Financial Integrity Monitor
Sign in

Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved.

Financial Integrity Monitor

United States — New York US-NY

Domains covered
8 of 8
Sources
198
Role actions
8
Horizon <90d
0
Jurisdiction profile
FATF status: Compliant Tier: A Risk direction: Increasing Enablement vs enforcement: Mixed

NY DFS operates the BitLicense regime (23 NYCRR Part 200) and layers state BSA/AML/sanctions examination atop federal FinCEN/OFAC/OCC oversight, positioning NY as the most active state-level AML/crypto regulator in the US.

MoreSimultaneously, NY's historically anonymous LLC formation regime and a national real-estate/legal-professional AML carve-out make the state a persistent venue for shell-company and property-based laundering, now compounded by the March 2025 federal rollback of domestic Corporate Transparency Act reporting.

Key deficiencies
  • Federal CTA rollback (March 2025) exempts all domestic reporting companies, including NY-formed LLCs, from FinCEN beneficial ownership reporting
  • Real estate closing/settlement professionals, title insurers and lawyers remain outside mandatory BSA AML program obligations
  • NY LLC Transparency Act beneficial ownership registry is not publicly searchable, limiting its substitute utility for the federal rollback
  • Federal OCC preemption trend allows crypto firms to obtain national charters that bypass NYDFS supervision
Recent developments (18m)
  • NYDFS extended blockchain-analytics compliance guidance to NY-regulated banks and licensed foreign bank branches (September 17, 2025)
  • OFAC assessed a $7,139,305 penalty against Gracetown Inc., a NY property-management firm, for Deripaska-related sanctions violations (December 4, 2025)
  • OFAC settled with an individual NY-linked fiduciary of a sanctioned oligarch's US family trust for $1,092,000 (December 9, 2025)
  • FinCEN's residential real estate anti-money-laundering final rule took effect (December 1, 2025), covering high-value all-cash NY transactions
  • FinCEN/OFAC issued a joint NPRM applying BSA and sanctions-compliance obligations to GENIUS Act payment stablecoin issuers, several of which are NYDFS-licensed (April 2026)
  • Reporting emerged that federal OCC national-charter reinterpretations are allowing crypto firms to bypass NYDFS and other state AML oversight (May 2026)

United States federal law that applies in United States – New York is covered once, on the United States page. This page covers United States – New York’s own layer: its own law, regulators and enforcement.

Brief

Lead signal

Lead Signal

New York's financial-integrity posture this cycle is defined by the state regulator's continued willingness to reach back into historical conduct years after the fact, even as it simultaneously advances a forward-looking rulemaking for stablecoin issuers. The New York State Department of Financial Services settled with Skandinaviska Enskilda Banken's New York branch for $33 million over customer due diligence gaps and Baltic transaction-monitoring backlogs dated 2015 to 2019, tied to the Panama Papers and Baltic money-laundering scandal era; the federal Department of Justice closed its parallel review with no action. In a related development reported with lower confidence, the department is also said to have penalized Swedbank $50 million for intentionally failing to provide information concerning the Panama Papers matter during a prior inquiry, though this account rests on a single secondary summary rather than a retrieved consent order.

Read full brief

Lead Signal

New York's financial-integrity posture this cycle is defined by the state regulator's continued willingness to reach back into historical conduct years after the fact, even as it simultaneously advances a forward-looking rulemaking for stablecoin issuers. The New York State Department of Financial Services settled with Skandinaviska Enskilda Banken's New York branch for $33 million over customer due diligence gaps and Baltic transaction-monitoring backlogs dated 2015 to 2019, tied to the Panama Papers and Baltic money-laundering scandal era; the federal Department of Justice closed its parallel review with no action. In a related development reported with lower confidence, the department is also said to have penalized Swedbank $50 million for intentionally failing to provide information concerning the Panama Papers matter during a prior inquiry, though this account rests on a single secondary summary rather than a retrieved consent order.

Taken together, the two enforcement actions underscore that branch supervision in New York remains an active check on conduct that occurred roughly a decade ago, not merely a forward-facing compliance exercise. The architecture-level point is that New York continues to function as an enabler-jurisdiction backstop for correspondent-banking relationships that trace back to European scandal-era deficiencies, long after the conduct itself and often after other authorities have closed their files.

Other Developments

A codified cybersecurity risk-assessment duty for exempt money transmitters. The department fined a New York-licensed money transmitter $250,000 under a consent order for failing to conduct a risk assessment sufficient to inform the design of its cybersecurity program, despite the firm qualifying for the limited exemption under the state's cybersecurity regulation. The action signals that qualifying for the limited exemption does not relieve a covered entity of the underlying duty to assess risk before designing its program, extending baseline expectations to firms that might otherwise assume lighter-touch treatment.

Stablecoin issuer rulemaking remains open. The department's proposed regulation establishing a framework for Authorized Payment Stablecoin Issuers remains in rulemaking, with its public comment period closed as of 21 September 2026 but no final rule issued. The proposal would replace the current reliance on bespoke supervisory agreements and a 2022 industry letter with a codified regime covering minimum capital, a backstop requirement, reserve-custody standards, and liquidation triggers, bringing the state's BitLicense and trust-charter stablecoin pathway into closer alignment with the federal GENIUS Act framework. Because the rule has not yet been finalized, issuers operating under existing supervisory agreements continue to do so pending the outcome.

Cross-Monitor Connections

The SEB and Swedbank matters sit at the intersection of financial-integrity supervision and the broader question of state capture and institutional accountability in the enabler jurisdictions where the underlying conduct originated: both actions concern a New York branch or correspondent relationship absorbing continued accountability for Baltic-region conduct years after European authorities and, in the SEB case, the federal Department of Justice itself moved on. The stablecoin rulemaking has a parallel connection to crypto-infrastructure monitoring more broadly, since a finalized capital and reserve-custody regime for payment stablecoins would directly shape how digital-asset issuers chartered in New York manage liquidity risk, with knock-on relevance for any monitor tracking crypto-market structural stability. The cybersecurity risk-assessment finding against an exempt money transmitter also has a bearing on any technology-risk tracking that follows how regulators treat limited exemptions generally, since the reasoning (exemption from a specific regulatory tier does not excuse the underlying duty) is a pattern that could recur in parallel supervisory contexts beyond financial integrity narrowly defined.

Outlook

The near-term marker to watch is whether the proposed stablecoin issuer framework is finalized; as of this cycle it remains in consultation with an expected impact window in the first quarter of 2027, subject to the uncertainty inherent in a rule that has closed its comment period but not yet been adopted. Separately, the SEB and Swedbank matters suggest that further branch-supervision actions tied to the same scandal-era Baltic conduct are plausible, though neither the Swedbank account nor its evidentiary basis has been confirmed to the same standard as the SEB settlement, so that claim should be read as provisional pending a primary consent order. On the compliance-technology side, the money-transmitter cybersecurity action suggests continued supervisory attention to whether exempt entities are meeting baseline risk-assessment duties, a theme likely to recur as the department tests the practical boundaries of its limited-exemption provisions.

Earlier periodic briefs (7)
4 Nov 2026 · fim-2026-11-01

Lead Signal

New York's financial-integrity posture is defined by the state regulator's continued willingness to reach back into historical conduct years after the fact, even as it simultaneously advances a forward-looking rulemaking for stablecoin issuers. The New York State Department of Financial Services settled with Skandinaviska Enskilda Banken's New York branch for $33 million over customer due diligence gaps and Baltic transaction-monitoring backlogs dated 2015 to 2019, tied to the Panama Papers and Baltic money-laundering scandal era; the federal Department of Justice closed its parallel review with no action. In a related development reported with lower confidence, the department is also said to have penalized Swedbank $50 million for intentionally failing to provide information concerning the Panama Papers matter during a prior inquiry, though this account rests on a single secondary summary rather than a retrieved consent order.

Taken together, the two enforcement actions underscore that branch supervision in New York remains an active check on conduct that occurred roughly a decade ago, not merely a forward-facing compliance exercise. The architecture-level point is that New York continues to function as an enabler-jurisdiction backstop for correspondent-banking relationships that trace back to European scandal-era deficiencies, long after the conduct itself and often after other authorities have closed their files.

Other Developments

A codified cybersecurity risk-assessment duty for exempt money transmitters. The department fined a New York-licensed money transmitter $250,000 under a consent order for failing to conduct a risk assessment sufficient to inform the design of its cybersecurity program, despite the firm qualifying for the limited exemption under the state's cybersecurity regulation. The action signals that qualifying for the limited exemption does not relieve a covered entity of the underlying duty to assess risk before designing its program, extending baseline expectations to firms that might otherwise assume lighter-touch treatment.

Stablecoin issuer rulemaking remains open. The department's proposed regulation establishing a framework for Authorized Payment Stablecoin Issuers remains in rulemaking, with its public comment period closed as of 21 September 2026 but no final rule issued. The proposal would replace the current reliance on bespoke supervisory agreements and a 2022 industry letter with a codified regime covering minimum capital, a backstop requirement, reserve-custody standards, and liquidation triggers, bringing the state's BitLicense and trust-charter stablecoin pathway into closer alignment with the federal GENIUS Act framework. Because the rule has not yet been finalized, issuers operating under existing supervisory agreements continue to do so pending the outcome.

Cross-Monitor Connections

The SEB and Swedbank matters sit at the intersection of financial-integrity supervision and the broader question of state capture and institutional accountability in the enabler jurisdictions where the underlying conduct originated: both actions concern a New York branch or correspondent relationship absorbing continued accountability for Baltic-region conduct years after European authorities and, in the SEB case, the federal Department of Justice itself moved on. The stablecoin rulemaking has a parallel connection to crypto-infrastructure monitoring more broadly, since a finalized capital and reserve-custody regime for payment stablecoins would directly shape how digital-asset issuers chartered in New York manage liquidity risk, with knock-on relevance for any monitor tracking crypto-market structural stability. The cybersecurity risk-assessment finding against an exempt money transmitter also has a bearing on any technology-risk tracking that follows how regulators treat limited exemptions generally, since the reasoning (exemption from a specific regulatory tier does not excuse the underlying duty) is a pattern that could recur in parallel supervisory contexts beyond financial integrity narrowly defined.

Outlook

The near-term marker to watch is whether the proposed stablecoin issuer framework is finalized; it remains in consultation with an expected impact window in the first quarter of 2027, subject to the uncertainty inherent in a rule that has closed its comment period but not yet been adopted. Separately, the SEB and Swedbank matters suggest that further branch-supervision actions tied to the same scandal-era Baltic conduct are plausible, though neither the Swedbank account nor its evidentiary basis has been confirmed to the same standard as the SEB settlement, so that claim should be read as provisional pending a primary consent order. On the compliance-technology side, the money-transmitter cybersecurity action suggests continued supervisory attention to whether exempt entities are meeting baseline risk-assessment duties, a theme likely to recur as the department tests the practical boundaries of its limited-exemption provisions.

3 Nov 2026 · fim-2026-11-03

Lead Signal

New York's financial supervisor spent the cycle doing two things at once: punishing the past and drafting the future. On enforcement, the Department of Financial Services reached a USD 33 million settlement with the New York branch of Skandinaviska Enskilda Banken over customer due diligence gaps and Baltic transaction-monitoring backlogs dating to 2015-2019, and separately penalized Swedbank USD 50 million over conduct tied to withholding information connected to the Panama Papers matter. On rulemaking, the proposed 23 NYCRR Part 202 framework for Authorized Payment Stablecoin Issuers remains in consultation, with the comment period having closed on 21 September 2026 and no final adoption date yet confirmed. Taken together, the two threads describe a supervisor that continues to look backward at historical correspondent-banking conduct even as it builds a forward-looking capital, custody and liquidation-trigger architecture for stablecoin issuance aligned with the federal GENIUS Act.

The enforcement actions are notable less for their size than for their timing: both settlements reach back years into conduct periods, reinforcing that branch supervision in New York functions as a durable enabler-jurisdiction check rather than a point-in-time filter. The due-diligence and transaction-monitoring failures attributed to SEB and the information-withholding conduct attributed to Swedbank both sit within the AML/CTF pillar, and both illustrate that the architecture of correspondent-bank supervision in New York continues to surface conduct years after the fact.

Other Developments

A separate cybersecurity consent order closed against a money transmitter, Order Express, which paid USD 250,000 after the Department found that the firm, though qualifying for a limited exemption under the cybersecurity regulation, had failed to conduct a risk assessment sufficient to inform the design of its cybersecurity program. The finding sits at the intersection of compliance technology and active defence: exemption from the full weight of a cybersecurity rule does not remove the underlying obligation to assess risk before designing controls, and the Department treated the gap as substantive rather than procedural.

The stablecoin rulemaking track continues to move, with the proposed Part 202 text setting out minimum capital and backstop requirements for Authorized Payment Stablecoin Issuers alongside controls on reserve custody. The proposal would formally withdraw the superintendent's 2022 industry letter and supersede potentially inconsistent supervisory agreements that have governed issuers to date, replacing a patchwork of bespoke arrangements with a single codified regime. No adoption date has been confirmed; the expected timeframe sits in early 2027, subject to the uncertainty inherent in any rule still in consultation.

Cross-Monitor Connections

The correspondent-banking enforcement actions against SEB and Swedbank connect directly to conflict-finance and state-capture-adjacent monitoring elsewhere in the fleet: transaction-monitoring backlogs and information-withholding conduct at the correspondent-bank layer are a standard vector by which illicit flows move through otherwise well-regulated financial centres, and New York's willingness to revisit years-old conduct is itself a signal about the durability of that check. The stablecoin rulemaking, meanwhile, connects to digital-asset and financial-innovation tracking across jurisdictions: a codified reserve-custody and liquidation-trigger regime in New York, aligned to the federal GENIUS Act, narrows the degree to which issuers chartered there can rely on bespoke supervisory agreements rather than public rules, a structural shift with implications for how digital-asset flows are tracked and constrained elsewhere.

Outlook

The near-term picture for New York is one of parallel tracks: continued enforcement attention on historical AML and transaction-monitoring conduct at branches of foreign banks, and a stablecoin rule that, as scheduled, would take effect around early 2027 but remains unresolved at this point. Readers should treat the Part 202 timeline as provisional until a final rule is adopted; the architecture it would impose, however, is already clear from the consultation text and represents a durable shift away from supervisory-agreement-based oversight of payment stablecoin issuers toward a codified capital and custody regime.

25 Oct 2026 · fim-2026-10-25

Lead Signal

Industry pressure on New York's proposed payment-stablecoin issuer rule, 23 NYCRR Part 202, continued inside this window. a16z's comment letter, dated 21 September 2026 and reported 20-21 October 2026, urges the Department of Financial Services to withdraw or rewrite the proposed rule pending final federal GENIUS Act standards, warning that premature state finalization risks a certification-standard divergence between New York's own stablecoin issuer requirements and the federal regime once it is finalized. The proposed rule, published 22 July 2026, remains at the consultation stage, with existing New York-authorized issuers expected to receive twelve months post-effective-date to comply, except for an earlier BSA/AML/sanctions certification deadline under section 202.9(b) that would bite sooner than the Part's general compliance runway.

Other Developments

Standing enforcement context. The New York Department of Financial Services' $33,000,000 consent order against Skandinaviska Enskilda Banken AB and its New York Branch, dated 15 October 2026, addressed anti-money-laundering program failures, including customer due diligence, correspondent-bank due diligence, and backlogged transaction monitoring, tied to the 2016 Panama Papers leak. This order predates the current window by several days and is carried here as contextual background rather than a new-this-cycle finding; the underlying conduct spanned 2015 onward, and the jurisdictional connection to New York was itself modest, with roughly $2.5 million in funds having flowed through the bank's New York branch.

Cross-Monitor Connections

The certification-timing tension in Part 202 sits precisely at the intersection of state payments supervision and federal anti-money-laundering architecture: the earlier BSA/AML/sanctions certification deadline under section 202.9(b) means an authorized issuer's AML compliance clock and its general operational compliance clock would run on different timelines, a structural feature that any institution tracking both the state rule and federal GENIUS Act rulemaking needs to account for jointly rather than separately.

Outlook

The near-term question for New York's stablecoin supervisory posture is whether the Department proceeds to finalize Part 202 on its current track or defers pending final federal GENIUS Act standards, as industry is requesting. The regulatory horizon places an expected impact date for this rule in the first quarter of 2027, with a six-month uncertainty band reflecting the live possibility of delay. Institutions operating or planning to operate as payment stablecoin issuers in New York should treat the BSA/AML/sanctions certification deadline under section 202.9(b) as the operative near-term planning date regardless of how the broader timing question resolves, since that specific obligation is drafted to precede the general compliance runway.

