RegRally Insights: AML/CTF Regulation, October 2026

The EU’s Anti-Money Laundering Authority (AMLA) has made crypto a strategic priority. Crypto-asset service providers (CASPs) and payment institutions working with crypto businesses should expect EU supervisors to align their expectations, including how crypto flows are monitored. Staffing is under scrutiny too: an understaffed anti-money laundering (AML) team can become a regulatory finding. Estonia’s action against Wallester shows why staffing and independent oversight belong in an AML audit, alongside customer checks and transaction monitoring.

This edition of RegRally covers September’s anti-money laundering and counter-terrorist financing (AML/CTF) developments for financial institutions and crypto businesses in the Baltics and across the EU.

At a glance

• AMLA: crypto-assets are now a strategic priority. AMLA presented its Crypto Action Plan for 2026 and beyond and called for stronger blockchain analytics at EU level.
• United Kingdom: firms closed the accounts of 238,396 suspected money mules in 2025. The Financial Conduct Authority (FCA) wants mule activity stopped earlier.
• Estonia: Finantsinspektsioon ordered Wallester AS to remedy governance, safeguarding and AML/CTF deficiencies, including by ensuring sufficient AML/CTF staff, by 31 December 2026.
• CASPs: the Commission set the criteria under which host Member States may require a central contact point from CASPs operating through establishments other than branches.
• Latvia / EU case law: in Jautiva, the Court of Justice ruled that the General Data Protection Regulation (GDPR) precludes national rules making the personal data of all shareholders of public limited companies, including minority shareholders, public without conditions such as a legitimate interest, even where the rules serve AML/CTF and sanctions purposes.
• FATF: the Financial Action Task Force (FATF) reports that underground banking and hawala are increasingly associated with “money laundering as a service”, with a growing shift toward digital wallets and stablecoins.
• Gaming and gambling: the FATF published new risk indicators and found that in many jurisdictions illegal gambling markets rival or even exceed legal markets.

AMLA makes crypto a strategic priority

Date: 15 September 2026 | Source: Anti-Money Laundering Authority (AMLA)
Link

At the Global Conference on Criminal Finances and Cryptoassets in Luxembourg, AMLA Executive Board member Simonas Krepšta said that crypto-assets have become a strategic priority for the Authority. He presented AMLA’s Crypto Action Plan for 2026 and beyond, which focuses on four areas:

• improving EU-wide understanding of crypto-related risks;
• advancing supervisory consistency and effectiveness;
• strengthening analytical resources;
• deepening cooperation with relevant EU stakeholders.

AMLA is analyzing money laundering and terrorist financing risks in the crypto sector, and a report is expected to follow. Mr Krepšta highlighted the importance of strengthening blockchain-analytics capabilities, noting that the current fragmented approach across Member States requires an EU-level response.

He also noted that the Markets in Crypto-Assets Regulation (MiCA) and the AML package provide a stronger framework, but important risks remain. Effective implementation and supervisory convergence will be decisive.

Why it matters

Supervisory expectations for crypto businesses are likely to converge across the EU, including the use of blockchain analytics in supervision. As AMLA strengthens blockchain analytics, CASPs should expect closer scrutiny of their own analytics and wallet screening.

What we recommend for CASPs and payment institutions serving crypto businesses

• Expect supervisors across the EU to align their expectations under AMLA, including on the use of blockchain analytics in supervision. Make sure your analytics tools and wallet-screening coverage would withstand a supervisory review.
• Track the forthcoming AMLA crypto risk report. Plan to reflect its findings in the business-wide risk assessment and in the sectoral risk factors used in customer risk scoring.

---

FCA urges earlier action against money mule accounts

Date: 23 September 2026 | Source: FCA (UK)
Link

The FCA published the results of a survey of 35 retail banks, building societies, challenger banks, payment institutions and e-money institutions on how they handle money mule accounts. Firms closed the accounts of 238,396 suspected money mules in 2025, up from 233,269 in 2024 and 184,935 in 2023.

Closures were highest among customers aged 26 to 39, and customers aged 25 and under also made up a significant share. The sharpest increase was among customers aged 40 to 49.

The FCA found that criminals move fraudulent funds through several accounts and typically cash out between the second and fifth account. Some accounts had been used repeatedly for mule activity and had also been used for fraud, which points to established criminal infrastructure. The National Crime Agency estimates that more than GBP 100 billion is laundered annually through the UK or UK corporate structures.

According to the FCA, firms need to act on mule activity as early as possible. The FCA is also working with industry on an action plan, including better ways for firms and law enforcement to share intelligence on suspected mule activity. Card payments were the most common cash-out method, used for many low-value transactions or for higher-value payments to local businesses and retailers.

