FCA Expectations for Crypto Firms: Financial Crime Priorities and Practical Considerations

The FCA’s expectations of cryptoasset firms continue to evolve, but the direction of travel is increasingly clear: firms are expected to demonstrate mature, risk-based and operationally effective financial crime controls, not simply policies that look adequate on paper.

As the sector grows and business models become more complex, the regulator is placing greater scrutiny on whether firms truly understand the financial crime risks within their products, customer bases and transaction flows. That includes how those risks are identified, governed, monitored and evidenced in practice.

For FCA-authorised crypto firms, this creates a challenge that goes beyond regulatory interpretation. Firms must ensure that their controls can withstand operational pressure, adapt to emerging typologies and produce evidence that governance frameworks are functioning effectively.

Below, we explore several of the key financial crime themes firms should be focusing on.

Risk Assessments Need to Reflect Real Exposure

A recurring issue across the crypto sector is the gap between documented risk assessments and the actual risks firms face operationally.

The FCA expects firms to maintain enterprise-wide and customer-level risk assessments that are dynamic, evidence-based and tailored to the nature of their business model. Generic assessments or frameworks borrowed from traditional financial services firms are unlikely to be sufficient where crypto-specific risks are present.

This is particularly important in areas such as:

• exposure to high-risk jurisdictions

• complex ownership structures

• decentralised ecosystems

• rapid movement of funds

• use of mixers, privacy tools or layered wallet structures

• exposure to sanctions evasion typologies

• fraud and mule account activity

Risk assessments should directly inform control design, customer due diligence, monitoring scenarios and escalation frameworks. Where firms cannot clearly demonstrate that linkage, regulators may question whether the framework is genuinely risk-based.

In practice, many firms also face challenges keeping risk assessments aligned to evolving products, customer behaviour and emerging typologies, particularly in fast-growth environments where frameworks can quickly become outdated if not reviewed regularly.

• Download our Risk Assessment Best Practices checklist

Practical considerations for firms

Firms should consider whether their risk assessments:

• accurately reflect current products, customer types and geographies

• are reviewed frequently enough to capture emerging threats

• incorporate crypto-specific typologies and red flags

• meaningfully drive monitoring and due diligence decisions

• are supported by clear governance and documented rationale

Transaction Monitoring Must Be Operationally Effective

Many crypto firms have invested heavily in surveillance tooling, blockchain analytics and screening capabilities; however, technology alone does not satisfy regulatory expectations.

The FCA is increasingly focused on whether transaction monitoring frameworks are calibrated appropriately, producing meaningful outputs and supported by effective investigative processes.

Common weaknesses across the sector can include:

• excessive alert volumes with limited prioritisation

• poorly tuned scenarios

• insufficient understanding of customer behaviour

• gaps between blockchain monitoring and internal customer data

• inadequate escalation or SAR decision-making processes

• limited evidence of ongoing optimisation and testing

For crypto firms in particular, monitoring frameworks should account for the speed, scale and cross-border nature of transactions, alongside typologies associated with sanctions evasion, layering, fraud networks and high-risk wallet exposure.

Monitoring programmes should also evolve alongside changes in customer behaviour and criminal methodologies. Static controls quickly become ineffective in fast-moving environments.

This is an area where firms often benefit from independent review and challenge, particularly where alert volumes are increasing, typologies are changing rapidly or internal teams are struggling to determine whether existing controls remain proportionate and effective.

• Download our Transaction Monitoring Checklist

Practical considerations for firms

Crypto firms should assess whether they can clearly evidence:

• how monitoring scenarios were designed and calibrated

• why thresholds remain appropriate

• how alerts are triaged and investigated

• what management information is reviewed by governance forums

• how typologies and emerging risks are incorporated into controls

• whether back-testing or effectiveness testing is performed regularly

Governance and Accountability Remain Critical

The regulator continues to emphasise the importance of governance, particularly in high-growth firms where financial crime frameworks may struggle to keep pace with commercial expansion.

Strong governance is not simply about committee structures or reporting lines. The FCA expects senior management to demonstrate meaningful oversight of financial crime risks, including an understanding of where control gaps exist and how remediation is progressing.

This becomes particularly important where firms operate internationally, introduce new products rapidly or rely heavily on third-party providers.

In practice, firms should be able to demonstrate:

• clear accountability for financial crime risks

• effective escalation processes

• appropriately skilled compliance and MLRO functions

• sufficient resourcing for investigations and monitoring

• evidence of challenge from senior management and boards

• timely remediation of identified weaknesses

For many crypto firms, maintaining effective governance becomes increasingly difficult as transaction volumes, jurisdictions and product offerings expand. Governance frameworks that were appropriate at an earlier stage of growth may require significant enhancement as firms mature operationally and face greater supervisory scrutiny.

Sanctions Controls Continue to Face Scrutiny

Sanctions risk remains a major area of focus across the crypto sector, particularly given ongoing geopolitical developments and concerns around sanctions evasion using digital assets.

The FCA expects firms to understand how sanctions exposure can manifest across customers, wallets, counterparties and transaction activity, and to implement controls proportionate to those risks.

This extends beyond basic name screening. Firms increasingly need to consider:

• wallet screening and blockchain exposure analysis

• indirect exposure to sanctioned entities

• typologies associated with evasion techniques

• transaction patterns linked to high-risk jurisdictions

• governance around escalation and decision-making

A common challenge for firms is balancing operational efficiency with effective escalation processes, particularly where screening outputs generate large volumes of potential matches.

