The EU’s Anti-Money Laundering Authority (AMLA) has made crypto a strategic priority. Crypto-asset service providers (CASPs) and payment institutions working with crypto businesses should expect EU supervisors to align their expectations, including how crypto flows are monitored. Staffing is under scrutiny too: an understaffed anti-money laundering (AML) team can become a regulatory finding. Estonia’s action against Wallester shows why staffing and independent oversight belong in an AML audit, alongside customer checks and transaction monitoring.

This edition of RegRally covers September’s anti-money laundering and counter-terrorist financing (AML/CTF) developments for financial institutions and crypto businesses in the Baltics and across the EU.

At a glance

• AMLA: crypto-assets are now a strategic priority. AMLA presented its Crypto Action Plan for 2026 and beyond and called for stronger blockchain analytics at EU level.
• United Kingdom: firms closed the accounts of 238,396 suspected money mules in 2025. The Financial Conduct Authority (FCA) wants mule activity stopped earlier.
• Estonia: Finantsinspektsioon ordered Wallester AS to remedy governance, safeguarding and AML/CTF deficiencies, including by ensuring sufficient AML/CTF staff, by 31 December 2026.
• CASPs: the Commission set the criteria under which host Member States may require a central contact point from CASPs operating through establishments other than branches.
• Latvia / EU case law: in Jautiva, the Court of Justice ruled that the General Data Protection Regulation (GDPR) precludes national rules making the personal data of all shareholders of public limited companies, including minority shareholders, public without conditions such as a legitimate interest, even where the rules serve AML/CTF and sanctions purposes.
• FATF: the Financial Action Task Force (FATF) reports that underground banking and hawala are increasingly associated with “money laundering as a service”, with a growing shift toward digital wallets and stablecoins.
• Gaming and gambling: the FATF published new risk indicators and found that in many jurisdictions illegal gambling markets rival or even exceed legal markets.

AMLA makes crypto a strategic priority

Date: 15 September 2026 | Source: Anti-Money Laundering Authority (AMLA)
Link

At the Global Conference on Criminal Finances and Cryptoassets in Luxembourg, AMLA Executive Board member Simonas Krepšta said that crypto-assets have become a strategic priority for the Authority. He presented AMLA’s Crypto Action Plan for 2026 and beyond, which focuses on four areas:

• improving EU-wide understanding of crypto-related risks;
• advancing supervisory consistency and effectiveness;
• strengthening analytical resources;
• deepening cooperation with relevant EU stakeholders.

AMLA is analyzing money laundering and terrorist financing risks in the crypto sector, and a report is expected to follow. Mr Krepšta highlighted the importance of strengthening blockchain-analytics capabilities, noting that the current fragmented approach across Member States requires an EU-level response.

He also noted that the Markets in Crypto-Assets Regulation (MiCA) and the AML package provide a stronger framework, but important risks remain. Effective implementation and supervisory convergence will be decisive.

Why it matters

Supervisory expectations for crypto businesses are likely to converge across the EU, including the use of blockchain analytics in supervision. As AMLA strengthens blockchain analytics, CASPs should expect closer scrutiny of their own analytics and wallet screening.

What we recommend for CASPs and payment institutions serving crypto businesses

• Expect supervisors across the EU to align their expectations under AMLA, including on the use of blockchain analytics in supervision. Make sure your analytics tools and wallet-screening coverage would withstand a supervisory review.
• Track the forthcoming AMLA crypto risk report. Plan to reflect its findings in the business-wide risk assessment and in the sectoral risk factors used in customer risk scoring.

FCA urges earlier action against money mule accounts

Date: 23 September 2026 | Source: FCA (UK)
Link

The FCA published the results of a survey of 35 retail banks, building societies, challenger banks, payment institutions and e-money institutions on how they handle money mule accounts. Firms closed the accounts of 238,396 suspected money mules in 2025, up from 233,269 in 2024 and 184,935 in 2023.

Closures were highest among customers aged 26 to 39, and customers aged 25 and under also made up a significant share. The sharpest increase was among customers aged 40 to 49.

The FCA found that criminals move fraudulent funds through several accounts and typically cash out between the second and fifth account. Some accounts had been used repeatedly for mule activity and had also been used for fraud, which points to established criminal infrastructure. The National Crime Agency estimates that more than GBP 100 billion is laundered annually through the UK or UK corporate structures.

According to the FCA, firms need to act on mule activity as early as possible. The FCA is also working with industry on an action plan, including better ways for firms and law enforcement to share intelligence on suspected mule activity. Card payments were the most common cash-out method, used for many low-value transactions or for higher-value payments to local businesses and retailers.

Why it matters

The survey covered payment and e-money institutions, not only banks. Closing a mule account is often too late, because by then the money has usually moved on through other accounts. The FCA says firms need to act as early as possible. In practice, this points to controls at onboarding and soon after an account is opened, before the funds are cashed out.

What we recommend for payment and e-money institutions

• Review account-opening controls and monitoring of new personal accounts. Set alert rules for funds moving rapidly in and out within days of onboarding and for accounts receiving funds from multiple unrelated payers.
• Have a documented process for restricting, closing and reporting mule accounts, and for sharing information with the financial intelligence unit (FIU) and, where the legal basis exists, with other payment service providers.
• Use the FCA age-profile findings to calibrate risk scoring for younger customers, without blanket restrictions that would breach access-to-account obligations.

Estonian supervisor orders Wallester to remedy governance and AML/CTF deficiencies

Date: 16 September 2026 | Source: Finantsinspektsioon (Estonian Financial Supervision and Resolution Authority)
Link

Finantsinspektsioon issued a precept (ettekirjutus) to the Estonian payment institution Wallester AS following an on-site inspection. The inspection assessed general and risk governance, the internal audit and compliance functions, capital management, reporting accuracy, the prevention of money laundering and terrorist financing, and the application of financial sanctions.

Wallester must remedy the deficiencies identified, including by:

• ensuring the separation of the three lines of defense at all levels;
• adopting and implementing the necessary internal rules;
• applying the statutory measures for safeguarding client assets;
• ensuring sufficient human resources for AML/CTF compliance.

The deficiencies must be remedied by 31 December 2026.

Why it matters

The precept requires internal rules, sufficient AML/CTF staff and separate lines of defense. Payment institutions’ AML reviews should examine procedures, who carries out controls, who can challenge business decisions and whether internal audit checks this independently.

What we recommend for payment and e-money institutions

• Assess AML/CTF staffing against transaction volumes and client numbers, and document the assessment. The supervisor explicitly identified AML/CTF staffing as an issue in this case.
• Confirm that the AML/CTF and sanctions functions sit in the second line and are independent from operational teams, with internal audit as a distinct third line. Make sure the organizational chart and job descriptions reflect this.
• Payment and e-money institutions with Estonian operations should be prepared for on-site inspections that combine governance, safeguarding, reporting and AML/CTF topics in a single review.

Commission extends AML central contact point standards to CASPs

Date: 8 September 2026 | Source: European Commission
Link

The European Commission adopted a Delegated Regulation (C(2026) 6179) amending Commission Delegated Regulation (EU) 2018/1108. As a result, the regulatory technical standards on the criteria for appointing central contact points, and the rules on their functions, will apply to crypto-asset service providers in addition to electronic money issuers and payment service providers.

A Member State may require a CASP to appoint a central contact point if the CASP has establishments on its territory in a form other than a branch and its head office is in another Member State. This is possible where any of the following applies:

• the CASP has 10 or more such establishments in that Member State;
• the cumulative value of the services and activities carried out by its establishments in that Member State is expected to exceed EUR 3 million per financial year, or exceeded that amount in the previous financial year;
• the information needed to assess these criteria is not provided to the host supervisor on request and in a timely manner.

Host Member States may also require a central contact point where this is commensurate with the money laundering or terrorist financing risk of those establishments and, in exceptional cases, where there are reasonable grounds to believe that this risk is high.

The central contact point must, among other things:

• facilitate the implementation of AML/CTF policies and procedures;
• oversee compliance;
• inform the head office of breaches;
• represent the CASP before the host authorities.

The act is subject to scrutiny by the European Parliament and the Council. It will enter into force on the twentieth day following its publication in the Official Journal.

Why it matters

A MiCA authorization lets a CASP offer services in other Member States, but AML/CTF supervisors in those countries can still oversee its local establishments. If a CASP works there through agents or other establishments that are not branches, the host state may require a central contact point: a local person or function responsible for AML/CTF compliance there.

What we recommend for cross-border CASPs

• CASPs passporting into Lithuania, Latvia or other Member States through agents or other non-branch establishments should compare the value of services provided through those establishments in each country with the EUR 3 million threshold. Prepare for a host-state request to appoint a central contact point.
• Draft the governance arrangements for a central contact point in advance, including the reporting line to the group AML officer and the mandate to act before host authorities and FIUs.
• Monitor publication in the Official Journal and the entry-into-force date. Check for any national implementing decisions by Lietuvos bankas or Latvijas Banka.

CJEU limits public access to shareholder data in Latvian case

Date: 3 September 2026 | Source: Court of Justice of the EU
Link

In Case C-798/24 Jautiva, on a reference from the Constitutional Court of Latvia, the Court of Justice of the EU held that Directive (EU) 2017/1132 does not require the public disclosure of information on all shareholders of public limited liability companies, including minority shareholders.

The Court examined the Latvian rule requiring shareholder names, identification numbers, addresses, email addresses (where the shareholder asked the company to use them) and shareholding details to be published online, without restriction and downloadable in bulk. It accepted that the rule pursued legitimate objectives: business transparency, the prevention of money laundering and terrorist financing, and the implementation of sanctions. However, it found that unrestricted public access was disproportionate under the GDPR and the Charter, since less intrusive means exist, such as access conditional on a demonstrated legitimate interest.

The judgment builds on the 2022 ruling on public access to beneficial ownership registers. It confirms that AML/CTF and sanctions objectives do not justify unlimited public disclosure of the personal data of shareholders.

Why it matters

Firms that use public registers for customer due diligence may need to change how they get shareholder information. Limited public access does not remove the duty to identify and verify owners, so firms should be ready to meet access conditions or ask customers directly.

What we recommend for obliged entities

• Where customer due diligence relies on national shareholder or beneficial ownership registers, document the legal basis of access. In Latvia, obliged entities already have a statutory right under the AML law to obtain register data on members and beneficial owners. Elsewhere, be prepared for national registers to require a legitimate interest for access, and make sure the firm can demonstrate its legitimate interest as an obliged entity.
• Review internal data-protection notices covering the collection and retention of shareholder and beneficial ownership data, and confirm that the proportionality reasoning is recorded.
• For clients that are Latvian public limited liability companies, anticipate changes to the publicly available shareholder data. Adjust the customer due diligence (CDD) procedure to use direct requests to the client where register data becomes restricted.