Why it matters

The survey covered payment and e-money institutions, not only banks. Closing a mule account is often too late, because by then the money has usually moved on through other accounts. The FCA says firms need to act as early as possible. In practice, this points to controls at onboarding and soon after an account is opened, before the funds are cashed out.

What we recommend for payment and e-money institutions

• Review account-opening controls and monitoring of new personal accounts. Set alert rules for funds moving rapidly in and out within days of onboarding and for accounts receiving funds from multiple unrelated payers.
• Have a documented process for restricting, closing and reporting mule accounts, and for sharing information with the financial intelligence unit (FIU) and, where the legal basis exists, with other payment service providers.
• Use the FCA age-profile findings to calibrate risk scoring for younger customers, without blanket restrictions that would breach access-to-account obligations.

---

Estonian supervisor orders Wallester to remedy governance and AML/CTF deficiencies

Date: 16 September 2026 | Source: Finantsinspektsioon (Estonian Financial Supervision and Resolution Authority)
Link

Finantsinspektsioon issued a precept (ettekirjutus) to the Estonian payment institution Wallester AS following an on-site inspection. The inspection assessed general and risk governance, the internal audit and compliance functions, capital management, reporting accuracy, the prevention of money laundering and terrorist financing, and the application of financial sanctions.

Wallester must remedy the deficiencies identified, including by:

• ensuring the separation of the three lines of defense at all levels;
• adopting and implementing the necessary internal rules;
• applying the statutory measures for safeguarding client assets;
• ensuring sufficient human resources for AML/CTF compliance.

The deficiencies must be remedied by 31 December 2026.

Why it matters

The precept requires internal rules, sufficient AML/CTF staff and separate lines of defense. Payment institutions’ AML reviews should examine procedures, who carries out controls, who can challenge business decisions and whether internal audit checks this independently.

What we recommend for payment and e-money institutions

• Assess AML/CTF staffing against transaction volumes and client numbers, and document the assessment. The supervisor explicitly identified AML/CTF staffing as an issue in this case.
• Confirm that the AML/CTF and sanctions functions sit in the second line and are independent from operational teams, with internal audit as a distinct third line. Make sure the organizational chart and job descriptions reflect this.
• Payment and e-money institutions with Estonian operations should be prepared for on-site inspections that combine governance, safeguarding, reporting and AML/CTF topics in a single review.

---

Commission extends AML central contact point standards to CASPs

Date: 8 September 2026 | Source: European Commission
Link

The European Commission adopted a Delegated Regulation (C(2026) 6179) amending Commission Delegated Regulation (EU) 2018/1108. As a result, the regulatory technical standards on the criteria for appointing central contact points, and the rules on their functions, will apply to crypto-asset service providers in addition to electronic money issuers and payment service providers.

A Member State may require a CASP to appoint a central contact point if the CASP has establishments on its territory in a form other than a branch and its head office is in another Member State. This is possible where any of the following applies:

• the CASP has 10 or more such establishments in that Member State;
• the cumulative value of the services and activities carried out by its establishments in that Member State is expected to exceed EUR 3 million per financial year, or exceeded that amount in the previous financial year;
• the information needed to assess these criteria is not provided to the host supervisor on request and in a timely manner.

Host Member States may also require a central contact point where this is commensurate with the money laundering or terrorist financing risk of those establishments and, in exceptional cases, where there are reasonable grounds to believe that this risk is high.

The central contact point must, among other things:

• facilitate the implementation of AML/CTF policies and procedures;
• oversee compliance;
• inform the head office of breaches;
• represent the CASP before the host authorities.

The act is subject to scrutiny by the European Parliament and the Council. It will enter into force on the twentieth day following its publication in the Official Journal.

Why it matters

A MiCA authorization lets a CASP offer services in other Member States, but AML/CTF supervisors in those countries can still oversee its local establishments. If a CASP works there through agents or other establishments that are not branches, the host state may require a central contact point: a local person or function responsible for AML/CTF compliance there.

What we recommend for cross-border CASPs

• CASPs passporting into Lithuania, Latvia or other Member States through agents or other non-branch establishments should compare the value of services provided through those establishments in each country with the EUR 3 million threshold. Prepare for a host-state request to appoint a central contact point.
• Draft the governance arrangements for a central contact point in advance, including the reporting line to the group AML officer and the mandate to act before host authorities and FIUs.
• Monitor publication in the Official Journal and the entry-into-force date. Check for any national implementing decisions by Lietuvos bankas or Latvijas Banka.

---

CJEU limits public access to shareholder data in Latvian case

Date: 3 September 2026 | Source: Court of Justice of the EU
Link

In Case C-798/24 Jautiva, on a reference from the Constitutional Court of Latvia, the Court of Justice of the EU held that Directive (EU) 2017/1132 does not require the public disclosure of information on all shareholders of public limited liability companies, including minority shareholders.

