As we move through Q3 following the summer break, we’ve pulled together the key AML, sanctions and financial crime regulatory developments impacting private markets.
This edition is particularly focused on the continued shift from regulatory expectation to active supervisory and enforcement scrutiny, with developments covering record enforcement action from FinCEN, AMLA’s emerging EU-wide approach to AML enforcement, new and proposed requirements for ongoing monitoring and suspicious activity reporting, and further supervisory findings on sanctions and financial crime controls.
Across the round-up, a clear theme is the need for firms to evidence risk-based, operationally effective AML frameworks, including robust customer due diligence, sanctions screening, escalation, record-keeping, independent assurance and timely remediation. We also cover MONEYVAL-driven developments in Guernsey and Jersey, new Cayman Islands AML and sanctions rules, FINMA’s updated guidance on money laundering risk analysis, and international reforms that point to greater scrutiny of sanctions compliance and financial intelligence powers.
For questions on any of the developments covered in this update, or to find out how Sonata One can support you with AML compliance across the fund lifecycle, please contact Louis Dodd, Askender Ouazzani or Tommaso Gava.
Key Upcoming Dates and Deadlines
- 18 September 2026 – Effective date for new Cayman Islands Monetary Authority AML and Financial Sanctions rules.
- 20 September 2026 – Deadline for responses to AMLA’s consultation on a common EU format for suspicious activity reporting
- 9 October 2026 – Deadline for responses to the Guernsey consultation on proposed changes following MONEYVAL recommendations
- First half of 2027 – AMLA and EDPB public consultation on joint guidelines for information-sharing partnerships
- 10 July 2027 – EU information-sharing framework under Article 75 of the AML Regulation applies
United States
OFAC updates guidance on assessing sanctions screening matches – On 9 September, OFAC updated its guidance on assessing potential sanctions screening matches, setting out a six-step process for determining whether an alert is a genuine match and what action should follow. The guidance emphasises reviewing identifying information, applying a risk-based assessment and escalating potential matches where appropriate, with firms expected to maintain records of the investigation and rationale for decisions. Firms should ensure their sanctions screening procedures clearly define how potential matches are investigated, escalated and documented.
FinCEN imposes $125m penalty on UBS for BSA violations – In August, FinCEN imposed a record $125 million penalty on UBS Financial Services for repeated BSA violations, including failures in transaction monitoring, customer due diligence and suspicious activity reporting. Despite a previous $14.5 million penalty in 2018, UBS failed to effectively remediate weaknesses, including the inadequate monitoring of more than 50,000 foreign currency wires worth over $10 billion. For private fund managers, the message is clear: AML controls must be risk-based, effective and continuously maintained, with robust CDD, source of wealth and adverse media checks, ongoing monitoring and prompt remediation of identified weaknesses.
FinCEN updates guidance on information sharing under Section 314(b) – In June, FinCEN issued updated guidance clarifying how financial institutions can share information on suspected fraud, money laundering, terrorist financing and other illicit activity under Section 314(b) of the USA PATRIOT Act. The guidance confirms that information shared can include fraud indicators, cyber-related data and transaction patterns, and encourages greater information sharing to support earlier detection of financial crime. Firms should consider how effectively their AML frameworks support information sharing and collaboration where elevated risks are identified.
FinCEN proposes customer identification rules for stablecoin issuers – In June, FinCEN and US federal banking regulators jointly proposed a rule requiring permitted payment stablecoin issuers to establish and maintain risk-based Customer Identification Programmes as part of their AML/CFT frameworks. The proposed requirements would include collecting and verifying customer information, maintaining CIP records, screening customers against relevant government lists and establishing procedures for cases where a customer’s identity cannot be verified. The rules would also allow issuers, in certain circumstances, to rely on another federally regulated financial institution for customer identification procedures. The proposal implements requirements under the GENIUS Act and complements separate proposed rules introducing additional AML obligations for permitted payment stablecoin issuers.
Alert on IRGC use of front companies and digital assets – In May, FinCEN issued an alert highlighting how Iran’s Islamic Revolutionary Guard Corps (IRGC) uses front companies, financial facilitators, layered corporate structures and digital assets to evade sanctions and launder proceeds. The alert identifies red flags including opaque ownership, recently incorporated companies moving unusually large sums, unclear sources of funds, complex cross-border transactions and unusual stablecoin or digital asset activity. FinCEN requests that financial institutions reference this Alert in SAR field 2 (“Filing Institution Note to FinCEN”) and the narrative by including the key term “FIN-2026-Alert002.”