18 Oct 2026 · fim-2026-10-18

Lead Signal

New York is building two distinct state-level regulatory perimeters simultaneously, and read together they describe a pattern of enabler-jurisdiction behaviour worth tracking beyond this single state. NYDFS's proposed 23 NYCRR Part 202 would codify an Authorized Payment Stablecoin Issuer framework aligned with the federal GENIUS Act, with an effective date tied to that Act's own commencement and due no later than January 18, 2027. Existing NY-approved issuers would not need fresh approval but must achieve full compliance within twelve months of the effective date. In parallel, NYDFS's proposed 3 NYCRR Part 423 would create a new BNPL licensing regime for originators, platform operators and loan-acquirers under New York's Banking Law Article 14-B, with New York City's Department of Consumer and Worker Protection filing comments on September 21, 2026 urging the rule be expanded to cover medical and rent financing. Neither rule is yet adopted, but the direction of travel is unambiguous: a state regulator moving to fill regulatory space as a federal regulator's posture on a comparable product category recedes.

Other Developments

The stablecoin alignment proposal positions New York as the first state to formally structure its own issuer framework around the federal GENIUS Act rather than waiting for federal preemption to settle the question. This is a structural choice, not an incidental one: a state regulator choosing to harmonise ahead of a federal commencement date signals an attempt to be positioned as the compliant pathway once the federal framework takes effect, rather than a laggard needing retrofitting. The BNPL licensing proposal reflects a different dynamic: it is New York stepping into a product category increasingly characterised as underserved by federal oversight. The comment period on Part 423 closed September 14, 2026, and the municipal-level intervention from NYC's consumer protection agency, pushing for the rule's scope to widen, suggests appetite for a broader perimeter than NYDFS's initial draft contemplated. The standing AML architecture underneath both proposals remains unchanged this cycle: New York's BitLicense AML programme (23 NYCRR 200.15) and its cybersecurity regulation (23 NYCRR Part 500) continue to layer state-specific governance duties atop the federal BSA/FinCEN baseline, a dual-track supervisory structure that predates this cycle's developments and was not amended within it.

Cross-Monitor Connections

The stablecoin alignment proposal is a live cross-reference for the World Payments monitor's tracking of digital-money infrastructure, since NYDFS's choice of Authorized Payment Stablecoin Issuer terminology and reserve/redemption/custodian-concentration requirements will shape how stablecoin issuers operating through New York structure their compliance architecture ahead of the federal GENIUS Act's own commencement. The BNPL licensing proposal is a parallel reference point for the same monitor's product-access tracking, given its direct bearing on how BNPL originators and platform operators structure consumer-facing lending products in a state that is moving ahead of federal BNPL oversight. Neither development currently carries an illicit-finance typology signal strong enough to warrant a typology observation this cycle; both are infrastructure and licensing developments rather than evasion or layering patterns.

Outlook

The stablecoin rule's effective date is tied to the federal GENIUS Act's own commencement, expected no later than January 18, 2027, which makes the federal timeline the binding constraint on when New York's framework actually takes hold. The BNPL rule is scheduled to take effect 180 days after publication of a Notice of Adoption in the State Register, a date not yet triggered since the rule remains in consultation. Both instruments warrant continued tracking for adoption status, and the NYC DCWP's push to expand BNPL scope to medical and rent financing is worth watching as a signal of how far the final rule's perimeter may extend beyond the originally proposed categories.

11 Oct 2026 · fim-2026-10-11

Lead Signal

New York's Department of Financial Services signed a seven-page memorandum of understanding with the Wyoming Division of Banking on 1 October 2026, establishing procedures for sharing supervisory information, coordinating examinations, and cooperating on licensing, chartering and enforcement for virtual-currency and digital-asset firms operating across both states. The arrangement targets roughly six-month licensing reviews for certain established firms, a structural narrowing of the regulatory-arbitrage gap between New York's BitLicense regime and Wyoming's Special Purpose Depository Institution model, confirmed by NYDFS's own press release.

Other Developments

Beneficial-ownership deadline approaching. The New York LLC Transparency Act requires non-U.S.-formed LLCs that were doing business in New York before 1 January 2026 to file a beneficial-ownership disclosure or exemption attestation with the New York Department of State by 31 December 2026. Secondary legal commentary flags that the Department of State's filing portal and forms had not yet been released as of this cycle's reporting, creating a compressed compliance window ahead of the deadline.

Standing AML/CTF architecture unchanged. New York's AML/CTF regime for financial and virtual-currency firms continues to run through NYDFS supervision under Banking Law Article 13-B for money transmitters, 23 NYCRR Part 200 (the BitLicense) and 23 NYCRR Part 504 (transaction monitoring), layered on federal Bank Secrecy Act and OFAC obligations. No development displacing this architecture was identified this cycle.

Cross-Monitor Connections

The NYDFS-Wyoming MOU sits squarely at the intersection of this monitor's sanctions/AML lens and the crypto and world-payments monitors' licensing-architecture lens: the same instrument that formalises AML-relevant supervisory cooperation also reduces the dual-licensing friction a digital-asset firm faces operating in both states. The LLC Transparency Act's beneficial-ownership deadline is a corporate-transparency development with no sanctions-evasion or conflict-finance signal attached this cycle, but a compressed compliance window ahead of a hard December deadline is the kind of gap enabler-jurisdiction analysis watches for in other states' transparency regimes.

Outlook

Watch for the New York Department of State's release of the LLC Transparency Act filing portal ahead of the 31 December 2026 deadline; a late or absent portal release would sharpen the compliance-readiness gap already flagged in secondary reporting. On the digital-asset side, watch for whether the NYDFS-Wyoming cooperation framework is replicated with additional states, which would extend the interstate-supervision model beyond the current two-state arrangement.

28 Sep 2026 · fim-2026-09-28

Lead Signal

FinCEN and OFAC issued a joint notice of proposed rulemaking that would classify Permitted Payment Stablecoin Issuers as Bank Secrecy Act financial institutions, requiring them to maintain AML programs, file suspicious activity reports, and operate five-element sanctions compliance programs. The proposal, an implementing measure under the GENIUS Act (Pub. L. 119-27), closed its comment period on June 9, 2026. This is the most significant single development in this cycle's coverage because it would, for the first time, formally bring payment stablecoin issuers into the same BSA/OFAC supervisory architecture that applies to banks, layering a federal supervisory track onto existing state-level oversight regimes such as New York's.

Other Developments

Cartel-linked fiscal fuel theft. FinCEN issued a supplemental alert on fiscal fuel theft, known as huachicol fiscal, describing financial typologies tied to the Cartel de Jalisco Nueva Generacion and other Mexico-based transnational criminal organisations. The alert updates a prior alert issued in May 2025 and coincided with new OFAC sanctions designations against two Mexican nationals and nine entities tied to CJNG fuel-smuggling schemes. Cambodia grey-list risk. Cambodia's central bank governor publicly warned of renewed FATF grey-list risk tied to online-scam and illegal-casino-linked laundering activity, a standing concern for a jurisdiction previously grey-listed on two occasions. Colombia follow-up status. Colombia remains in the FATF/GAFILAT enhanced follow-up process, with no new plenary action recorded this cycle.

Cross-Monitor Connections

The proposed PPSI rule bears directly on entities supervised by New York's Department of Financial Services, since several major payment stablecoin issuers operate under New York charters; the world-payments monitor separately tracks NYDFS's own proposed 23 NYCRR Part 202 stablecoin framework, and the crypto monitor tracks the same issuers' stablecoin-regime obligations. Readers following those monitors' New York coverage should read this alert as the federal AML/sanctions layer underneath the state-level frameworks those monitors describe. The cartel fuel-theft alert and associated OFAC designations connect to conflict-finance and enabler-jurisdiction typologies tracked structurally rather than episodically; no direct New York nexus was identified for the Mexico-focused material this cycle.

Outlook

The PPSI rule remains at the proposal stage, with FinCEN and OFAC yet to publish a final rule; the expected timeframe for finalisation is around the first quarter of 2027, though this remains an estimate rather than a confirmed date. Issuers and their supervisors, including NYDFS, should watch for the final rule text, which would resolve remaining ambiguity about how the federal BSA financial-institution classification interacts with existing state-level chartering and supervision. Cambodia's grey-list trajectory and Colombia's follow-up status are both standing watch items without confirmed near-term plenary action expected.

3 Sep 2026 · fim-2026-08-05

Lead Signal

OFAC's designation this cycle of 32 Houthi-linked individuals and entities and four vessels is, by Treasury's own characterization, the largest single Yemen sanctions action to date, and it is best read as an architecture finding rather than an isolated incident. The designations target the businessmen and vessel operators who administer Ansarallah's petroleum-import taxation system, the revenue architecture that has funded Houthi Red Sea attack operations at scale. The action sits within a High-confidence, Tier 1 record and demonstrates a sanctions program functioning simultaneously as pressure tool and, elsewhere in the same regime, a managed-relief mechanism. Read as architecture rather than incident, the Houthi action is this cycle's clearest example of a sanctions program doing double duty: escalating pressure on a conflict-finance revenue stream while the broader toolkit continues to manage orderly exit from other exposures elsewhere.

Other Developments

New York's enforcement reach into crypto and prediction markets continued to widen this cycle. The New York Attorney General's escalation of its campaign against Kalshi, from an October 2025 cease-and-desist letter to a civil suit seeking forfeiture, restitution, and treble-damages penalties totaling approximately 36 billion dollars, extends a state-level enforcement theory that already produced suits against Coinbase and Gemini in April 2026 for allegedly operating illegal gambling platforms via prediction-market products. This is architecturally significant for the crypto and digital-asset domain because it applies an unlicensed-gambling theory to platforms that are otherwise federally registered or federally framed, testing a jurisdictional boundary that AML/CFT compliance functions at affected firms will need to track independent of federal licensing status.

The EU's beneficial-ownership transparency architecture showed a credibility gap this cycle. The European Commission has opened infringement proceedings against eleven member states for failing to fully transpose AMLD6 register-access provisions due 10 July 2025, roughly a third of the bloc falling short one year ahead of the AMLA technical-standards package and BO-register provisions due 10 July 2026. This is an Assessed-confidence finding resting on a single vendor secondary source without a corroborating primary Commission notice this cycle, but it is a structurally relevant signal for the durability of the 2027 full-application timeline.

Enabler-jurisdiction exposure deteriorated on two fronts. Cambodia's central bank governor publicly warned of FATF re-listing risk this cycle, citing persistent casino-junket and scam-centre money-laundering activity that has continued despite the jurisdiction's 2023 grey-list exit, a capacity-deficit signal rather than an enforcement one. In Mexico, FinCEN's supplemental alert on CJNG fuel-smuggling and tax-evasion schemes, paired with OFAC sanctions on two Mexican nationals and nine entities, layers onto the continuing Section 311 special-measures isolation of CIBanco, Intercam, and Vector from US correspondent access, compounding an already structural trade-based-money-laundering exposure along the same corridor.

Sanctions delisting proved an incomplete remedy for decentralized mixing infrastructure. An empirical study of Tornado Cash found deposit volume fell roughly 71 percent following its removal from the SDN list, yet the protocol remained implicated in 78.33 percent of Ethereum-related security incidents afterward, evidence that delisting reduces but does not eliminate a mixing protocol's evasion utility. Developer Roman Storm faces an October 2026 retrial on related laundering and evasion counts.

Cross-Monitor Connections

The Houthi petroleum-revenue designations and the Mexican fuel-smuggling and cartel-finance findings both route directly to commodity-flow and conflict-finance monitoring: the same petroleum and fuel corridors that fund Ansarallah's Red Sea operations and CJNG's smuggling networks are the natural cross-reference point for monitors tracking extractive-industry and commodity-trade integrity. New York's crypto and prediction-market enforcement campaign is worth flagging to monitors tracking platform and payments-infrastructure regulation, since the underlying question, whether a federally-framed platform can be reached by state law, has direct payments-infrastructure implications distinct from its financial-crime dimension. The EU beneficial-ownership infringement wave is best read alongside any monitor tracking EU institutional capacity generally, since implementation-capacity gaps of this kind tend to recur across adjacent EU compliance deadlines.

Outlook

The most consequential open question for the next cycle is whether Kalshi's federal-preemption defense succeeds, a ruling that would determine whether state gambling law can reach CFTC-framed derivatives platforms and, by extension, how much comfort other crypto-native platforms can take from federal registration when operating under state AML and gambling regimes simultaneously. On the EU side, watch for whether AMLA actually publishes its 23 RTS/ITS/guidelines package by the 10 July 2026 deadline, given the infringement-proceedings evidence of uneven member-state implementation capacity; a slip here would be a material signal for the credibility of the 2027 AMLR full-application date. Cambodia's re-listing risk and the Mexican corridor's compounding TBML exposure both remain structural rather than episodic and are unlikely to resolve in a single cycle.

Domain intelligence (D1–D8)

D1 Sanctions

no_changestanding position

Sanctions Architecture and Evasion

The most consequential sanctions-architecture development this cycle sits in the counter-terrorist-financing pillar rather than the more heavily enforcement-weighted anti-money-laundering pillar, and is worth foregrounding precisely because CTF and CPF findings are structurally under-represented relative to AML enforcement volume. The Office of Foreign Assets Control designated thirty-two individuals and entities and four vessels tied to Ansarallah financial and procurement networks, the largest single Yemen-related sanctions action to date. The action targets the petroleum-import taxation architecture that has generated the revenue base funding Red Sea attack operations, treating the businessmen and vessel operators who enable that taxation mechanism as the object of designation rather than the militant organization alone. This is an architecture-level intervention: it attacks the financial-services layer that converts petroleum commerce into operational funding, rather than pursuing a single transaction or entity in isolation, and it is held at high confidence on the strength of the primary Treasury press release.

Continue reading

Read alongside the standing Russian sanctions-evasion architecture tracker, the sanctions toolkit continues to function simultaneously as a pressure instrument and a managed-relief mechanism. General License 131H issued by OFAC extends the wind-down authorization for Lukoil International GmbH through 22 August 2026, a rolling compact extension consistent with the pattern of continuing Cuba-related general-license wind-down activity observed on the same standing tracker. That the same regulator is, in the same window, executing the largest-ever single Yemen designation while extending a Russia-related wind-down license illustrates that sanctions architecture is not a monotonic escalation instrument; it is calibrated differently across programs according to strategic objective, with Yemen treated as a pure-pressure case and the Russian energy sector treated as a managed-transition case.

A third development links the sanctions-architecture domain directly to the commodity-flow and enabler-jurisdiction domains covered elsewhere in this cycle tracker. The joint FinCEN supplemental alert and OFAC sanctions action against a Cartel Jalisco Nueva Generacion fuel-smuggling network, targeting two Mexican nationals and nine entities, extends the sanctions toolkit into a domestic commodity-diversion typology that functions as both a trade-based-money-laundering and organized-crime-financing vector. The designation architecture here again targets network nodes, businesses and individuals facilitating the smuggling and laundering of proceeds, rather than pursuing the underlying commodity theft as a standalone criminal matter, held at high confidence on primary joint-agency sourcing.

The Cartel Jalisco Nueva Generacion designation also carries direct Bank Secrecy Act reporting relevance, given its accompanying obligation reference to Bank Secrecy Act suspicious-activity-report filing requirements for banks exposed to trade-finance and correspondent-banking channels linked to the network. This is consistent with a standing pattern in which the Section 311 special-measures designations against CIBanco, Intercam, and Vector, covered in this cycle enabler-jurisdiction domain, and this fuel-smuggling action jointly define a compounding sanctions-and-screening exposure surface for financial institutions with Mexican correspondent relationships, an architecture-level linkage that assessed-confidence secondary reporting corroborates without yet reaching the primary-source strength of the OFAC and FinCEN action itself.

Outlook

Several sanctions-architecture items merit continued tracking. The wind-down authorization for Lukoil International GmbH under General License 131H expires 22 August 2026, and its treatment on renewal, extension, or lapse will be a meaningful signal for whether the managed-relief posture toward Russian energy-sector wind-downs persists. The October 2026 retrial of Roman Storm on Tornado Cash-related laundering and evasion counts, covered in this cycle digital-asset domain, carries sanctions-architecture relevance insofar as it tests whether criminal liability can attach to infrastructure providers independent of the underlying SDN delisting status. The Financial Action Task Force Presidency held by the United Kingdom, which began 1 July 2026 with a stated focus on fraud, scams, and information-sharing, is a further item to watch for whether it produces any divergence from, or alignment with, the US and EU sanctions-list architecture; no direct OFSI counter-designation divergence surfaced this cycle, and this absence is itself worth tracking rather than treating as settled. No dedicated OFSI parallel action on the Yemen and Houthi designations was identified this cycle, a coverage gap the interpreter records explicitly and which should be revisited to determine whether UK sanctions architecture is tracking the US action in substance even without a mirrored formal designation.

Cumulative analysis

This is the standing synthesis of the FIM sanctions-architecture and evasion posture through the current cycle, integrating prior standing-tracker context with this cycle new findings.

Sanctions Architecture and Evasion

The most consequential sanctions-architecture development this cycle sits in the counter-terrorist-financing pillar rather than the more heavily enforcement-weighted anti-money-laundering pillar, and is worth foregrounding precisely because CTF and CPF findings are structurally under-represented relative to AML enforcement volume. The Office of Foreign Assets Control designated thirty-two individuals and entities and four vessels tied to Ansarallah financial and procurement networks, the largest single Yemen-related sanctions action to date. The action targets the petroleum-import taxation architecture that has generated the revenue base funding Red Sea attack operations, treating the businessmen and vessel operators who enable that taxation mechanism as the object of designation rather than the militant organization alone. This is held at high confidence on the strength of the primary Treasury press release.

