Chapter 7 · Recent Developments

In 2019, FATF updated Recommendation 15 (technology neutrality) to explicitly bring Virtual Asset Service Providers (VASPs) into scope — same AML obligations as traditional financial institutions. Timeline:

• 2014 — FATF issues virtual currency guidance (advisory)
• June 2019 — Interpretive Note formalises binding obligations
• 2020-24 — Progressive national transposition — mixed pace

VASPs subject to Rec 15: exchanges, custodian wallet providers, ICO issuers, DeFi platforms with a clear person of legal responsibility.

Extension of the wire-transfer "Travel Rule" (Rec 16) to crypto: originator and beneficiary information must accompany every VASP-to-VASP transfer above the threshold.

Implementation is patchy — many jurisdictions still not fully enforcing; technical solutions (TRP, Sygna, Notabene) emerging.

The Markets in Crypto-Assets Regulation (MiCA) is the EU's landmark crypto framework — adopted 2023, staged rollout 2024-25. Covers:

• Asset-referenced tokens (ARTs) — stablecoins referencing baskets
• E-money tokens (EMTs) — single-currency stablecoins
• Other crypto-assets — utility tokens, plain crypto
• Crypto-Asset Service Provider (CASP) licensing requirements

MiCA is EU regulatory law — sits alongside AML obligations from 5MLD/6MLD. Considered the world's first comprehensive crypto regulatory regime.

The largest crypto enforcement in history — Binance settled with US DOJ + Treasury for $4.3bn for:

• BSA violations — inadequate AML programme
• Unregistered money transmission
• Sanctions violations (Iran, Cuba, Syria, DPRK)

CZ (Changpeng Zhao, founder) pleaded guilty personally + served 4 months prison. Case defines the modern enforcement baseline for crypto exchanges.

US Treasury OFAC sanctioned Tornado Cash, an Ethereum-based mixing service, in August 2022 — the first designation of a smart contract (rather than a person or entity). Landmark case for:

• Establishing that code itself can be sanctioned
• Setting the precedent for further mixer designations (Blender.io, later Sinbad)
• Provoking constitutional legal challenges (Fifth Circuit reversal Nov 2024 — case still evolving)

Estimated $7bn+ laundered through Tornado Cash pre-sanction, including proceeds from DPRK Lazarus Group hacks.

AMLA — new EU direct supervisor for AML, operational 2025. Part of a broader AML package:

• AMLR (Anti-Money Laundering Regulation) — directly applicable, replaces patchwork of MLDs
• AMLD 6 — updated directive (co-exists with AMLR)
• AMLA — the enforcement + supervision engine

AMLA has direct supervision of the ~40 highest-risk EU financial firms + indirect coordination of national supervisors for others. Based in Frankfurt (selected Feb 2024).

Represents the most significant EU AML reform in decades — shift from Directive (transposed differently per Member State) to Regulation (uniform across all).

Enacted as part of AMLA 2020 (Anti-Money Laundering Act, itself part of the NDAA 2021). Requires most US companies and foreign-registered US entities to report beneficial owners to FinCEN — the US FIU.

Key features:

• Reporting required from 1 Jan 2024 for new entities, 1 Jan 2025 for existing
• Non-public register — LEA + FIU access only
• Exemptions for larger regulated firms (already reporting)
• Facing ongoing legal challenges: 5th Circuit rulings 2024 have suspended enforcement in some scenarios

UK's most significant corporate crime reform in decades. Key elements:

• Failure-to-prevent-fraud corporate offence — large orgs (>250 staff / >£36m turnover / >£18m assets) criminally liable for employee/associate fraud unless "reasonable procedures" in place. In force Sept 2025.
• Reform of identification doctrine — senior managers' conduct attributable to companies for economic crimes (previously only "directing mind and will" doctrine, narrow)
• Companies House reform — verification of directors, enhanced BO checks
• Limited-partnership reform (used in tax structures)
• Enhanced NCA powers

Follows the earlier Economic Crime (Transparency and Enforcement) Act 2022 (Register of Overseas Entities — see [[Ch 3]]).