The Court examined the Latvian rule requiring shareholder names, identification numbers, addresses, email addresses (where the shareholder asked the company to use them) and shareholding details to be published online, without restriction and downloadable in bulk. It accepted that the rule pursued legitimate objectives: business transparency, the prevention of money laundering and terrorist financing, and the implementation of sanctions. However, it found that unrestricted public access was disproportionate under the GDPR and the Charter, since less intrusive means exist, such as access conditional on a demonstrated legitimate interest.

The judgment builds on the 2022 ruling on public access to beneficial ownership registers. It confirms that AML/CTF and sanctions objectives do not justify unlimited public disclosure of the personal data of shareholders.

Why it matters

Firms that use public registers for customer due diligence may need to change how they get shareholder information. Limited public access does not remove the duty to identify and verify owners, so firms should be ready to meet access conditions or ask customers directly.

What we recommend for obliged entities

• Where customer due diligence relies on national shareholder or beneficial ownership registers, document the legal basis of access. In Latvia, obliged entities already have a statutory right under the AML law to obtain register data on members and beneficial owners. Elsewhere, be prepared for national registers to require a legitimate interest for access, and make sure the firm can demonstrate its legitimate interest as an obliged entity.
• Review internal data-protection notices covering the collection and retention of shareholder and beneficial ownership data, and confirm that the proportionality reasoning is recorded.
• For clients that are Latvian public limited liability companies, anticipate changes to the publicly available shareholder data. Adjust the customer due diligence (CDD) procedure to use direct requests to the client where register data becomes restricted.

---

FATF: underground banking and hawala increasingly associated with “money laundering as a service”

Date: 3 September 2026 | Source: Financial Action Task Force (FATF)
Link

The FATF published a report on professional money launderers operating through underground banking, hawala and other similar service providers (HOSSPs). More than 80 percent of reporting jurisdictions identified these systems among the principal professional money laundering channels or techniques. Individual cases involved more than EUR 500 million laundered within a few months.

The report describes a shift toward commercially operated “money laundering as a service” networks that offer low commissions and rapid cross-border value transfer. Nearly 70 percent of respondents identified the integration of new technologies, including a growing shift toward “digital hawala”:

• operators coordinate through encrypted messaging apps;
• customers initiate transfers through digital wallets and fintech applications;
• operators settle balances between themselves in virtual assets, including stablecoins.

The proceeds handled now extend beyond drug trafficking to fraud, cyber-enabled crime, terrorist financing and illegal gaming.

The FATF notes growing involvement by lawyers, accountants, notaries, corporate agents, real estate agents and casino operators. These schemes are also becoming integrated with formal banking, fintech platforms and virtual asset services. It recommends combining targeted prevention and enforcement with proportionate financial inclusion measures, supported by legal clarity, better detection and public-private cooperation.

Why it matters

Digital hawala uses the same products many fintechs offer: customers send money through wallets and apps, and operators settle with each other in stablecoins. Each payment can look ordinary on its own, so the risk only shows when firms look at how incoming and outgoing flows and counterparties connect.

What we recommend for payment, e-money and crypto businesses

• Add the report’s typologies to the business-wide risk assessment. Pay particular attention to money remittance, multi-currency wallet, crypto on- and off-ramp and merchant acquiring products that can be used to net-settle informal value transfers.
• Review transaction-monitoring scenarios for patterns consistent with informal value transfer: offsetting flows between unrelated parties in different corridors, third-party settlement of trade invoices, and frequent stablecoin settlement between the same counterparties.
• Refresh staff training with the report’s red flags, and confirm that suspicious transaction reporting procedures cover professional intermediaries acting for clients.

---

FATF publishes risk indicators for gaming and gambling

Date: 9 September 2026 | Source: Financial Action Task Force (FATF)
Link

The FATF published a report on money laundering and terrorist financing risks in gaming and gambling, together with a new set of risk indicators. The report finds that risks are rising with the expansion of online platforms and fast cross-border payments. In many jurisdictions, illegal gambling markets rival or even exceed the size of legal markets.

The indicators cover:

• multiple accounts and payment methods opened under different identities;
• discrepancies between customer and payment data;
• links to cyber fraud, organized crime or corruption;
• unusual or coordinated betting patterns suggesting match manipulation;
• smurfing and movement of funds without genuine gambling;
• complex ownership structures obscuring beneficial owners.

The FATF notes that payment methods such as cash, e-wallets, mobile money and virtual assets are vulnerable to a range of money laundering risks. Platforms depend on interconnected digital services that may fall outside the scope of regulation.

The FATF urges governments to strengthen oversight, crack down on illegal and offshore operators, and deepen international and public-private cooperation.

Why it matters

The risks extend to payment institutions, e-money institutions and CASPs processing gambling-related funds. A merchant’s stated business activity may not reveal where its customers are located, whether it has the required licenses or whether payments relate to genuine play.