Read alongside the standing Russian sanctions-evasion architecture tracker, the sanctions toolkit continues to function simultaneously as a pressure instrument and a managed-relief mechanism. General License 131H issued by OFAC extends the wind-down authorization for Lukoil International GmbH through 22 August 2026, a rolling compact extension consistent with continuing Cuba-related general-license wind-down activity on the same standing tracker. That the same regulator is, in the same window, executing the largest-ever single Yemen designation while extending a Russia-related wind-down license illustrates that sanctions architecture is not a monotonic escalation instrument; it is calibrated differently across programs according to strategic objective.

A third development links the sanctions-architecture domain directly to the commodity-flow and enabler-jurisdiction domains. The joint FinCEN supplemental alert and OFAC sanctions action against a Cartel Jalisco Nueva Generacion fuel-smuggling network, targeting two Mexican nationals and nine entities, extends the sanctions toolkit into a domestic commodity-diversion typology functioning as both a trade-based-money-laundering and organized-crime-financing vector, held at high confidence on primary joint-agency sourcing.

The Cartel Jalisco Nueva Generacion designation carries direct Bank Secrecy Act reporting relevance for banks exposed to trade-finance and correspondent-banking channels linked to the network, consistent with a standing pattern in which the Section 311 special-measures designations against CIBanco, Intercam, and Vector and this fuel-smuggling action jointly define a compounding sanctions-and-screening exposure surface for institutions with Mexican correspondent relationships.

Outlook

The wind-down authorization for Lukoil International GmbH under General License 131H expires 22 August 2026, and its treatment on renewal, extension, or lapse will be a meaningful signal for whether the managed-relief posture toward Russian energy-sector wind-downs persists. The October 2026 retrial of Roman Storm carries sanctions-architecture relevance insofar as it tests whether criminal liability can attach to infrastructure providers independent of underlying SDN delisting status. The Financial Action Task Force Presidency held by the United Kingdom, begun 1 July 2026 with a stated focus on fraud, scams, and information-sharing, is a further item to watch for divergence from, or alignment with, US and EU sanctions-list architecture; no direct OFSI counter-designation divergence surfaced this cycle. No dedicated OFSI parallel action on the Yemen and Houthi designations was identified this cycle, a coverage gap that should be revisited in coming cycles.

domain_sub_briefs · D1 · Cumulative analysis
Periodic updates (1)
3 Sep 2026 · fim-2026-08-05

Sanctions Architecture and Evasion

OFAC's designation of 32 Houthi-linked individuals and entities and four vessels is Treasury's largest single Yemen sanctions action to date, targeting the businessmen and vessel operators who administer Ansarallah's petroleum-import taxation architecture. This is a High-confidence, Tier 1 finding: the primary Treasury press release is the sourcing basis, and the action is best read architecturally rather than as an isolated designation event, since it targets a revenue system rather than a single transaction or actor. The designation sits alongside the standing Lukoil International GmbH wind-down authorization, extended through 22 August 2026, illustrating that the same sanctions toolkit is simultaneously being used for escalatory pressure in one theater and managed, orderly relief in another. For sanctions-compliance functions, the practical takeaway is that OFAC's Yemen program has moved decisively toward targeting revenue architecture rather than discrete transactions, which raises the due-diligence bar for any counterparty with petroleum-trade exposure touching Houthi-controlled import points.

Signal on this domain was otherwise limited this cycle: no new UK OFSI parallel action was identified, and no corroborating multilateral designation was retrieved beyond the Treasury action itself. Coverage here should accordingly be read as anchored to the single Treasury designation rather than as a broader sanctions-architecture survey this cycle.

Outlook

Watch for OFSI or EU Council parallel designations that would indicate coordinated multilateral pressure on the same Houthi revenue architecture, and for any additional OFAC follow-on designations targeting the trading and shipping networks that move the taxed petroleum. The absence of a UK-side echo this cycle is itself worth tracking as a gap rather than an absence of interest.

D2 Beneficial Ownership

no_changestanding position

Beneficial Ownership and Corporate Transparency

For New York and the broader United States federal perimeter, this cycle registered no fresh beneficial-ownership or corporate-transparency development among the structured findings gathered. The federal Corporate Transparency Act framework remains the standing beneficial-ownership disclosure architecture relevant to reporting companies domiciled in New York, and it carries forward as an unchanged baseline rather than a fresh signal this cycle. Given that quiet, the material beneficial-ownership movement this cycle sits on the European side, and is presented here as structural backdrop against which any future New York-specific development should be read.

Continue reading

The beneficial-ownership and corporate-transparency architecture of the European Union rests on three distinct instruments that should not be conflated. The AML Regulation, or AMLR, Regulation (EU) 2024/1624, is directly applicable across member states without a transposition step. The sixth Anti-Money Laundering Directive, or 6AMLD, is transposed individually by each member state rather than applying directly. The AMLA Regulation, Regulation (EU) 2024/1620, establishes the Anti-Money Laundering Authority itself, and the direct- and indirect-supervision perimeter of that Authority is shifting beneficial-ownership and broader AML supervision away from a purely national-authority model and toward a hybrid regime in which the Authority directly supervises a defined set of high-risk cross-border obliged entities while indirectly overseeing national supervisors for the remainder. This tripartite structure is the durable backdrop against which this cycle transparency signal should be read, rather than a single-cycle development in itself.

Against that backdrop, the European Commission opened infringement proceedings against eleven member states this cycle for failing to fully notify transposition of sixth-directive register-access provisions ahead of the 10 July 2025 deadline. This is held at assessed rather than high confidence, resting on a single vendor secondary source without a corroborating primary Commission infringement notice retrieved this cycle. Read against the technical-standards package required of AMLA, due for publication by 10 July 2026, and the core beneficial-ownership register provisions due the same date, the infringement wave against roughly a third of member states indicates uneven implementation capacity a year ahead of those deadlines, which could bear on the credibility of the full-application date of the AML Regulation in the third quarter of 2027.

Outlook

The principal item to watch for New York and the broader United States perimeter is whether any Corporate Transparency Act enforcement or beneficial-ownership rulemaking activity registers in coming cycles; none did this cycle, and that absence is treated as a coverage gap rather than a substantive finding. On the European side, the AMLA technical-standards package and the core beneficial-ownership register provisions both fall due 10 July 2026, and an individual member-state transposition breakdown behind the current eleven-state infringement wave was not available this cycle, a gap that should be closed as primary Commission documentation becomes available. The AML Regulation and sixth-directive full-application deadlines in the third quarter of 2027 remain the structural horizon against which the current infringement wave should continue to be measured.

Cumulative analysis

This is the standing synthesis of the FIM beneficial-ownership and corporate-transparency posture through the current cycle, read from the perspective of New York and the broader United States perimeter.

Beneficial Ownership and Corporate Transparency

For New York and the United States federal perimeter, no fresh beneficial-ownership or corporate-transparency development has registered across recent cycles including this one. The federal Corporate Transparency Act framework remains the standing disclosure architecture relevant to New York-domiciled reporting companies, an unchanged baseline rather than a fresh signal.

The beneficial-ownership architecture of the European Union, tracked as durable structural backdrop, rests on three distinct instruments. The AML Regulation, AMLR, Regulation (EU) 2024/1624, is directly applicable across member states without a transposition step. The sixth Anti-Money Laundering Directive, 6AMLD, is transposed individually by each member state. The AMLA Regulation, Regulation (EU) 2024/1620, establishes the Anti-Money Laundering Authority, whose direct- and indirect-supervision perimeter is shifting supervision away from a purely national-authority model toward a hybrid regime supervising a defined cohort of high-risk cross-border obliged entities directly while overseeing national supervisors indirectly for the remainder.

Against that backdrop, this cycle the European Commission opened infringement proceedings against eleven member states for failing to fully notify sixth-directive register-access transposition ahead of the 10 July 2025 deadline, held at assessed confidence. Read against the AMLA technical-standards package and core beneficial-ownership register provisions both due 10 July 2026, this infringement wave against roughly a third of member states indicates uneven implementation capacity a year ahead of those deadlines, bearing on the credibility of the AML Regulation full-application date in the third quarter of 2027.

Outlook

The principal item to watch for New York and the United States perimeter remains whether Corporate Transparency Act enforcement or rulemaking activity registers in future cycles. On the European side, the AMLA technical-standards package and core beneficial-ownership register provisions fall due 10 July 2026, and an individual member-state transposition breakdown was not available this cycle. The 2027 full-application deadlines remain the structural horizon against which the current infringement wave should continue to be measured.

domain_sub_briefs · D2 · Cumulative analysis
Standing baseline position

Non-U.S.-formed LLCs doing business in New York before Jan 1, 2026 must file beneficial-ownership disclosure or exemption attestation with the NY Dept of State by Dec 31, 2026; secondary reporting indicates the filing portal had not yet been released as of this cycle.

Periodic updates (1)
3 Sep 2026 · fim-2026-08-05

Beneficial Ownership and Corporate Transparency

The durable structural backdrop against which this cycle's beneficial-ownership signal should be read is the EU AML Package's three-instrument architecture: the AML Regulation (AMLR, Regulation (EU) 2024/1624), directly applicable across member states without national transposition; the sixth AML Directive (6AMLD), which each member state transposes individually; and the AMLA Regulation (Regulation (EU) 2024/1620), which establishes the Anti-Money Laundering Authority and progressively shifts supervision of higher-risk obliged entities from purely national authorities toward a hybrid EU-level regime through AMLA's direct and indirect supervisory perimeter. This architecture is a standing structural fact, not a single-cycle development, and it is the frame against which any given cycle's member-state-level signal should be measured.

Against that backdrop, this cycle's signal is a credibility gap rather than a positive development: the European Commission has opened infringement proceedings against eleven member states over missed transposition of AMLD6's register-access provisions, due 10 July 2025. That is roughly a third of the bloc falling short one year ahead of two further deadlines, the core AMLD6 beneficial-ownership-register provisions and AMLA's package of 23 regulatory and implementing technical standards and guidelines, both due 10 July 2026, ahead of full AMLR application on 10 July 2027. This finding carries Assessed confidence and rests on a single vendor secondary source without a corroborating primary Commission infringement notice retrieved this cycle, and individual member-state transposition-status detail was not available this cycle.

Outlook

The 10 July 2026 deadlines for AMLA's technical-standards package and the AMLD6 BO-register core provisions are the near-term test of whether this cycle's implementation-capacity gap is resolved or compounds further ahead of the 2027 full AMLR application date. A further round of infringement action, or evidence that AMLA's RTS/ITS package slips, would be the clearest signal that the credibility gap is widening rather than narrowing.

D3 Enabler Jurisdictions

stable

Enabler Jurisdictions

New York's role as a check on enabler-jurisdiction conduct is on display this cycle through two settlements that reach back to the Baltic money-laundering scandal era. The Department of Financial Services settled with Skandinaviska Enskilda Banken's New York branch for $33 million over customer due diligence gaps and Baltic transaction-monitoring backlogs dated 2015 to 2019. The underlying conduct is tied to the broader Panama Papers and Baltic money-laundering scandal, and the federal Department of Justice closed its own parallel review of the matter with no action, leaving the state regulator as the active enforcement authority on this file. Because the underlying consent order text was not independently retrieved this cycle, coverage rests on trade-press reporting, and the confidence attached to this account is probable rather than confirmed.

Continue reading

A second, related development concerns Swedbank, which the department is reported to have penalized $50 million for intentionally failing to provide information concerning the Panama Papers matter during a prior inquiry. This account rests on a single secondary summary rather than a retrieved primary order, and the evidentiary basis is accordingly thinner; the confidence assigned to this claim is uncertain, and it should be read as a reported development pending confirmation from the underlying order itself.

Read together, these two matters illustrate a structural pattern rather than an isolated incident: New York branch supervision continues to extract accountability for conduct that occurred roughly a decade ago, involving correspondent and branch relationships linked to Baltic-region banks whose home-jurisdiction and EU-level scrutiny has already largely run its course. This is the architecture-over-incident reading that matters for enabler-jurisdiction analysis. It is not that New York discovered new wrongdoing this cycle; it is that the state's supervisory reach continues to operate as a backstop against the risk that conduct originating in, or routed through, less assertive enabler jurisdictions escapes consequence once other authorities close their files. The Swedbank matter, if confirmed, adds a further dimension: an entity found to have intentionally withheld information from a prior inquiry would represent a distinct and arguably more serious category of conduct than the due-diligence gaps at issue in the SEB settlement, since it implicates obstruction of supervisory process rather than program deficiency alone.

No other enabler-jurisdiction development specific to New York surfaced this cycle, and the gap in primary-source retrieval for both the SEB and Swedband matters is itself worth flagging: the analysis here rests on secondary characterizations of actions that a reader should expect to see confirmed against the department's own consent order text in a subsequent cycle.

Outlook

The principal marker to watch is whether either the SEB or Swedbank matter is corroborated against a primary consent order, which would allow the confidence currently attached to each account to be reassessed. If the pattern holds, further branch-supervision actions tied to the same Baltic-region, scandal-era conduct would not be surprising, given the volume of correspondent and branch relationships that passed through New York during the period in question. Readers tracking enabler-jurisdiction dynamics should treat the Swedbank claim in particular as provisional until a primary source is available, while treating the SEB settlement, which carries a more substantive secondary account, as the more load-bearing of the two findings this cycle.

Cumulative analysis

This is the standing synthesis of the FIM enabler-jurisdiction and professional-facilitator posture through the current cycle.

Enabler Jurisdictions and Professional Facilitators

Cambodia and Mexico continue to compound the enabler-jurisdiction risk picture, and in both cases the signal remains structural rather than episodic. The central bank governor of Cambodia this cycle publicly warned of Financial Action Task Force re-listing risk, citing persistent casino-junket and scam-centre money-laundering exposure continuing despite the formal exit of the jurisdiction from the grey list in 2023. This continuing exposure is analytically significant because grey-list exit did not, by itself, resolve the underlying enforcement-capacity gap that produced the original listing; the casino-junket and scam-compound laundering typology that drove Cambodia onto the list in the first instance appears to persist as a structural feature of its financial ecosystem.

Mexico continues to present a compounding rather than singular enabler-jurisdiction signal. Section 311 special measures against three financial institutions, CIBanco, Intercam, and Vector, remain in effect, continuing to cut those institutions off from US correspondent-banking access, a standing structural condition against which this cycle new signal should be read: a joint FinCEN supplemental alert and OFAC sanctions action against a Cartel Jalisco Nueva Generacion fuel-smuggling network, designating two Mexican nationals and nine entities. The relevant framework for Mexico is not a single permissive statute but a persistent trade-based-money-laundering corridor in which Section 311-isolated institutions and newly-designated fuel-smuggling facilitators together indicate that targeted institutional isolation has not, on its own, closed the broader laundering corridor associated with cartel-linked commodity diversion.

Read together, Cambodia and Mexico illustrate a common enabler-jurisdiction pattern across cycles: enforcement action against individual nodes, whether casino-junket operators, isolated financial institutions, or fuel-smuggling facilitators, has proceeded without evidence of a broader structural closure of the underlying laundering corridor. This is consistent with the architecture-over-incident principle: the individual designations and warnings are each, on their own, incident-level data points, but their persistence against a backdrop of continuing structural exposure is the more analytically significant finding. Neither jurisdiction this cycle produced a dedicated professional-services-facilitator finding in the narrower sense of lawyers, accountants, or corporate-service providers; this is treated as a collection gap rather than a substantive finding of reduced facilitator risk in either jurisdiction.

Outlook

The public warning issued by the central bank governor of Cambodia should be watched for whether it presages a formal Financial Action Task Force re-listing decision at a future plenary, which would represent a significant reversal of the 2023 delisting. On Mexico, the Section 311 special measures against CIBanco, Intercam, and Vector remain a standing item for confirmation of continuing status, and further OFAC or FinCEN action against additional network nodes in the Cartel Jalisco Nueva Generacion fuel-smuggling architecture should be tracked as a continuation of the current designation series. Both jurisdictions warrant continued monitoring for whether enforcement action begins to address underlying supervisory or institutional capacity rather than individual designated entities, a more durable resolution the current enforcement pattern has not yet achieved.

domain_sub_briefs · D3 · Cumulative analysis
Periodic updates (3)
3 Nov 2026 · fim-2026-11-03

Enabler Jurisdictions

New York's branch-supervision posture surfaced two significant actions that bear directly on how the enabler-jurisdiction lens should read the state's financial centre. The Department of Financial Services reached a USD 33 million settlement with the New York branch of Skandinaviska Enskilda Banken over customer due diligence gaps and Baltic transaction-monitoring backlogs, with the underlying conduct dated to 2015-2019. The settlement is rooted in historical conduct years removed from the present cycle, which is itself the analytically significant feature: New York continues to look backward at correspondent-banking conduct long after the fact rather than treating enforcement as a point-in-time exercise tied to current-year activity.