FATF: underground banking and hawala increasingly associated with “money laundering as a service”

Date: 3 September 2026 | Source: Financial Action Task Force (FATF)
Link

The FATF published a report on professional money launderers operating through underground banking, hawala and other similar service providers (HOSSPs). More than 80 percent of reporting jurisdictions identified these systems among the principal professional money laundering channels or techniques. Individual cases involved more than EUR 500 million laundered within a few months.

The report describes a shift toward commercially operated “money laundering as a service” networks that offer low commissions and rapid cross-border value transfer. Nearly 70 percent of respondents identified the integration of new technologies, including a growing shift toward “digital hawala”:

• operators coordinate through encrypted messaging apps;
• customers initiate transfers through digital wallets and fintech applications;
• operators settle balances between themselves in virtual assets, including stablecoins.

The proceeds handled now extend beyond drug trafficking to fraud, cyber-enabled crime, terrorist financing and illegal gaming.

The FATF notes growing involvement by lawyers, accountants, notaries, corporate agents, real estate agents and casino operators. These schemes are also becoming integrated with formal banking, fintech platforms and virtual asset services. It recommends combining targeted prevention and enforcement with proportionate financial inclusion measures, supported by legal clarity, better detection and public-private cooperation.

Why it matters

Digital hawala uses the same products many fintechs offer: customers send money through wallets and apps, and operators settle with each other in stablecoins. Each payment can look ordinary on its own, so the risk only shows when firms look at how incoming and outgoing flows and counterparties connect.

What we recommend for payment, e-money and crypto businesses

• Add the report’s typologies to the business-wide risk assessment. Pay particular attention to money remittance, multi-currency wallet, crypto on- and off-ramp and merchant acquiring products that can be used to net-settle informal value transfers.
• Review transaction-monitoring scenarios for patterns consistent with informal value transfer: offsetting flows between unrelated parties in different corridors, third-party settlement of trade invoices, and frequent stablecoin settlement between the same counterparties.
• Refresh staff training with the report’s red flags, and confirm that suspicious transaction reporting procedures cover professional intermediaries acting for clients.

FATF publishes risk indicators for gaming and gambling

Date: 9 September 2026 | Source: Financial Action Task Force (FATF)
Link

The FATF published a report on money laundering and terrorist financing risks in gaming and gambling, together with a new set of risk indicators. The report finds that risks are rising with the expansion of online platforms and fast cross-border payments. In many jurisdictions, illegal gambling markets rival or even exceed the size of legal markets.

The indicators cover:

• multiple accounts and payment methods opened under different identities;
• discrepancies between customer and payment data;
• links to cyber fraud, organized crime or corruption;
• unusual or coordinated betting patterns suggesting match manipulation;
• smurfing and movement of funds without genuine gambling;
• complex ownership structures obscuring beneficial owners.

The FATF notes that payment methods such as cash, e-wallets, mobile money and virtual assets are vulnerable to a range of money laundering risks. Platforms depend on interconnected digital services that may fall outside the scope of regulation.

The FATF urges governments to strengthen oversight, crack down on illegal and offshore operators, and deepen international and public-private cooperation.

Why it matters

The risks extend to payment institutions, e-money institutions and CASPs processing gambling-related funds. A merchant’s stated business activity may not reveal where its customers are located, whether it has the required licenses or whether payments relate to genuine play.

What we recommend for payment and e-money institutions and CASPs serving gambling merchants

• Payment institutions, e-money institutions and CASPs that serve gambling operators or process gaming-related payments should incorporate the FATF indicators into merchant onboarding, ongoing monitoring and merchant-activity reviews.
• Verify that gambling merchants hold the license required in each jurisdiction where players are located, and that the firm’s own license and card-scheme rules permit the activity.
• Treat pass-through of gaming proceeds without genuine play, and repeated deposits and withdrawals across multiple payment instruments, as scenarios requiring alert rules in the monitoring system.

Our view

AMLA’s crypto priorities give CASPs and payment institutions serving crypto businesses a reason to review how they use blockchain analytics and wallet screening. We recommend testing coverage against the networks, assets and counterparties the business actually handles, and documenting how findings feed into customer risk assessments and investigations. Cross-border CASPs should also assess whether their local operations could fall within the central contact point framework.

The FCA and FATF findings provide specific patterns to test in transaction monitoring, including money mule activity, informal value transfers and gambling-related flows. The Wallester case also highlights staffing, independent compliance oversight and follow-up when gaps are found. Alerts are only useful if there are staff to investigate them.

The Latvian ruling may limit what firms can find in public registers, but it does not change their duty to identify and verify ownership.

How ECOVIS ProventusLaw can help with AML/CTF compliance

ECOVIS ProventusLaw advises payment and e-money institutions, CASPs, banks and other obliged entities on AML/CTF compliance, from risk assessments and policies to independent audits and remediation after a supervisory inspection. The aim is compliance that holds up under audit and inspection, so that our clients avoid fines, business restrictions and the suspension or withdrawal of their license.

For the issues covered in this edition, we can help with:

• Independent AML/CTF and sanctions audit – testing whether know-your-customer (KYC), transaction monitoring, screening and suspicious transaction reporting work in practice. Members of our audit team have carried out more than 50 internal and external AML and sanctions audits.
• Review of AML systems and tools – configuration of transaction monitoring, KYC software, and politically exposed person (PEP) and sanctions screening, including scenarios and thresholds. Where artificial intelligence (AI) or algorithmic tools support AML decisions, the review covers their role in customer risk scoring and monitoring, human oversight and retained evidence.
• Post-inspection remediation – remediation plans after findings by the Bank of Lithuania or another supervisor, and independent reviews of whether corrective measures have been implemented and work.
• Compliance support and governance – the three lines of defense, resourcing of the compliance function, internal controls and ongoing compliance support that turns audit findings into assigned actions and follows them through to completion.
• Money laundering and terrorist financing (ML/TF) risk assessments – business-wide and customer risk assessments that reflect new typologies such as digital hawala, money mules and gaming-related flows.
• AML policies, procedures and training – KYC, CDD and enhanced due diligence (EDD) procedures adapted to your business model, escalation procedures and internal investigations, and ML/TF training for staff and management.
• AMLA readiness and cross-border requirements – preparation for the EU AML package and AMLA supervision, and host-state requirements such as central contact points.
• AML/CTF for licensing and crypto businesses – the AML/CTF parts of license applications for payment, e-money and crypto businesses, and CASP-specific AML requirements, including Travel Rule controls, blockchain analytics and wallet screening.

If you are planning an audit or need to resolve known gaps, contact us and we will help you plan the work before the regulator asks.

Why ECOVIS ProventusLaw

ECOVIS ProventusLaw is one of the most experienced financial regulatory law firms in the Baltics and has advised financial institutions for many years.

Our Banking, Finance & FinTech department has separate regulatory, compliance and audit teams. This gives clients access to legal advice, operational compliance support and independent testing, with roles defined for each engagement.

We adapt AML processes to each client’s business model, so that compliance does not hold up customer onboarding or day-to-day operations. We also work to supervisory timelines: we can carry out an audit quickly and support clients during an inspection or when they respond to the regulator’s findings and inspection reports.

The department is led by Inga Karulaitytė. Members of our teams hold the Certified Anti-Money Laundering Specialist (CAMS) and Certified Information Privacy Professional/Europe (CIPP/E) certifications and the International Compliance Association (ICA) International Advanced Certificate in Anti-Money Laundering, and our auditors are members of the Association of Internal Auditors. Before the actual audit, clients can check their readiness with RegRally, our AI-assisted AML compliance platform. They complete an expert-vetted AML questionnaire, upload documents and receive findings and recommendations within a couple of hours.

With teams in Lithuania, Latvia and Estonia, we act as a single point of contact for regulatory and compliance matters across the Baltic region. As part of the ECOVIS International network, present in more than 90 countries, we also support clients whose business crosses several jurisdictions. We have advised on more than 40 end-to-end licensing projects, from business structuring and regulatory applications to ongoing supervision and compliance.

The post RegRally Insights: AML/CTF Regulation, October 2026 appeared first on ECOVIS ProventusLaw.

The September edition of RegRally covers what matters most to financial institutions, payment and electronic money institutions, crypto-asset service providers (CASPs) and other obliged entities in Lithuania and across the EU.

This month at a glance

• Lithuania: the Bank of Lithuania’s letter, based on 2025 supervisory data and 10 AML/CTF inspections, flags formally assessed geographic risk, the need to verify authorization under the Markets in Crypto-Assets Regulation (MiCAR), weak enhanced due diligence, disproportionately low suspicious transaction reporting and incomplete sanctions screening. The Council of Europe’s MONEYVAL 6th evaluation round starts in October 2026, and the EU AML package applies in full from 10 July 2027.
• Lithuania enforcement: the Bank of Lithuania temporarily prohibited the electronic money institution Lux International Payment System from providing financial services to new and existing customers while an inspection is ongoing, citing suspected serious deficiencies and possible AML/CTF breaches. The restriction was authorized by the Regional Administrative Court.
• Payment fraud: the Bank of Lithuania published the first results of the Verification of Payee (VoP) service, based on a survey of seven banks, two central credit unions and five electronic money institutions. VoP is seen as a useful additional measure against payment fraud, and monitoring continues.
• AMLA direct supervision: the EBA published a draft data model and taxonomy for the 2027 eligibility data collection, the basis for AMLA’s first selection of institutions for direct supervision. The reference date is 31 December 2026. Payment institutions and electronic money institutions fall within the reporting population.
• Cross-border payments: AMLA surveyed electronic money institutions (EMIs) and payment service providers (PSPs) on Central Contact Points until 15 September 2026, feeding future technical standards under Article 41(2) of the Anti-Money Laundering Directive (AMLD). Crypto-asset service providers are not in scope.
• Isle of Man: the Isle of Man Financial Services Authority (FSA) published a year-one progress report on its two-year supervisory engagement program covering AML, countering the financing of terrorism and countering proliferation financing (AML/CFT/CPF), and set out its priorities for 2026/27. Legislative reviews touch virtual asset service providers (VASPs) and the Travel Rule, and a questionnaire on foreign politically exposed persons (PEPs) is coming.

Bank of Lithuania warns financial market participants about ML/TF deficiencies

Date: 20 August 2026 | Source: Lietuvos bankas (Bank of Lithuania), Financial Market Supervision Department
Link

What happened?

The Bank of Lithuania sent a letter to the heads of financial market participants on money laundering and terrorist financing (ML/TF) risks and prevention requirements. It is based on 2025 supervisory data and 10 AML/CTF inspections.