As sanctions typologies continue to evolve, firms should also consider whether their frameworks are receiving sufficient ongoing tuning, assurance and specialist oversight to remain effective in practice.

Practical considerations for firms

Firms should consider whether their sanctions framework:

• adequately covers wallet and transactional exposure

• incorporates current typologies and geopolitical developments

• includes clear escalation and investigation procedures

• is supported by documented governance decisions

• can demonstrate ongoing tuning and optimisation

FINTRAIL’s experts have extensive knowledge of sanctions regulatory requirements and their application in practice. We can assist clients of all sizes build and maintain an effective sanctions compliance programme.

Evidence, Assurance and Control Testing Matter More Than Ever

An increasingly important theme across FCA supervision is the expectation that firms can evidence control effectiveness — not simply describe their framework.

Policies, procedures and governance documentation remain important, but regulators are also looking for operational proof points, including:

• testing results

• QA findings

• management information

• remediation tracking

• audit outcomes

• evidence of senior management oversight

Firms that cannot demonstrate how controls operate in practice may struggle during supervisory engagement, even where policies appear comprehensive.

This is particularly relevant for crypto firms operating in fast-growth environments, where controls may not have scaled at the same pace as customer acquisition or transaction volumes.

Independent assurance activity can play an important role here, both in identifying weaknesses before regulators do and in helping firms demonstrate that controls are subject to meaningful challenge and review.

Practical considerations for firms

Areas firms may wish to review include:

• the maturity of QA and assurance programmes

• whether MI supports meaningful decision-making

• how remediation actions are tracked and evidenced

• the quality and consistency of investigations

• whether governance committees receive actionable reporting

Final Thoughts

The FCA’s expectations of crypto firms are continuing to mature alongside the sector itself. Increasingly, the focus is shifting from whether firms have controls in place to whether those controls are demonstrably effective, proportionate and embedded operationally.

For many firms, the challenge is no longer simply implementing a financial crime framework; it is ensuring that governance, monitoring, assurance and risk management processes can evolve alongside changing threats, regulatory expectations and business growth.

This is particularly relevant for firms scaling quickly, entering new markets or adapting to increasingly sophisticated fraud and sanctions risks, where control frameworks can struggle to keep pace with operational complexity.

Firms that invest early in scalable, risk-based and evidence-driven controls are likely to be better positioned as supervisory scrutiny continues to increase.

FINTRAIL supports crypto and digital asset firms with financial crime risk assessments, AML and sanctions framework reviews, governance support, transaction monitoring optimisation, assurance activities and broader anti-financial crime advisory services. You can learn more about our work with crypto firms on our cryptocurrency sector page.

Please reach out to our team if you’d like support with any of these topics.

This article was adapted from an original piece published by Cosegic.

---

FFECON26: Key Insights for Anti-Financial Crime Professionals

Each year, FFECON brings together a community of professionals from across financial services, fintech, law enforcement and beyond, to explore the evolving fight against financial crime.

FFECON26, our eighth annual conference, was the largest yet, welcoming 500+ attendees to London for a day of discussion on the risks, technologies and behaviours shaping the future of anti-financial crime (AFC). Across seven sessions and panels, industry experts explored everything from sanctions evasion and cryptocurrency risks to the darker edges of the digital economy.

A central aim of FFECON has always been to move beyond theory and provide practical insights that compliance teams can apply immediately. With that in mind, we have distilled the key lessons from each session below, summarising the discussion and highlighting what financial institutions, fintechs and compliance professionals should consider in response.

1. Trade Sanctions Compliance: Are Financial Institutions Responsible for Detecting Evasion?
2. Crypto and Financial Innovation: New Risks or Familiar Financial Crime?
3. Teenage Banking and Financial Crime Risk
4. Financial Sextortion: Technology, Social Media and Organised Crime
5. Financial Crime Beyond Banking: Risks in Social Media, Gaming and Digital Platforms
6. Technology in Financial Crime Compliance: Hype, Reality and the Human Factor
7. The Future of Payments and Financial Crime Risk

🎤 Trade Sanctions Compliance: Are Financial Institutions Responsible for Detecting Evasion?

Following Russia’s invasion of Ukraine in 2022, trade sanctions have moved firmly onto the frontline of financial crime compliance. The panel explored how export restrictions, import bans and controls on dual-use goods have dramatically expanded the scope of sanctions risk.

For financial institutions, this creates a difficult operational challenge. In a poll during the session, 70% of the audience said detecting trade sanctions evasion feels like “looking for a needle in a haystack.”

Panellists agreed that regulators increasingly expect firms to go beyond traditional sanctions screening. While list-based screening remains essential, it is unlikely to detect trade sanctions evasion on its own. Instead, firms must focus on behavioural indicators, analysing transaction patterns, trade routes, counterparties, and the nature of goods being financed.

The discussion highlighted that strong customer due diligence and risk assessment processes are foundational. Understanding a customer’s business model, supply chains and typical trading partners can make the difference between detecting suspicious activity and missing it entirely.

Another key theme was the need for strong internal awareness. Frontline staff should be trained to recognise potential trade-based financial crime typologies, even where the initial alert relates to a different issue.

With regulatory expectations continuing to evolve, the panel suggested firms should prepare for greater enforcement action in the trade sanctions space, rather than relying solely on regulatory guidance.