A second, larger settlement saw Swedbank penalized USD 50 million over conduct described as intentionally withholding information connected to the Panama Papers matter. This action, like the SEB settlement, traces to conduct that predates substantially, and together the two cases describe a consistent pattern: foreign banks operating New York branches face continued exposure to supervisory action rooted in historical due-diligence and disclosure failures, regardless of how much time has elapsed since the underlying conduct occurred.

The architecture-over-incident reading of these two settlements is that New York functions less as a jurisdiction that merely enforces against live misconduct and more as one that maintains an active, long-horizon capacity to revisit correspondent-banking conduct. That capacity is itself a structural feature of how the state's financial centre operates as an enabler-jurisdiction check: a branch's historical transaction-monitoring and disclosure failures remain within reach of supervisory action well after the conduct period closes, which shapes the risk calculus for any foreign institution operating a New York branch. The current evidentiary basis for both findings rests on press and legal-commentary corroboration rather than the underlying consent order text itself, a gap that should be read as a limitation on independent verification rather than a limitation on the substance of the findings as reported.

The transaction-monitoring and customer-due-diligence themes in the SEB matter connect to a broader three-pillar balance point: AML findings of this kind tend to generate more enforcement volume and visibility than counter-terrorist-financing or counter-proliferation-financing findings, and the evidence base reflects that same asymmetry. Both settlements sit squarely within the AML pillar, with no CTF or CPF dimension surfaced in the available material. Readers should not infer from this that CTF/CPF risk at New York branches is absent; rather, the evidence available speaks only to the AML dimension of supervisory activity.

The enablement-as-signal principle also applies here in a specific sense: the fact that New York continues to find and penalize historical AML and transaction-monitoring deficiencies, rather than allowing them to lapse with time, is itself a signal about the jurisdiction's posture as a well-regulated centre that does not treat the passage of time as a shield. This stands in contrast to jurisdictions where enforcement activity declines sharply once conduct moves outside a short look-back window.

Outlook

The enabler-jurisdiction posture for New York going into the next period should be read as one of sustained, backward-looking supervisory attention rather than escalation or retreat. Both settlements closed this cycle rested on multi-year-old conduct, and there is no indication in the available material of a shift in the Department's look-back practice. The open question for future cycles is whether the underlying consent order texts become available for independent verification, which would allow the specific statutory basis for each settlement to be stated with more precision than the press-tier corroboration currently permits. Absent that, the enabler-jurisdiction reading should continue to treat New York's branch supervision as a durable, multi-year check on correspondent-banking conduct at foreign-bank branches, with historical due-diligence and disclosure failures remaining within reach of enforcement well after the conduct period has closed.

18 Oct 2026 · fim-2026-10-18

Enabler Jurisdictions and Professional Facilitators

New York's current rulemaking posture offers a clear case study in the enabler-jurisdiction lens: not a jurisdiction permitting illicit activity through regulatory gaps, but a sub-national jurisdiction actively constructing regulatory perimeters in product categories where federal oversight is receding or has not yet settled. The BNPL licensing proposal, NYDFS's proposed 3 NYCRR Part 423, would license BNPL originators, platform operators and loan-acquirers under New York Banking Law Article 14-B. Its public comment period closed September 14, 2026, and New York City's Department of Consumer and Worker Protection filed comments on September 21, 2026 urging NYDFS to expand the rule's scope to cover medical and rent financing, categories not contemplated in the original draft. This divergence between a state-level regulator building out BNPL oversight and a federal regulator (the CFPB) reported to be stepping back from the same product category is the structural signal of interest: where federal supervisory attention recedes, a well-resourced state regulator can either fill the gap or leave it open, and New York's trajectory this cycle is toward filling it, not leaving it.

This state-level build-out sits atop a standing dual-track AML supervisory architecture that is itself a structural feature of the New York enabler-jurisdiction profile, independent of this cycle's BNPL development. New York's BitLicense AML programme under 23 NYCRR 200.15 and its cybersecurity regulation under 23 NYCRR Part 500 layer New York-specific governance, reporting and cybersecurity duties atop the federal Bank Secrecy Act and FinCEN baseline that applies to regulated entities nationwide. No amendment to this dual-track structure was identified within this cycle's window; it remains the backdrop against which any new state-level licensing regime, including the proposed BNPL rule, will operate. The practical consequence for facilitators and intermediaries operating in or through New York is that state-level compliance obligations do not substitute for federal BSA/FinCEN duties — they are additive, and a firm licensed only against one layer remains exposed on the other.

The enabler-jurisdiction reading of New York is therefore not one of permissiveness but of regulatory density: a state actively layering new licensing perimeters (BNPL) onto an already dual-tracked AML/cybersecurity architecture, at a moment when a federal regulator's attention to an adjacent product category may be diminishing. Whether this pattern reduces facilitator risk by closing a federal gap, or simply shifts the locus of compliance obligation to a jurisdiction with its own distinct enforcement posture, is the open analytical question this development raises.

Outlook

The BNPL licensing rule has not been adopted; its effective date is set at 180 days after publication of a Notice of Adoption in the State Register, a trigger that has not yet occurred. Whether NYDFS incorporates NYC DCWP's requested expansion to medical and rent financing into the final rule is the next material marker for the scope of New York's BNPL perimeter, and by extension the scope of the enabler-jurisdiction dynamic described above. The standing dual-track AML architecture is not expected to change independently of this development and should be read as continuing background structure rather than an active variable this cycle.

3 Sep 2026 · fim-2026-08-05

Enabler Jurisdictions and Professional Facilitators

Two enabler-jurisdiction pictures deteriorated in parallel this cycle, one on a capacity-deficit basis and one on a mixed enforcement-and-enablement basis. Cambodia's central bank governor publicly warned of FATF re-listing risk this cycle, citing persistent casino-junket and scam-centre money-laundering activity that has continued despite the jurisdiction's formal exit from the FATF grey list in 2023. This is an Assessed-confidence finding, corroborated across two Tier 3 outlets citing the governor's statement alongside a UNODC assessment, though no Tier 1 primary source was retrieved this cycle. The architectural significance is that grey-list exit evidently did not resolve the underlying structural laundering exposure tied to Cambodia's casino and scam-compound sector; the jurisdiction risk tracker classifies this as a structural rather than episodic risk driven by capacity deficit rather than active enablement or deliberate non-enforcement.

Mexico presents a more mixed picture, combining active enforcement with continuing structural exposure. FinCEN issued a supplemental alert this cycle on CJNG fuel-smuggling and tax-evasion schemes along the southern border corridor, paired with OFAC sanctions on two Mexican nationals and nine entities tied to that network, a High-confidence, Tier 1 joint action. That fresh designation activity layers onto a standing condition: FinCEN's Section 311 special measures against CIBanco, Intercam, and Vector remain in effect, continuing to cut those institutions off from US correspondent-banking access. The Section 311 finding itself carries Assessed confidence, sourced to a Tier 3 law-firm alert summarizing an underlying Tier 1 FinCEN order, and it is tracked as part of an active trade-based-money-laundering corridor rather than a standalone event. Taken together, the fresh CJNG designations and the continuing Section 311 isolation indicate that Mexico's enabler-jurisdiction exposure is compounding rather than resolving.

The jurisdiction risk tracker's classification is instructive here: Yemen-adjacent enforcement action is episodic by nature, reflecting a discrete, high-scale designation event, whereas Mexico's entry is coded mixed and structural, reflecting that enforcement activity and standing structural exposure are both present simultaneously. That distinction matters for weighting: Cambodia's and Mexico's risk will not resolve through a single enforcement action or designation round, while a purely episodic finding's significance can fade absent follow-on action.

It is also worth being explicit about evidence gaps. No Tier 1 primary source corroborates the Cambodia governor's statement beyond secondary reporting, which caps confidence at Assessed rather than High regardless of how consistent the underlying signal is across outlets. On the Mexico side, the Section 311 finding rests on a law-firm secondary summary of an underlying FinCEN order rather than freshly retrieved primary order text, which is why it is carried at Assessed rather than High confidence despite the underlying instrument being a formal US Treasury special measure. Both gaps are worth tracking into the next cycle.

Outlook

For Cambodia, the governor's own warning is the leading indicator to watch: a formal FATF statement or UNODC follow-on report would move this from an Assessed to a High-confidence trajectory ahead of any prospective plenary re-listing discussion. For Mexico, watch for whether the Section 311 special measures are lifted, extended, or expanded to additional institutions, and for further FinCEN/OFAC joint action against adjacent cartel-finance networks beyond CJNG.

D4 Conflict Finance

no_changestanding position

Conflict Finance and Extractive-Industry Integrity

The Houthi petroleum-revenue taxation architecture is the clearest conflict-finance signal this cycle. The designation by OFAC of thirty-two individuals and entities and four vessels, the largest single Yemen-related sanctions action to date, targets the businessmen and vessel operators who enable a petroleum-import taxation mechanism generating what Treasury has characterized as hundreds of millions of dollars in annual revenue for Ansarallah. Applying the source-channel-deployment framework of the conflict-finance filter, the source is petroleum-import commerce transiting Yemeni ports, the channel is a network of designated businessmen and vessels functioning as a taxation and revenue-collection layer, and the deployment is direct funding of Red Sea attack operations that Ansarallah has continued to conduct. This is held at high confidence on the strength of the primary Treasury press release, and it illustrates the conflict-finance principle that petroleum-revenue architecture, not weapons procurement alone, is frequently the more durable financial target: designating the taxation and logistics layer disrupts the funding mechanism directly rather than pursuing after-the-fact interdiction of weapons or materiel.

Continue reading

A second, structurally distinct commodity-flow conflict-finance vector appears in Mexico this cycle, where a joint FinCEN supplemental alert and OFAC sanctions action targeted a Cartel Jalisco Nueva Generacion fuel-smuggling network, designating two Mexican nationals and nine entities. While cartel fuel-theft and smuggling activity is not conflict finance in the state-versus-non-state-armed-actor sense that characterizes the Yemen case, it shares the extractive-industry-integrity dimension of this domain: illicit diversion of a state-controlled commodity, refined fuel, into a criminal financing architecture that in turn funds cartel violence functionally comparable in scale and social effect to sub-state armed conflict in the affected regions. Read alongside the continuing Section 311 isolation of CIBanco, Intercam, and Vector, the fuel-smuggling designation in Mexico indicates that extractive-commodity diversion and correspondent-banking exposure remain linked in a single laundering architecture rather than separable phenomena, held at high confidence on the primary joint-agency sourcing of the designation action itself.

Both developments this cycle sit in domains that the architecture-over-incident and three-pillar-balance principles of FIM direct particular attention toward. The Houthi designation is properly read as a counter-terrorist-financing pillar finding, correcting for the structural tendency of AML enforcement volume to crowd out CTF and CPF signal in weekly reporting. The Mexican fuel-smuggling designation, by contrast, sits closer to the AML pillar but carries direct extractive-industry-integrity relevance given the status of fuel as a state-controlled commodity subject to diversion.

Both developments also carry direct cross-monitor relevance recorded elsewhere in this cycle tracker: the Houthi petroleum-revenue architecture is flagged to SCEM given its continuing role in funding Red Sea attack operations, a connection held at high confidence given the strength of the underlying primary Treasury sourcing. No equivalent SCEM or ERM cross-monitor flag was recorded this cycle specifically for the Mexican fuel-smuggling designation within the structured findings reviewed, though the commodity-diversion character of the scheme would ordinarily invite such a flag in future cycles as the extractive-industry dimension of the network is further substantiated.

The conflict-finance domain this cycle is notably absent any fresh signal on Sahel minerals or DRC extractive-governance typologies that form part of the standing coverage of FIM; this is a coverage gap rather than a substantive finding of reduced risk in those geographies, and it should be read as a limitation of this cycle search scope rather than as evidence those standing risk pictures have improved.

Outlook

The Houthi petroleum-revenue architecture should be watched for whether continuing designations further degrade the specific taxation and vessel-logistics network targeted this cycle, or whether the network adapts to route around the newly-designated nodes, a pattern observed elsewhere in sanctions-evasion architecture. The Mexican fuel-smuggling designation series, now compounding with the standing Section 311 special-measures status of three financial institutions, should be tracked for whether further OFAC or FinCEN action extends to additional correspondent-banking or trade-finance nodes servicing the same cartel-linked commodity-diversion architecture. The conflict-finance position of Colombia, covered by illicit cocaine and gold-mining revenue estimates on the standing tracker, registered no fresh driver this cycle and its current stable assessment should not be read as confirmation of continuing stability so much as an absence of this cycle search scope reaching that jurisdiction. Analysts should also watch whether the Treasury characterization of Houthi petroleum-revenue scale, hundreds of millions of dollars annually, is updated in subsequent designation rounds, since a revised estimate would itself constitute a material tracked-metric revision under the interpreter materiality framework.

Cumulative analysis

This is the standing synthesis of the FIM conflict-finance and extractive-industry-integrity posture through the current cycle.

Conflict Finance and Extractive-Industry Integrity

The Houthi petroleum-revenue taxation architecture remains the clearest conflict-finance signal across recent cycles, reinforced this cycle by the designation by OFAC of thirty-two individuals and entities and four vessels, the largest single Yemen-related sanctions action to date. The designation targets the businessmen and vessel operators who enable a petroleum-import taxation mechanism generating hundreds of millions of dollars in annual revenue for Ansarallah, funding continued Red Sea attack operations, held at high confidence on primary Treasury sourcing. The recurring pattern across cycles is that designating the taxation and logistics layer, rather than pursuing after-the-fact interdiction of weapons or materiel, remains the durable financial-pressure tool against this network.

A structurally distinct commodity-flow conflict-finance vector has emerged in Mexico, where this cycle a joint FinCEN supplemental alert and OFAC sanctions action targeted a Cartel Jalisco Nueva Generacion fuel-smuggling network, designating two Mexican nationals and nine entities. Read alongside the continuing Section 311 isolation of CIBanco, Intercam, and Vector, this indicates that extractive-commodity diversion and correspondent-banking exposure remain linked in a single laundering architecture in Mexico, an extractive-industry-integrity dimension distinct from but structurally comparable to the Yemen case.

Across cycles, the domain continues to show a persistent gap in fresh signal on Sahel minerals and DRC extractive-governance typologies, and Colombia continues to register a stable position on cocaine and illegal-gold-mining revenue absent a fresh driver, both treated as coverage limitations rather than confirmed stability.

Outlook

The Houthi petroleum-revenue architecture should be watched for whether continuing designations degrade the targeted taxation and vessel-logistics network or whether it adapts to route around newly-designated nodes. The Mexican fuel-smuggling designation series should be tracked for further OFAC or FinCEN action extending to additional correspondent-banking or trade-finance nodes. Any revised Treasury estimate of Houthi petroleum-revenue scale would constitute a material tracked-metric revision warranting a cumulative update.

domain_sub_briefs · D4 · Cumulative analysis
Periodic updates (1)
3 Sep 2026 · fim-2026-08-05

Conflict Finance and Extractive-Industry Integrity

This cycle's clearest conflict-finance signal is the scale of the Houthi petroleum-revenue architecture that OFAC's latest designations target. The 32 individuals and entities and four vessels designated this cycle are described by Treasury as its largest single Yemen sanctions action to date, and the designations specifically target the businessmen and vessel operators who administer Ansarallah's petroleum-import taxation system, the revenue mechanism funding Houthi Red Sea attack operations. This is a High-confidence, Tier 1 finding, and it belongs in the conflict-finance domain as much as the sanctions domain precisely because the underlying target is a revenue-generation architecture tied directly to ongoing armed operations.

A parallel, distinct commodity-flow conflict-finance vector runs through Mexico, where FinCEN's supplemental alert on CJNG fuel-smuggling and tax-evasion schemes, paired with OFAC's sanctions on two Mexican nationals and nine entities, illustrates that cartel-finance and conflict-adjacent commodity smuggling are not limited to state-conflict contexts. Fuel and crude-product smuggling functions here as a direct revenue stream for a designated cartel network in much the same structural role that petroleum-revenue taxation plays for Ansarallah, even though the actors, geography, and legal characterization differ substantially. This is a High-confidence, Tier 1 finding for the underlying FinCEN/OFAC joint action, though the broader Mexican corridor context, including the continuing Section 311 isolation of CIBanco, Intercam, and Vector, carries only Assessed confidence given its Tier 3 sourcing.

Reading the Yemen and Mexico findings together supports a broader architectural point: commodity-flow conflict finance is not a single-region phenomenon confined to conventional armed-conflict contexts, and the mechanisms, revenue taxation on petroleum movement, smuggling-based tax evasion, and the correspondent-banking isolation that follows once a jurisdiction's institutions are flagged, recur across very different conflict and quasi-conflict settings. Colombia's entry on the jurisdiction risk tracker, by contrast, shows no fresh driver this cycle and remains rated Compliant or Largely Compliant on 30 of 40 FATF Recommendations, with no sanctions currently in force, a useful counterpoint illustrating that conflict-finance risk in the region is not uniform.