European Union
AMLA introduces common EU approach to enforcement – AMLA has introduced a harmonised, risk-based approach to enforcing AML and counter-terrorist financing rules across the EU. The new standards establish a common method for assessing the severity of breaches, considering factors such as duration, repetition and impact before classifying breaches into four levels of gravity and determining the appropriate enforcement response. The standards will apply across financial and non-financial sectors and, once adopted by the European Commission, will be legally binding across EU Member States.
AMLA consults on ongoing monitoring of business relationships – AMLA has concluded its public hearing on draft guidelines for ongoing monitoring of business relationships, covering customer information updates and transaction and activity monitoring. The guidelines aim to provide a practical, proportionate and risk-based framework for firms across the financial and non-financial sectors, with written submissions open until 3 September 2026.
AMLA and EDPB issue press release on the development of joint guidelines on information sharing – In July, AMLA and the European Data Protection Board announced that they are working together to develop Joint Guidelines on information-sharing partnerships under Article 75 of the EU AML Regulation. The guidelines will clarify how obliged entities and public authorities can share information to detect and prevent money laundering and terrorist financing while meeting data protection requirements. The new information-sharing framework will apply from 10 July 2027, with a public consultation on the draft guidelines planned for the first half of 2027.
AMLA consults on harmonised EU suspicious activity reporting – In July, AMLA launched a public consultation on a common format for reporting suspicions across the EU, proposing common data points and reporting templates to improve consistency for firms and enable FIUs to process and share information more efficiently. The consultation is open to financial and non-financial sector stakeholders, with responses sought by 20 September 2026.
Luxembourg
Global situation of undertakings for collective investment at the end of June 2026 – Although not an AML rule change, the latest CSSF fund industry data provides useful market context for Luxembourg’s regulated funds sector and may be relevant when considering the scale of AML oversight across fund vehicles. As of 30 June 2026, the total net assets of undertakings for collective investment, comprising UCIs subject to the 2010 Law, specialised investment funds and SICARs, amounted to EUR 6,731.325 billion compared to EUR 6,634.393 billion as of 31 May 2026, i.e. an increase of 1.46% over one month. Over the last twelve months, the volume of net assets increased by 16.31%. The Luxembourg UCI industry thus registered a positive variation amounting to EUR 96.932 billion in June.
Luxembourg Law of 22 July 2026 on FIU Fraud Alerts – The Law of 22 July 2026 introduces a new mechanism allowing Luxembourg’s Financial Intelligence Unit (Cellule de Renseignement Financier – CRF) to share targeted fraud-related intelligence with certain financial sector professionals in order to help prevent fraud and the laundering of fraud proceeds.
The law creates a legal framework enabling the CRF to provide fraud alerts (“signals”) concerning accounts linked to significant fraud schemes. The objective is to help financial institutions identify and disrupt fraud-related transactions earlier, rather than relying solely on suspicious transaction reporting after losses have already occurred.
Importantly, this is not a blacklist and does not constitute a determination that a customer has committed a crime. The information is intended as a risk indicator to support institutions’ own assessment processes.
Recipients are prohibited from:
- Informing the customer concerned;
- Disclosing the information to third parties.
A key compliance requirement is that institutions must delete the received information within six months of receipt.
Switzerland
FINMA publishes supplementary guidance on money laundering risk analysis – In June, FINMA supplemented its 2023 guidance on money laundering risk analysis, following a review of risk assessments across more than 30 banks and numerous financial institutions regulated under Switzerland’s Financial Institutions Act. While progress was identified in areas such as risk tolerance and the structure of risk analyses, FINMA highlighted weaknesses including insufficiently defined exclusions for higher-risk countries, client segments, products and services, and incorrect application of risk assessment methodologies.
United Kingdom
FCA review finds sanctions control gaps – The FCA’s latest review of sanctions systems and controls across more than 150 firms found that while some firms demonstrated strong practices, weaknesses remain in due diligence, alert management, transaction and name screening, frozen asset management and licence compliance. The review also found that controls for trade sanctions are generally less mature than those for financial sanctions. The findings are relevant to all FCA-authorised or registered firms, particularly MLROs, nominated officers and financial crime compliance professionals, who should assess their sanctions frameworks against the FCA’s findings.
