· Weekly Digest

Financial Crime Weekly Digest — 29 September – 5 October 2026

Global enforcement actions, regulatory moves & intelligence from the world of AML & financial crime.

Illustration for “Financial Crime Weekly Digest — 29 September – 5 October 2026”

Download the full digest (PDF) · 7 pages

29 September – 5 October 2026

In this issue

  • STORY OF THE WEEK — The US Treasury moves against the A7 Network: a proposed FinCEN rule, a FinCEN Alert and an OFAC designation, all on one day
  • ENFORCEMENT — Almost £30m in suitcases, flown from UK airports to Dubai · sham charities and crypto for Hamas · the DFSA fines an ADGM-licensed firm
  • REGULATORY — OFAC warns foreign banks dealing with Iran · AMLA finalises its customer due diligence standards · FATF publishes Canada’s mutual evaluation
$17B+
PROCESSED BY A7 NETWORK SUB-AGENTS
FinCEN · 1 Oct · January 2025 to June 2026		£788,455
CASH SEIZED AT UK AIRPORTS
NCA · 2 Oct · of almost £30m smuggled to the UAE		125
REMOVED FROM OFAC’S SANCTIONS LISTS
US Treasury · 5 Oct · and 22 list entries updated		$40.73M
REPORTED ATM JACKPOTTING LOSSES
US Treasury · 30 Sept · alleged attacks, as of Aug 2025

STORY OF THE WEEK · UNITED STATES / RUSSIA / IRAN

Treasury Targets the A7 Network: Designation, Alert, Proposed Rule

$17 BILLION+ — processed by the A7 Network’s Sub-Agents between January 2025 and June 2026, aggregated globally, as identified by FinCEN’s investigation

On 1 October, as part of Operation Economic Outcast, the US Treasury took what it calls “unprecedented action” against the A7 Network, “a shadow banking network with ties to Russia used by the Iranian regime to evade sanctions”. Three measures came together. FinCEN proposed a rule that would prohibit transmittals of funds regarding transactions involving the A7 Network’s Sub-Agents, under section 9714(a) of the Combating Russian Money Laundering Act; the comment period closes 30 days after publication in the Federal Register. FinCEN issued an Alert with red flags. And OFAC sanctioned the A7 Network as a significant transnational criminal organization. Treasury says the network is led by Ilan Mironovich Shor, and that its Sub-Agents are companies “purpose-built to disguise payments linked to sanctioned sectors and persons as ordinary commercial activity”.

Keep the numbers apart. The $17 billion is what FinCEN’s investigation identified. The larger figure — more than 2,000 transactions a day and more than 7.5 trillion rubles, the dollar equivalent of $91.5 billion — is what the network claimed “by its own account” as of January 2026. FinCEN’s Alert adds that, as of June 2026, the network operates hundreds of companies with bank accounts at approximately 435 financial institutions in at least 83 countries, and that it forms, acquires or partners with companies in third countries “such as” Hong Kong, Indonesia, the Kyrgyz Republic, the Seychelles, Türkiye and the United Arab Emirates — examples, not a complete list.

  • Announced 1 October 2026 · FinCEN Alert FIN-2026-Alert007 · SAR key term “FIN-2026-A7NETWORK”
  • The FinCEN rule is proposed, not final: it would prohibit transmittals of funds involving A7 Network Sub-Agents
  • OFAC: the A7 Network is sanctioned as a significant transnational criminal organization
  • FinCEN: the A7A5 token is a ruble-backed stablecoin developed within the network

Why it matters for compliance teams A Sub-Agent is built to look like an ordinary trading company, so a name match is unlikely to be what finds it. FinCEN’s red flags are about behaviour and paper: a recently-formed company with unusually high volumes of large transactions over a short period; payments routed through several potential shell companies in multiple jurisdictions for no clear economic purpose; invoices with overly simplified or vague product details. FinCEN also flags access from VPN infrastructure on servers in jurisdictions “such as Dubai, Hong Kong, or Kyrgyz Republic”, and says no single red flag is determinative.

ENFORCEMENT ACTIONS

Law Enforcement Strikes This Week

Almost £30 Million in Suitcases, Flown From UK Airports to Dubai

SENTENCED · UK NATIONAL CRIME AGENCY · UNITED KINGDOM / UAE

On 2 October the NCA announced sentences for members of a crime group which smuggled almost £30 million of cash out of the UK to the UAE hidden in suitcases. The group worked with a British Dubai-based organiser — alleged, and awaiting extradition to face trial — using Dubai-bound flights from Manchester, Birmingham and Brussels between December 2017 and November 2019. Couriers carried cash in up to five suitcases at a time, undeclared on departure. One courier declared £3.9 million on arrival in Dubai on 14 occasions. £788,455 was seized at UK airports.