The jurisdiction risk tracker's classification is instructive: Yemen's entry is coded enforcement-driven and episodic, reflecting that the OFAC action is a discrete, high-scale designation event, whereas Mexico's entry is coded mixed and structural, reflecting that enforcement activity and standing structural exposure are both present simultaneously. It is also worth being explicit about evidence gaps: Treasury's press release is the sole primary source for the Houthi designations this cycle, and no OFSI or EU Council parallel action was identified. On the Mexico side, the Section 311 finding rests on a law-firm secondary summary of an underlying FinCEN order rather than freshly retrieved primary order text. Both gaps are worth tracking into the next cycle, since a corroborating primary source on either finding would move the overall domain confidence from a mixed Assessed/High picture toward a more uniformly High-confidence conflict-finance read.

Outlook

The Houthi designations' durability will depend on whether the targeted shipping and trading networks can be readily reconstituted under new corporate structures, a pattern that has recurred in prior sanctions-evasion cycles for petroleum-revenue architectures. For Mexico, watch for whether the fresh CJNG designations are followed by additional FinCEN advisories targeting adjacent smuggling corridors, and whether the standing Section 311 measures against CIBanco, Intercam, and Vector are extended to further institutions.

D5 Crypto / Digital Assets / Financial Innovation

watch

Crypto / Digital Assets / Financial Innovation

New York's digital-asset regulatory architecture continues to develop through a proposed rule rather than a finalized one this cycle. The Department of Financial Services' proposed regulation establishing a framework for Authorized Payment Stablecoin Issuers remains in rulemaking, with the public comment period having closed on 21 September 2026 but no final rule issued. The proposal would replace the department's current reliance on bespoke supervisory agreements and a 2022 industry letter with a codified regime, requiring that an authorized payment stablecoin issuer comply with minimum capital and backstop requirements, among other provisions covering reserve custody and liquidation triggers.

Continue reading

The structural significance of this rulemaking, for a jurisdiction already operating one of the oldest dedicated virtual-currency licensing regimes in the country through its BitLicense framework, is that it would formalize a stablecoin-specific pathway within that existing structure rather than create a wholly separate regime. The proposal is explicitly aligned to the federal GENIUS Act framework, meaning the state's approach is being calibrated against a federal baseline rather than developed in isolation, which is itself a notable shift in posture for a state regulator that has historically moved ahead of, rather than in step with, federal digital-asset policy. Once finalized, the rule would subject stablecoin issuers licensed via the BitLicense or a trust charter to bank-style capital requirements, a prohibition on reserve self-custody, codified liquidation triggers, and cybersecurity obligations equivalent to those under the state's existing cybersecurity regulation.

Because the rule has not been finalized, issuers currently operating under existing supervisory agreements continue to do so for now, and the practical effect of the proposal on the market remains prospective rather than realized. The expected impact window carries meaningful uncertainty, estimated at roughly the first quarter of 2027, and that date should be read as a current estimate rather than a committed deadline, since it depends on both the state rulemaking process and its intended alignment with the federal statute's own effective timeline.

No enforcement action specific to crypto-asset or digital-asset firms surfaced within the enabler-jurisdiction or compliance-technology findings this cycle that would bear directly on the digital-asset reading; the material development here is the rulemaking itself rather than a supervisory action against a named digital-asset firm.

Outlook

The rule's finalization is the development to track going forward. If adopted substantially as proposed, it would mark one of the more significant codifications of stablecoin-specific prudential requirements at the state level, with direct relevance for any issuer licensed under New York's virtual-currency or trust-charter regimes. Until finalized, firms operating under existing supervisory agreements face continued uncertainty as to whether their current arrangements will be grandfathered, transitioned, or superseded outright once Part 202 and the federal GENIUS Act take effect together.

Cumulative analysis

This is the standing synthesis of the FIM crypto, digital-asset, and financial-innovation posture through the current cycle, anchored to the regulatory and enforcement environment of New York.

Crypto, Digital Assets, and Financial Innovation

New York continues to build a dense, dual-track posture in digital assets across recent cycles: an active state-level enforcement theory against crypto-adjacent platforms, and a structured regulatory pathway for stablecoin issuance. This cycle sharpened both tracks. The New York Attorney General filed a thirty-six billion dollar civil suit against KalshiEX, LLC, alleging an unlicensed gambling operation conducted via prediction markets, escalating from an October 2025 cease-and-desist notice after a federal court declined injunctive relief, and testing the jurisdictional boundary between state gambling law and Commodity Futures Trading Commission authority. This extends the same unlicensed-gambling theory the office previously applied against Coinbase and Gemini in April 2026.

On the regulatory track, the New York State Department of Financial Services has a proposed rule in consultation setting custodian reserve-concentration limits and risk-management-program requirements for stablecoin issuers, intended to align the state regime with the federal GENIUS Act certification framework, positioning New York as a template state regime.

A third New York-anchored thread this cycle is a forty million dollar NYDFS fine against Block Inc., operator of Cash App, for AML, cybersecurity, and consumer-protection program deficiencies, extending a recurring New York supervisory pattern under the Part 504 transaction-monitoring regulation.

Against this New York-anchored picture, the global backdrop is defined by empirical evidence that Tornado Cash evasion utility persisted after its 2025 SDN delisting: deposit volume fell roughly seventy-one percent, yet the protocol remained implicated in 78.33 percent of Ethereum-related security incidents, with developer Roman Storm facing an October 2026 retrial. This reinforces, across cycles, that delisting alone is an insufficient tool against decentralized mixing infrastructure lacking a central operator subject to blocking.

Outlook

The Kalshi and Coinbase and Gemini litigation should be watched for judicial resolution of the state-versus-federal jurisdictional question. The New York stablecoin state-certification proposal should be tracked toward formal rulemaking. The October 2026 Storm retrial remains an item for confirmation, and a MiCA-specific standing update remains an open coverage gap across cycles.

domain_sub_briefs · D5 · Cumulative analysis
Standing baseline position

NYDFS signed a seven-page MOU with the Wyoming Division of Banking on 1 Oct 2026 establishing procedures for sharing supervisory information, coordinating examinations, and cooperating on licensing, chartering and enforcement for virtual-currency/digital-asset firms in both states.

Periodic updates (6)
3 Nov 2026 · fim-2026-11-03

Crypto / Digital Assets / Financial Innovation

The most material New York-specific development in the digital-asset space is the proposed 23 NYCRR Part 202, which would create a comprehensive framework for Authorized Payment Stablecoin Issuers. The proposed text requires that an authorized payment stablecoin issuer comply with minimum capital and backstop requirements, and it remains in the consultation stage, with the comment period having closed on 21 September 2026. No final adoption date has been confirmed; the expected timeframe, as scheduled, sits in early 2027, though that date should be treated as provisional until a final rule is adopted.

The proposal's structural significance lies in what it replaces. Rather than relying on the superintendent's 2022 industry letter and a set of bespoke supervisory agreements negotiated issuer by issuer, Part 202 would establish a single codified regime covering capital, reserve-custody and liquidation-trigger requirements for all Authorized Payment Stablecoin Issuers operating under New York's jurisdiction. This is a shift from a flexible, case-by-case supervisory posture to a formal, publicly codified rule, and it is explicitly framed as aligning New York's stablecoin regime with the federal GENIUS Act, suggesting a deliberate effort to harmonize state and federal approaches to payment stablecoin regulation rather than maintaining a separate, potentially divergent state track.

From a financial-integrity perspective, the proposed capital, reserve-custody and liquidation-trigger requirements are the elements most relevant to assessing illicit-finance exposure through stablecoin issuance. A regime that prohibits or constrains issuer self-custody of reserves, and that establishes defined liquidation triggers, narrows some of the structural ambiguity that has historically made stablecoin reserve arrangements difficult to verify independently. At the same time, the proposal remains unadopted, and the specific pinpoint citations for capital thresholds and liquidation mechanics have not yet been published in final form, which limits how precisely the eventual compliance burden can be described at this stage.

The crypto/digital-asset domain shows no enforcement action specific to New York-licensed virtual currency businesses; the signal is entirely on the rulemaking side. This is itself consistent with an architecture-over-incident reading: a jurisdiction building out a durable regulatory structure for an asset class is, in its own way, as significant a development as an enforcement action against a specific firm, particularly where the structure in question is explicitly designed to supersede an ad hoc supervisory approach that had persisted since 2022.

Outlook

The proposed Part 202 framework is the single most important thing to watch in New York's digital-asset space going forward. Its path to finalization, as scheduled for early 2027, remains uncertain in both timing and final substance, and the current evidentiary basis for its content rests on the published proposed rule text together with secondary legal commentary rather than a finalized instrument. Readers should treat the capital, custody and liquidation-trigger provisions described in the proposal as indicative of the direction of travel rather than as settled law until the rule is adopted in final form. The explicit alignment with the federal GENIUS Act suggests that New York's final rule, whenever adopted, is likely to track federal stablecoin standards closely, which would reduce the degree of divergence between state and federal stablecoin regimes relative to the bespoke-agreement era that the proposal is designed to end.

25 Oct 2026 · fim-2026-10-25

Crypto / Digital Assets / Financial Innovation

New York's proposed payment-stablecoin issuer rule, 23 NYCRR Part 202, remains the operative development in this domain for the jurisdiction. Published 22 July 2026 and still at the consultation stage, the rule would formalize payment-stablecoin issuer requirements including reserve, redemption and BSA/AML/sanctions certification obligations aligned to the federal GENIUS Act. a16z's comment letter, dated 21 September 2026 and reported inside the window on 20-21 October 2026, urges the Department of Financial Services to withdraw or rewrite the proposal pending final federal GENIUS Act standards, framing premature state finalization as a risk of certification-standard divergence between the state and federal regimes.

The structural feature most relevant to a financial-integrity read is the differential compliance timeline embedded in the proposal: existing New York-authorized issuers would receive twelve months post-effective-date to come into general compliance, but the BSA/AML/sanctions certification obligation under section 202.9(b) is drafted with an earlier deadline than that general runway. This means an issuer's anti-money-laundering certification obligation would become operative before its other Part 202 compliance obligations, a sequencing choice that effectively prioritizes AML/sanctions certification over the rule's other prudential requirements during the transition period.

This is the only in-window development with direct jurisdictional application to New York's digital-asset financial-integrity posture this period; sanctions, beneficial-ownership, enabler-jurisdiction, conflict-finance, compliance-technology and broader AML/CTF-regime tracking for New York produced no sourced development distinct from this stablecoin-rule thread within the window.

Outlook

The near-term question is whether NYDFS proceeds to finalize Part 202 ahead of, or in step with, final federal GENIUS Act rulemaking. The regulatory horizon places the expected impact date in the first quarter of 2027 with a six-month uncertainty band, reflecting genuine uncertainty over whether the Department will defer to industry's request for delay. Institutions assessing exposure under this rule should treat the earlier BSA/AML/sanctions certification deadline under section 202.9(b) as the operative near-term compliance date regardless of how the broader finalization timing resolves.

18 Oct 2026 · fim-2026-10-18

Crypto, Digital Assets, and Financial Innovation

New York's proposed 23 NYCRR Part 202 is the dominant digital-asset development on file for this jurisdiction this cycle. The rule would align NYDFS's existing stablecoin regulatory framework with the federal GENIUS Act, establishing a codified Authorized Payment Stablecoin Issuer category. Its drafted effective date is not fixed independently but is instead tied to the commencement of the federal GENIUS Act itself, with that commencement due no later than January 18, 2027. The rule has not been adopted; it remains in the proposal stage, a confirmed status as of this cycle. A notable feature of the draft is its transition treatment: existing NY-approved stablecoin issuers would not be required to seek fresh approval under the new framework, but would need to achieve full compliance with the GENIUS Act-aligned requirements, including custodian-concentration limits and risk-management programme obligations, within twelve months of the rule's effective date. NYDFS has indicated it intends to review public comments to refine the rule further before any adoption, meaning the final text now in circulation is not necessarily the text that will take effect.

The significance of this development for digital-asset financial-innovation tracking lies in New York's positioning choice: rather than wait for the federal GENIUS Act framework to fully settle and then retrofit its own BitLicense-adjacent stablecoin guidance, NYDFS has moved to pre-align its rulebook with the anticipated federal standard. This is a notable sequencing decision for a state regulator relative to a still-developing federal digital-asset framework, and it sits alongside New York's existing 2022 stablecoin guidance requiring full reserve backing and monthly independent attestation — a standing instrument that remains in force independent of Part 202's eventual adoption. The withdrawal of the 2022 Industry Letter upon Part 202's adoption would mark the formal transition point from the current guidance-based regime to a codified regulatory one.

No enforcement action tied specifically to the stablecoin regime was identified within this cycle's window; the compliance-technology and active-defence dimension of this development remains forward-looking, contingent on the rule's eventual adoption and the twelve-month compliance runway it would afford existing issuers.

Outlook

The binding constraint on this rule's practical effect is the federal GENIUS Act's own commencement date, expected no later than January 18, 2027; New York's framework cannot take effect ahead of that federal trigger. Whether NYDFS finalises Part 202 substantially as drafted, or revises it materially in response to the comment period NYDFS has said it will carefully review, is the key marker to track. The twelve-month compliance runway for existing issuers, once triggered, will itself be a period worth monitoring for how smoothly the transition from guidance-based to codified regulation proceeds.

11 Oct 2026 · fim-2026-10-11

Crypto, Digital Assets, and Financial Innovation

New York's digital-asset supervisory architecture took a structural step on 1 October 2026 when NYDFS and the Wyoming Division of Banking signed a seven-page memorandum of understanding establishing procedures for sharing supervisory information, coordinating examinations, and cooperating on licensing, chartering and enforcement for virtual-currency and digital-asset firms operating in both states. This is architecture, not incident: it formalises a channel between two of the most developed but structurally different US state digital-asset regimes -- New York's BitLicense model under 23 NYCRR Part 200 and Wyoming's Special Purpose Depository Institution charter -- rather than responding to any single enforcement matter. Confirmed by NYDFS's own primary press release, the MOU is reported to target licensing decisions within roughly six months for certain established firms seeking dual New York and Wyoming authorisation, a material reduction in the friction a multi-state digital-asset operator has previously faced in satisfying two separately-run supervisory regimes.

The analytical significance is that this narrows, rather than widens, a regulatory-arbitrage gap. Where a digital-asset firm might previously have chosen Wyoming's lighter-touch SPDI model specifically to avoid New York's comparatively stringent BitLicense examination regime, coordinated examination and information-sharing procedures reduce the value of that choice as a means of regulatory avoidance. For firms already licensed in New York, the MOU signals that NYDFS supervisory findings may now be more readily shared with a second state regulator, raising the practical stakes of a New York examination finding.

No additional first-party New York digital-asset development beyond the MOU was identified this cycle. The state's standing AML/CTF architecture for virtual-currency firms, running through Banking Law Article 13-B, the BitLicense under 23 NYCRR Part 200, and transaction-monitoring obligations under 23 NYCRR Part 504, is unchanged and continues to apply alongside this new interstate-cooperation layer.

Outlook

Watch for whether the NYDFS-Wyoming cooperation model is extended to additional states, which would signal an emerging multi-state supervisory-coordination architecture for digital-asset firms beyond a bilateral arrangement. Watch also for the first examination or enforcement action conducted under the new information-sharing procedures, which would be the first test of whether the formalised cooperation changes substantive supervisory outcomes rather than only procedural coordination.

28 Sep 2026 · fim-2026-09-28

Crypto / Digital Assets / Financial Innovation

Globally, the FinCEN/OFAC PPSI rulemaking is the standing structural development in the crypto and digital-assets space this cycle: FinCEN and OFAC's joint notice of proposed rulemaking would classify Permitted Payment Stablecoin Issuers as Bank Secrecy Act financial institutions, requiring AML programs, suspicious activity report filing, and five-element sanctions compliance programs, implementing the GENIUS Act (Pub. L. 119-27). In New York specifically, this proposal is directly relevant because several major payment stablecoin issuers, including entities operating under NYDFS charters, would become subject to a federal BSA financial-institution classification layered onto their existing New York state supervision. The proposal's comment period closed June 9, 2026, and the rule remains at proposal stage; no final rule has been published.

The practical effect, once finalised, would be to extend a second, federal supervisory track over the same New York-chartered payment stablecoin issuers that NYDFS separately supervises through its own proposed state-level stablecoin framework, creating a layered federal-state compliance architecture for AML programs, SAR filing obligations, and sanctions screening specific to stablecoin issuance and transfer. This is a structural extension of BSA/OFAC architecture into a product category, payment stablecoins, that has previously operated primarily under state money-transmitter or trust-charter frameworks and industry-analogised MSB-style AML programs rather than a dedicated federal financial-institution designation.

No other D5-relevant crypto or digital-asset development was researched or evidenced this cycle beyond the PPSI rulemaking; the domain tracker records this as the sole material development for D5.

Outlook

The rule's finalisation timeline is estimated around the first quarter of 2027 but remains unconfirmed. New York-chartered issuers and their supervisor, NYDFS, should watch for the primary Federal Register text once published, since only secondary law-firm reporting on the proposal was available this cycle rather than the primary Federal Register notice itself. Finalisation would resolve current ambiguity about how the new federal BSA financial-institution status interacts with NYDFS's own proposed stablecoin issuer framework and existing BitLicense/trust-charter supervision.

