· Weekly Digest

Financial Crime Weekly Digest — 8–14 September 2026

Global enforcement actions, regulatory moves & intelligence from the world of AML & financial crime.

Illustration for “Financial Crime Weekly Digest — 8–14 September 2026”

Download the full digest (PDF) · 7 pages

8–14 September 2026

In this issue

  • STORY OF THE WEEK — Treasury grounds 27 Iranian airlines — and targets the intermediaries serving Mahan Air
  • ENFORCEMENT — ‘Dubai Bank’ underground banking arrests · Xinbi marketplace · Hizballah and Iran finance networks
  • REGULATORY — $17.5B in suspicious activity tied to possible health-care fraud · digital ID under CIP · proposed third-party risk guidance
27
AIRLINES
OFAC · 8 Sept		$24B
XINBI THROUGHPUT
US Treasury · since ~2022		$17.5B
SUSPICIOUS ACTIVITY
Possible health-care fraud · 5,702 BSA reports		€20M
ASSETS IDENTIFIED
Identified, seized or frozen · Europol

STORY OF THE WEEK · USA / IRAN / UAE / TÜRKIYE

Treasury Grounds Iran’s Airlines — and Targets the Routes Around Them

27 AIRLINES — designated in one action, alongside nine facilitators in the UAE, Türkiye, Malaysia, Kazakhstan and the UK

On 8 September OFAC sanctioned 36 targets for supporting Iran’s aviation sector, which Treasury says the regime uses to move weapons, personnel and illicit cargo. The 27 Iranian airlines were designated under E.O. 13902 for operating in Iran’s aviation sector. The other nine, including aircraft-transfer intermediaries, cargo service providers and general sales agents, were designated under counter-terrorism authority E.O. 13224 in connection with Mahan Air. OFAC also suspended three Iran-related aviation authorisations. Treasury says Mahan Air received at least three Boeing 777s diverted through the UAE and Oman in summer 2026.

The same day FinCEN issued Alert FIN-2026-Alert006. It says front companies posing as technology, aviation or logistics firms in third countries often buy aircraft components from the US or other Western countries for export to Iran, and that Iranian airlines rely on freight forwarders and smugglers in transshipment jurisdictions such as Türkiye or the UAE. “You are at risk of being cut off from the global financial system,” Treasury Secretary Scott Bessent warned anyone doing business with Iran’s remaining airlines.

  • 27 Iranian airlines (E.O. 13902) plus 9 facilitators (E.O. 13224) · 8 Sept 2026
  • Three Iran-related aviation authorisations suspended; Iran GL DD authorises the wind-down of certain civil aviation-related transactions
  • FinCEN Alert FIN-2026-Alert006 lists seven red flags for Iranian aviation procurement
  • Flags include: a free-zone general trading company with no apparent aviation business ordering Western-origin aircraft parts; recently incorporated logistics firms in high-risk transshipment jurisdictions sharing an address with similar companies; aircraft long in storage or frequently re-registered
  • SAR key term: FIN-2026-IRANAIR

Why it matters for compliance teams None of these red flags needs an Iranian name to appear: FinCEN says they are meant to help detect activity even when Iran’s direct involvement is not readily identifiable in transaction details. A recently incorporated logistics company in a high-risk transshipment jurisdiction sharing an address with similar firms, a free-zone general trading company that does not ordinarily deal in aviation goods, a customer in a jurisdiction of concern ordering parts from one country for delivery to a forwarder in another — each becomes a flag once aircraft parts are involved, and FinCEN stresses that no single flag is determinative. That puts the weight on KYB and trade-finance monitoring in the transshipment hubs, not on sanctions screening alone. Institutions banking free-zone traders in the UAE should test their onboarding and trade-monitoring rules against the seven indicators now.

ENFORCEMENT ACTIONS

Law Enforcement Strikes This Week

21 Arrests in ‘Dubai Bank’ Underground Banking Case

21 ARRESTS · EUROPOL · SPAIN / UAE / EUROPE

Europol announced on 8 September that an investigation led by Spain’s National Police and supported by Europol, with contributions from the Netherlands, Sweden and the United States (including the DEA), has led to 21 arrests for offences including participation in a criminal organisation, drug trafficking and money laundering. Among those arrested is a leading figure in the underground banking network known as ‘Dubai Bank’, which is suspected of making large sums available to criminal organisations in different countries within very short periods. Spain issued 19 international arrest warrants; six have been executed, with four arrests in the UAE, one in Egypt and one in the Netherlands. Investigators also identified the use of tokens, frequently a banknote serial number, to authenticate cash transactions. Authorities have identified, seized or frozen assets worth about EUR 20 million, including 48 properties and 121 bank accounts.