Guernsey
Consultation on changes following MONEYVAL recommendations – The Commission and Policy & Resources Committee are consulting on proposed changes to the AML/CFT/CPF Handbook and Schedule 3 of the Proceeds of Crime Law to address supervisory recommendations made by MONEYVAL in its 2025 evaluation. The consultation also proposes minor changes to other schedules and seeks views on the list of jurisdictions recognised as having standards equivalent to FATF requirements. The proposals are relevant to firms subject to Guernsey’s AML/CFT framework, with responses sought by 9 October 2026.
Commission updates Financial Crime Returns Rules – In July, the Guernsey Financial Services Commission amended the Financial Crime Returns Rules to reflect changes to Form 152, now renamed the Financial Crime Risk – Investment Vehicles Return. The revised return updates its content, reporting period and submission deadline following consultation with the fund administration sector. The changes apply to designated administrators responsible for the return, with no impact on other financial crime reporting requirements.
Jersey
JFSC thematic review identifies SAR control gaps – The Jersey Financial Services Commission’s 2025 thematic examination of suspicious activity reporting found that four of nine firms examined had no findings, while deficiencies at others included outdated policies and procedures, SAR registers and records, MLRO independence, training, board oversight of reporting timeliness and compliance monitoring. The review followed a MONEYVAL recommendation to strengthen how supervised persons identify and report suspicious activity to the FIU. Firms should review their SAR frameworks against the findings, with particular focus on MLRO oversight, record-keeping, training and ongoing monitoring.
JFSC shares key findings from 2025 financial crime examinations – The JFSC’s feedback paper highlights the most common and higher-risk findings from its 2025 financial crime examinations, covering corporate governance, customer identification and risk assessment, ongoing monitoring, enhanced due diligence and reporting obligations. Recurring weaknesses included inadequate board oversight, poor customer risk assessments, overdue reviews, insufficient source of wealth information and gaps in SAR decision-making records. Boards and senior management are encouraged to use the findings to assess whether similar gaps exist within their own financial crime control frameworks.
Cayman Islands
CIMA introduces new AML and sanctions rules – From 18 September 2026, CIMA-regulated financial services providers, including investment funds, managers and advisers, will be subject to two new enforceable rules: the Rule on an Effective Compliance Programme for the Prevention and Detection of Money Laundering, Terrorist Financing and Proliferation Financing for Financial Services Providers and the Rule on Compliance with Financial Sanctions and Targeted Financial Sanctions.
The rules largely formalise requirements already embedded in Cayman’s existing AML/CFT/CPF and sanctions framework, including governance, written policies and procedures, the appointment of AMLCO and MLRO roles, a risk-based approach and annual training. They also introduce new enforceable requirements around outsourcing controls and independent AML audits, including appropriate remediation of identified weaknesses.
Cayman FSPs should review their existing frameworks against the new rules, with particular focus on the enhanced outsourcing and independent audit requirements ahead of the September deadline.
International
New Zealand introduces final AML/CFT reform bill – In August, the New Zealand Government introduced the AML/CFT (Omnibus) Amendment Bill, the fourth and final stage of its AML/CFT reform programme. The Bill would give reporting entities greater flexibility to apply simplified customer due diligence where risks are low, while placing greater emphasis on entity-specific risk assessments. It also introduces a new sanctions compliance framework, requiring firms to assess and manage sanctions risks within their AML/CFT programmes and undertake sanctions screening. The reforms would also significantly strengthen enforcement and intelligence-gathering powers, including new powers for the Financial Intelligence Unit to obtain ongoing financial records and introduce temporary freezing orders. Maximum civil penalties would increase substantially, with entities potentially facing penalties of up to the greater of NZD 5 million, three times the gain derived from a breach, or 10% of turnover.
Financial Action Task Force Grey List – On 19 June 2026, the Financial Action Task Force (FATF) reviewed its list of jurisdictions under increased monitoring, commonly known as the “grey list.” Following the review, the FATF has now also identified Bosnia and Herzegovina and Iraq.