3 Sep 2026 · fim-2026-08-05

Crypto, Digital Assets, and Financial Innovation

This cycle produced a mixed but analytically rich picture for the crypto and digital-asset domain, combining a state-level enforcement expansion with fresh empirical evidence on the limits of sanctions delisting as a control tool. On the enforcement side, the New York Attorney General escalated a running campaign against unlicensed gambling-adjacent platforms into a civil suit against Kalshi seeking forfeiture, restitution, and treble-damages penalties totaling approximately 36 billion dollars, an escalation from an October 2025 cease-and-desist letter that followed a federal court's refusal to enjoin state enforcement. This is a High-confidence, Tier 1 finding. It sits alongside an April 2026 New York Attorney General suit against Coinbase and Gemini, also High-confidence and Tier 1-sourced, alleging that both platforms operated illegal gambling platforms via prediction-market-style products. Read together, these two actions indicate that New York is applying a single unlicensed-gambling enforcement theory across platforms with materially different federal postures, Kalshi as a CFTC-registered derivatives exchange, and Coinbase and Gemini as crypto-asset trading platforms, treating the underlying wagering mechanic, not the federal regulatory label, as the operative fact for state gambling-law exposure.

On the sanctions-evasion side, an empirical academic study of Tornado Cash's post-delisting behavior found that deposit volume fell by roughly 71 percent following its 2025 removal from the OFAC SDN list, yet the protocol remained implicated in 78.33 percent of Ethereum-related security incidents in the period studied. This is an Assessed-confidence finding, sourced to an academic paper rather than a primary DOJ filing, but it is the clearest evidence available this cycle that SDN delisting materially reduces but does not eliminate a decentralized mixing protocol's utility to illicit actors. The protocol's developer, Roman Storm, faces an October 2026 retrial on related laundering and evasion counts, meaning the legal characterization of Tornado Cash's operators remains an open question into the next cycle.

The academic sourcing for the Tornado Cash finding is worth flagging explicitly: it derives from a study rather than from DOJ or Treasury primary material, and no fresh Tier 1 DOJ filing was retrieved this cycle to corroborate the retrial timeline beyond trade-press coverage. That places the finding's confidence at Assessed rather than High, notwithstanding that the underlying empirical measurement is a reasonably precise quantitative result. Compliance functions relying on this finding should treat the direction of the result as more durable than the precise percentages, which derive from a single study's methodology and time window.

The through-line across both findings is that neither federal registration status nor sanctions delisting functions as a clean, durable resolution of underlying risk: New York's enforcement theory treats federal registration as non-dispositive for state gambling-law purposes, and the Tornado Cash study shows delisting as only a partial technical remedy. New York's dual posture, aggressive gambling-theory enforcement against crypto-adjacent platforms on one hand, and a forward-looking GENIUS Act stablecoin certification framework on the other, illustrates a jurisdiction that is simultaneously an active state-level enforcer against platforms it deems unlicensed and one of the more advanced state regulators building a compliant pathway for stablecoin issuance.

Outlook

The Kalshi litigation's merits outcome on the federal-preemption defense is the single most consequential unresolved question in this domain: a ruling either way will clarify whether CFTC registration shields a platform from state gambling and, by extension, state financial-crime law. Separately, watch New York's own regulatory response on the payments side: NYDFS has a proposed rule aligning the state's stablecoin framework with GENIUS Act federal certification requirements, expected toward the fourth quarter of 2026. On Tornado Cash, the October 2026 Storm retrial is the next concrete event to track.

D6 Compliance Technology & Active Defence

watch

Compliance Technology and Active Defence

The department's enforcement this cycle extends baseline cybersecurity risk-assessment expectations to firms that might otherwise assume lighter-touch treatment. A New York-licensed money transmitter was fined $250,000 under a consent order for failing to conduct a risk assessment sufficient to inform the design of its cybersecurity program, notwithstanding that the firm qualified for the limited exemption available under the state's cybersecurity regulation. The consent order itself was not independently retrieved this cycle; the account here rests on detailed legal-commentary coverage of the named order, and the confidence attached to the claim is probable rather than confirmed.

Continue reading

The structural point is that qualifying for a limited exemption from the fuller set of obligations under the cybersecurity regulation does not relieve a covered entity of the underlying duty to assess its own risk before designing a compliance program around it. This is a meaningful clarification of where the boundary of the exemption actually sits: the exemption narrows the scope of what a qualifying entity must build, but it does not narrow the threshold duty to understand, through a documented risk assessment, what needs to be built in the first place. For firms relying on exemption status as a basis for a lighter compliance posture generally, this action is a signal that the department views the risk-assessment duty as close to a floor-level obligation that attaches regardless of exemption tier.

This finding sits alongside, but is distinct from, the enabler-jurisdiction enforcement activity this cycle: where the SEB and Swedbank matters concern historical due-diligence and disclosure conduct at branches of foreign banks, this money-transmitter action concerns the adequacy of a domestic licensee's internal risk-governance process under the state's technology-focused regulatory regime. Both reflect the same underlying posture, however: active, ongoing supervisory testing of whether regulated entities are meeting their obligations in substance rather than merely in form, irrespective of the specific statutory or regulatory basis invoked.

No further compliance-technology development specific to New York surfaced this cycle beyond the money-transmitter matter; the broader proposed stablecoin issuer framework, while it would eventually impose cybersecurity obligations equivalent to the state's existing cybersecurity regulation on authorized stablecoin issuers once finalized, is treated here only as a forward reference, since its substantive compliance-technology content remains part of an unfinalized rule rather than an active obligation.

Outlook

The pattern to watch is whether the department brings further actions against other limited-exemption entities on the same risk-assessment theory, which would confirm this cycle's action as the start of a supervisory trend rather than an isolated matter. Firms currently relying on the limited exemption under the cybersecurity regulation should expect that reliance to be tested specifically against the adequacy of their documented risk assessment, independent of whatever lighter-touch program obligations the exemption otherwise permits.

Cumulative analysis

This is the standing synthesis of the FIM compliance-technology and active-defence posture through the current cycle.

Compliance Technology and Active Defence

The compliance-technology signal has remained thin across recent cycles, and this cycle continues that pattern rather than reversing it. The forty million dollar NYDFS fine against Block Inc., operator of Cash App, for AML, cybersecurity, and consumer-protection program deficiencies, is the one development bearing on this domain this cycle, held at assessed confidence on secondary reporting of the underlying consent order. Read through the compliance-technology and active-defence lens, the finding illustrates a persistent gap between supervisory expectations for proactive, technology-enabled transaction monitoring under the Part 504 Transaction Monitoring Regulation of New York and documented industry practice at a major fintech and crypto-adjacent payment company. No dedicated RegTech or SupTech guidance publication has been identified across recent cycles including this one, a standing coverage gap rather than a substantive finding of an absence of such guidance.

Outlook

The principal item to watch across coming cycles is whether dedicated RegTech or SupTech guidance, from NYDFS, FinCEN, or an international standard-setter, finally surfaces to close this standing coverage gap. The Block Inc. consent order should be tracked for whether it specifies concrete technology or control-architecture remediation commitments beyond the headline fine.

domain_sub_briefs · D6 · Cumulative analysis
Periodic updates (1)
3 Nov 2026 · fim-2026-11-03

Compliance Technology & Active Defence

New York's Department of Financial Services closed a consent order against Order Express, a money transmitter, imposing a USD 250,000 penalty tied to deficiencies in the firm's cybersecurity risk assessment. The order found that Order Express, although it qualified for a limited exemption under the cybersecurity regulation, had failed to conduct a risk assessment sufficient to inform the design of its cybersecurity program. The finding is structurally significant because it addresses a firm that was not subject to the full weight of the cybersecurity rule: qualifying for a limited exemption did not relieve the firm of the underlying obligation to assess risk adequately before designing its controls.

This distinction matters for how the compliance-technology domain should be read going forward. A limited exemption under New York's cybersecurity regulation reduces certain prescriptive programmatic requirements, but it does not eliminate the foundational risk-assessment obligation that underpins the entire regulatory architecture. The Department's willingness to penalize a firm for an inadequate risk assessment, notwithstanding its exempt status, signals that exemptions of this kind should not be read by other similarly-situated firms as a broad safe harbor from active-defence obligations.

Within the three-pillar balance, this finding sits in a cross-pillar category rather than squarely within AML: it is a cybersecurity and technology-governance finding rather than a customer due diligence or transaction-monitoring finding. The compliance-technology domain continues to be structurally underweighted relative to AML enforcement volume across most jurisdictions, and this single order is the only compliance-technology-specific development surfaced in New York. Its significance lies less in the dollar figure, which is modest relative to the AML settlements closed in parallel, and more in the precedent it sets for exempt-entity obligations.

The order's reasoning, as reported, traces to the risk-assessment obligation embedded within New York's broader cybersecurity regulatory architecture, read alongside the limited-exemption provision that Order Express had relied upon. The available material does not include the full consent order text, so the precise regulatory provisions cited, and the specific deficiencies identified in the firm's risk-assessment methodology, cannot be stated with full precision at this stage; the finding as reported rests on detailed legal commentary rather than the primary order itself.

Outlook

The Order Express action is a useful marker for any firm in New York relying on a limited exemption from the full cybersecurity regulatory regime: the underlying risk-assessment obligation persists regardless of exemption status, and the Department has demonstrated a willingness to enforce that obligation even against a modestly-sized money transmitter. Future cycles should watch for whether this becomes a pattern across other exempt firms, or whether it remains an isolated action. The absence of the primary consent order text from the available evidentiary base limits how far this analysis can go in specifying the exact compliance gap identified, and that limitation should be read as a constraint on current reporting precision rather than as a signal about the substance or seriousness of the Department's finding.

D7 AML/CTF Regime

no_changestanding position

AML/CTF Regime

New York's AML/CTF enforcement posture this cycle is defined by two settlements, both rooted in historical conduct at foreign-bank branches operating in the state. The Department of Financial Services reached a USD 33 million settlement with the New York branch of Skandinaviska Enskilda Banken over customer due diligence gaps and Baltic transaction-monitoring backlogs, with the conduct at issue dated to 2015-2019. Separately, Swedbank was penalized USD 50 million over conduct described as intentionally failing to provide information connected to the Panama Papers matter. Both settlements sit within the AML pillar and both involve correspondent-banking relationships, with customer typology in each case tied to correspondent-bank exposure.

Continue reading

These two actions, read together, describe continued active supervision of historical AML conduct at foreign-bank branches in New York, years after the underlying activity occurred. The pattern reinforces a structural reading of New York's AML/CTF regime: enforcement is not confined to a short look-back window tied to recent conduct, but extends to multi-year-old due-diligence and disclosure failures. This is architecturally significant because it signals that the regime's deterrent effect operates over a longer time horizon than enforcement volume alone would suggest, and because it demonstrates that New York continues to allocate supervisory resources to investigating and resolving matters tied to conduct from the middle of the previous decade.

The evidentiary basis for both findings currently rests on secondary reporting — trade-press corroboration for the SEB settlement and a single law-firm blog headline roundup for the Swedbank settlement — rather than the underlying NYDFS consent order text for either matter. This is a meaningful limitation on the precision with which the specific statutory basis, exact violations, and full remediation terms can be described; the substance of both penalties, as reported, is clear, but the granular regulatory citations supporting each cannot be independently confirmed from the material available this cycle.

Within the three-pillar framing that AML/CTF regime analysis should apply, both settlements fall within the AML pillar specifically, with no CTF or CPF component surfaced in either matter as reported. This is consistent with the broader observation that AML enforcement tends to generate more visible activity than CTF or CPF enforcement, and readers should not infer from the absence of CTF/CPF findings this cycle that New York's regime is inactive on those fronts — only that no CTF/CPF-specific finding reached the evidentiary bar this cycle.

Outlook

The near-term trajectory for New York's AML/CTF regime should be read as one of sustained attention to historical correspondent-banking conduct, with two multi-million-dollar settlements closed in a single cycle reinforcing that posture. Future cycles should watch for whether the underlying consent order texts for either the SEB or Swedbank matters become available, which would allow for a more precise statement of the specific regulatory provisions each institution was found to have violated. In the interim, the regime should be understood as continuing to exercise a long look-back capacity over correspondent-banking conduct, with no indication in the available material of either an acceleration or a retreat from that posture.

Cumulative analysis

AML/CTF Regime

New York's AML/CTF enforcement posture is defined by two settlements, both rooted in historical conduct at foreign-bank branches operating in the state. The Department of Financial Services reached a USD 33 million settlement with the New York branch of Skandinaviska Enskilda Banken over customer due diligence gaps and Baltic transaction-monitoring backlogs, with the conduct at issue dated to 2015-2019. Separately, Swedbank was penalized USD 50 million over conduct described as intentionally failing to provide information connected to the Panama Papers matter. Both settlements sit within the AML pillar and both involve correspondent-banking relationships, with customer typology in each case tied to correspondent-bank exposure.

These two actions, read together, describe continued active supervision of historical AML conduct at foreign-bank branches in New York, years after the underlying activity occurred. The pattern reinforces a structural reading of New York's AML/CTF regime: enforcement is not confined to a short look-back window tied to recent conduct, but extends to multi-year-old due-diligence and disclosure failures. This is architecturally significant because it signals that the regime's deterrent effect operates over a longer time horizon than enforcement volume alone would suggest, and because it demonstrates that New York continues to allocate supervisory resources to investigating and resolving matters tied to conduct from the middle of the previous decade.

The evidentiary basis for both findings currently rests on secondary reporting — trade-press corroboration for the SEB settlement and a single law-firm blog headline roundup for the Swedbank settlement — rather than the underlying NYDFS consent order text for either matter. This is a meaningful limitation on the precision with which the specific statutory basis, exact violations, and full remediation terms can be described; the substance of both penalties, as reported, is clear, but the granular regulatory citations supporting each cannot be independently confirmed from the material available.

Within the three-pillar framing that AML/CTF regime analysis should apply, both settlements fall within the AML pillar specifically, with no CTF or CPF component surfaced in either matter as reported. This is consistent with the broader observation that AML enforcement tends to generate more visible activity than CTF or CPF enforcement, and readers should not infer from the absence of CTF/CPF findings that New York's regime is inactive on those fronts — only that no CTF/CPF-specific finding reached the evidentiary bar.

Outlook

The near-term trajectory for New York's AML/CTF regime should be read as one of sustained attention to historical correspondent-banking conduct, with two multi-million-dollar settlements closed in a single cycle reinforcing that posture. Future cycles should watch for whether the underlying consent order texts for either the SEB or Swedbank matters become available, which would allow for a more precise statement of the specific regulatory provisions each institution was found to have violated. In the interim, the regime should be understood as continuing to exercise a long look-back capacity over correspondent-banking conduct, with no indication in the available material of either an acceleration or a retreat from that posture.

domain_sub_briefs · D7 · Cumulative analysis

D8 Commercial Activity

no_change

No commercial activity among financial-integrity-market firms identified this cycle.

Regulatory horizon
Proposed2027 · ±multi_year

NY LLC Transparency Act scope-broadening amendment

No current change; a previously proposed broadening of beneficial-ownership disclosure was vetoed and is not in force.
source not collected
Proposed2027-Q1 · ±year

23 NYCRR Part 202 stablecoin BSA/AML certification

A new state certification requirement tied to the federal stablecoin framework would apply to NY-nexus stablecoin issuers.
source not collected
Consultation2027-Q1 · ±half_year

23 NYCRR Part 202 - Authorized Payment Stablecoin Issuers

Stablecoin issuers licensed via BitLicense or trust charter would face bank-style capital requirements, a ban on reserve self-custody, codified liquidation triggers, and cybersecurity obligations equivalent to the state's existing cybersecurity regulation once Part 202 and the federal GENIUS Act take effect.
Source
3 dated · 1 pending date · baseline fim-2026-07-05
Role action cards
MLRO

NYDFS continues to enforce historical correspondent-banking due diligence gaps years after the conduct period.

The SEB settlement reflects continued regulatory willingness to pursue customer due diligence and transaction-monitoring failures tied to Baltic-region correspondent relationships well after the conduct occurred, reinforcing the durability of exposure from historical AML program gaps.

2 evidence refs
Compliance

A limited cybersecurity exemption does not excuse the underlying risk-assessment duty.

The money-transmitter consent order clarifies that qualifying for the state's limited cybersecurity exemption narrows programmatic obligations but does not remove the threshold duty to conduct a sufficient risk assessment, a distinction relevant to any entity relying on exemption status.

1 evidence refs
Legal

Historical AML conduct at foreign-bank branches remains open to New York enforcement well after federal review closes.

The federal review of the SEB matter closed with no action while the state regulator proceeded to a $33 million settlement, underscoring that state-level enforcement exposure on historical conduct can persist independent of federal case closure.

1 evidence refs
Board

Regulatory exposure from legacy correspondent-banking conduct and a developing stablecoin capital regime both warrant attention.

Two multi-million dollar settlements over roughly decade-old conduct, alongside a pending stablecoin issuer framework that would impose bank-style capital requirements, together indicate sustained and evolving state-level regulatory exposure for institutions operating in or through New York.

3 evidence refs
CTO

A proposed capital and reserve-custody regime for stablecoin issuers would reshape technical custody architecture.