Xinbi Illicit Marketplace Designated

TCO · OFAC · SOUTHEAST ASIA / DIGITAL ASSETS

On 9 September OFAC designated Xinbi Guarantee as a significant transnational criminal organisation. Treasury says the Chinese-language platform runs an illicit online marketplace connecting criminal syndicates, including scam-centre operators, with merchants selling financial services, technology and other goods, and provides escrow services to scam operators and laundering networks. OFAC also designated Anwen Technology (Cambodia), developer of the XinbiPay wallet that Xinbi launched, and SafeW Technology (Singapore), developer of the encrypted messenger to which Xinbi began moving its merchant and money-laundering networks around June 2025. Treasury says the marketplace has processed the equivalent of over $24 billion in digital assets and fiat since around 2022. The DOJ’s Scam Center Strike Force seized infrastructure and digital-asset wallets used by Xinbi the same day.

Hizballah and Iran Finance Networks Hit

19 PERSONS · OFAC · IRAQ / LEBANON / UAE / TÜRKIYE

On 10 September OFAC added 14 individuals and five entities to the SDN List. Sixteen were designated under counter-terrorism authority E.O. 13224 in networks tied to Kata’ib Hizballah and Lebanese Hizballah — among them two Lebanese money exchangers, a Hizballah money courier and two Lebanese exchange businesses. Three were designated under E.O. 13902 for Iran’s financial sector: Dubai-based Shams & Bahr Trading Company, an exchange Treasury says has been used to remit millions of dollars from Iraq to Iran via the UAE, and two individuals acting for it. OFAC also moved Iran-related specific licence applications to a presumption of denial, except as required by law or in certain circumstances, such as risk to life, limb or environmental safety.

Individual Settles 39 Apparent Iran Violations

$1.43M · OFAC · UNITED STATES / IRAN

A US person agreed on 10 September to pay $1,427,230 to settle 39 apparent violations of Iran sanctions between 2019 and 2021: providing management consulting and advisory services to one of Iran’s leading software companies, receiving $713,615 in Iranian-origin dividends into US bank accounts through wires that transited banks in third countries such as Türkiye, the UAE and Singapore, and buying real property in Iran. OFAC found the case egregious and not voluntarily self-disclosed; the base penalty was $14,730,300, and OFAC considered the person’s demonstrated inability to pay a larger settlement. OFAC notes that its prohibitions apply to all US persons, including lawful permanent residents.

REGULATORY DEVELOPMENTS

Regulatory Moves Reshaping the Compliance Landscape

$17.5 Billion in Suspicious Activity Tied to Possible Health-Care Fraud

UNITED STATES

FinCEN published a Financial Trend Analysis on 9 September identifying about $17.5 billion in suspicious financial activity potentially linked to health-care fraud, based on 5,702 BSA reports filed between 1 March 2025 and 28 February 2026. Depository institutions filed about 89% of the reports, and home health care businesses were identified as the suspected fraudulent provider in 20% of them, the largest share. The figure is suspicious activity reported, not proven fraud.

Digital IDs May Be Used for Customer Identification

UNITED STATES

On 8 September FinCEN, jointly with staff of the Federal Reserve, the FDIC, the NCUA and the OCC, issued FAQs on state-issued mobile driver’s licences and other government-issued verifiable digital credentials under the CIP Rule. A bank or credit union may consider an unexpired credential of this kind that evidences nationality or residence and bears a photograph or similar safeguard as one of its documentary verification methods — if its own CIP allows it and it has the technology or systems to extract the relevant information. If a credential shows indications of fraud, the institution must consider that in deciding whether it can form a reasonable belief that it knows the customer’s true identity. The CIP Rule neither requires nor prohibits reliance on such credentials, and the FAQs do not alter existing BSA requirements or set new supervisory expectations.

Whistleblower Bulletin on Iran Finance

UNITED STATES

FinCEN issued a Whistleblower Bulletin on 10 September inviting tips from US and non-US whistleblowers on Bank Secrecy Act and OFAC sanctions violations tied to Iran, including those involving Iranian proxies and facilitators operating outside Iran. Awards of 10–30% of collected penalties may be paid if a tip leads to a Treasury or DOJ enforcement action that collects more than $1 million in penalties and the other statutory requirements are met; potential OFAC violations require a nexus to the United States. The bulletin’s typologies include company types and jurisdictions at higher risk for Iranian sanctions evasion, including those from Iraq, the UAE, Türkiye and China. For trading and payment firms in those jurisdictions, an insider with a financial reason to report is now a realistic risk.

Third-Party Risk Guidance Rewrite Proposed

UNITED STATES

On 11 September the FDIC, Federal Reserve Board, NCUA and OCC requested comment on proposed principles-based guidance on third-party risk management which, like all supervisory guidance, is non-binding. When it is finalised, the federal bank regulatory agencies plan to rescind their existing third-party risk management guidance and replace it. Separately, the Fed, FDIC and OCC issued a statement on community banks’ engagement with core service providers, whose critical systems it describes as including compliance and reporting. Comments are due 60 days after Federal Register publication. This is not an AML rule, but outsourced screening, monitoring and KYC services are third-party relationships, so the final text will matter to compliance teams.