The letter flags several risk areas:

• geographic risk assessed too formally, based on declared residence only rather than actual activity and payment flows
• higher-risk activities (crypto-assets, gambling, remittance), where licenses must be verified in official registers, including MiCAR authorization now that the transitional period ended on 1 July 2026
• agents and distributors, where responsibility remains with the financial market participant
• cash operations, virtual IBANs (vIBANs) and Travel Rule compliance

Deficiencies found during inspections:

• business-wide risk assessments that do not match the actual risk profile
• weak enhanced due diligence
• transaction monitoring not tailored to the business
• incomplete sanctions screening, with no sanctions risk assessment

Suspicious transaction report (STR) numbers remain disproportionately low or nil in most sectors. The Bank of Lithuania also reminded firms of the cash reporting duty: linked cash operations reaching EUR 15,000 must be reported to the Financial Crime Investigation Service (FNTT) within 7 business days.

On sanctions, circumvention continues via the Commonwealth of Independent States (CIS) and third countries, and EU packages now reach third-country banks and crypto platforms. Not being established in Russia or Belarus is no evidence of low risk. The Council of Europe’s MONEYVAL 6th evaluation round runs from October 2026 to May 2028, and the EU AML package applies in full from 10 July 2027.

Why does it matter for businesses?

The flagged areas are where 2025 inspections actually found breaches, and the MONEYVAL evaluation starts in October 2026.

Two duties already apply. The MiCAR transitional period ended on 1 July 2026, so crypto-asset business clients must be checked for MiCAR authorization in the official register. And the EUR 15,000 cash reporting duty carries a 7-business-day deadline.

STR volumes should be reviewed against the firm’s scale and risk profile, and firms should be able to justify them.

Recommended actions

Lithuanian financial market participants should:

• re-do geographic risk assessments based on actual activity and payment flows
• screen the crypto client book for clients without MiCAR authorization
• review STR volumes against the firm’s scale and risk profile and be able to justify them
• complete the sanctions risk assessment and extend screening to ownership and the intermediary chain
• remediate known deficiencies before expanding activities
• start the EU AML package gap analysis against the 10 July 2027 application date

Bank of Lithuania temporarily prohibits EMI Lux International Payment System from providing services during inspection

Date: 4 August 2026 | Source: Lietuvos bankas (Bank of Lithuania)
Link

What happened?

The Bank of Lithuania temporarily prohibited the electronic money institution UAB “Lux International Payment System” from providing financial services to both new and existing customers while an inspection is ongoing.

The measure was imposed because the Bank of Lithuania had grounds to suspect serious deficiencies and possible breaches of AML/CTF and other regulatory requirements. The restriction was authorized by the Regional Administrative Court.

Why does it matter for businesses?

The case shows that the supervisor does not need a completed inspection to act. Where suspected deficiencies are serious, the supervisor can impose an interim restriction before the inspection is completed, with court authorization.

For other institutions, the practical lesson is that material AML/CTF weaknesses should be escalated and remediated promptly, and management should be able to demonstrate control over identified deficiencies.

Recommended actions

Financial institutions should:

• treat the case as a supervisory benchmark demonstrating the Bank of Lithuania’s willingness to impose interim restrictions before completion of an inspection where serious deficiencies are suspected
• ensure material AML/CTF weaknesses are escalated and remediated promptly
• ensure management can demonstrate effective control over identified regulatory deficiencies

Bank of Lithuania publishes first results of the Verification of Payee service

Date: 13 August 2026 | Source: Lietuvos bankas (Bank of Lithuania)
Link

What happened?

The Bank of Lithuania published the first assessment of the implementation of the Verification of Payee (VoP) service, based on a survey covering seven banks, two central credit unions and five electronic money institutions.

The initial results indicate that VoP is considered a useful additional measure for reducing payment fraud, particularly by alerting customers to discrepancies between the beneficiary name and account details before a payment is executed.

The Bank of Lithuania nevertheless emphasised that further data and experience are required to assess its effectiveness. It intends to continue monitoring both financial institutions’ and consumers’ experience with the service.

Why does it matter for businesses?

VoP has moved from go-live to supervisory review. Expectations will now be shaped by implementation data, so how a firm handles match results today is what gets benchmarked tomorrow.

The key question is whether VoP outcomes are integrated into the firm’s fraud prevention and monitoring framework, rather than only shown to the customer as a warning.

Recommended actions

Payment service providers should:

• review VoP implementation, including the handling of match, no-match and close-match results and customer warnings
• assess whether VoP outcomes are appropriately integrated into the firm’s fraud prevention and monitoring framework
• monitor further Bank of Lithuania communications as supervisory expectations develop based on implementation experience

EBA publishes draft reporting framework for AMLA’s 2027 eligibility data collection

Date: 4 August 2026 | Source: European Banking Authority (EBA)
Link

What happened?

The EBA published, as part of release 4.4 of its reporting framework, a public working draft of the data model and taxonomy that will support the 2027 eligibility data collection underpinning AMLA’s first selection of financial institutions for direct supervision.

The data will be gathered in early 2027 from all obliged entities provisionally identified as eligible in 2026, to confirm whether they still meet the criteria as of the 31 December 2026 reference date.

Credit and financial institutions fall within the population that must report, including payment institutions and electronic money institutions. Feedback on the draft could be submitted through the EBA feedback form until 24 August 2026, and the draft should be read alongside the templates AMLA published for the 2026 eligibility-criteria data collection.

Why does it matter for businesses?

Selection for direct AMLA supervision from 2028 will be based on this data. The 31 December 2026 reference date means the position that determines eligibility is being fixed now, not when the data is collected in 2027.

Payment institutions and electronic money institutions are explicitly within the reporting population. Firms that have not mapped their internal data against the draft model may only discover gaps once the collection exercise is already under way.

Recommended actions

Firms should:

• assess whether they are within scope of the eligibility data collection and begin mapping the required data against the draft model and taxonomy
• review the draft reporting templates alongside the templates AMLA published for the 2026 eligibility-criteria data collection
• plan governance and resourcing for possible selection for AMLA direct supervision from 2028, using 31 December 2026 as the reference date

AMLA surveyed EMIs and payment service providers on Central Contact Points

Date: 6 August 2026 | Source: Anti-Money Laundering Authority (AMLA)
Link

What happened?

AMLA launched a survey on Central Contact Points (CCPs), inviting electronic money institutions and payment service providers to share their experience of the current CCP framework under Article 45(9) of the AMLD and Delegated Regulation (EU) 2018/1108.

The survey supports AMLA’s preparatory work on forthcoming regulatory technical standards (RTS) under Article 41(2) of the AMLD. The standards will address when a host Member State may require the appointment of a CCP and what functions the CCP should perform.

AMLA ran a parallel survey for national competent authorities. It also confirmed that crypto-asset service providers are not in scope, as the previous CCP framework did not apply to them. The survey closed on 15 September 2026, and AMLA will publish a report on the main findings.

Why does it matter for businesses?

For EMIs and payment service providers operating cross-border through agents or distributors, CCP requirements shape host-Member-State compliance obligations. The future technical standards will harmonize when a host state may require a CCP and what functions it performs.

Practical implementation challenges reported in the survey are likely to shape the future harmonized standards.

Recommended actions

EMIs and PSPs operating cross-border through agents or distributors should:

• review their host-Member-State CCP arrangements
• capture practical implementation challenges now, as they are likely to shape the future harmonized RTS
• monitor the follow-up report and the eventual Article 41(2) technical standards

Isle of Man FSA publishes year-one progress report on AML/CFT supervisory priorities

Date: 19 August 2026 | Source: Isle of Man Financial Services Authority (FSA)
Link

What happened?

The Isle of Man FSA published a year-one progress report on its two-year AML/CFT/CPF supervisory engagement program. It sets out the risk-based work delivered during 2025/26 and the priorities for 2026/27.

The report covers topical thematic reviews (sanctions, terrorist financing, proliferation financing, business risk assessments, reporting and registers), sectoral reviews (estate agents, moneylenders) and legislative reviews touching Virtual Asset Service Providers (VASPs) and the Travel Rule.

Findings feed into the AML/CFT Handbook, sectoral guidance, the Island’s National Risk Assessment and preparations for the MONEYVAL mutual evaluation. The Authority also signalled a forthcoming questionnaire on foreign PEPs.

Why does it matter for businesses?

For firms within scope, the stated priorities show where the FSA’s thematic and sectoral reviews will land during 2026/27. The legislative reviews confirm continued attention to VASPs and the Travel Rule.

Recommended actions

Firms within scope should:

• review the FSA’s stated supervisory priorities and benchmark their AML/CFT/CPF frameworks against the thematic and sectoral focus areas
• confirm Travel Rule readiness ahead of continued legislative attention (VASPs and firms handling transfers)
• anticipate thematic reviews and the PEP questionnaire, and evidence remediation of known gaps

What businesses should take from this month’s developments

The Bank of Lithuania’s letter makes the expectation explicit: risk assessments, due diligence, monitoring, reporting and sanctions screening must reflect how the business actually operates, not just how it is documented.

The Lux International Payment System case shows the other side of the same expectation. Where serious deficiencies are suspected, the supervisor is prepared to stop business before the inspection ends.

At EU level, the AMLA era is arriving on two tracks. The 2027 eligibility data collection, with 31 December 2026 as the reference date, will determine which institutions face direct AMLA supervision from 2028. The Central Contact Point survey shows AMLA building the technical rules for cross-border payment and e-money business.

MONEYVAL starts in October 2026 and the EU AML package applies in full from 10 July 2027. The deadlines are set.

Need assistance?

ECOVIS ProventusLaw advises financial institutions, fintechs, CASPs and other obliged entities on AML/CTF compliance, including:

• AML/CTF regulatory assessments and gap analysis
• business-wide ML/TF risk assessments
• AML policies, internal controls and procedures
• customer due diligence and enhanced due diligence frameworks
• transaction monitoring and suspicious transaction reporting
• AML governance, MLRO responsibilities and employee training
• CASP and virtual asset AML/CTF requirements
• regulatory inspections and remediation of identified deficiencies.

If your organization is preparing for increased AMLA or national supervisory scrutiny, our team can help assess whether your AML framework works in practice and is ready for regulatory review.

The post RegRally Insights: AML/CTF Regulation, September 2026 appeared first on ECOVIS ProventusLaw.

This month’s RegRally highlights the developments most relevant to financial institutions, CASPs, fintechs and other obliged entities operating in Lithuania and across the EU.

This month at a glance

• Virtual assets: FATF identifies continuing gaps in Travel Rule implementation, VASP supervision and risk mitigation, while highlighting stablecoins, unhosted wallets and offshore VASPs as growing risk areas.
• DeFi: FATF takes a functional approach to determining when supposedly decentralised arrangements fall within AML/CFT requirements.
• EU reporting: AMLA is developing a harmonised EU format for suspicious transaction reporting and transaction data, potentially replacing fragmented national reporting approaches.
• Ongoing monitoring: AMLA is preparing horizontal guidance on customer information updates and ongoing monitoring applicable across obliged entities.
• Lithuania: FNTT’s 2025 inspections show that deficiencies in CDD, record keeping, internal controls, employee training and suspicious transaction reporting remain key enforcement risks.