The proposed framework would ban reserve self-custody and impose codified liquidation triggers, meaning stablecoin issuers licensed in New York would need to redesign custody and treasury architecture around a third-party custody model well ahead of any finalized effective date.

1 evidence refs
Risk

Supervisory testing of exemption boundaries signals a recurring theme beyond this one case.

The finding that a limited exemption does not excuse the baseline risk-assessment duty is a pattern likely to recur across other exempt entities, raising exposure-concentration concerns for any firm whose compliance posture assumes exemption equals materially reduced obligation.

1 evidence refs
Operations

Transaction-monitoring backlog findings at a foreign bank branch illustrate the operational cost of delayed remediation.

The SEB settlement traces to transaction-monitoring backlogs spanning several years, highlighting the operational risk of allowing monitoring queues to accumulate rather than resolving them within the period in which they arise.

1 evidence refs
Audit

A risk-assessment-adequacy finding underscores the need for documented evidence even where program scope is reduced.

The money-transmitter action turned on the adequacy of the firm's own risk assessment, not on an undisputed absence of a cybersecurity program, indicating that audit trails evidencing a sufficient risk-assessment process are scrutinized even for entities qualifying for lighter-touch treatment.

1 evidence refs
Scenario sketches

Finalization of the stablecoin issuer framework ahead of federal alignment deadlines

One illustrative path is that the proposed Authorized Payment Stablecoin Issuer framework is finalized substantially as proposed, with issuers currently relying on bespoke supervisory agreements given a defined transition window to meet the new capital, reserve-custody and liquidation-trigger requirements. In this sketch, the state regulator positions its codified regime as a template compatible with the federal statute, reducing the risk of a bifurcated compliance burden for issuers licensed in New York. This is one plausible path among several and is not a forecast of the rule's actual content or timing.

Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.

Standing trackers (T1–T6)
TrackerStatusNote
T1 · Russian Sanctions-Evasion Architectureno_changeNo material NY-specific T1 development surfaced this cycle.
T2 · EU AML Package / AMLAno_changeNot applicable at the US-NY subnational level.
T3 · FATF Grey Listno_changeNo US-specific grey-list movement this cycle.
T4 · Beneficial-Ownership Register Statusno_changeNo New York-specific BO registry development surfaced this cycle.
T5 · Crypto & Digital-Asset IntegritywatchNYDFS's proposed 23 NYCRR Part 202 (Authorized Payment Stablecoin Issuers) remains in rulemaking.
T6 · Sanctions Regime Divergenceno_changeNo NY-specific sanctions-divergence development surfaced this cycle.
Registers

Enforcement actions

  • 4 Dec 2025
  • 9 Dec 2025
  • 17 Sep 2025
  • 13 Feb 2026
  • 11 Apr 2025
  • 30 Jun 2026
  • 21 May 2026
  • 30 Jun 2026
  • 15 Oct 2026
  • 11 Jan 2024
  • 4 Jan 2023
  • 10 Apr 2025
  • 18 Oct 2026
  • 1 Oct 2026
  • 5 Aug 2026
  • OFAC assessed a civil monetary penalty against Gracetown for accepting payments on behalf of an entity owned by sanctioned oligarch Oleg Deripaska and for failing to timely report blocked property for over 45 months. 4 Dec 2025
  • OFAC settled with a US person who served as fiduciary of the family trust of a sanctioned Russian oligarch, dealing in blocked property and providing prohibited services between April 2018 and June 2022, across 122 apparent violations. 9 Dec 2025
  • NYDFS extended its blockchain-analytics compliance expectations (previously applied only to licensed virtual currency businesses) to NY banking organizations conducting or considering virtual-currency-related activity, formalizing wallet-screening and transaction-monitoring expectations. 17 Sep 2025
  • FinCEN issued an Account Opening Exceptive Relief Order granting covered financial institutions relief from re-verifying beneficial ownership of legal entity customers at each new account opening under the CDD Rule. 13 Feb 2026

Sanctions changes

  • 10 Jan 2025
  • 1 Aug 2025
  • 18 Dec 2025
  • 11 Sep 2025
  • 16 Jan 2026
  • 3 Aug 2026
  • 24 Jul 2026
  • 6 Aug 2026
  • 24 Aug 2026
  • 30 Jun 2026
  • OFAC amended General License 8L to authorize a limited wind-down of energy-related transactions involving certain Russian financial institutions sanctioned under E.O. 14024, through March 12, 2025, affecting NY correspondent-banking exposure to Russian energy trade financing. 10 Jan 2025
  • OFAC and OFSI jointly designated entities tied to the A7A5 ruble-backed stablecoin network, its affiliated exchange Grinex, and Kyrgyzstani issuer Old Vector, targeting a Russian sanctions-evasion settlement rail relevant to NY-based dollar-stablecoin issuers and exchanges monitoring counterparty exposure. 1 Aug 2025
  • OFAC issued amended Russia-related FAQs 1224 and 1225 clarifying scope of sanctions obligations affecting financial institutions, including NY-based banks handling Russia-linked accounts. 18 Dec 2025

Regulatory horizon (register)

  • AMLA Work Programme / build-out
  • FinCEN/OFAC PPSI AML & Sanctions Compliance Program rule
  • NY LLC Transparency Act — initial filing deadline for pre-2026 foreign LLCs
  • Proposed 23 NYCRR Part 202 (Authorized Payment Stablecoin Issuers)
  • 23 NYCRR Part 202 stablecoin BSA/AML certification
  • NY LLC Transparency Act scope-broadening amendment
  • NYLTA annual confirmation deadline for pre-2026 LLCs
  • 23 NYCRR Part 202 - Authorized Payment Stablecoin Issuers
  • NY LLC Transparency Act beneficial ownership disclosure operative
  • GENIUS Act stablecoin AML/BSA implementing regulations deadline
  • FATF October 2026 plenary — US status review
  • OCC state-preemption rulemaking affecting NYDFS crypto supervisory perimeter