ON OUR RADAR

Watch This Space

  • Central Bank Law: One Year From 16 September 2025 REGULATORY DEADLINE · UAE — The CBUAE Rulebook shows Federal Decree-Law No. 6 of 2025, the central bank law, as effective from 16 September 2025. Article 184 gives agencies and persons subject to it one year from entry into force to reconcile their positions, and lets the CBUAE Board of Directors extend that period. Its licensed activities include payment services using virtual assets, and Article 62 extends the CBUAE’s jurisdiction to anyone carrying on or facilitating a licensed financial activity, whatever the technology, including platforms and technological infrastructure that facilitate financial services. Under Article 168 the CBUAE may fine a licensed financial institution up to AED 1 billion, or a violating party up to ten times the funds involved in the violation. The law does not apply to the financial free zones. Check the CBUAE’s own notices for any extension before treating the period as closed.
  • Sharjah Prosecutor Warns on Account Renting MONEY MULES · UAE — As reported by Gulf News on 10 September, Dr Abdullah Mohammed Al Ali of the Sharjah Public Prosecution warned on Sharjah TV that renting out a bank account, setting up a fake company or issuing forged invoices can expose people to serious criminal charges, and said newly arrived residents are among the most common targets of account-rental schemes. According to the report, he said money-laundering offences can carry prison terms of 15 to 25 years and fines of up to Dh200 million. Those penalty figures come from the news report of his interview; we have not checked them against the law text.
  • After Huione, the Users Moved to Xinbi SCAM ECONOMY · SOUTHEAST ASIA — Treasury says that after FinCEN’s listing of Huione Pay as a financial services conglomerate of primary money laundering concern, cybercriminals tried to preserve their operations by moving their activity to Xinbi Guarantee’s marketplace, which kept offering substantially similar services to an overlapping customer base. Around June 2025, in response to growing law-enforcement scrutiny, Xinbi began moving its merchant and money-laundering networks to the SafeW messenger. Expect Xinbi’s merchants to look for the next venue, which is why wallet and counterparty screening needs refreshing after every designation.
  • OTSI Moves to Intelligence-Led Cases TRADE SANCTIONS · UNITED KINGDOM — The UK’s Office of Trade Sanctions Implementation received 178 reports or referrals in 2025–26, according to its annual review published on 27 August. The majority came from the financial services sector, and 111 cases (62%) were reported by sectors under mandatory reporting obligations. OTSI has not yet imposed any civil monetary penalties. About 6% of the cases it opened were proactively initiated, and it aims to increase significantly the number of proactive and intelligence-led investigations — a sign that reporting alone will not stay the main trigger.

This Week’s 3 Key Takeaways

  1. The Iran Campaign Reached the Supply Chain — Last week OFAC designated a Türkiye-based bank, Golden Global Bank, and its two subsidiaries; this week it targeted airlines, aircraft-transfer intermediaries, cargo service providers and general sales agents. FinCEN’s aviation red flags include recently incorporated logistics firms in high-risk transshipment jurisdictions sharing an address with similar companies, and free-zone general traders that do not ordinarily deal in aviation goods ordering aircraft parts. KYB and trade monitoring, not name screening alone, is where this risk gets caught.
  2. Scam Money Moves Through Marketplaces — Treasury says Xinbi’s marketplace, which provides escrow services to scam operators and laundering networks, processed the equivalent of over $24 billion. Designating a marketplace hits many merchants at once, but Treasury’s own account shows cybercriminals moving to Xinbi after the Huione Pay action. Screen digital-asset counterparties against fresh designations, not last quarter’s list.
  3. Underground Banking Has a Gulf Address — On 3 September FATF published a report finding that more than 80% of reporting jurisdictions identify underground banking, hawala and similar service providers among their principal professional money-laundering channels. This week Europol described one alleged network, ‘Dubai Bank’: a leading figure is among the 21 arrested, and four of the six arrest warrants executed so far led to arrests in the UAE. Europol notes that such networks can settle payments through trade transactions and companies’ bank accounts rather than moving money across borders for every transaction. That leaves traces with the brokers and trading companies around them, which makes it a KYB and correspondent-monitoring problem.

Want this digest in your inbox every week?

Follow SonarPulse on LinkedIn · https://www.linkedin.com/company/sonarpulse

Sources

This article draws on the following sources. Follow the links for the original text.

Start with a compliance health check.

A working session with your compliance team, then a walkthrough against your own risk appetite: the lifecycle end to end, scoring weights set to your policy, and a review of the audit trail the system produces.

Or write to info@sonarpulse.mu