FATF identifies continuing gaps in VASP supervision and highlights emerging virtual asset risks

Date: 16 July 2026 | Source: Financial Action Task Force (FATF)
Link

What happened?

FATF published its seventh targeted update on the implementation of Recommendation 15 concerning virtual assets and virtual asset service providers (VASPs).

The report identifies continued global progress in implementing the Travel Rule: 83% of surveyed jurisdictions have now passed Travel Rule legislation, compared with 73% in 2025.

At the same time, significant implementation gaps remain. These include translating risk assessments into effective mitigation measures, operationalising licensing and registration frameworks, identifying persons conducting VASP activities, and ensuring effective risk-based supervision and enforcement.

FATF also highlights emerging risks involving the use of virtual assets for organised fraud and money laundering, with particular attention to stablecoins, peer-to-peer transactions involving unhosted wallets and offshore VASPs.

Why does it matter for businesses?

The report reinforces that virtual asset businesses are moving into a more mature supervisory environment. Having a Travel Rule solution or VASP licence is not, by itself, sufficient: supervisors are increasingly likely to assess whether the underlying risk assessment and controls actually address the relevant typologies.

For CASPs, exposure to stablecoins, unhosted wallets, P2P transfers and offshore counterparties should therefore be reflected in the business-wide ML/TF risk assessment and corresponding controls.

Recommended actions

CASPs should:

• benchmark Travel Rule implementation against the FATF’s identified implementation gaps;
• review whether stablecoin, unhosted-wallet and offshore-VASP risks are adequately reflected in the ML/TF risk assessment;
• test whether enhanced due diligence and transaction-monitoring controls respond to the relevant virtual asset typologies;
• assess whether existing controls remain appropriate as the business expands into new virtual asset products or transaction models.

FATF warns that DeFi is increasingly exposed to money laundering and other financial crime risks

Date: 21 July 2026 | Source: Financial Action Task Force (FATF)
Link

What happened?

FATF published a targeted report on regulatory challenges arising from decentralised finance (DeFi).

The report identifies permissionless access, automated smart-contract execution, cross-border reach and pseudonymity as factors that can increase exposure to fraud, ransomware, professional money laundering and proliferation financing.

Implementation of the FATF Standards for qualifying DeFi arrangements remains limited: almost 93% of reporting jurisdictions have not yet implemented the Standards in this area.

Importantly, FATF takes a functional approach to determining whether a DeFi arrangement falls within Recommendation 15. A business or person may be subject to AML/CFT requirements where it exercises sufficient control or influence, even where the arrangement is presented as decentralised.

FATF identifies indicators of potential control both on-chain and off-chain, including governance token concentration, administrative privileges, control over upgrades, economic benefits and influence over development or infrastructure.

Why does it matter for businesses?

The report challenges the assumption that describing a product or protocol as “decentralised” automatically places it outside the AML/CFT framework.

This is particularly relevant to CASPs, financial institutions and technology businesses interacting with DeFi protocols. The regulatory analysis may need to focus on who actually controls or influences the arrangement, rather than how the protocol is marketed or structured.

FATF also states that financial institutions and VASPs should apply relevant AML/CFT controls when interacting with qualifying DeFi arrangements and refrain from interacting where compliance cannot be achieved.

Recommended actions

Businesses interacting with DeFi should:

• document an assessment of the actual control and influence exercised over each relevant arrangement;
• consider FATF’s on-chain and off-chain indicators when determining whether a DeFi arrangement falls within Recommendation 15;
• assess the adequacy of CDD, transaction monitoring and other AML/CFT controls applicable to the relationship;
• identify exposure to chain-hopping, cross-chain bridges, decentralised exchanges and mixers;
• avoid entering into or maintaining relationships where required AML/CFT controls cannot be effectively implemented.

For CASPs and financial institutions, DeFi exposure should also be reflected in the business-wide ML/TF risk assessment.

AMLA moves towards a harmonised EU format for suspicious transaction reporting

Date: 2 July 2026 | Source: Anti-Money Laundering Authority (AMLA)
Link

What happened?

AMLA launched a public consultation on draft implementing technical standards establishing a common EU format for reporting suspicions and providing transaction records to Financial Intelligence Units (FIUs).

The proposed framework would introduce a harmonised set of data points for suspicious transaction reporting across the EU, replacing the fragmented national reporting formats currently used by obliged entities.

A public hearing is scheduled for 9 September 2026, while written consultation responses remain possible.

Why does it matter for businesses?

A common EU reporting format could materially change how compliance teams prepare and submit suspicious transaction reports, particularly for businesses operating across several EU jurisdictions.

For Lithuanian and Latvian businesses, the change may require adjustments to existing reporting processes and the data collected for national FIU reporting.

The impact will be particularly relevant to fintechs, financial institutions and other businesses operating cross-border, where differences between national reporting requirements currently create operational complexity.

Recommended actions

Compliance teams should:

• compare existing STR reporting processes with the proposed EU data points;
• identify information currently collected in national systems that may not map easily to the proposed format;
• assess whether existing transaction-monitoring and case-management systems can produce the required information;
• consider submitting consultation feedback where the proposed requirements create significant operational or proportionality concerns.

Businesses operating across multiple EU jurisdictions should begin considering the implications for their reporting architecture rather than waiting until implementation.

AMLA develops EU-wide guidance on ongoing monitoring of business relationships

Date: 2 July 2026 | Source: Anti-Money Laundering Authority (AMLA)
Link

What happened?

AMLA held a public hearing on its draft guidelines for the ongoing monitoring of business relationships, attracting more than 1,200 stakeholders from the financial and non-financial sectors.

The draft guidance addresses customer information updates and the monitoring of transactions and activities. As horizontal guidance, it is intended to apply across obliged entities, with proportionality and the risk-based approach embedded throughout.

The written consultation remains open until 3 September 2026.

Why does it matter for businesses?

Ongoing monitoring is one area where AML frameworks often become operationally inconsistent: customer information may be updated at fixed time intervals without sufficient regard to changes in customer risk, while transaction monitoring may operate separately from KYC refresh processes.

The forthcoming AMLA guidance may therefore influence how businesses structure customer reviews, trigger events, conduct transaction monitoring, and perform periodic KYC refreshes.

Recommended actions

Obliged entities should:

• review current KYC refresh procedures against the draft AMLA approach;
• assess whether customer reviews are sufficiently risk-based rather than driven solely by fixed review cycles;
• identify trigger events that should result in an earlier review of customer information;
• assess whether transaction monitoring outcomes feed effectively into customer-risk reassessment;
• Consider submitting consultation responses by 3 September 2026, where the proposed approach creates significant operational challenges.

Fintechs and other business models with large or rapidly changing customer populations should pay particular attention to the proportionality of ongoing monitoring requirements.

FNTT enforcement data shows where Lithuanian AML controls continue to fail

Date: 16 July 2026 | Source: Financial Crime Investigation Service (FNTT)

FNTT published the 2025 activity report of its Money Laundering Prevention Board.

During 2025, FNTT conducted 20 inspections of obliged entities and imposed measures on 11 companies. Fines ranged from €2,435 to €771,400, with total fines reaching approximately €1.46 million.

The most common deficiencies concerned:

• customer identification and verification;
• record keeping;
• internal policies and control procedures;
• appointment and training of responsible employees;
• reporting requirements for transactions of €15,000 or more;
• suspicious transaction reporting;
• examination of complex, unusually large or unusually structured transactions.

Why does it matter for businesses?

This is one of the most useful indicators of current AML enforcement priorities in Lithuania because it shows the areas where deficiencies are actually identified during inspections.

The findings also demonstrate that enforcement risk does not necessarily arise from sophisticated money laundering schemes. Basic weaknesses in CDD, documentation, governance, training and escalation processes remain significant.

For obliged entities, the practical question is whether the AML framework would withstand an inspection today — not whether the required policies formally exist.

Recommended actions

Lithuanian obliged entities should test their AML framework against the FNTT’s identified enforcement areas, including:

• customer identification and verification;
• customer and business relationship risk assessment;
• record keeping and audit trails;
• internal AML policies and controls;
• appointment, competence and training of responsible employees;
• suspicious transaction identification and escalation;
• reporting of transactions subject to mandatory reporting requirements;
• assessment of complex, unusually large or unusually structured transactions.

Businesses should ensure that evidence of these controls is readily available and inspection-ready, rather than relying solely on written policies.

What businesses should take from this month’s developments

The direction of AML/CTF supervision is becoming clear: regulators are moving from formal requirements towards demonstrable effectiveness.

For virtual asset businesses, this means demonstrating that emerging risks — including stablecoins, unhosted wallets, and DeFi — are reflected in the risk assessment and control framework.

For traditional financial institutions and other obliged entities, the same principle applies to CDD, transaction monitoring, suspicious transaction reporting, ongoing KYC and internal governance.

The FNTT’s Lithuanian enforcement data is particularly clear: weaknesses in fundamental AML controls can still lead to significant financial penalties.

Businesses should therefore assess not only whether their AML framework is documented, but whether it would withstand a regulatory inspection, a complex customer-risk scenario or a suspicious transaction requiring rapid escalation and reporting.

Need assistance?

ECOVIS ProventusLaw advises financial institutions, fintechs, CASPs and other obliged entities on AML/CTF compliance, including:

• AML/CTF regulatory assessments and gap analysis;
• business-wide ML/TF risk assessments;
• AML policies, internal controls and procedures;
• customer due diligence and enhanced due diligence frameworks;
• transaction monitoring and suspicious transaction reporting;
• AML governance, MLRO responsibilities and employee training;
• CASP and virtual asset AML/CTF requirements;
• regulatory inspections and remediation of identified deficiencies.

If your organisation is preparing for increased AMLA or national supervisory scrutiny, our team can help assess whether your AML framework is not only documented but operationally effective and ready for regulatory review.

The post RegRally Insights: AML/CTF Regulation, August 2026 appeared first on ECOVIS ProventusLaw.

The July edition of AML/CFT Insights highlights key regulatory developments shaping the future of anti-money laundering compliance, with an increased focus on ongoing monitoring, risk-based controls, and the effective implementation of AML frameworks.

AMLA continues to strengthen the EU AML/CFT framework by emphasising continuous customer risk assessment, transaction monitoring and practical effectiveness of compliance measures. Meanwhile, the end of the MiCAR transitional period introduces new challenges for crypto-asset service providers, including customer migration risks and increased supervisory expectations.