Trade sanctions compliance increasingly sits at the intersection of sanctions screening, transaction monitoring and customer risk assessment. Firms that rely solely on list-based controls may struggle to identify more complex evasion patterns.

Through our advisory work, FINTRAIL supports organisations in strengthening sanctions frameworks, conducting risk assessments, and designing effective monitoring controls that reflect the growing complexity of global sanctions regimes.

🎤 Crypto and Financial Innovation: New Risks or Familiar Financial Crime?

Few topics divide opinion in financial crime compliance quite like cryptocurrency. While some view blockchain technology as a transparency revolution, others see a new frontier for financial crime.

This panel examined whether crypto and emerging financial technologies truly introduce new financial crime risks, or simply reshape existing typologies in a new environment.

One of the core themes was the illusion of transparency. While blockchain transactions are publicly visible, that visibility only becomes useful when firms can accurately attribute wallet addresses to real-world actors. Without this attribution, transparency alone may offer limited investigative value.

Panellists also explored the growing risk landscape around stablecoins. While issuers may not have direct customer relationships, they can still face downstream exposure; particularly in relation to token distribution, freezing capabilities, and reputational risk where tokens are used for illicit activity.

Another emerging control discipline discussed was “coin due diligence”: assessing the founders, governance structures and technical design of new tokens before supporting or integrating them.

Operational challenges remain too. Compliance with the Travel Rule, for example, continues to present significant complexity across jurisdictions and platforms.

A recurring insight was that compliance friction can actually support long-term innovation. Robust KYC, monitoring and compliance frameworks may initially appear restrictive, but they ultimately help digital assets scale safely into mainstream financial systems.

Crypto risk management increasingly requires specialist expertise, technology capability and governance frameworks tailored to digital assets.

FINTRAIL works with fintechs, payment firms and financial institutions to assess crypto-related financial crime risk, develop appropriate control frameworks, and align their AFC programmes with evolving regulatory expectations.

🎤 Teenage Banking and Financial Crime Risk

Teen banking products are growing rapidly, offering young users access to payment cards and financial apps from an early age. While these products can play a positive role in financial education and inclusion, they also introduce new financial crime vulnerabilities.

This panel explored how criminals increasingly exploit young users (particularly teenagers) in schemes involving money muling, online extortion and other forms of exploitation.

Panellists highlighted that many young people lack the financial literacy needed to recognise when they are being recruited into criminal activity. As a result, teenagers are increasingly used to help launder illicit funds through their bank accounts.

Another disturbing trend discussed was the intersection between financial crime and online harms. Teenagers exposed to extremist content online may become involved in criminal networks, while others fall victim to financially motivated extortion schemes.

Because teen banking products typically restrict cross-border payments, criminals often exploit alternative payment mechanisms, such as gift cards and gaming vouchers, to extract funds from victims.

The discussion emphasised the importance of education, monitoring and tailored safeguards. Firms offering youth financial products need to ensure their controls reflect the unique behavioural patterns and risks associated with younger customers.

Ultimately, youth banking requires carefully calibrated fraud and AML controls, alongside strong customer education initiatives.

FINTRAIL supports organisations in conducting product risk assessments and designing proportionate control frameworks that protect vulnerable users while supporting responsible innovation.

🎤 Financial Sextortion: Technology, Social Media and Organised Crime

One of the most confronting sessions of FFECON26 focused on the growing threat of financial sextortion targeting minors.

Hosted by keynote speaker Paul Raffile, the session explored how criminal groups exploit social media platforms to target young people. Individuals who self-identify as “Yahoo Boys” are actively involved in sextortion schemes, deceiving minors into sharing explicit images before subjecting them to escalating blackmail and coercion.

The consequences can be devastating. Victims are pressured to make repeated payments to prevent images from being shared and sadly, in many cases, this leads to suicide. While a difficult topic, it was an essential discussion for the anti-financial crime community and became one of the most talked-about sessions of the day.

A key takeaway was that these crimes are highly organised, often operating at scale and targeting large numbers of victims. The financial flows linked to sextortion frequently pass through cryptocurrency platforms, peer-to-peer payment apps and gift cards, many of which are easily accessible to minors.

Countries including Nigeria, Ivory Coast and the Philippines have emerged as global hotspots for sextortion activity. Addressing this threat requires stronger safety, privacy and device-blocking controls across platforms, alongside closer collaboration between Compliance, Fraud and Trust & Safety teams.

💡What this means for financial institutions and digital platforms

Financial sextortion sits at the intersection of financial crime and online harms, meaning institutions often only see fragments of the activity, such as unusual payment patterns involving gift cards, peer-to-peer transfers or cryptocurrency.

Criminal networks are highly organised; our response must be equally coordinated by building cross-sector communities, raising awareness, and delivering targeted training across financial institutions, technology companies and social media platforms.

Through our advisory work, FINTRAIL helps organisations identify emerging typologies, strengthen detection and escalation processes, and equip teams with the training needed to respond to complex threats.

🎤 Financial Crime Beyond Banking: Risks in Social Media, Gaming and Digital Platforms

As financial services become more embedded in the digital economy, financial crime risks are extending far beyond traditional banking environments. This panel examined how criminals exploit online platforms such as social media networks, gaming ecosystems, creator platforms and digital marketplaces.

While the environments differ, panellists noted that the same criminal actors often operate across multiple platforms, adapting their tactics to exploit specific features.