Sham Charities and Crypto: a Hamas Financing Network

DESIGNATED · CHARGED · US TREASURY / US DEPARTMENT OF JUSTICE · UNITED STATES / FRANCE / GAZA

On 2 October OFAC designated a member of Hamas’s military wing, two France-based individuals and two affiliated entities. Treasury describes a financing architecture that moved more than $2 million to Hamas “through deceptive charitable fronts and cryptocurrency channels”; the Gaza-based member oversees a network that has used various money services businesses and cryptocurrency wallets. The same day the Justice Department announced an unsealed indictment charging him, three arrests in the US and three in France. Its figure differs: more than $1.7 million collected through purported charitable campaigns since January 2020. The charges are allegations.

ATM Jackpotting as Revenue for Tren de Aragua

10 TARGETS · US TREASURY / US DEPARTMENT OF JUSTICE · UNITED STATES / MEXICO / VENEZUELA

On 30 September OFAC designated 10 targets involved in a Tren de Aragua fraud scheme: “jackpotting”, in which malware forces ATMs to dispense cash. Treasury says the network uses cryptocurrency transactions to launder the proceeds. As of August 2025, reported losses from alleged jackpotting attacks in the US total $40.73 million across over 1,500 attacks. On 2 October the Justice Department announced the apprehension of the alleged engineer of the malware, Anibal Alexander Canelon Aguirre, who entered not guilty pleas.

Licensed in ADGM Is Not Authorised in DIFC

USD 109,200 FINE · DUBAI FINANCIAL SERVICES AUTHORITY · UAE / DIFC

On 1 October the DFSA announced a fine of USD 109,200 on Vault Wealth Limited, a firm incorporated in ADGM and licensed by the FSRA, for carrying on financial services in or from DIFC without DFSA authorisation; the fine was reduced by 30% because the firm agreed to settle. Its employees worked from the office of a related DIFC entity not regulated by the DFSA, where prospective clients were given financial advice and provided know-your-customer documentation. The DFSA treated as aggravating that senior management failed to act on concerns raised by the firm’s then Compliance Officer.

REGULATORY DEVELOPMENTS

Regulatory Moves Reshaping the Compliance Landscape

OFAC to Foreign Banks Dealing With Iran: You “Could Be Targeted at Any Time”

UNITED STATES / IRAN

On 5 October OFAC published an Alert, “Notice to Foreign Financial Institutions Conducting Business with Iran”. It says foreign financial institutions that continue to do business with Iran or its financial sector may be sanctioned under Operation Economic Outcast, and that those continuing to transact with sanctioned Iranian financial institutions “could be targeted at any time without advance notification and should take immediate action to terminate such activity and relationships”. The Alert names its precedents: Treasury’s 28 August action on Banque Misr UAE, the 4 September designation of Türkiye-based Golden Global Bank and the 14 September designation of VTB Bank. One sentence reaches beyond Iran’s borders: the risk covers “providing financial services to Iranian banks or their subsidiaries or branches in third countries”. On shadow banking, institutions potentially exposed should take steps to detect and disrupt the activity, incorporating Treasury’s recommended mitigation measures on a risk basis. This is an alert, not a new rule or designation.

AMLA Finalises Its Customer Due Diligence Standards — Final Drafts, Not Yet Law

EUROPEAN UNION

On 1 October the EU’s AMLA said it had finalised three sets of regulatory technical standards for the private sector: on business relationships and occasional transactions, including how to identify linked transactions; on customer due diligence, covering the information to collect and verify, proportionate measures for lower-risk situations, non-face-to-face verification, electronic identification and the screening of politically exposed persons, their family members and close associates; and on group-wide arrangements. Mind the status. The final draft standards have been submitted to the European Commission; once adopted and published in the Official Journal, they are proposed to apply six months after their entry into force. The same day AMLA published final draft standards on cooperation between home and host supervisors of cross-border groups.

FATF Publishes Canada’s Mutual Evaluation — Regular Follow-Up

GLOBAL / CANADA

On 29 September the FATF and the Asia/Pacific Group on Money Laundering published their mutual evaluation of Canada, assessed at the time of an on-site visit in November 2025. Canada has taken steps to strengthen its defences, including by advancing its framework for beneficial ownership transparency, but should improve the effectiveness of risk-based supervision and prioritise the investigation and prosecution of complex money laundering cases. On supervision, a significant proportion of financial institutions and VASPs are not subject to an entity-level risk assessment, and the focus on higher-risk DNFBPs leaves certain sectors vulnerable, notably dealers in precious metals and stones and real estate. Canada is placed in regular follow-up, with a roadmap of Key Recommended Actions to complete within three years.