Recent enforcement actions and international developments, including FATF updates and crypto-related financial crime cases, demonstrate that regulators are placing greater emphasis on whether organisations can, in practice, identify, assess and manage evolving ML/TF risks.

AMLA Consults on Guidelines for Ongoing Monitoring of Business Relationships

Source: AMLA | Date: 2026-06-03
Link

The Anti-Money Laundering Authority (AMLA) launched a public consultation on draft Guidelines on the ongoing monitoring of business relationships under Article 26(5) of the Anti-Money Laundering Regulation (AMLR).

The draft Guidelines establish risk-based and proportionate principles for maintaining up-to-date customer information and monitoring customer activity throughout the entire business relationship lifecycle.

The Guidelines address how obliged entities should identify changes in customers’ circumstances, review customers’ risk profiles, and ensure that transaction monitoring processes remain effective at detecting unusual or suspicious activity.

The consultation applies across financial and non-financial sectors and is particularly relevant for newly covered entities, including certain crypto-asset service providers (CASPs), crowdfunding providers and traders in high-value goods.

The consultation period remains open until 3 September 2026.

Why does it matter?

The initiative reflects a broader regulatory shift: AML compliance is increasingly moving away from a one-time onboarding exercise towards continuous risk management.

Supervisors are placing greater emphasis on whether companies can demonstrate that their customer monitoring processes operate effectively in practice, rather than merely having documented AML procedures.

For financial institutions and CASPs, this means that ongoing monitoring, customer risk reassessment and transaction-monitoring calibration are becoming key elements of supervisory scrutiny.

Recommended actions

Businesses should:

• Review existing ongoing monitoring procedures against AMLA’s draft expectations.
• Identify gaps in customer review triggers and transaction-monitoring calibration.
• Ensure customer risk assessments are updated throughout the relationship lifecycle.
• Prepare internal AML documentation for alignment with the final Guidelines once adopted.
• Consider submitting feedback to AMLA before the consultation deadline, particularly where practical implementation challenges exist.

AMLA Highlights ML/TF Risks Following the End of the MiCAR Transitional Period

Source: AMLA | Date: 2026-06-29
Link

AMLA issued an Advisory Note addressing money laundering and terrorism financing risks arising from the end of the MiCAR transitional period, which concluded across the EU on 1 July 2026.

The Advisory Note identifies several potential risks connected with the transition, including:

• the exit of unauthorised virtual asset service providers (VASPs);
• migration or termination of large volumes of customer relationships;
• increased concentration of customers among authorised crypto-asset service providers (CASPs).

AMLA emphasised that CASPs onboarding customers from former VASPs should conduct individual risk assessments and avoid automatic de-risking based solely on the customer’s previous service provider.

The Authority also highlighted the need for CASPs to ensure that transaction-monitoring systems, onboarding procedures, and compliance resources can handle increased operational pressure.

The end of the MiCAR transitional period represents a significant restructuring point for the European crypto market. While market consolidation may improve regulatory certainty, it also creates new AML risks related to customer migration, increased transaction volumes and potentially incomplete historical customer information. CASPs will be expected to demonstrate that growth and customer onboarding are supported by appropriate AML controls.

Recommended actions

CASP clients receiving migrating customers should document individualised risk assessments rather than uniform treatment, and evidence why de-risking decisions are proportionate.

Stress-test transaction-monitoring and staffing capacity against projected inflows following the 1 July 2026 deadline.

Retain up-to-date CDD and suspicious-activity reporting throughout any wind-down phase.

Lietuvos bankas Identifies AML Control Weaknesses During EMI Inspections

Source: Lietuvos bankas | Date: 2026-06-04
Link

Following targeted AML/CFT inspections, Lietuvos bankas concluded administrative settlements with two electronic money institutions: UAB “Nuvei” and UAB “TeslaPay”.

The supervisory findings related to deficiencies in several areas of AML governance and control frameworks.

In the case of UAB “Nuvei”, Lietuvos bankas identified shortcomings related to:

• enhanced customer identification;
• monitoring of business relationships and transactions;
• conflict-of-interest management;
• internal controls for safeguarding client funds.

A €90,000 sanction was imposed for AML-related breaches, alongside additional supervisory measures.

In the case of UAB “TeslaPay”, Lietuvos bankas identified deficiencies in transaction-monitoring procedures, including insufficient calibration to ML/TF risks and inconsistent application of monitoring measures. A €19,000 sanction was imposed.

The enforcement actions demonstrate that Lithuanian supervisors continue focusing on the practical effectiveness of AML frameworks.

The existence of AML policies and procedures alone is insufficient. Supervisors expect institutions to demonstrate that controls are appropriately designed, risk-based, consistently applied and independently tested.

Transaction monitoring remains a key area of regulatory attention, particularly regarding calibration and alignment with actual business risks.

Recommended actions

• Strengthen AML/CFT transaction monitoring by ensuring monitoring scenarios are risk-based, properly calibrated, periodically reviewed, and consistently applied across all customers.
• Enhance customer due diligence and ongoing monitoring by ensuring enhanced due diligence measures are applied to higher-risk customers and business relationships are reviewed throughout the customer lifecycle.
• Strengthen governance and conflict-of-interest management by implementing clear conflict-of-interest controls, maintaining declarations, and ensuring independent oversight of key decisions.
• Review client-funds safeguarding controls by ensuring robust reconciliation, segregation, oversight, and documented internal controls to protect client funds.
• Perform independent effectiveness testing of AML/CFT and safeguarding frameworks to identify weaknesses before regulatory inspections and ensure timely remediation.

FATF Updates Jurisdictions Under Increased Monitoring

Source: FATF | Date: 2026-06-19
Link

The Financial Action Task Force (FATF) updated its list of jurisdictions under increased monitoring (“grey list”) on 19 June 2026.

The updated list includes jurisdictions subject to increased FATF monitoring due to identified strategic deficiencies in their AML/CFT frameworks.

The list includes:
Angola, Bolivia, Bosnia and Herzegovina, Bulgaria, Cameroon, Côte d’Ivoire, Democratic Republic of the Congo, Haiti, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Monaco, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam, Virgin Islands (UK) and Yemen.

Why does it matter?

FATF grey-listing remains an important factor in assessing geographic AML/CFT risk exposure.

Financial institutions are expected to consider updated jurisdictional risks when assessing customers, transactions and business relationships.

The update may affect customer risk classifications, enhanced due diligence procedures and internal risk models.

Recommended actions

Refresh country-risk models and enhanced-due-diligence triggers against the current grey list; the specific jurisdictions should be verified directly against the FATF statement.

FATF Publishes Follow-Up Report on Indonesia’s AML/CFT Progress

Source: FATF | Date: 2026-06-03
Link

FATF published a follow-up report assessing Indonesia’s progress in strengthening its AML/CFT framework.

The report provides an updated assessment of Indonesia’s technical compliance with FATF standards and the progress achieved since the previous evaluation.

Why does it matter?

Businesses with customers, counterparties or operations connected to Indonesia should ensure that their AML risk assessments reflect the latest FATF assessment.

Regulatory expectations require institutions to maintain current geographic risk assessments rather than relying on outdated country-risk assumptions.

Recommended actions

Firms with Indonesia exposure should reflect the updated technical-compliance position in country-risk assessments.

Europol Highlights Crypto-Related Terrorism Financing Risks

Source: Europol | Date: 2026-06-10
Link

Europol supported Belgian authorities in concluding a counter-terrorism investigation into an international network involved in financing the so-called Islamic State.

Seven individuals were convicted and received prison sentences ranging from five to fifteen years.

The investigation identified the use of terrorism financing structures, cryptocurrency-based money laundering and facilitation networks connected with financing activities involving Foreign Terrorist Fighters detained in conflict zones.

Why does it matter?

The case highlights the continued focus of authorities on crypto-related financial crime risks.

Crypto transactions remain an area of increased regulatory attention, particularly when they involve complex structures, high-risk jurisdictions, or links to terrorism-financing indicators.

Recommended actions

Note the crypto-based TF/ML typology; reinforce monitoring for small-value crypto flows linked to foreign-terrorist-fighter facilitation and conflict-zone nexus.

Ensure sanctions and terrorism-financing screening covers facilitation networks, not only designated principals.

Need assistance?

Our AML/CTF specialists assist financial institutions, FinTech companies, EMIs, payment institutions and crypto-asset service providers in navigating evolving regulatory expectations and strengthening compliance frameworks.

We can assist with:

• AML/CFT gap assessments and compliance maturity reviews
• Independent reviews of AML policies, procedures and internal controls
• Transaction monitoring and risk assessment framework reviews
• AML/CFT policy updates and implementation support
• Regulatory inspections, investigations and remediation projects
• CASP, EMI and payment services licensing and supervisory matters
• Preparation for changing EU AML/CFT requirements, including AMLA and MiCAR-related developments

The post RegRally Insights: AML/CFT Compliance Updates, July 2026 appeared first on ECOVIS ProventusLaw.

Alongside this, EU and international developments continue to reshape the AML/CFT landscape — from AMLA’s preparations for its 2027 direct supervision regime and new harmonised risk assessment standards, to FATF findings on Singapore and updated supervisory insights from Estonia’s FIU. Across jurisdictions, the direction is consistent: a stronger focus on cross-border transparency, governance of complex payment infrastructures, and the effectiveness of transaction monitoring and reporting.

Together, these developments confirm that AML supervision is entering a more centralised and data-driven phase, where FinTech growth must be matched by demonstrable control maturity across products, clients, and jurisdictions.

Baltic FIUs Highlight Elevated AML Risks in Regional FinTech Payment Sector

The three Baltic Financial Intelligence Units — Financial Crime Investigation Service (FNTT), Estonian Financial Intelligence Unit, and Financial Intelligence Unit of Latvia, together with the Bank of Lithuania, have published a landmark joint study, “Evolving Payment Landscapes and AML Challenges in the Baltic States”, examining developments across the region between 2021 and mid-2024.

The report identifies Lithuania as a significant regional FinTech payment hub with comparatively elevated exposure to foreign clients and associated AML risks. According to the study, suspicious transaction reports (STRs) filed in Estonia and Latvia frequently reference accounts held with Lithuanian FinTech payment institutions and electronic money institutions, suggesting that traditional bank de-risking has often shifted higher-risk customers toward digital payment providers rather than removing the underlying risk.