Examples discussed included promotional abuse, bonus fraud, financial sextortion, and manipulation of platform monetisation systems. Gifting mechanisms, in-platform tokens and virtual assets can also provide new channels for moving illicit funds.

Companies operating these platforms face a difficult balancing act. They must support vibrant creator ecosystems and user engagement, while ensuring that financial incentives do not unintentionally encourage harmful or fraudulent behaviour.

Detection strategies are evolving accordingly. Organisations are increasingly using AI-driven monitoring tools, analysing device patterns, identifying multi-account connections and scanning platform content to detect emerging risks.

However, enforcement remains complex. Removing accounts can disrupt criminal activity, but it can also eliminate valuable investigative trails.

Bottom line: The financial crime landscape is expanding into digital ecosystems that sit adjacent to financial services.

FINTRAIL works with fintechs and digital platforms to conduct financial crime risk assessments, strengthen monitoring capabilities, and develop proportionate governance frameworks for emerging digital environments. Speak to our team to find out more.

🎤 Technology in Financial Crime Compliance: Hype, Reality and the Human Factor

Technology continues to transform how organisations detect and prevent financial crime. Yet despite significant investment in automation, AI and analytics, the panel highlighted that technology is not a silver bullet.

The audience-generated word cloud revealed a split perspective: while many compliance professionals feel excited about technological progress, others remain cautious; concerned that some solutions are overhyped or poorly understood.

A key theme was the importance of trust in technology. Before deploying new tools, firms must ensure they are transparent, explainable and capable of delivering reliable outcomes in real operational environments.

Panellists also emphasised the concept of failure tolerance. Automated systems will inevitably produce errors or unexpected results, particularly when applied to complex financial crime typologies. Organisations therefore need robust safeguards and contingency plans to maintain operational resilience.

Rather than replacing human expertise, technology should act as a force multiplier, enabling investigators and compliance professionals to focus on higher-value analytical work.

Another challenge discussed was the ongoing technology arms race between regulated institutions and organised crime groups. Criminal networks often adopt emerging technologies faster, meaning firms must continuously evolve their controls.

The discussion also highlighted the importance of data sharing and collaboration across the financial crime community, though legal and cultural barriers remain.

Successful financial crime technology strategies require more than just new tools; they require governance, testing frameworks and skilled teams capable of interpreting results.

FINTRAIL supports organisations in evaluating technology solutions, strengthening financial crime operating models, and ensuring technology investments deliver measurable improvements in control effectiveness.

🎤 The Future of Payments and Financial Crime Risk

This session explored how the rapid evolution of global payments is reshaping financial crime risk.

New technologies and business models, including the emergence of agentic commerce, are likely to challenge traditional assumptions about how financial crime compliance frameworks operate.

One of the key questions raised was how regulators and industry will define regulatory perimeters as payment ecosystems evolve. Applying blunt regulatory controls to emerging models could undermine innovation, yet insufficient oversight could expose markets to new risks.

The discussion emphasised that the underlying financial crime threats remain broadly consistent, even as payment technologies change. The critical task for financial institutions is therefore to understand how those risks manifest within new products and platforms.

This makes product-level financial crime risk assessments increasingly important. As payment innovations accelerate, organisations must evaluate risks early in the design and rollout of new services.

Another key theme was the evolving skillset required for anti-financial crime professionals. Just a few years ago, the industry was focused on hiring compliance professionals with coding expertise. Today, the emphasis is shifting toward understanding AI systems, workflows and data-driven investigations.

Yet despite these technological changes, the panel agreed on one enduring truth: human judgement remains irreplaceable. Experienced investigators bring empathy, intuition and contextual understanding that technology alone cannot replicate.

As payment ecosystems evolve, financial crime frameworks must evolve alongside them.

FINTRAIL supports firms with product risk assessments, regulatory strategy and governance design, helping organisations adapt their AFC programmes as new payment models emerge.

---

Looking Ahead: Building a Stronger Anti-Financial Crime Community

FFECON26 once again demonstrated the strength of collaboration across the anti-financial crime community. With 500+ attendees, seven sessions and contributions from experts across industry, technology and policy, the conference sparked valuable conversations about the risks and opportunities shaping the future of financial crime prevention.

Events like FFECON sit within the broader mission of the FinTech FinCrime Exchange (FFE) - a community created to bring together financial institutions, fintechs and industry experts to share insights, improve practices and strengthen the fight against financial crime.

While FFECON is our flagship event, the FFE’s work continues throughout the year through research, collaboration initiatives and knowledge sharing across the financial crime ecosystem.

Both FFECON and the FFE are powered by FINTRAIL, whose team works with financial institutions and fintechs around the world to strengthen their anti-financial crime frameworks. By partnering with organisations to assess risk, enhance controls and build resilient compliance programmes, FINTRAIL helps firms operate confidently, protecting themselves, their customers, and the wider financial system from the impacts of financial crime.

FINTRAIL is now part of the Cosegic group, bringing together deep financial crime expertise with broader regulatory and compliance advisory capabilities to better support firms as they tackle evolving financial crime risks.

If the discussions at FFECON26 reinforced one message, it is this: financial crime is constantly evolving, but so too is the community committed to fighting it.

Cosegic Strengthens Financial Crime Expertise Through FINTRAIL Acquisition

London, 15 January 2026: Cosegic is excited to announce the acquisition of FINTRAIL, a leading specialist financial crime consultancy, strengthening the Group’s financial crime and regulatory risk capabilities. By continuing to invest in specialist expertise, Cosegic enables clients to move beyond regulatory burden and build stronger, more resilient organisations in increasingly complex regulatory environments.