ON OUR RADAR

Watch This Space

  • OFAC’s Third Round of Removals: 125 Off the Lists, 22 Entries Updated SANCTIONS MAINTENANCE · UNITED STATES — On 5 October Treasury announced that OFAC had removed 125 individuals and entities from its sanctions lists and updated 22 list entries “to facilitate and enhance compliance screening”. Those removed include deceased individuals, defunct companies and entries lacking sufficient information for robust screening. Treasury says entries without appropriate identifying information can produce false positive matches. A removal changes your screening results as surely as a designation does.
  • The Bank of Mauritius Warns of Counterfeit Banknotes COUNTERFEIT CURRENCY · MAURITIUS — On 1 October the Bank of Mauritius issued a public notice alerting the public to reports of counterfeit Mauritian banknotes in circulation. Anyone who suspects a note may be counterfeit should refrain from accepting it and report the matter to the nearest police station. The Bank recalls that the Bank of Mauritius Act 2004 makes it an offence to possess counterfeit banknotes, and says it is working with the Police, relevant authorities and regulatees. The notice gives no figures.
  • The AMMC and the Judiciary Hold Their First Exchange Meeting MARKET OFFENCES · MOROCCO — In a press release dated 2 October, Morocco’s capital markets authority, the AMMC, said it had held its first exchange meeting with the Conseil Supérieur du Pouvoir Judiciaire on 30 September, under a framework agreement the two signed on 20 May 2026. It brought together more than thirty magistrates; topics included capital-market regulation and criminal policy on market offences.
  • FinCEN Withdraws Two Crypto Proposals; the FCA Opens Its Gateway CRYPTO-ASSETS · UNITED STATES / UNITED KINGDOM — On 5 October FinCEN announced it is withdrawing two proposed rules: one on recordkeeping, verification and reporting for certain transactions involving convertible virtual currencies and unhosted wallets, and one that would have imposed a special measure on convertible virtual currency mixing. Neither had become a final rule. In the UK, from 30 September crypto firms can apply to the FCA for authorisation; firms that intend to continue operating should apply by 28 February 2027, ahead of the regime coming into force on 25 October 2027. The FCA says authorisation is not automatic.

This Week’s 3 Key Takeaways

  1. The Evasion Network Is Built to Look Like Trade — Treasury’s description of the A7 Network is of companies purpose-built to make sanctioned payments appear to be ordinary commercial activity, using falsified trade documents and misleading goods descriptions. FinCEN says the network’s companies hold accounts at approximately 435 financial institutions in at least 83 countries, and names the UAE among its examples of where such companies are set up. That is a monitoring and document-review problem before it is a list problem: test the red flags in the Alert against new corporate customers with sudden, large, short-lived transaction volumes, and remember that the FinCEN rule is still a proposal.
  2. Iran Exposure Now Includes Branches in Third Countries — Last week our lead story was the Central Bank of the UAE barring Bank Melli Iran’s UAE branches from transactions to and from Iran. This week OFAC’s Alert tells foreign financial institutions that providing financial services to Iranian banks or their subsidiaries or branches in third countries risks sanctions, and that institutions transacting with sanctioned Iranian financial institutions could be targeted at any time without advance notification. Read the two together. If your institution holds any relationship with an Iranian bank’s branch or subsidiary outside Iran, the question to answer now is whether it has been ended, and who can evidence that.
  3. Our Six: the UAE, Mauritius and Morocco This Week — From the regulators of the six jurisdictions this digest follows, we confirmed in-week publications from the DFSA (a fine for unauthorised financial services in DIFC), the Bank of Mauritius (a counterfeit banknote notice) and Morocco’s AMMC (a first meeting with the judiciary). The UAE also appears in others’ releases: as the destination of the cash in the NCA case, and among FinCEN’s examples of where A7 Network companies are set up. We found nothing on financial crime dated 29 September – 5 October from the Saudi or Qatari regulators we could reach; several sites block automated access, so that is what we could see, not proof that nothing was published.

Want this digest in your inbox every week?

Follow SonarPulse on LinkedIn · https://www.linkedin.com/company/sonarpulse

Sources

This article draws on the following sources. Follow the links for the original text.

Start with a compliance health check.

A working session with your compliance team, then a walkthrough against your own risk appetite: the lifecycle end to end, scoring weights set to your policy, and a review of the audit trail the system produces.

Or write to info@sonarpulse.mu