The study highlights several structural vulnerabilities within the regional payments ecosystem, including:

• virtual IBAN (vIBAN) arrangements
• Banking-as-a-Service (BaaS) models
• crypto on-ramp and off-ramp structures
• complex cross-border payment flows involving non-resident clients

The authorities also identify recurring money laundering and financial crime typologies involving:

• fraud schemes
• tax evasion structures
• sanctions circumvention activities
• misuse of digital payment infrastructure for cross-border fund movements

For Lithuanian EMIs, PIs, crypto-asset service providers, and FinTech firms, the report serves as a clear supervisory signal. Institutions should expect continued regulatory focus on customer onboarding, beneficial ownership verification, transaction monitoring, sanctions screening, vIBAN controls, BaaS governance, and crypto-related risk management.

Key considerations for firms include:

• reassessing foreign customer risk exposure
• reviewing vIBAN and BaaS control frameworks
• strengthening sanctions and fraud monitoring systems
• enhancing transaction monitoring scenarios for complex payment flows
• ensuring AML risk assessments accurately reflect current business models

The report reinforces a broader regulatory trend: Baltic supervisors increasingly expect FinTech institutions to demonstrate that innovation and growth are matched by robust AML/CFT controls and effective risk governance.

Our recommendation:

Lithuanian PIs and EMIs: conduct targeted enhanced due diligence reviews of non-resident client portfolios; re-assess risk scores for clients from jurisdictions overrepresented in Baltic STRs.

Implement specific vIBAN and BaaS opacity controls; apply transaction monitoring calibrated to the pass-through payment patterns and crypto on-ramp typologies identified in the joint study.

Enhance cross-Baltic information-sharing protocols by assigning correspondent relationship managers to Lithuanian PSP accounts flagged in Estonian and Latvian FIU STRs.

AMLA Launches 2027 Selection Process for Direct Supervision of High-Risk Financial Institutions

The Anti-Money Laundering Authority published a reporting package on 12 May 2026 to support the identification of obliged entities that may fall within AMLA’s direct supervisory remit from 2028.

The package includes:

• a standardised reporting template (version 1.1)
• an interpretative note explaining the eligibility criteria for the 2027 selection exercise
• guidance on the information national supervisors must collect from obliged entities

National competent authorities, including the Bank of Lithuania, Latvijas Banka, and Finantsinspektsioon, must gather the required data from obliged entities by 15 August 2026.

From 2028, AMLA will directly supervise 40 high-risk cross-border financial institutions across the EU, marking a significant shift towards centralised AML/CFT supervision at European level.

Financial institutions with cross-border operations, particularly EMIs, payment institutions, banks, crypto-asset service providers, and other regulated entities operating in multiple Member States, should assess whether they could fall within AMLA’s future supervisory scope and prepare for upcoming reporting requests from their national regulators.

Key actions include:

• reviewing AMLA’s eligibility criteria and reporting requirements
• ensuring data collection and reporting capabilities are in place
• assessing cross-border activities and group structures
• evaluating whether the institution could qualify for AMLA direct supervision from 2028
• engaging early with national supervisors regarding reporting expectations

AMLA will host a public webinar on 10 June 2026 to provide further guidance on the selection exercise and reporting process.

For Baltic fintechs and financial institutions, this development is an important reminder that EU-level AML supervision is rapidly becoming a reality and may significantly influence future compliance expectations and supervisory engagement.

Assess whether your institution meets the criteria for provisional eligibility for AMLA direct supervision; engage your national supervisor before the 15 August 2026 data collection deadline.

Begin updating AML/CFT governance frameworks to align with AMLA’s risk assessment methodology; register for the AMLA webinar on 10 June 2026 to ensure accurate reporting template completion.

AMLA Advances EU AML/CFT Harmonisation with Group-Wide and Risk Assessment Standards

The Anti-Money Laundering Authority held two public hearings in May 2026, marking a key step in implementing the EU’s harmonised AML/CFT framework under Regulation (EU) 2024/1624 (AMLR).

On 20 May 2026 (with over 650 participants), AMLA presented draft Regulatory Technical Standards (RTS) on group-wide AML/CFT requirements under Articles 16(4) and 17(3) AMLR. These RTS establish binding requirements for financial groups, including:

• group-wide AML/CFT policies, procedures and internal controls
• consolidated group-wide ML/TF risk assessments
• intra-group information sharing mechanisms
• governance arrangements for AML/CFT compliance at the group level across cross-border structures

On 28 May 2026, AMLA presented draft Guidelines on Business-Wide Risk Assessment (BWRA), setting the foundation for how obliged entities identify, assess, document and manage ML/TF risks. The BWRA Guidelines harmonise the risk-based approach across the EU and directly underpin future AMLA Customer Due Diligence (CDD) RTS requirements, shaping:

• customer risk profiling methodologies
• transaction monitoring thresholds
• enhanced due diligence (EDD) triggers
• risk scoring and control calibration frameworks

Practical recommendations for obliged entities

• Conduct a gap analysis between existing group AML/CFT governance and the draft RTS, covering all subsidiaries and branches in scope
• Align parent and subsidiary compliance functions, with particular focus on intra-group information sharing and escalation protocols
• Review and update business-wide risk assessment methodologies in line with the BWRA Guidelines
• Treat BWRA implementation as a strategic priority, as it will be central to supervisory convergence and AMLA’s future selection process for direct supervision

These developments signal a shift toward a fully standardised EU AML framework, where consistency of governance, documentation, and risk methodology will become a core supervisory expectation rather than a best practice.

FATF/APG Mutual Evaluation Highlights Targeted AML/CFT Gaps in Singapore

The Financial Action Task Force (FATF) and the Asia/Pacific Group on Money Laundering (APG) published the Mutual Evaluation Report on Singapore on 6 May 2026, based on an on-site assessment conducted in July 2025.

The report concludes that Singapore maintains a generally competent and well-coordinated AML/CFT framework. However, it identifies the need for more effective risk-based outcomes in several areas. Importantly, Singapore remains in the regular follow-up category and is not subject to grey-listing.

Key findings

The assessment highlights several structural and supervisory challenges:

• supervisory gaps in designated non-financial businesses and professions (DNFBPs) and casinos
• uneven enforcement consistency across sectors
• cross-border ML/TF exposure linked to Singapore’s role as a fintech, payment, and digital asset hub

The FATF/APG also notes Singapore’s ongoing commitment to strengthening implementation of FATF standards and addressing identified deficiencies.

Implications for financial institutions

For banks, EMIs, payment institutions, and crypto-asset service providers with exposure to Singapore, the report is relevant from a risk-based compliance perspective:

• reassess correspondent banking and payment relationships involving Singapore-based entities
• apply enhanced, risk-proportionate due diligence to fintech, payments, and digital asset counterparties
• review exposure to cross-border transaction flows routed through Singapore infrastructure
• ensure ongoing monitoring reflects identified supervisory gaps in higher-risk sectors

Institutions should also closely monitor Singapore’s follow-up reporting under the FATF process, as any deterioration in status or escalation of follow-up measures could materially affect internal country risk ratings and correspondent banking policies, particularly in crypto-asset and cross-border payment channels.

Estonian FIU Yearbook 2025 Highlights Sharp VASP Market Contraction and Shift in AML Priorities

The Estonian Financial Intelligence Unit (FIU) published its Yearbook 2025, providing an updated assessment of AML/CFT risks, supervisory trends, and typologies in Estonia. The report is available in English.

Key findings

• Significant reduction in VASP sector risk exposure
  The number of active virtual asset service provider (VASP) licences has dropped from 846 at the beginning of 2021 to 36 by the end of 2025, reflecting a heavily consolidated and de-risked market.
• Persistent fraud and online scams
  Online fraud schemes remain a major source of illicit proceeds, continuing to generate large-scale financial crime exposure.
• Ongoing crypto-sector vulnerabilities
  The FIU highlights continued risks in the crypto ecosystem, particularly nested service models, where smaller operators rely on infrastructure provided by larger exchanges, creating opacity and dependency risks.
• Shift in supervisory focus: SAR quality over volume
  The FIU emphasises that the effectiveness of suspicious activity reports (SARs) depends on quality and analytical value, not submission volume.
• Institutional resilience and independence
  The report underscores the importance of FIUs maintaining operational autonomy and strong tools to counter increasingly complex cross-border financial crime schemes.

Practical implications for obliged entities

• reassess exposure to the now highly consolidated Estonian VASP market
  • review reliance on nested crypto service structures and upstream/downstream dependencies
  • strengthen due diligence on VASP counterparties, particularly those providing infrastructure services
  • improve SAR processes with a focus on analytical quality, relevance, and actionable intelligence
  • align internal AML frameworks with FIU expectations on typology detection and reporting standards

Institutions operating in Estonia or engaging with Estonian VASPs should treat the findings as a signal that the market has moved from expansion to concentration, with supervisory focus shifting toward service quality, transparency of crypto flows, and intelligence value of reporting rather than formal compliance output volume.

The post RegRally Insights: Your Guide to AML/CTF Compliance, June 2026 appeared first on ECOVIS ProventusLaw.

Lithuania remains particularly active, with significant enforcement actions against financial institutions, increased scrutiny of higher-risk business models, and direct encouragement for market participants to engage in AMLA consultations that will shape the next generation of EU AML/CFT requirements. At the same time, cross-border developments, such as the Swedbank case in Sweden, underscore the growing intersection among AML compliance, executive accountability, and reputational risk.

For regulated firms, the key message is clear: AML/CTF compliance in 2026 requires more than policies on paper. It demands effective controls, accurate regulatory reporting, strong governance, and readiness for a more intrusive and harmonised European supervisory environment.

Lietuvos Bankas (Bank of Lithuania) – Notice inviting participation in AMLA consultations

The Bank of Lithuania, alongside AMLA, is inviting Lithuanian financial market participants to engage with two ongoing AMLA public consultations on draft AML/CFT instruments (see Entry 2 below for details). The notice specifically targets banks, credit unions, payment institutions, electronic money institutions, and other obliged entities supervised by Lietuvos Bankas, encouraging them to submit written comments and participate in the public hearings organised by AMLA.

Lithuanian-supervised institutions should treat this as a direct call to action from their national regulator to engage with the AMLA consultation process.

Participation demonstrates regulatory engagement and may help shape rules that will directly affect day-to-day AML/CFT compliance.

European Merchant Bank UAB – warning, €270,000 fine, and temporary activity restrictions

European Merchant Bank UAB – warning, €270,000 fine, and temporary activity restrictions for AML/CFT and international sanctions control failures, including failure to follow supervisory instructions and submission of inaccurate supervisory information.

Bank must remediate all violations by 30 June 2026 and submit an independent audit conclusion by 30 September 2026. Temporarily prohibited from onboarding new higher-risk clients and restricted in services to existing clients from higher-risk third countries.

Banks and other regulated entities with higher-risk client segments must ensure robust AML/CFT and sanctions controls are in place, especially for enhanced due diligence and transaction monitoring. The temporary activity restriction is a significant escalation signal. Entities with similar risk profiles should conduct an urgent compliance review.

Contact us for AML/CFT compliance support.