FINTRAIL brings deep expertise in financial crime risk management, regulatory compliance and controls design across banking, payments, fintech and digital assets. The entire FINTRAIL team will join Cosegic, expanding the depth and scale of services available to clients. Together, Cosegic combines specialist expertise, cutting-edge technology and proactive advice across multiple jurisdictions, helping firms strengthen culture, safeguard stakeholders and enhance operational resilience. Because when you rule the rules, you don’t just manage risk - you create the conditions to compete and win.

BEN COOK, GROUP CEO OF COSEGIC

“FINTRAIL has an exceptional specialist team, and bringing them into Cosegic strengthens an already strong financial crime capability. This move makes sense for our clients, gives us an additional edge, and reinforces our commitment to investing in specialist expertise as regulatory expectations continue to rise. This acquisition of FINTRAIL is an exciting step for Cosegic.”

ROBERT EVANS, CEO - CO-FOUNDER OF FINTRAIL

“We are joining Cosegic at an exciting time for both businesses. FINTRAIL was founded to provide practical, high-quality financial crime support to firms facing real regulatory challenges, and becoming part of Cosegic allows us to build on that mission at a greater scale. We are delighted to join an established compliance company that shares our focus on integrity and delivering outcomes that matter to clients.”

NANCY KING, SENIOR MANAGING DIRECTOR, HEAD OF CORPORATE DEVELOPMENT AT COSEGIC

“This acquisition aligns closely with our strategy of building targeted, specialist capability in areas of increasing regulatory focus. FINTRAIL adds deep financial crime expertise to our platform, enhancing our ability to support clients across the full regulatory lifecycle. Getting to know Rob and team has been a privilege, and we can’t wait to get started.”

HENRY ALTY, INVESTMENT DIRECTOR AT MML

“This is the second acquisition completed by Cosegic in as many months. MML is pleased to be working with the Cosegic Management Team to support a national and international buy-and-build strategy, focused on developing a suite of specialist financial services compliance capabilities in key global markets.”

ABOUT COSEGIC.

Cosegic is the Compliance Partner to the world’s most competitive organisations, helping to engineer the culture, controls, and confidence that go beyond compliance to performance. By combining cutting-edge technology with proactive advice across multiple jurisdictions, we enable our clients to enhance both their brand reputation and operational resilience. Cosegic is backed by MML Capital Partners.

ABOUT FINTRAIL.

FINTRAIL is a global consultancy that helps companies manage their exposure to financial crime risk and maintain regulatory compliance.

MEDIA CONTACT.

Kiran Sandhu
Head of Global Marketing, Cosegic
kiran.sandhu@cosegic.com

How MLROs and Sanctions Leaders Should Monitor the Situation in Venezuela

The US capture of Venezuelan President Nicolas Maduro to face drug trafficking charges in New York follows months of intensifying military pressure on Venezuela, including naval blockades and strikes on vessels allegedly linked to drugs trafficking. With President Trump declaring that the US will “run” Venezuela temporarily, the situation on the ground is ever-shifting and certainty is not a guaranteed outcome. 

For MLROs and financial crime compliance teams, these geopolitical developments also bring financial crime and sanctions risks to the forefront: from uncertainty over the future of sanctions, to continued (and even increased) sanctions evasion activity, firms must remain vigilant and plan accordingly.

What is likely to happen with Venezuela sanctions regulations?

The short answer is that nothing has currently changed, and there is still a lot we do not know. The biggest question to be definitively answered includes who will be in charge of Venezuela in the long term. As of Monday January 5th, President Trump has declared his willingness to work with the new Venezuelan leader, former Vice President Delcy Rodriguez; however, warning that “if she doesn’t do what’s right, she is going to pay a very big price, probably bigger than Maduro”. Rodriguez, who first resisted US demands, has since stated that she is ready to “work together” with the US. This might suggest the intention of stability.

However, even if this scenario materialises in the short term, it is unlikely to result in any meaningful or immediate sanctions relief for Venezuela. Sanctions relief is likely to be very gradual, limited to key areas and easily reversible. Even if limited sanctions relief becomes a reality, businesses and banks will remain cautious given the fragility and uncertainty surrounding its longevity.

There remains another scenario in which Trump sours on Rodriguez, or an internal leadership struggle  unfolds  within Venezuela, leaving no one actor in charge. Under these circumstances, sanctions that target the Venezuelan government would be near impossible to navigate with confidence, materially increasing the risk of sanctions evasion activity.

What can I do right now to limit my financial crime and sanctions risk exposure?

This is a wait-and-see scenario. We are still far from a scenario where sanctions relief is forthcoming, and in the face of political uncertainty sanctions evasion - in particular involving Venezuelan oil - will continue and could increase in intensity. 

Firms should use this opportunity to dedicate internal resources to scenario planning and exposure assessment:

Step 1: Understand your exposure to Venezuela and neighbouring countries

Most firms may have limited or no funds flows to and from Venezuela, but may not have taken the time to understand their wider exposure to the country. This includes:

• Identifying beneficial owners of clients that have a nexus to Venezuela.

• Mapping clients operating the oil and gas sector or other sectors with likely sanctions exposure to Venezuela or the country’s state-owned oil and gas company, PDVSA, even if they do not directly transact with Venezuela. Import and export businesses operating in the region are likely to be used for diversion and evasion.

