal

No material change this cycle.

Board

AMLA's absorption of the EBA mandate marks a structural first step toward EU-level AML supervision.

CTO

FDIC and OCC advanced GENIUS Act stablecoin rulemakings on separate tracks this cycle.

Risk

Cambodia's grey-list warning and the GENIUS Act's dual-track rulemaking are both emerging exposure signals.

Operations

No material change this cycle.

Audit

AMLA's supervisory methodology consultation closed without published final selection criteria.

Shared evidence: 3 refs
Scenario sketches

AMLA direct-supervision transition and the evasion landscape

Illustrative scenario for analytical orientation: as AMLA moves from mandate absorption toward direct supervision of a first cohort of high-risk cross-border obliged entities from 2028, the supervisory perimeter shifts from a purely national model toward a hybrid EU-level regime. This could, illustratively, alter where evasion pressure concentrates - potentially toward entities and jurisdictions positioned just outside the eventual direct-supervision cohort, where national-only supervision persists longer. This is architecture-over-incident framing, not a prediction of any specific evasion event.

Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.

Standing trackers (T1–T6)
TrackerStatusNote
T1 · Russian Sanctions-Evasion Architectureno_changeNo material Russia-sanctions-evasion signal surfaced for the US-VA-bound cycle; dedicated OFAC/OFSI/UN Panel search not run this cycle.
T2 · EU AML Package / AMLAno_changeNot directly applicable to the US-VA-bound cycle; no AMLR/6AMLD/AMLA developments in scope.
T3 · FATF Grey Listno_changeNo FATF plenary or grey-list movement surfaced this cycle; not independently re-verified.
T4 · Beneficial-Ownership Register Statusno_changeNo US federal or Virginia-specific beneficial-ownership registry development surfaced this cycle.
T5 · Crypto & Digital-Asset IntegritywatchVirginia's Chapter 19.1 recodification narrows state MTL reach over virtual-currency-only platforms (excluded from 'money'), a state-level digital-asset integrity development worth tracking against federal BSA/MSB coverage of the same actors.
T6 · Sanctions Regime Divergenceno_changeNo EU/US/UK autonomous-listing divergence signal surfaced for this cycle.
Registers

Enforcement actions

  • FinCEN issued a Consent Order finding Brink's operated as an unregistered money transmitter/MSB within the United States without registering with FinCEN or complying with BSA AML program, recordkeeping, and reporting obligations during the relevant period. 6 Feb 2025
  • DOJ unsealed an indictment in the Eastern District of Virginia against the operators of Garantex, a Russian crypto exchange under OFAC sanctions since 2022, alleging they oversaw laundering of hundreds of millions of dollars in cryptocurrency while evading US sanctions. 27 Feb 2025
  • OFAC designated Garantex co-administrator Aleksandr Mira Serda under the Ukraine-/Russia-Related Sanctions Regulations and cyber-related authorities, linking him to Garantex Europe OU, following the Eastern District of Virginia indictment. 14 Aug 2025
  • DOJ filed a civil forfeiture complaint seeking over $7.7 million in cryptocurrency, NFTs, and digital assets tied to a laundering network operated by North Korean IT workers who used fraudulent identities to collect stablecoin payments from US employers. 5 Jun 2025

Sanctions changes

  • OFAC designated Aleksandr Mira Serda, Garantex co-administrator, under Russia-related cyber sanctions authorities following the Eastern District of Virginia federal indictment against him and co-defendant Aleksej Besciokov. 14 Aug 2025
  • Following Garantex's operational migration to a successor platform, OFAC sanctioned Grinex (the Kyrgyzstan-registered successor VASP), Exved, Mendeleev, and the issuer of the rouble-pegged A7A5 stablecoin for continuing to move billions in cryptocurrency value in evasion of sanctions. 1 Aug 2025

Regulatory horizon (register)

  • FinCEN AML/CFT program modernization rule finalization
  • GENIUS Act stablecoin AML/sanctions rule for PPSIs
  • DOJ appeal of vacated Residential Real Estate reporting rule

Active schemes

  • [CRITICAL] Russian crypto-exchange sanctions-evasion pipeline (Garantex/Grinex/A7A5)
  • [CRITICAL] DPRK IT-worker fraud funding WMD/ballistic programs
  • [HIGH] Anonymous LLC shell-company formation post-CTA rollback
  • Non-financed real estate layering in Northern Virginia/DC metro
Sources
  1. FinCEN (U.S. Department of the Treasury)
  2. U.S. Department of the Treasury
  3. Office of Foreign Assets Control (OFAC)
  4. Virginia State Corporation Commission, Bureau of Financial Institutions (via FinCEN state-contact directory)
  5. International Consortium of Investigative Journalists (ICIJ)
  6. Chainalysis
  7. Global Witness
  8. FinCEN (U.S. Department of the Treasury)
Coverage gaps
Since March 2025, all US-formed 'domestic reporting companie…
Since March 2025, all US-formed 'domestic reporting companies' — including Virginia LLCs and corporations — are exempt from Corporate Transparency Act beneficial ownership reporting; only foreign entities registering to do business in the US remain covered, and Virginia has no independent state-level BO registry to fill the gap.
FinCEN's nationwide Residential Real Estate Rule, intended t…
FinCEN's nationwide Residential Real Estate Rule, intended to replace legacy Geographic Targeting Orders covering Northern Virginia/DC-metro counties, was vacated by a federal court on March 19, 2026; reporting persons are not currently required to file Real Estate Reports, and the underlying GTOs expired February 28, 2026, leaving a reporting vacuum for non-financed high-value residential purchases.
No dedicated Virginia state-level ML/TF risk assessment or s…
No dedicated Virginia state-level ML/TF risk assessment or sector-specific risk narrative is publicly available independent of Treasury's national NMLRA/NTFRA; the Virginia SCC Bureau of Financial Institutions does not publish granular state-specific illicit-finance risk data, limiting visibility into sub-national typologies beyond what surfaces through federal enforcement actions and press reporting.

Evidence

Confidence-tiered claims

No structured claims published for this jurisdiction yet.