AMLA Consults on Risk Assessments and Group-Wide AML Frameworks

AMLA launched two public consultations on draft instruments that will shape how obliged entities identify, assess, and manage money laundering / terrorist financing (ML/TF) risks.

1. Draft Guidelines on Business-Wide Risk Assessment

Sets minimum expectations for all obliged entities when conducting enterprise-wide AML risk assessments, applying proportionality based on size, business model, and risk profile.

• Consultation open until 15 July 2026
• Public hearing: 28 May 2026

2. Draft RTS on Group-Wide Requirements

Introduces minimum standards for consolidated AML/CFT frameworks across groups, including cross-border structures and third-country operations. Groups must maintain a holistic view of ML/TF risk across the organisation.

• Consultation open until 15 June 2026
• Public hearing: 20 May 2026

Additional development: AMLA also published an updated data model and taxonomy for its 2027 direct supervision selection exercise, with comments accepted until 10 May 2026.

Obliged entities – especially those operating across multiple jurisdictions or with third-country subsidiaries – should review both instruments carefully and consider submitting responses or attending the public hearings.

Contact the Ecovis team for assistance in assessing the impact on existing AML/CFT frameworks and preparing consultation submissions.

Sweden Supreme Court Acquits Former Swedbank CEO in AML-Related Fraud Case

Sweden’s Supreme Court acquitted former Swedbank CEO Birgitte Bonnesen, overturning a 2024 appellate conviction for gross fraud.

The case concerned statements made to the media in October 2018 about anti-money laundering measures at Swedbank’s Estonian branch. Prosecutors alleged the comments misled shareholders and the public regarding the bank’s AML controls in the Baltics.

The Supreme Court held that:

• the responses were protected by freedom of expression;
• there was insufficient evidence that Bonnesen intended to spread misleading information affecting the bank’s financial position.

Procedural history:

• 2023: acquitted at first instance
• 2024: partially convicted on appeal
• 2026: fully acquitted by the Supreme Court

The acquittal narrows the scope of executive criminal liability for public communications on AML matters, drawing a distinction between misleading market statements and press responses covered by freedom of expression.

Financial institutions should nonetheless maintain robust internal controls ensuring that executive-level public statements on compliance matters are accurate and consistent with internal assessments – particularly in the context of ongoing regulatory investigations.

The post RegRally Insights: Your Guide to AML/CTF Compliance, May 2026 appeared first on ECOVIS ProventusLaw.

Supreme Administrative Court of Lithuania confirms the per-violation AML fines approach

The Supreme Administrative Court of Lithuania upheld the Bank of Lithuania’s practice of imposing penalties for each individual systematic AML/CTF violation, confirming that it is lawful, proportionate, and aligned with EU law, following guidance from the Court of Justice of the European Union.

The case concerned a €370,000 fine for eight violations, which LVAT ultimately reinstated in full, confirming that sanctions may be assessed separately where breaches are serious and systematic.

Key takeaway:This ruling is of major practical significance. Institutions should not assume that multiple AML/CTF breaches identified in a single inspection will be treated as one consolidated infringement – each systematic violation may attract a separate penalty, substantially increasing overall exposure. The Bank of Lithuania’s approach has now been validated at both the EU and national supreme court levels.

Institutions are strongly advised to review their AML/CTF frameworks holistically, ensuring that monitoring, investigation and STR reporting processes are robust, well-resourced and properly documented.

Bank of Lithuania revokes PAYTEND EUROPE e-money licence

The Bank of Lithuania revoked UAB “PAYTEND EUROPE”’s licence due to serious and systematic AML/CTF violations.

Key deficiencies included:

• ineffective client and transaction monitoring (missed suspicious activity, inadequate alert handling);
• formal/incomplete internal investigations and failure to submit STRs to the Financial Crime Investigation Service;
• weak internal controls, lack of function separation and insufficient AML resources;
• provision of false information to the regulator and failure to retain relevant records;
• failure to submit audited financial statements and supervisory reports on time.

The institution was prohibited from providing financial services as of 4 March 2026 and required to notify clients within 5 business days.

This case represents the most severe supervisory outcome available. It demonstrates that cumulative failures across AML/CTF monitoring, internal governance, STR reporting, the provision of accurate information to the regulator, and the timely submission of financial statements will result in licence revocation. All licensed payment and e-money institutions should treat this case as a benchmark and conduct a thorough review of their AML/CTF frameworks, internal audit processes and regulatory reporting obligations.

The post RegRally Insights: Your Guide to AML/CTF Compliance, April 2026 appeared first on ECOVIS ProventusLaw.

AMLA Consults on New EU-Wide AML/CTF Standards Through Draft RTS

AMLA has launched public consultations on three draft regulatory technical standards aimed at harmonising AML/CTF rules across both financial and non-financial sectors and ensuring consistent supervision across the EU.

The draft RTS cover key areas: criteria for determining when customer due diligence obligations apply (including business relationships and linked transactions), detailed requirements for conducting customer due diligence on a risk-based basis, and a harmonised framework for supervisory and administrative measures, including penalties for AML/CTF breaches.

A public hearing on the first two RTS is scheduled for 24 March 2026, with consultation submissions accepted in all EU languages.

Financial institutions should assess the proposed standards and consider participating in the consultation, with particular focus on the new CDD framework and harmonised enforcement approach, as these will directly impact internal AML/CTF policies, procedures and supervisory expectations.

MONEYVAL Reviews Latvia’s AML/CTF Framework

The Council of Europe’s anti-money laundering and counter-terrorist financing monitoring body, MONEYVAL, has published a report assessing the effectiveness of Latvia’s measures against money laundering, countering terrorist financing and proliferation financing and their level of compliance with the Financial Action Task Force Recommendations, at the time of the on-site visit conducted in November 2024.

Key findings: Latvia demonstrates strong overall performance, well-developed risk understanding and sustained political commitment.

Strengths:

1. solid international cooperation;
2. high-quality FIU analytical outputs;
3. effective risk-based banking supervision;
4. robust beneficial ownership transparency framework;
5. strong asset recovery practices, including non-conviction-based confiscation.

Areas for improvement:

1. risk assessment methodology in the non-financial sector (State Revenue Service);
2. A fully risk-based supervisory approach by the Latvian Council of Sworn Advocates;
3. prosecution of legal persons not yet commensurate with risk profile;
4. uneven TF awareness in certain non-financial sectors, particularly the legal profession.

Latvia is placed under regular follow-up and must report to MONEYVAL by June 2028.

MONEYVAL Report, Use of virtual assets for money laundering, terrorist financing and sanctions evasion

MONEYVAL published an updated horizontal review of virtual asset (VA) and virtual asset service provider (VASP) regulation across 25 jurisdictions.

Key findings: significant progress in regulatory/supervisory frameworks and international cooperation.

However, challenges remain:

1. Enforcement against unlicensed VASPs is weak.
2. FATF Travel Rule (Recommendation 16) operationalised in only 46% of jurisdictions;
3. Sanctions evasion via virtual assets is a growing concern.

Emerging risks identified: misuse of VAs for sanctions evasion, fraud, proliferation financing and child exploitation.

Further action needed on:

1. Integrating sanctions/proliferation financing risks into national assessments;
2. improving suspicious activity reporting quality by VASPs;
3. enhancing investigatory capabilities;
4. cross-border cooperation and capacity building.

VASPs and financial institutions dealing with virtual assets should:

1. Ensure full licensing/registration compliance.
2. Implement the FATF Travel Rule if not yet operationalised;
3. Integrate sanctions evasion and proliferation financing risks into their AML/CTF risk assessments;
4. Review and improve the quality of suspicious activity reports.

Institutions should monitor further MONEYVAL guidance given the rapidly evolving VA sector.

The post RegRally Insights: Your Guide to AML/CTF Compliance, March 2026 appeared first on ECOVIS ProventusLaw.

AMLA Takes Over EU AML/CFT Supervision from the EBA

As of 1 January 2026, the European Banking Authority has formally transferred all AML/CFT mandates and functions to the new EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism. This ends the EBA’s stand-alone AML/CFT role introduced in 2020 and marks a structural shift in the EU’s anti-financial crime architecture. Existing EBA AML/CFT guidelines remain applicable until replaced, ensuring continuity, while AMLA assumes responsibility for completing the EU Single Rulebook, strengthening supervisory convergence, coordinating FIUs, and directly supervising 40 of the EU’s most complex financial institutions and groups. Key tools, including the EuReCa database and accumulated supervisory expertise, have been handed over. The EBA will continue addressing ML risks from a prudential perspective in coordination with AMLA, supported by a formal ESAs–AMLA Memorandum of Understanding to ensure structured cooperation and information exchange.

Financial institutions should assess how AMLA’s direct supervisory model may affect them, particularly if they fall within the group of 40 directly supervised entities, review internal AML/CFT frameworks against the evolving Single Rulebook standards, and monitor upcoming AMLA technical standards and guidance that will progressively replace the EBA framework.

Bank of Lithuania Publishes 2026 Inspection Plan with AML/CTF Focus

The Bank of Lithuania has announced its 2026 supervisory inspection plan, which includes approximately 20 planned inspections primarily focused on AML/CTF compliance. The inspections will cover two banks, one central credit union, one electronic money institution, one payment institution and one crowdfunding provider.

In addition, around 15 unplanned inspections are foreseen, targeting AML/CTF compliance, fraud prevention and the provision of payment services.

To enhance transparency and reduce administrative burden, the regulator has published standardised inspection templates, enabling supervised entities to better prepare for supervisory reviews.

AMLA to Launch EU-Wide Data Collection to Calibrate AML Risk Models

AMLA will begin a data-collection exercise in March 2026 to test and calibrate its financial-sector risk assessment models. These models will underpin two key objectives: ensuring consistent AML/CFT risk assessment across the EU and selecting up to 40 financial institutions for AMLA’s direct supervision starting in 2028 (with selection taking place in 2027).

The exercise, conducted in cooperation with national supervisors and the private sector, will involve two groups: institutions potentially eligible for AMLA’s direct supervision and a representative sample likely to remain under national oversight. Participating entities have already been notified. The initiative will allow firms to test their reporting systems before the formal 2027 data collection, which will determine the final list of directly supervised institutions.

Recommended actions:

• Prepare data systems and internal controls to ensure accurate and timely submissions.
• Use the exercise to assess data quality and strengthen AML/CFT risk assessment frameworks.
• Institutions potentially subject to direct supervision should review governance, internal controls and compliance structures against anticipated AMLA standards.
• Engage with national supervisors to clarify reporting expectations.
• Monitor AMLA’s final methodology and selection criteria.
• Even entities remaining under national supervision should anticipate greater harmonisation of risk assessment practices across the EU.