What we recommend for payment and e-money institutions and CASPs serving gambling merchants

• Payment institutions, e-money institutions and CASPs that serve gambling operators or process gaming-related payments should incorporate the FATF indicators into merchant onboarding, ongoing monitoring and merchant-activity reviews.
• Verify that gambling merchants hold the license required in each jurisdiction where players are located, and that the firm’s own license and card-scheme rules permit the activity.
• Treat pass-through of gaming proceeds without genuine play, and repeated deposits and withdrawals across multiple payment instruments, as scenarios requiring alert rules in the monitoring system.

---

Our view

AMLA’s crypto priorities give CASPs and payment institutions serving crypto businesses a reason to review how they use blockchain analytics and wallet screening. We recommend testing coverage against the networks, assets and counterparties the business actually handles, and documenting how findings feed into customer risk assessments and investigations. Cross-border CASPs should also assess whether their local operations could fall within the central contact point framework.

The FCA and FATF findings provide specific patterns to test in transaction monitoring, including money mule activity, informal value transfers and gambling-related flows. The Wallester case also highlights staffing, independent compliance oversight and follow-up when gaps are found. Alerts are only useful if there are staff to investigate them.

The Latvian ruling may limit what firms can find in public registers, but it does not change their duty to identify and verify ownership.

---

How ECOVIS ProventusLaw can help with AML/CTF compliance

ECOVIS ProventusLaw advises payment and e-money institutions, CASPs, banks and other obliged entities on AML/CTF compliance, from risk assessments and policies to independent audits and remediation after a supervisory inspection. The aim is compliance that holds up under audit and inspection, so that our clients avoid fines, business restrictions and the suspension or withdrawal of their license.

For the issues covered in this edition, we can help with:

• Independent AML/CTF and sanctions audit – testing whether know-your-customer (KYC), transaction monitoring, screening and suspicious transaction reporting work in practice. Members of our audit team have carried out more than 20 internal and external AML and sanctions audits.
• Review of AML systems and tools – configuration of transaction monitoring, KYC software, and politically exposed person (PEP) and sanctions screening, including scenarios and thresholds. Where artificial intelligence (AI) or algorithmic tools support AML decisions, the review covers their role in customer risk scoring and monitoring, human oversight and retained evidence.
• Post-inspection remediation – remediation plans after findings by the Bank of Lithuania or another supervisor, and independent reviews of whether corrective measures have been implemented and work.
• Compliance support and governance – the three lines of defense, resourcing of the compliance function, internal controls and ongoing compliance support that turns audit findings into assigned actions and follows them through to completion.
• Money laundering and terrorist financing (ML/TF) risk assessments – business-wide and customer risk assessments that reflect new typologies such as digital hawala, money mules and gaming-related flows.
• AML policies, procedures and training – KYC, CDD and enhanced due diligence (EDD) procedures adapted to your business model, escalation procedures and internal investigations, and ML/TF training for staff and management.
• AMLA readiness and cross-border requirements – preparation for the EU AML package and AMLA supervision, and host-state requirements such as central contact points.
• AML/CTF for licensing and crypto businesses – the AML/CTF parts of license applications for payment, e-money and crypto businesses, and CASP-specific AML requirements, including Travel Rule controls, blockchain analytics and wallet screening.

If you are planning an audit or need to resolve known gaps, contact us and we will help you plan the work before the regulator asks.

---

Why ECOVIS ProventusLaw

ECOVIS ProventusLaw is one of the most experienced financial regulatory law firms in the Baltics and has advised financial institutions for many years.

Our Banking, Finance & FinTech department has separate regulatory, compliance and audit teams. This gives clients access to legal advice, operational compliance support and independent testing, with roles defined for each engagement.

We adapt AML processes to each client’s business model, so that compliance does not hold up customer onboarding or day-to-day operations. We also work to supervisory timelines: we can carry out an audit quickly and support clients during an inspection or when they respond to the regulator’s findings and inspection reports.

The department is led by Inga Karulaitytė. Members of our teams hold the Certified Anti-Money Laundering Specialist (CAMS) and Certified Information Privacy Professional/Europe (CIPP/E) certifications and the International Compliance Association (ICA) International Advanced Certificate in Anti-Money Laundering, and our auditors are members of the Association of Internal Auditors. Before the actual audit, clients can check their readiness with RegRally, our AI-assisted AML compliance platform. They complete an expert-vetted AML questionnaire, upload documents and receive findings and recommendations within a couple of hours.

With teams in Lithuania, Latvia and Estonia, we act as a single point of contact for regulatory and compliance matters across the Baltic region. As part of the ECOVIS International network, present in more than 90 countries, we also support clients whose business crosses several jurisdictions. We have advised on more than 40 end-to-end licensing projects, from business structuring and regulatory applications to ongoing supervision and compliance.