• Determining exposure to specific regions in Colombia and Brazil bordering Venezuela, as well as the island nations of Aruba, Grenada and Trinidad and Tobago, that are located just off the coast of Venezuela. Due diligence on transactions to these countries should be detailed, in particular where they overlap with import/export businesses or the oil and gas industry, or other risk factors are present.

Step 2: Understand sanctions evasion typologies

Venezuela has been subject to wide-ranging US-sanctions for many years and in particular since Trump’s first term starting in 2017, and has developed sophisticated evasion techniques over time. If you are not already familiar with how the country has evaded sanctions in the past, now is the time to revise.

• The role of cryptocurrency: In recent years, the Venezuelan government has leveraged digital assets to facilitate payments into the country, in particular to receive payments for the export of sanctioned oil. The Atlantic Council has reported that since 2024, PDVSA has required new clients to make payments in USDT. Domestically, cryptocurrency adoption among the population has surged amid high inflation.

• China and oil exports: The main destination for Venezuelan oil is China and recent sanctions designations have shown that. For example, as recently as December 31, 2025, OFAC designated a number of companies in China who either owned or operated vessels involved in the transportation of Venezuelan oil.

• Drugs trafficking networks possibly utilising state agencies: Maduro’s arrest follows the US decision in November to designate Cartel de los Soles as a Foreign Terrorist Organization. The US has stated that the cartel has made use of Venezuela’s state apparatuses - including its military -  to move drugs to the United States and Europe.

Step 3: Plan for all outcomes and know your controls

Scenario planning is about speculating what would happen if financial flows to and from Venezuela becomes further restricted by sanctions and how this may spur further evasion of sanctions, as well as planning for possible sanctions relief. Ensure you have robust transaction monitoring and sanctions screening capabilities in place if pressure increases, and policies and procedures to manage any changes in US sanctions policy towards Venezuela.

For example:

• Are you adequately detecting all data points on customers that could indicate sanctions evasion, e.g. IP addresses, physical addresses, website domains, emails, etc?

• Do you have adequate IP detection and blocking in place to limit access from Venezuela if needed?

• Have you deployed keyword screening for sanctions-relevant or geographical terms in payment messages?

• Do you have proper escalation procedures to detect and deal with likely grey areas of sanctions compliance, as sanctions regulations will begin to shift?

• Do you have a clear view on your firm’s risk appetite to Venezuela going forward?

In summary, the message for MLROs and sanctions leaders is clear: Keep calm, but do not carry on as normal. While sanctions relief may remain a distant and fragile possibility for now, evasion is an active and ongoing threat involving cryptocurrency, and sophisticated sanctions evasion networks. And in the short term, as instability in Venezuela rises, further financial crime and sanctions risks will emerge.

Your firm’s best response to the unfolding Venezuela crisis is not to wait, but to  assess your exposure and where relevant, dedicate resources to further scenario planning and bolstering your transaction monitoring and sanctions screening controls. Most importantly: keep reading the news as things are far from settled.

Emil Dall
Principal Consultant - Head of Sanctions

---

Strengthening Customer Due Diligence and Enhanced Due Diligence Requirements

HM Treasury published a draft statutory instrument (SI) on 2 September 2025 that proposes targeted amendments to the UK Money Laundering Regulations (the MLRs). The draft SI and accompanying policy note are pitched at making the regime more risk-based and proportionate while closing some identified gaps from market participants. The technical consultation closed on 30 September 2025 and subject to feedback and Parliamentary scheduling, the final instrument is expected to be published in early 2026 and will come into force 21 days after. This blog post focuses on the proposed changes under the MLRs specific to customer due diligence (CDD) and enhanced due diligence (EDD) requirements.

Summary of Current Requirements under the MLRs

In order to understand the proposed changes, it’s useful to recap the baseline framework under the existing MLRs:

• Customer Due Diligence (CDD) Triggers: Under Regulation 27, firms must carry out CDD when establishing a business relationship or undertaking a relevant transaction. 

• Verification and “Acting on Behalf of”: Under Regulation 28, firms must identify and verify the customer, beneficial owner(s), and anyone acting on behalf of the customer. Where someone acts on behalf of the customer, firms must understand that person’s authority and verify their identity.

• Source of Funds / Source of Wealth Checks: Regulation 28 allows (but does not always require) source of funds checks as part of ongoing monitoring where “necessary”. Regulation 33 requires firms to obtain source of fund and source of wealth information on the customer or beneficial owner in higher risk situations. 

• EDD: EDD is mandated in higher-risk situations. Under current rules, firms must apply enhanced CDD under Regulation 33 in business relationships or transactions involving parties in High Risk Third Countries (HRTC)*. The MLRs currently require regulated businesses to carry out EDD on any customer established in, or in relation to any relevant transaction where either of the parties to the transaction is established in, a HRTC.

• Ongoing Monitoring & Review: Under Regulation 28, firms must monitor transactions and review the CDD information over time. Where circumstances change or new risks emerge, additional checks or re-verification may be required.

* The MLRs definition of an HRTC refers to two lists: the FATF’s ‘Increased Monitoring’ List (IML) of countries whose AML/CTF regimes have been found to be deficient after FATF assessment; and the list of countries subject to a ‘Call for Action’, i.e., those with the most serious strategic deficiencies.