CJEU Clarifies Direct Liability of Companies for AML Breaches (Directive (EU) 2015/849)

The Court of Justice of the European Union ruled that companies may be sanctioned directly for breaches of the EU Anti-Money Laundering Directive (Directive (EU) 2015/849), without the prior formal accusation or conviction of a specific natural person.

The case concerned Austrian rules requiring authorities to first identify and prosecute an individual employee or manager before imposing a fine on the legal entity. The Court held that such a requirement is incompatible with EU law, as it undermines the effectiveness and deterrent purpose of AML sanctions.

The judgment confirms that:

• Legal entities can bear autonomous administrative liability for AML violations.
• Member States must ensure sanctions are effective, proportionate and dissuasive.
• National procedural rules cannot create barriers that make enforcement excessively difficult.

At the same time, the Court accepted national limitation periods of three years for initiating proceedings and five years for imposing sanctions, provided they do not render enforcement practically impossible or excessively difficult.

The ruling strengthens supervisory authorities’ ability to pursue corporate AML enforcement directly, without procedural dependence on parallel individual liability proceedings.

Court practices within the EU may still differ; therefore, case-by-case analysis shall be applied.

The post RegRally Insights: Your Guide to AML/CTF Compliance, February 2026 appeared first on ECOVIS ProventusLaw.

AMLA Introduces Binding EU-Wide ML/TF Risk Assessment and Supervision Methodologies

On 16 December 2025, AMLA adopted two final Regulatory Technical Standards establishing harmonised EU methodologies for assessing inherent and residual money laundering and terrorist financing risk and for selecting obliged entities for direct AMLA supervision. The RTS replace national approaches with a single, standardised risk model based on predefined indicators, data inputs and scoring logic, significantly reducing supervisory discretion. Risk assessments must aggregate detailed data on customers, products, transactions, geographic exposure, delivery channels and control effectiveness, with limited scope for weak controls to offset inherent risk and with formalised review cycles for higher-risk entities.

The RTS on direct supervision introduce an objective, data-driven selection mechanism, under which only entities meeting defined cross-border activity thresholds are considered, and final designation depends on residual risk scores calculated under the harmonised model. Group-wide risk must be assessed using weighted aggregation rules that reflect higher-risk exposures rather than diluting them. Institutions should reassess business-wide and customer risk assessments, analyse cross-border activity against AMLA materiality thresholds, review group risk aggregation methodologies, and strengthen data governance and control effectiveness frameworks, given their direct impact on supervisory classification.

AMLA Advances EU-Wide AML/CFT Supervisory Framework Ahead of 2028

On 18 December 2025, AMLA announced substantial progress toward harmonised AML/CFT supervision across the European Union. The announcement outlines key instruments that will support AMLA’s future direct supervision of a selected group of high-risk financial institutions from 2028, including a standard ML/TF risk assessment methodology and objective criteria for identifying entities subject to direct AMLA oversight under the AML Regulation. These tools are intended to ensure consistent application of risk indicators, data inputs and supervisory judgments by both national competent authorities and AMLA. As part of the preparatory phase, AMLA has also launched a public consultation on draft implementing technical standards governing cooperation and the transfer of supervisory responsibilities between national authorities and AMLA, with stakeholders invited to submit comments by 27 January 2026.

EU Designates Russia as High-Risk Third Country for AML/CFT Purposes

The European Commission has adopted a delegated act adding Russia to the EU list of high-risk third countries with strategic deficiencies in their anti-money laundering and counter-terrorist financing frameworks. The assessment was carried out independently of the FATF process, reflecting Russia’s current suspension from FATF and the absence of FATF grey- or black-listing. Relying on a technical analysis based on publicly available sources, input from Member States, and assessments by the European External Action Service, the Commission concluded that Russia meets the criteria for high-risk designation under EU AML rules. The delegated regulation is now subject to scrutiny by the European Parliament and the Council, which may raise objections within the applicable scrutiny period before the measure enters into force.

EBA and ECB Report Highlights Rising Payment Fraud Across the EEA

The European Banking Authority and the European Central Bank have published their 2025 Report on Payment Fraud, showing that payment fraud across the EEA continued to increase, with total losses reaching around EUR 4.2 billion in 2024. Credit transfers and card payments remain the main drivers, with fraud predominantly occurring in remote transactions. Strong customer authentication is shown to be effective in reducing fraud when applied. Still, its overall impact is limited by the widespread use of exemptions, some of which, particularly for remote card payments, are linked to significantly higher fraud rates. The report also points to the growing importance of authorised push payment fraud driven by social engineering, and notes that payment service users still bear a substantial proportion of total fraud losses.

ESMA Sets Unified Governance Expectations for Supervised Entities

ESMA has published a concise statement outlining its supervisory expectations for the management bodies of entities under its supervision, consolidating twelve core governance principles applicable across all sectors. The statement confirms that ultimate responsibility for strategy, risk appetite and oversight rests with the management body, irrespective of delegation or committee arrangements. ESMA places strong emphasis on effective challenge by supervisory members, clear leadership, and a strong tone from the top on ethics, conduct and organisational culture. Expectations also cover appropriate board composition, ongoing suitability and effectiveness assessments, structured and continuous training, and substantive engagement with risk management, compliance and internal audit functions. Robust information flows, well-documented decision-making and accurate record-keeping are highlighted as essential, with ESMA indicating that these principles will serve as a practical benchmark in supervisory dialogue and assessments.

Swiss FIPPP Warns of Fraud Risks Linked to Virtual IBANs

The Swiss FIPPP has issued a warning on the growing misuse of virtual IBANs in fraud schemes affecting payment service providers and financial intermediaries. According to the newsletter, vIBANs are increasingly used to create a misleading appearance of domestic banking relationships, while the underlying accounts may be located in other jurisdictions. This opacity has been exploited in a range of fraud typologies, including impersonation and invoice redirection scams, fake investment schemes, romance fraud and fraudulent charity solicitations. The risk extends beyond institutions issuing vIBANs, as intermediaries processing payments may also unknowingly facilitate fraudulent transactions due to limited visibility over the ultimate destination of funds. The FIPPP stresses that reliance on standard IBAN country-code checks is insufficient and calls for enhanced controls to identify jurisdictional mismatches and patterns indicative of vIBAN misuse.

2025 Shows Stable Global ML/TF Risk but Worsening Transparency

The Basel Institute on Governance has published the 14th edition of the Basel AML Index, assessing money laundering and terrorist financing risk across 177 jurisdictions. The 2025 results show that global ML/TF risk remains broadly stable, with only marginal improvement in average scores compared to last year. While many countries recorded slight progress, the data points to convergence around mid-level risk rather than an apparent strengthening of global AML/CFT effectiveness. The report highlights a deterioration in financial transparency, particularly due to persistent weaknesses in beneficial ownership regimes and tax transparency. At the same time, modest improvements were noted in formal AML/CFT frameworks and indicators related to corruption and fraud. Regional divergence is increasing, with some traditionally lower-risk jurisdictions scoring worse, while parts of Sub-Saharan Africa show measurable improvement. The Index also introduces a revised three-tier risk classification to distinguish risk levels across jurisdictions better.

FinCEN Launches Data-Driven AML Enforcement Targeting MSBs at the U.S. Southwest Border

On 22 December 2025, the U.S. Treasury’s Financial Crimes Enforcement Network announced a technology-driven enforcement initiative focused on money services businesses operating along the southwest U.S. border. Using advanced analytics on more than one million Currency Transaction Reports and tens of thousands of Suspicious Activity Reports, FinCEN has issued notices of investigation, made numerous examination referrals to the IRS, and sent over fifty compliance outreach letters to MSBs. The operation targets potential Bank Secrecy Act weaknesses linked to cartel-related money laundering, human smuggling and other serious crimes. FinCEN indicated that identified violations may lead to civil penalties, injunctions or criminal referrals, and reiterated MSBs’ obligations to maintain effective risk-based AML/CFT programmes, ensure proper customer identification, monitor and report suspicious activity, file required transaction reports, and exercise robust oversight of agents and third-party service providers.

FinCEN Intensifies Public–Private Cooperation Against Chinese Money Laundering Networks

On 19 December 2025, FinCEN convened a FinCEN Exchange public–private partnership event with financial institutions, federal law enforcement and U.S. Treasury officials to address systemic money laundering risks posed by organised criminal networks, with a particular focus on Chinese money laundering networks. The discussions highlighted the critical role of Bank Secrecy Act data, advanced analytics and information sharing in identifying and disrupting these networks, which are assessed as posing material risks to the U.S. financial system and national security. FinCEN noted that, following its earlier advisory and financial trend analysis on CMLN activity, it has received hundreds of suspicious activity reports referencing suspected CMLN-linked transactions, involving billions of dollars in potentially illicit flows, underscoring both the scale of the threat and the importance of sustained public–private collaboration.

FATF Publishes Mutual Evaluation Report on Belgium’s AML/CFT Regime

On 19 December 2025, the FATF released its Mutual Evaluation Report (MER) assessing Belgium’s anti-money laundering and counter-terrorist financing framework. The evaluation found that Belgium has a comprehensive legal, regulatory, and institutional AML/CFT structure largely aligned with FATF standards, supported by robust supervisory frameworks and active international cooperation. Reporting entities generally implement customer due diligence and reporting practices effectively. However, the MER identified areas needing improvement, including enhancing operational effectiveness in prosecuting and convicting money laundering and predicate offences, achieving timely asset seizure and confiscation, implementing targeted financial sanctions, applying consistent risk-based supervision across sectors, and translating strategic risk assessments into actionable plans with apparent oversight. Belgium’s inter-agency collaboration and international engagement were noted as strengths, with further focus required to close remaining gaps in outcomes.

FATF/APG Publishes Mutual Evaluation Report on the Maldives’ AML/CFT Framework

On 23 December 2025, the FATF, via the Asia/Pacific Group on Money Laundering (APG), released the Mutual Evaluation Report assessing the Maldives’ compliance with FATF Recommendations and the effectiveness of its AML/CFT regime. The evaluation found that, although the Maldives has established core legal and institutional AML/CFT structures, significant gaps in effectiveness persist. National coordination and strategic oversight are weak, limiting the authorities’ ability to address identified money laundering and terrorist financing risks. Preventive measures and supervision vary across sectors, with banks generally more compliant than non-bank financial institutions and designated non-financial businesses and professions (DNFBPs). The report highlights material deficiencies in beneficial ownership transparency, oversight of money changers and informal value transfer systems, and the implementation of targeted financial sanctions for terrorist and proliferation financing. Law enforcement outcomes, including investigations, prosecutions, and asset confiscation, remain limited relative to the country’s risk profile.

The post RegRally Insights: Your Guide to AML/CTF Compliance, January 2026 appeared first on ECOVIS ProventusLaw.