Enforcement is progressively targeting individuals — not just firms:

• UK SMCR — Senior Manager Conduct Rules — personal accountability, "duty of responsibility"
• US AMLA 2020 whistleblower rewards — up to 30% of penalties >$1m (modelled on SEC)
• Prosecutions of MLROs increasing (UK NatWest 2021 first bank criminal ML conviction)
• Individual sanctions — designations against private individuals (post-Russia; also compliance-officer designations in some cases)

Ongoing revisions to keep the 40 Recs current:

• Rec 15 (2019) — VASPs and virtual assets
• Rec 24 (Mar 2022 update) — beneficial ownership transparency; requires beneficial ownership registries or equivalent
• Rec 25 (Feb 2023 update) — trust beneficial ownership
• Rec 8 revision (2023) — NPOs and TF risk (proportionate approach)
• Environmental crime — treated as a serious ML predicate (typology reports 2020-24)

Emerging financial-crime categories tied to sustainability:

• Greenwashing — misleading sustainability claims (marketing fraud, potential mis-selling)
• Carbon credit fraud — VAT carousel fraud, double-counting, fictitious offset projects
• Environmental crime as ML predicate — illegal logging, wildlife trafficking, illegal mining
• ESG-linked bond mis-selling — funds falsely marketed as ESG-compliant
• Corruption in emerging-market renewables — bribery to secure permits

Effective 31 May 2024. Requires all FCA-authorised firms to ensure any sustainability-related claim is:

1. Fair — accurately reflects the product
2. Clear — comprehensible to the target audience
3. Not misleading — no cherry-picking / omission
4. Evidenced — backed by data

Applies to ALL sustainability claims (not just asset managers or investment products) — marketing pages, product literature, disclosure documents. Sits within the FCA Sustainability Disclosure Requirements (SDR) framework.

See our ESG compliance cheat sheet for the full context.

Growing use of machine learning + AI in AML:

• Transaction monitoring — ML models identify unusual patterns; typically reduce false positives by 40-60% vs rules-only
• Adverse-media screening — NLP to sift news / court records
• Network analysis — graph analysis of counterparty relationships
• Sanctions screening — fuzzy matching, transliteration handling
• Investigation productivity — LLMs to summarise cases, draft SAR narratives

• Explainability — regulators require firms to explain why an alert was raised or suppressed
• Bias — model may under-flag protected classes or over-flag underserved communities
• Model drift — patterns change over time; models degrade without retraining
• Adversarial evasion — sophisticated criminals learn model behaviour
• Governance — traditional model risk management (SR 11-7, PS6/23) applies

Deepfake fraud — AI-generated voice/video used in BEC + authentication attacks — is a growing defensive concern.

Open banking (UK PSD2) enables third-party access to account data with customer consent — creates new AML opportunities and risks:

• Opportunity — richer transaction data across accounts improves monitoring; Account Information Service Providers can support KYC refresh
• Risk — TPPs are less mature AML operators; API abuse; consent fraud

Russia's February 2022 invasion of Ukraine triggered the most extensive sanctions regime in modern history. Key shifts:

• Scale — 3,000+ Russian individuals + entities designated by UK OFSI alone; comparable US/EU numbers
• Oligarch focus — high-net-worth individuals designated; asset freezes in UK/EU real estate
• Oil price cap — G7 mechanism (Dec 2022) capping Russian oil exports at $60/bbl
• Circumvention — trade routing via Turkey, UAE, Kazakhstan, Kyrgyzstan; ships flag-hopping
• Enforcement — UK OFSI moved to strict liability (Jun 2022); US enforcement heavy on facilitation

PPP models have proliferated since JMLIT (2015):

• UK JMLIT+ — expanded scope, more firms
• US FinCEN Exchange — bank-FinCEN info-sharing
• Australia FinTerra — similar structure
• Netherlands TMNL — cross-bank transaction monitoring joint venture (5 major banks)
• Nordic KYC Utility — shared KYC utility for corporates

Legal enablers vary — safe harbours (US 314(b)), coordinated joint ventures (Netherlands), industry utilities (Nordic).