Market Sentiment

CDD plays a pivotal role in the UK’s anti-money laundering and counter-terrorist financing (AML/CTF) framework. For regulated firms, CDD is the backbone of their AML/CTF framework as effective CDD allows firms to understand their customers and establish a standard for normal behaviour as well as use this as a benchmark to detect suspicious activity and provide essential intelligence for law enforcement through Suspicious Activity Reports (SARs). 

The Consultation indicated that many market participants perceive certain CDD and EDD requirements as ambiguous or lacking clear purpose, with some respondents reporting that the current requirements were not as effective as they could be in identifying money laundering or terrorist financing. Specific pain points were around the trigger points for CDD for non-financial firms, the requirements in cases where a third party is acting on behalf of a customer, and source of funds checks as part of ongoing monitoring. 

Below highlights the key themes stemming from the Consultation as well as the proposed changes and Government response on how it intends to sharpen and clarify the CDD/EDD regime. Here are the most salient proposals for financial services firms to watch.

Customer due diligence

Theme	Market sentiment	Proposed changes
CDD for non financial firms	The Consultation revealed that there was some confusion due to the nature of some firms' businesses (such as art market participants) on what constitutes ‘establishing a business relationship’ where a business relationship looks different for those that may be making one off transactions.	The Government plans to make minor changes to the MLRs to clarify the situation in respect of art market participants and letting agents. HM Treasury will align the transaction-based CDD triggers for these sectors in Regulation 27 (for example the requirement for art market participants to apply CDD to any relevant transaction whose value amounts to 10,000 euros or more) with the equivalent provision for high value dealers. This will clarify that CDD should be done for inscope transactions forming part of the establishment of a new business relationship or as an occasional transaction.
Source of fund checks for ongoing monitoring	Feedback from respondents revealed that there should be more guidance to clarify the phrase ‘where necessary’. The MLRs require that as part of ongoing monitoring of business relationships, regulated businesses should review transactions, including, ”where necessary”, the source of a customer’s funds, to ensure the transactions are consistent with their understanding of the customer, their business, and overall risk profile.	The MLRs will not be changed to preserve the flexibility of the regulations, but the Government will work with supervisors and industry bodies to refine guidance so that source of fund checks are required only where transactions appear inconsistent with the customer profile. This should reduce over-application of source of funds when it adds little value, but places more burden on firms to justify when checks are not necessary.
Verifying whether someone is acting on behalf of a customer	The Consultation highlighted that there was some confusion around when CDD is required on employees, when acting for the companies which employ them and whether these count as ‘acting on behalf of’ and should therefore be subject to CDD.	There will be no changes to the MLRs, however, the HM Treasury clarifies that the ‘acting on behalf of’ provision was intended to apply to entities acting on behalf of individuals (for example when the individual has granted power of attorney to another individual or organisation) or to third parties acting on behalf of an organisation (for example when an agent or intermediary acts for a company). Employees or staff of an organisation acting on its own behalf (for example a member of staff transacting using a company credit card) should be considered to be acting as the organisation, and are not subject to the obligations in Regulation 28(10). HM Treasury will therefore ask supervisors and other guidance authors to review the guidance to ensure regulated firms are clear on their obligations so as to address the risk of over-compliance with the Regulations.
Digital identity	The Consultation revealed that many firms are already using digital identity when it comes to their CDD processes. However, there is a need to clarify how digital identities can be used to meet MLRs requirements.	There will be no changes to the MLRs. Instead, much of the refining will come via enhanced guidance from supervisors and industry bodies such as the Department for Science, Innovation and Technology (DSIT) and HM Treasury who will jointly produce guidance on using digital identities for MLRs identity verification checks.

Enhanced due diligence 

It is a regulatory requirement for EDD to be performed in instances where higher money laundering/terrorist financing is identified. There are, however, certain instances where EDD is specifically mandated by the MLRs, such as when a customer or transaction is linked to a high risk third country. Below highlights the proposed changes to the MLRs to provide more guidance on in what scenarios EDD should be applied.

Theme	Market sentiment	Proposed changes
Complex or unusually large transactions	Some respondents felt that the requirement to apply EDD on transactions which are “complex or unusually large” was disproportionate to the ML/TF risks and results in EDD being undertaken in low-risk scenarios.	HM Treasury will amend the MLRs to clarify that EDD is required on “unusually complex” transactions, instead of all complex transactions. The requirement for EDD on unusually large transactions will remain unchanged, since responses indicated this remains proportionate and useful in identifying suspicious activity.
High risk third countries	General sentiment was that the mandatory EDD requirements for customers and transactions linked to countries listed by the FATF often did not reflect illicit finance risk to the UK specifically. Respondents agreed that being linked to a jurisdiction listed by the FATF did not automatically make a customer high risk, and advocated for a more targeted approach based on knowledge of the specific customer or business and focused on the countries presenting the biggest illicit finance risks to the UK. For example, in the latest UK National Risk Assessment there were reference to jurisdictions that pose an illicit finance and organised crime risk to the UK such as Albania, China, Russia, the UAE, Nigeria, Ghana, India and South East Asia (Cambodia, Laos, and Myanmar) which could be considered in firms country risk assessments instead.	The MLRs will be amended so that mandatory EDD applies only to parties established in a “Call for Action” jurisdiction (i.e. those with severe FATF deficiencies), rather than all jurisdictions on the “Increased Monitoring” list. This narrows the set of jurisdictions for mandatory EDD, giving firms more discretion to apply their own country risk assessment specific to their customer, product, transactions and geographic exposure or the jurisdictions which pose the greatest risk to the UK which are not mentioned in the FATF lists.