Active schemes

  • [HIGH] NY property-management and fiduciary structuring for sanctioned Russian oligarchs
  • [HIGH] Anonymous LLC layering in NY luxury real estate
  • NY-licensed VASP and stablecoin exposure amid federal charter preemption
  • [HIGH] NY legal and fiduciary professional enablement of sanctioned oligarchs
Sources
  1. Small Entity Compliance Guide | FinCEN.gov
  2. FATF
  3. Zavia
  4. Casino Guardian
  5. FinCEN
  6. Crowell & Moring
  7. US Treasury/OFAC
  8. NY Office of the Attorney General
  9. Comsure
  10. arXiv (ACM Web Conference 2026)
  11. https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-40.html
  12. https://www.fatf-gafi.org/en/publications/Fatfgeneral/outcomes-fatf-plenary-june-2026.html
  13. https://ofac.treasury.gov/recent-actions/sanctions-list-updates
  14. https://www.fieldfisher.com/en/services/international-trade/trade-sanctions-blog/uk-eu-and-us-sanctions-on-russia
  15. https://www.fincen.gov/news/news-releases/fincen-issues-supplemental-alert-fuel-smuggling-and-tax-evasion-schemes-southern
  16. https://agbrief.com/news/cambodia/26/01/2026/cambodia-battles-to-avoid-third-fatf-grey-list-placement-amid-scam-crackdown/
  17. https://www.state.gov/releases/office-of-the-spokesperson/2025/09/presidential-determination-on-major-drug-transit-or-major-illicit-drug-producing-countries-for-fiscal-year-2026/
  18. https://www.mayerbrown.com/en/insights/publications/2026/04/stable-rules-for-stablecoins-treasury-proposes-aml-and-sanctions-framework-for-issuers
  19. https://www.kslaw.com/news-and-insights/new-york-charts-its-course-nydfs-proposes-to-align-its-stablecoin-regime-with-the-genius-act
  20. https://www.fincen.gov/system/files/2026-06/FinCEN-Alert-Fiscal-Fuel-Theft.pdf
  21. https://www.global-amlcft.eu/colombia-aml-cft/
  22. New York State Department of Financial Services
  23. Pillsbury Winthrop Shaw Pittman LLP
  24. McDermott Will & Schulte
  25. White & Case
  26. Axler (compliance blog)
  27. https://www.dfs.ny.gov/reports_and_publications/press_releases/pr20260609
  28. https://www.dfs.ny.gov/industry-guidance/regulations/proposed-fs/rp-fs-23nycrr-202-text
  29. https://receivablesinfo.com/2026/09/29/new-york-city-urges-nydfs-expand-bnpl-rules-medical-rent-financing/
  30. https://complianceconcourse.willkie.com/articles/nydfs-reaches-2-25-million-cybersecurity-settlement-with-delta-dental/
  31. https://cryptoslate.com/crypto-laws/bitlicense-23-nycrr-part-200/
  32. https://www.dfs.ny.gov/reports_and_publications/press_releases/pr20261015
  33. https://www.zyphe.com/resources/news/seb-aml-penalty-nydfs-baltic-october-2026
  34. https://www.bankingdive.com/news/nydfs-fines-swedish-bank-seb-33-million-aml-panama-papers/833251/
  35. https://blogaboutnydfs.com/2026/10/
  36. CryptoSlate
  37. New York State Department of Financial Services
  38. NY State Senate (Open Legislation)
  39. CCH (reproducing NYDFS regulation text)
  40. Kor LLP
  41. New York State Department of Financial Services
  42. New York State Department of Financial Services
  43. wiki.private.law (legal commentary)
  44. Paul, Weiss, Rifkind, Wharton & Garrison LLP
  45. Justia (New York Consolidated Laws)
  46. Harvard Law School Forum on Corporate Governance
  47. Stratis Advisory
  48. Skadden, Arps, Slate, Meagher & Flom LLP
  49. New York State Department of Financial Services
  50. New York State Department of Financial Services
  51. Cornell Law School Legal Information Institute
  52. Money Transmitter Law
  53. Crowell & Moring LLP
  54. Manhattan Standard
  55. FindLaw
  56. FindLaw
  57. Justia (New York Consolidated Laws)
  58. 1800NYNYLAW (criminal defense practice site)
  59. New York State Unified Court System
  60. New York State Department of Financial Services
  61. Alston & Bird (Alston Privacy blog)
  62. New York State Department of Financial Services
  63. New York State Senate
  64. Guidehouse
  65. Buckingham Capital Consulting
  66. Board of Governors of the Federal Reserve System
  67. https://financefeeds.com/seb-agrees-to-33-million-new-york-penalty-over-aml-controls/
  68. https://risktemplate.com/blog/2026-08-29-nydfs-order-express-cybersecurity-risk-assessment-exempt-entities/
  69. Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering, Combating the Financing of Terrorism, and Counter-Proliferation Finance Deficiencies | FinCEN.gov
  70. PPSI-AMLCFT-NPRM.pdf
  71. Bullish - Form 6-K - FY2025
  72. Bullish - Form 6-K - FY2025
  73. Press Releases | FinCEN.gov
  74. New York state of mind: a look at NY Department of Financial Services' role as one of the most active regulators in the crypto space | TRM Blog
  75. Financial Action Task Force Identifies Jurisdictions with Anti-Money Laundering and Combating the Financing of Terrorism and Counter-Proliferation Deficiencies | FinCEN.gov
  76. Bitwise XRP ETF - Form S-1/A - FY2025
  77. Wise Group plc - Form 6-K - FY2026
  78. New York state of mind: a look at NY Department of Financial Services' role as one of the most active regulators in the crypto space | TRM Blog
  79. New York banks get clarity on blockchain analytics requirements for digital assets
  80. Sanctions Compliance Guidance for the Virtual Currency
  81. Treasury
  82. What to make of the NYDFS’s latest crypto guidance
  83. What the New York Department of Financial Services guidance means for stablecoins
  84. Civil Penalties and Enforcement Information | Office of Foreign Assets Control
  85. 2025 Crypto Regulatory Round-Up
  86. Request for Administrative Ruling on the Application of FinCEN’s Regulations to a Virtual Currency Payment System | FinCEN.gov
  87. New York Comptroller Criticizes State Financial Regulator on BitLicense Control - Bloomberg
  88. HDFC BANK LTD - Form 6-K - FY2025
  89. HDFC BANK LTD - Form 6-K - FY2025
  90. HDFC BANK LTD - Form 6-K - FY2025
  91. ICICI BANK LTD - Form 6-K - FY2025
  92. HDFC BANK LTD - Form 6-K - FY2025
  93. Finward Bancorp - Form 8-K - FY2025
  94. Discover Financial Services - Form 8-K - FY2025
  95. WELLS FARGO & COMPANY/MN - Form 8-K - FY2025
  96. Finward Bancorp - Form ARS - FY2025
  97. US takes aim at real estate money laundering - ICIJ
  98. How Anonymous Companies Are Used to Launder Money in US Real Estate | Global Witness
  99. New York’s Rich Condo Buyers Risk Losing Secrecy Cloak of LLCs - Bloomberg
  100. New US rule targeting real estate money laundering slated for early 2024 - ICIJ
  101. Hidden in Plain Sight: New York Just Another Island Haven | OCCRP
  102. FinCEN Takes Aim at Real Estate Secrecy in Manhattan and Miami | FinCEN.gov
  103. New York Lawyer Pleads Guilty to Laundering Money for Sanctioned Russian Oligarch | OCCRP
  104. Donald Trump Sued by New York Over Misleading Asset Valuations - Bloomberg
  105. FinCEN Advisory - FIN-2017-A003 | FinCEN.gov
  106. FinCEN Launches Regulatory Process for New Real Estate Sector Reporting Requirements to Curb Illicit Finance | FinCEN.gov
  107. Enforcement Actions | FinCEN.gov
  108. NYDFS Extends Blockchain Analytics Expectations to NY-Regulated Banks. Here’s What You Need to Know. | TRM Blog
  109. FinCEN Penalizes Peer-to-Peer Virtual Currency Exchanger for Violations of Anti-Money Laundering Laws | FinCEN.gov
  110. FinCEN Fines BTC-e Virtual Currency Exchange $110 Million for Facilitating Ransomware, Dark Net Drug Sales | FinCEN.gov
  111. UNITED STATES OF AMERICA FINANCIAL CRIMES ENFORCEMENT NETWORK
  112. FinCEN Announces $15 Million Civil Money Penalty Against Shinhan Bank America for Violations of the Bank Secrecy Act | FinCEN.gov
  113. Beneficial Ownership Information Reporting | FinCEN.gov
  114. Frequently Asked Questions | FinCEN.gov
  115. Fact Sheet: Beneficial Ownership Information Reporting Notice of Proposed Rulemaking (NPRM) | FinCEN.gov
  116. U.S. Beneficial Ownership Information Registry Now Accepting Reports | FinCEN.gov
  117. Beneficial Ownership Information Reporting Rule Fact Sheet | FinCEN.gov
  118. Small Entity Compliance Guide | FinCEN.gov
  119. FinCEN Removes Beneficial Ownership Reporting Requirements for U.S. Companies and U.S. Persons, Sets New Deadlines for Foreign Companies | FinCEN.gov
  120. BOI E-FILING - FinCEN
  121. Guidance on Beneficial Ownership and Transparency of Legal Arrangements
  122. Beneficial Ownership Reporting Outreach and Education Toolkit | FinCEN.gov
  123. CDD Rule FAQs | FinCEN.gov
  124. Fact Sheet: Beneficial Ownership Information Reporting Notice of Proposed Rulemaking (NPRM) | FinCEN.gov
  125. Corporate Transparency Act
  126. Settlement Agreement between the U.S. Department of the Treasury's Office of Foreign Assets Control and An Individual | Office of Foreign Assets Control
  127. Russian Harmful Foreign Activities Sanctions
  128. DEPARTMENT OF THE TREASURY OFFICE OF FOREIGN ASSETS CONTROL
  129. Russian Harmful Foreign Activities Sanctions | Office of Foreign Assets Control
  130. U.S. DEPARTMENT OF THE TREASURY OFFICE OF FOREIGN ASSETS CONTROL
  131. Issuance of Amended Russia-related Frequently Asked Questions | Office of Foreign Assets Control
  132. Russian Attempts to Evade Sanctions Using New Overseas ...
  133. Venture capital firm hit with $216 million penalty for ‘egregious’ violations of US sanctions against Russian billionaire - ICIJ
  134. Russian Oligarch Charged with Violating US Sanctions | OCCRP
  135. US Fines NY Firm For Breaking Sanctions Against Russian Oligarch - Bloomberg
  136. U.S. DEPARTMENT OF THE TREASURY OFFICE OF FOREIGN ASSETS CONTROL
  137. New FinCEN Analysis of BSA Data Reveals Trends on the Financial Activity of Russian Oligarchs | FinCEN.gov
  138. Global Advisory on Russian Sanctions Evasion Issued Jointly ...
  139. Global advisory on Russian sanctions evasion issued jointly by the multilateral REPO Task Force (accessible version) - GOV.UK
  140. Leaked Emails Reveal How Putin’s Friends Dodged Sanctions With Help of Western Enablers | OCCRP
  141. FinCEN Alert on Potential U.S. Commercial Real Estate Investments by Sanctioned Russian Elites, Oligarchs, and Their Proxies | FinCEN.gov
  142. Money Laundering National Risk Assessment Guidance
  143. MONEY LAUNDERING NATIONAL RISK ASSESSMENT TOOLKIT – ANNEXES A-C
  144. 1 1. See 31 U.S.C. § 5312(a)(2); 31 C.F.R. § 1010.100(t). 2.
  145. FATF GUIDANCE Money Laundering National Risk Assessment Guidance November 2024
  146. National money laundering and terrorist financing risk assessment
  147. Anti-Money Laundering Regulations for Residential Real Estate Transfers | FinCEN.gov
  148. 1 The U.S. Department of the Treasury’s (Treasury)
  149. FATF launches National Risk Assessment toolkit to help countries identify greatest money laundering risks
  150. Suspected Money Laundering and Fraud in the Residential Real Estate Industry | FinCEN.gov
  151. The U.S. Department of the Treasury's Office of Foreign Assets Control Assesses a Civil Monetary Penalty against Gracetown, Inc. | Office of Foreign Assets Control
  152. Settlement Agreement between the U.S. Department of the Treasury's Office of Foreign Assets Control and Interactive Brokers LLC | Office of Foreign Assets Control
  153. Settlement Agreement between the U.S. Department of the Treasury's Office of Foreign Assets Control and IPI Partners, LLC | Office of Foreign Assets Control
  154. NEWMARK GROUP, INC. - Form 8-K - FY2025
  155. Recent Actions | Office of Foreign Assets Control
  156. U.S. DEPARTMENT OF THE TREASURY - OFAC
  157. Currenc Group Inc. - Form 6-K - FY2025
  158. Planet 13 Holdings Inc. - Form 8-K - FY2025
  159. Jurisdictions under Increased Monitoring - 19 June 2026
  160. "Black and grey" lists
  161. Outcomes FATF Plenary, 17-19 June 2026
  162. Jurisdictions under Increased Monitoring - 13 February 2026
  163. Money Laundering Advisory Notice: June 2026 - GOV.UK
  164. High-Risk Jurisdictions subject to a Call for Action - 19 June 2026
  165. News
  166. High-risk and other monitored jurisdictions
  167. Jurisdictions under Increased Monitoring - 24 October 2025
  168. High-Risk Jurisdictions subject to a Call for Action - 13 February 2026
  169. D SANCTIONS ADVISORY Guidance on Sham Transactions and Sanctions Evasion
  170. U.S. DEPARTMENT OF THE TREASURY OFFICE OF FOREIGN ASSETS CONTROL
  171. OFAC Imposes $215988868 Penalty on GVA Capital Ltd. ...
  172. OFAC Consolidated Frequently Asked Questions | Office of Foreign Assets Control
  173. Frequently Asked Questions | Office of Foreign Assets Control
  174. 1060 | Office of Foreign Assets Control
  175. OFAC Related Press Releases | Office of Foreign Assets Control
  176. 1049 | Office of Foreign Assets Control
  177. 95 | Office of Foreign Assets Control
  178. Global Crypto Policy Review Outlook 2025/26 Report | TRM Labs
  179. CFTC Moves to Undo Settlement That Had Gemini Pay $5 Million - Bloomberg
  180. 2026 Crypto Crime Report: Scams
  181. New York AG Seeks Landmark Crypto Law, Cites ‘Dysfunction’ - Bloomberg
  182. Crypto Sanctions: 2026 Crypto Crime Report
  183. Law enforcement, banks warn of money laundering gaps in major US crypto bill - ICIJ
  184. The DOJ's NCET Disbanded: What This Means for Digital Assets - Chainalysis
  185. Amid a scam crackdown, crypto giants keep fueling bitcoin ATMs - ICIJ
  186. Trump administration curbs state oversight of crypto industry - ICIJ
  187. Interim Final Rule: Questions and Answers | FinCEN.gov
  188. New York State Department of Financial Services (NYDFS)
  189. U.S. Department of the Treasury, Office of Foreign Assets Control
  190. U.S. Department of the Treasury, Office of Foreign Assets Control
  191. Financial Crimes Enforcement Network (FinCEN)
  192. U.S. Department of the Treasury
  193. Financial Action Task Force (FATF)
  194. International Consortium of Investigative Journalists (ICIJ)
  195. Organized Crime and Corruption Reporting Project (OCCRP)
  196. Elliptic
  197. Chainalysis
  198. Global Witness
Coverage gaps
fim-int-2026-07-07-G001: Confirmation is needed on whether t…
fim-int-2026-07-07-G001: Confirmation is needed on whether the March 2025 Corporate Transparency Act interim final rule has been finalized, amended, or challenged following the Eleventh Circuit December 2025 ruling upholding CTA constitutionality, to resolve the reversibility uncertainty flagged in the beneficial-ownership backstop claim. [resolved]
fim-int-2026-07-07-G002: The finalized text of the coordinat…
fim-int-2026-07-07-G002: The finalized text of the coordinated OCC and Treasury GENIUS Act rulemaking is needed to confirm the actual stringency of AML and sanctions-compliance standards applicable to nationally chartered crypto and stablecoin firms, to properly weigh the OCC-preemption claim. [resolved]
fim-int-2026-07-07-G003: Confirmation of the NY LLC Transpar…
fim-int-2026-07-07-G003: Confirmation of the NY LLC Transparency Act actual operative date and the scope of law-enforcement access to its non-public registry would improve confidence in the state-level beneficial-ownership backstop assessment. [resolved]
fim-int-2026-07-07-G004: No NY-specific FATF mutual evaluati…
fim-int-2026-07-07-G004: No NY-specific FATF mutual evaluation exists; a dedicated sub-national effectiveness assessment would allow NY-level claims to be corroborated independently of the national US mutual evaluation report. [resolved]
fim-int-2026-07-07-G005: Enforcement or examination data con…
fim-int-2026-07-07-G005: Enforcement or examination data confirming whether OCC Interpretive Letter-type national charter approvals have in practice reduced NYDFS supervisory activity over previously state-licensed crypto firms would substantiate the erosion-of-supervisory-perimeter claim beyond investigative reporting. [resolved]
fim-int-2026-08-05-G001: No dedicated RegTech/SupTech guidan…
fim-int-2026-08-05-G001: No dedicated RegTech/SupTech guidance publication identified this cycle beyond enforcement-gap inference from NYDFS consent orders. [resolved]
fim-int-2026-08-05-G002: No dedicated OFSI (UK) parallel che…
fim-int-2026-08-05-G002: No dedicated OFSI (UK) parallel check on Yemen/Houthi sanctions found this cycle. [resolved]
fim-int-2026-08-05-G003: Individual member-state breakdown o…
fim-int-2026-08-05-G003: Individual member-state breakdown of AMLD6 transposition status not available this cycle. [resolved]
fim-int-2026-08-05-G004: Colombia risk assessment shows no f…
fim-int-2026-08-05-G004: Colombia risk assessment shows no fresh driver this cycle; confirmation rests on a single mixed-tier source. [resolved]
fim-int-2026-09-05-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-05-G001 ({'scheme': 'financial_integrity', 'value': 'D3'}): No source found this cycle for Laos (LA) Tier-D mandatory coverage; recorded as no_source rather than fabricated. [resolved]
fim-int-2026-09-05-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-05-G002 ({'scheme': 'financial_integrity', 'value': 'D2'}): EU AML Package (T2 tracker) NY-relevant delta was not actively re-searched at EU-instrument granularity given the US-NY jurisdictional binding of this run. [resolved]
fim-int-2026-09-05-G003 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-05-G003 ({'scheme': 'financial_integrity', 'value': 'D6'}): D6 Compliance Technology enforcement-gap log has no source this cycle for US-NY. [resolved]
fim-int-2026-09-05-G004 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-05-G004 ({'scheme': 'financial_integrity', 'value': 'D5'}): Primary NYDFS Part 202 rule text was not independently retrieved this cycle; sourcing capped at T3 secondary law-firm commentary. [resolved]
fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', 'value': 'D2'}): D2 (beneficial ownership), D4 (conflict finance) and D6 (compliance technology) were not substantively researched this cycle given budget concentration on the US-NY-bound sweep. [resolved]
fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-09-28-G002 ({'scheme': 'financial_integrity', 'value': 'D5'}): Primary Federal Register text of the FinCEN/OFAC PPSI NPRM (cited as 91 Fed. Reg. 18582) was not independently retrieved this cycle; only T3 law-firm secondary reporting was available. [resolved]
fim-int-2026-10-11-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-11-G001 ({'scheme': 'financial_integrity', 'value': 'D2'}): No NYDFS primary consent order or press release located for the NY LLC Transparency Act's filing portal status; portal-readiness claim rests on Tier-3 secondary commentary only. [resolved]
fim-int-2026-10-11-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-11-G002 ({'scheme': 'financial_integrity', 'value': 'D1'}): No US-NY-specific Russian sanctions-evasion or conflict-finance finding was located this cycle (D1, D4). [resolved]
fim-int-2026-10-18-G001: Tier-D watch jurisdictions (KH, LA,…
fim-int-2026-10-18-G001: Tier-D watch jurisdictions (KH, LA, MX, CO) were not re-searched this cycle because the pooled union search budget was directed at the bound jurisdiction (US-NY). [resolved]
fim-int-2026-10-18-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-10-18-G002 ({'scheme': 'financial_integrity', 'value': 'D1'}): No sanctions designations, FATF movements, or beneficial-ownership developments specific to New York were identified; global sanctions-evasion architecture was not re-swept this cycle given the JID-bound scope. [resolved]
fim-int-2026-10-25-G001: Tier D jurisdiction watch (KH, LA, …
fim-int-2026-10-25-G001: Tier D jurisdiction watch (KH, LA, MX, CO) was not actively re-swept this cycle given single-jurisdiction binding and pooled search-budget exhaustion on US-NY-specific queries. [resolved]
fim-int-2026-10-25-G002: D1-D4 and D6-D8 had thin coverage t…
fim-int-2026-10-25-G002: D1-D4 and D6-D8 had thin coverage this cycle; no substantive search was completed for these domains against US-NY beyond the standing-tracker no-change check. [resolved]
fim-int-2026-11-02-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-02-G001 ({'scheme': 'financial_integrity', 'value': 'D5'}): Prospective 23 NYCRR Part 202 stablecoin BSA/AML certification regime and its 2027 effective date rest on a single T3 commentary source (wiki.private.law); no primary NYDFS proposal text was located this cycle. [open]
fim-int-2026-11-02-G002 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-02-G002 ({'scheme': 'financial_integrity', 'value': 'D7'}): Federal-only AML regimes (BSA/FinCEN travel rule, OFAC sanctions lists themselves, 314(b) information sharing, conflict-minerals, counter-proliferation financing) were not researched as NY-specific instruments within the search budget; coverage is limited to NY-specific overlays. [open]
fim-int-2026-11-01-G001 ({'scheme': 'financial_integrity', '…
fim-int-2026-11-01-G001 ({'scheme': 'financial_integrity', 'value': 'D3'}): Underlying NYDFS consent orders for SEB and Swedbank were not independently retrieved; coverage rests on trade-press and law-firm-blog summaries, capping confidence below Confirmed. [open]
fim-int-2026-11-01-G002: Tier D watch jurisdictions (KH, LA,…
fim-int-2026-11-01-G002: Tier D watch jurisdictions (KH, LA, MX, CO) were not actively searched this cycle; the pooled web-search budget was concentrated on US-NY. [open]
FIM-GAP-001 (D2): The March 2025 federal interim final rule …
FIM-GAP-001 (D2): The March 2025 federal interim final rule exempting all domestic reporting companies from Corporate Transparency Act beneficial ownership reporting removed the federal BOI backstop for NY-formed LLCs, leaving only the state's own non-public LLC Transparency Act registry as a substitute.
FIM-GAP-002 (D3): NY-licensed real estate agents, escrow age…
FIM-GAP-002 (D3): NY-licensed real estate agents, escrow agents, and attorneys handling closings remain outside mandatory BSA AML program and suspicious-activity-reporting obligations, notwithstanding repeated FinCEN advisories on real-estate-based laundering by oligarchs and their proxies.
FIM-GAP-003 (D6): Federal OCC reinterpretation of national b…
FIM-GAP-003 (D6): Federal OCC reinterpretation of national bank charter eligibility is allowing crypto firms to obtain charters carrying minimal federal AML oversight and immunity from state regulator action, directly reducing NYDFS's practical supervisory perimeter over crypto AML compliance.
FIM-GAP-004 (D1): No NY-specific FATF mutual evaluation exis…
FIM-GAP-004 (D1): No NY-specific FATF mutual evaluation exists; FATF assesses the United States as a single jurisdiction, and no dedicated NY-level supranational assessment report is publicly available to substantiate state-specific effectiveness ratings beyond the national MER.

Evidence

Confidence-tiered claims

NYDFS settlement, $33 million, for customer due diligence gaps and Baltic transaction-monitoring backlogs dated 2015-2019 [Source 1]
Probable · 1 source
NYDFS penalty, $50 million, for intentionally failing to provide information concerning the Panama Papers matter [Source 1]
Uncertain · 1 source
NYDFS consent order, $250,000, for failing to conduct a risk assessment sufficient to inform cybersecurity program design despite qualifying for the Part 500 limited exemption [Source 1]
Probable · 1 source
Remains in rulemaking; comment period closed 21 September 2026; not finalized this cycle [Source 1]
Probable · 1 source
Secondary reporting flags that the NY Department of State's filing portal/forms for beneficial-ownership disclosure had not yet been released as of this cycle's sources, ahead of the Dec 31, 2026 deadline. [Source 1]
Uncertain · 1 source
BNPL originators, platform operators and loan-acquirers; comment period closed Sept 14, 2026; NYC DCWP filed comments Sept 21, 2026 urging expanded scope to medical/rent financing [Source 1]
Probable · 1 source
Federal GENIUS Act; codifies 'Authorized Payment Stablecoin Issuer' framework, withdrawing 2022 Industry Letter, adding custodian concentration limits and risk-management programme requirements; effective date tied to GENIUS Act commencement (no later than Jan 18, 2027) [Source 1]
Probable · 1 source
Federal BSA/FinCEN baseline; no new NY-specific AML statutory change identified in the 2026-10-11 to 2026-10-18 window [Source 1]
Probable · 1 source
$2.25 million consent order against Delta Dental Insurance Company (April 30, 2026) for 23 NYCRR Part 500 violations tied to a 2023 MOVEit breach [Source 1]
Probable · 1 source
USD 33,000,000 consent order against Skandinaviska Enskilda Banken AB (SEB) and its New York Branch for AML program failures (CDD, correspondent-bank due diligence, backlogged transaction monitoring) tied to the 2016 Panama Papers leak. [Source 1]
Probable · 1 source
Proposed 23 NYCRR Part 202 (Authorized Payment Stablecoin Issuers) would formalize payment-stablecoin issuer requirements aligned to the federal GENIUS Act, published 22 July 2026, remaining at consultation stage. [Source 1]
Probable · 1 source
in_force [Source 1]
Probable · 1 source
in_force [Source 1]
Probable · 1 source
in_force [Source 1]
Probable · 1 source
in_force [Source 1]
Probable · 1 source
settlement [Source 1]
Probable · 1 source
USD 15,000,000 [Source 1]
Probable · 1 source
vetoed 2025-12-19 [Source 1]
Probable · 1 source
in_force [Source 1]
Probable · 1 source
proposed [Source 1]
Uncertain · 1 source
2026-01-01 [Source 1]
Probable · 1 source
annual [Source 1]
Probable · 1 source
suspension of authority to conduct business [Source 1]
Probable · 1 source
licence required [Source 1]
Probable · 1 source
no scienter requirement [Source 1]
Probable · 1 source
10000 [Source 1]
Probable · 1 source
monitor and block [Source 1]
Probable · 1 source
blockchain analytics and reporting expected [Source 1]
Probable · 1 source
whistleblowing programme expected [Source 1]
Probable · 1 source
no dedicated state gatekeeper AML regime identified [Source 1]
Uncertain · 1 source
20000000 [Source 1]
Probable · 1 source
blockchain analytics expected [Source 1]
Probable · 1 source
NYDFS signed a seven-page MOU with the Wyoming Division of Banking on 1 Oct 2026 establishing procedures for sharing supervisory information, coordinating examinations, and cooperating on licensing, chartering and enforcement for virtual-currency/digital-asset firms in both states, targeting roughly six-month licensing reviews for certain established firms. [Source 1]
Probable · 1 source
Non-U.S.-formed LLCs doing business in New York before Jan 1, 2026 must file a beneficial-ownership disclosure or exemption attestation with the NY Department of State by Dec 31, 2026. [Source 1]
Probable · 1 source
New York's AML/CTF regime for financial and virtual-currency firms is supervised by NYDFS under NY Banking Law Article 13-B (money transmitters), 23 NYCRR Part 200 (BitLicense) and 23 NYCRR Part 504 (transaction monitoring), layered on federal BSA/OFAC obligations; no change identified this cycle. [Source 1]
Probable · 1 source
The NYDFS-Wyoming MOU (Oct 1, 2026) formalises interstate supervisory cooperation on virtual-currency/digital-asset licensing, examination and enforcement. [Source 1]
Probable · 1 source