The FinCrime Wire · Weekly Wire No. 2 · 12–18 October 2026 · By the LearnAML Editorial Board
Sources checked 17 October 2026 · 6 minute read
Three stories this week share one lesson: the money moves through ordinary channels long before anyone names it. A US bank failed to report more than $5 billion of suspicious activity, Iran’s bankers turned up in Havana and Baghdad, and West African scam centres used millions of social media accounts in plain sight.
The week in 60 seconds
- Bank of America fined $1.21bn. FinCEN and OFAC penalised the bank for wilful Bank Secrecy Act failures and sanctions breaches; the OCC added a record $750m penalty (13 October).
- EU lists 1,569 Russian targets. The largest single round of EU listings since 2022 hits suppliers to Russia’s missile, drone and aircraft production (12 October).
- Scam centres raided in Ghana and Nigeria. A UK-hosted operation led to 28 arrests, 117 trafficking victims freed and more than 3.7 million accounts removed (13 October).
- Iran’s shadow banks widen. The US designated 27 people and entities, including a Cuban state bank and an Iraqi bank (15 October).
Number of the week
1,569
Individuals and entities the EU listed in a single day: 826 Russian companies and 743 of their chief executives.
Top stories
Bank of America pays $1.21bn for missed red flags (13 October)
What happened. FinCEN assessed a $1.2 billion penalty and the bank admitted wilfully violating the Bank Secrecy Act. It failed to run an adequate AML programme, to carry out due diligence on foreign correspondent accounts and to file suspicious activity reports. OFAC settled 475 apparent sanctions violations for $11.6 million. The OCC’s $750 million penalty, the largest in its history, is credited against FinCEN’s. Reporting by OCCRP puts unreported suspicious activity at more than $5 billion.
Why it matters. FinCEN tied the failures to Chinese money laundering networks and illicit finance on the US southwestern border. Any bank that clears US dollars for correspondents, wherever it sits, is exposed to the same typologies.
What to do. Test a sample of correspondent files and recent decisions not to file a SAR against the failings cited.
Our read. Expect supervisors outside the US to cite this case when they examine correspondent banking.
EU agrees its largest-ever round of Russia listings (12 October)
What happened. The Council of the EU listed 1,569 targets: 826 Russian companies and 743 individuals who run them. The companies supply components for missiles, drones and aircraft, including semiconductors, radars, explosives and navigation systems. Listed persons face an asset freeze, and individuals a travel ban.
Why it matters. Screening teams in every jurisdiction that trades with the EU must load almost 1,600 new names at once. Many are mid-level suppliers that may appear in trade finance and payments as ordinary manufacturers.
What to do. Confirm your list provider has ingested the 12 October update, then re-screen customers, counterparties and open trade deals.
Our read. High Representative Kaja Kallas said “this is not the time to ease pressure on Moscow”. The EU and US are moving in different directions on Russia, so firms subject to both regimes cannot rely on one list.
Scam centres raided in Ghana and Nigeria (13 October)
What happened. The UK’s National Crime Agency hosted a “Joint Disruption Week” with the US Department of Justice, the FBI and agencies from ten countries. Police arrested 19 people at a compound outside Accra and nine in Nigeria, and freed 117 suspected trafficking victims. Meta removed more than 3.7 million Facebook and Instagram accounts, pages and groups, and US officials identified over $11 million in potentially freezable funds.
Why it matters. The networks ran romance, crypto investment, job and law-enforcement impersonation scams against victims in the US, the UK and beyond. Banks and payment firms are where the money lands, and where it can still be stopped.
What to do. Refresh scam typologies for frontline and fraud teams, especially impersonation and “pig butchering” investment fraud.
Our read. Platforms, crypto exchanges and police acting together is the model to watch; banks are likely to be asked to join the next round.
Iran’s shadow banks reach Havana and Baghdad (15 October)
What happened. Treasury designated 16 individuals and 10 entities, and the State Department designated Cuba’s state-owned Banco Internacional de Comercio (BICSA) for services to sanctioned Karafarin Bank. Targets include Iraq’s International Development Bank for Investment and Finance, accused of supplying US dollars to Iran, offshore Iranian banks and four exchange houses.
Why it matters. Treasury’s release links the network to the UAE, Hong Kong and Türkiye. Correspondent and trade-finance teams in those hubs are the most exposed.
What to do. Screen correspondent, payments and trade files against the 15 October names now, not at the next scheduled list refresh.
Around the world
Europe and UK
- Insider-dealing ring. The FCA and NCA arrested three people on suspicion of insider dealing and money laundering after searching five homes in London and Manchester (13 October).
East Asia and Pacific
- Singapore: police arrested four men after a 16-hour operation and say they laundered at least S$300,000 of scam proceeds collected from victims in cash, gold bars and jewellery (15 October).
- Hong Kong: the ICAC charged six people, including Cyberport’s former head of entrepreneurship, over about HK$20 million in technology subsidies allegedly obtained through bribery and fraud (13 October).
Americas
- Reminder: OFAC’s General Licence 135, issued on 9 October, still authorises dealings in Russian-origin diesel until 7 April 2027. It does not cover Russia’s central bank, National Wealth Fund or finance ministry, or parties blocked under other programmes.
Regional spotlight
Pakistan. We found no new AML/CFT circulars from the SBP or FMU dated inside the week. All eyes are on the FATF plenary on 26–30 October; our FATF grey list page tracks the current list.
Gulf. The Iraqi bank and the UAE links in the 15 October Iran action put Gulf correspondent and exchange-house relationships in scope.
Türkiye. Treasury again places parts of Iran’s financial network in Türkiye; Turkish banks and trading houses with Iran-adjacent business should re-check counterparties.
This week’s rotating spotlight: West Africa. Nigeria and Ghana were at the centre of this week’s scam-centre raids. The Record reports that 89 victims in Ghana lost an estimated $8.3 million, a reminder that these scams hurt people in the region too. GIABA, West Africa’s FATF-style body, holds its plenary from 22 to 27 November.
Red flag of the week
A customer suddenly withdraws large amounts of cash or buys gold, and will not say why. In Singapore this week, victims handed cash, gold bars and jewellery to couriers working for a scam syndicate, and police repeated that officials never ask for money, gold or valuables. Watch for customers making unusual withdrawals or gold purchases under time pressure, or mentioning a “case” with the police or a government agency. Learn more: How frontline staff can spot and respond to scam payments.
What we couldn’t confirm
Indian media continue to report that New Delhi will ask the FATF to return Pakistan to its grey list at the October plenary. The FATF does not publish its agenda in advance, and we have seen no official confirmation.
Dates to watch
- 26–30 OctFATF Plenary and working groups, Paris. Grey and black list updates usually follow on the final day; see our FATF grey list tracker.
- 16–20 NovEAG plenary, Kyrgyz Republic.
- 22–26 NovMENAFATF plenary (dates and location to be confirmed).
- 22–27 NovGIABA plenary (West Africa).
- 8–11 DecMONEYVAL plenary, Strasbourg.
- 7 Apr 2027OFAC General Licence 135 (Russian diesel) expires.
Your Monday checklist
- Re-screen against two big list updates: the EU’s 12 October Russia listings and OFAC’s 15 October Iran designations.
- Test correspondent due diligence and SAR decisions against the Bank of America failings.
- Brief frontline staff on courier collection of cash and gold, impersonation and crypto investment scams.
- Book time after 30 October to update high-risk country lists and enhanced due diligence triggers.
Quick quiz
- How many individuals and entities did the EU list on 12 October?
- 160
- 826
- 1,569
- 3,700
- Whose $750 million penalty against Bank of America was the largest in its history?
- FinCEN
- The OCC
- OFAC
- The FCA
- In this week’s Singapore case, how did scam victims hand over their money?
- Cash, gold bars and jewellery given to couriers
- Crypto transfers
- Wire transfers to offshore accounts
- Gift cards
Show answers
1. C (1,569: 826 companies and 743 individuals). 2. B (the OCC). 3. A (cash, gold bars and jewellery collected in person).
Learn more on LearnAML
- Screening, ownership and secondary sanctions risk: Sanctions Compliance in Practice.
- Correspondent and high-risk customers: CDD & EDD in Practice.
- Verifying urgent payment requests: AI impersonation scams.
- New to AML? Start with the free AML Foundations & Core Concepts course.
- Country context: our Pakistan, UAE and Saudi Arabia guides, and all country guides.
For the specialists: legal bases and identifiers
- EU: Council Decision (CFSP) 2026/2279 and Council Implementing Regulation (EU) 2026/2281, under the regime on actions undermining Ukraine’s territorial integrity (Decision 2014/145/CFSP).
- US, Iran: most designations under Executive Order 13902; BICSA under Executive Order 14404, Section 2(a)(i)(A).
- US, Bank of America: FinCEN consent order; OFAC settlement covering 475 apparent violations of Russia, Belarus, Iran, Myanmar, Somalia, narcotics and terrorism programmes.
- Singapore: charges under Section 51 of the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992.
Sources
- FinCEN, FinCEN Assesses $1.2 Billion Penalty Against Bank of America, 13 October 2026
- OFAC, Recent Actions: Settlement Agreement with Bank of America, N.A., 13 October 2026
- OCCRP, Bank of America Fined $1.21B Over AML Failures, 14 October 2026
- Council of the EU, EU agrees largest-ever package of listings targeting almost 1,600 individuals and entities in Russia’s military-industrial complex, 12 October 2026
- Meta, Leading Tech Companies Join Global Law Enforcement in Major Crackdown on West African Scam Networks, 13 October 2026
- The Record, report on the Ghana and Nigeria scam-centre raids, 13 October 2026
- US Treasury, Operation Economic Outcast Targets Iran’s International Financial Networks and Shadow Banking Architecture, 15 October 2026
- US Department of State, Sanctioning Cuban State-Owned Banco Internacional de Comercio, S.A. (BICSA), 15 October 2026
- FCA, Three arrests in major FCA operation against criminal insider dealing ring, 13 October 2026
- Singapore Police Force, Four men to be charged for laundering scam monies following 16-hour police operation, 15 October 2026
- The Standard (Hong Kong), Ex-Cyberport entrepreneurship head among 6 charged by ICAC over $20m tech subsidy fraud, 13 October 2026
- Herbert Smith Freehills Kramer, OFAC Issues General License 135 Authorizing Transactions Involving Russian-Origin Diesel Fuel, October 2026
- FATF, Calendar of Events
Compiled from official and public sources; reviewed by the LearnAML Editorial Board. This brief is general information, not legal advice. Last updated 17 October 2026.