---

The new rules for Pooled Client Accounts: Staying ahead of MLR changes

Pooled Client Accounts (PCAs) are bank accounts used by businesses which need to hold funds which belong to their clients. They are sometimes used as a mechanism to protect client funds in the event that the firm servicing the client becomes insolvent. In some cases, they are mandated by regulators (e.g. the Client Asset Sourcebook (CASS) rules applicable to investment businesses, safeguarding for non-bank Payment Service Providers (PSPs), the Solicitors Regulation Authority (SRA) Account Rules for solicitors, and the Client Money Protection (CMP) rules applicable to letting agents).

What do we actually mean by a ‘pooled account’?

At the simplest level a ‘pooled account’ is an account into which monies are pooled. More specifically:

• The bank’s customer operates a business which ordinarily involves the handling of client funds;

• The bank’s customer may be subject to regulatory requirements regarding the holding of client funds in designated accounts;

• The bank has no contractual relationship with the clients of the customer;

• The pooled account is controlled by the customer firm, not the owners of the funds, or the bank (meaning that the clients of the bank’s customer cannot instruct the bank as to the use of the funds).

• Client funds are commingled, rather than being separately identifiable (which is why it is important that the customer maintains accurate and up-to-date written records with respect to movement of funds into and out of a PCA).

Do pooled accounts pose a money laundering risk?

The risks relating to pooled accounts stem from potential mis-use by the customer’s client, whether the customer is unaware or complicit (willingly, or under duress). The latest UK National Risk Assessment (NRA), noted that “client accounts continue to be assessed as high risk as they can be misused by criminals to both move illicit funds and provide a veil of legitimacy to the proceeds of crime. Criminals can use client accounts as a way of moving money from one individual or entity to another through a trusted third party (e.g. a Legal Service Provider (LSP)) under the guise of a legitimate transaction. They are also attractive to criminals as their use can contribute to true transferee and beneficiary being shielded, reducing transparency and assisting with obfuscating the source of funds.”

In addition to the potential mis-use, the banks which provide pooled accounts have inherently lower visibility over client transactions through the account, compared to separate, named accounts for each individual client. As PCAs are controlled by the customer, a bank does not know to which underlying client a particular transaction relates. This knowledge limitation can reduce a bank’s ability to effectively monitor transactions through PCAs. This can be heightened where, for example, the firm holding the account is unwilling or unable to disclose client information (e.g. confidentiality, legal and professional privilege).

The JMLSG Guidance (Part 1, Annex 4-II) highlights pooled accounts as an example of a product or service where there may be lesser transparency.

Banks providing pooled accounts have to carefully consider whether the setup is manageable within their respective risk appetites and from a commercial perspective. There have been reports that some firms who depend on a pooled client account to operate within the bounds of their regulatory requirements faced the closure of these accounts by their banks. Through the June 2022 review of the UK’s AML/CFT regulatory and supervisory regime, the UK Government indicated its intent to consult on options aimed at addressing difficulties with accessing PCAs.  HM Treasury’s February 2024 consultation on improving the effectiveness of the Money Laundering Regulations presented various access improvement options. The Government response to the consultation included a proposal to remove the link between PCAs and simplified due diligence (SDD) in the MLRs and include new requirements regarding PCAs in the MLRs.

The current position

Currently, MLR 2017 Reg 37 permits a bank to apply simplified due diligence (SDD) where: 

• the customer is subject to the MLRs (or equivalent); 

• the account is a pooled account; 

• the business relationship is assessed as low ML/TF risk; and

• the identities of the underlying clients who have a claim on the funds are available upon request. This is reflected in JMLSG Guidance Part 1 Para 5.3.142.

JMLSG Guidance, Part 1, Annex 5-V provides guidance on the management of pooled accounts by banks. In summary:

• Establish and document the purpose of the PCA (e.g. types of underlying clients, volume of funds to be deposited, volume, value and frequency of transactions, exposure to higher risk industries and countries).

• Assess the risk presented by the PCA and factor that into the broader customer risk assessment.

• Assess the steps taken by the customer to apply due diligence to its clients (e.g. review of audit reports, attestation by the customer, and/or review the customer’s due diligence procedures).

• Establish a written agreement with the customer, under which the customer is obliged to provide the identity information of the underlying clients, upon request, within an agreed timeframe.

Where the relationship with the firm holding the PCA is deemed to present greater risk, additional steps should be taken, such as:

• Entering into a reliance agreement or otherwise verify the identities of the owners of the funds in the PCA;

• Applying enhanced ongoing monitoring to the PCA;

• Restricting the usage of the PCA (e.g. by reference to the type of client whose funds the customer may place in the account).

The proposed position

On 2 September 2025, the Government published draft amending regulations (The Money Laundering and Terrorist Financing (Amendment and Miscellaneous Provision) Regulations 2025) and an accompanying policy note. The policy note explains that the policy intent is to increase the supply and accessibility of PCAs for businesses with a legitimate need, while maintaining robust risk-based controls.

Under the amended MLRs, banks operating PCAs will have to: 

• Take reasonable measures to understand the purpose of the pooled account and how the customer proposes to use it.

• Satisfy themselves that the purpose and proposed use of the pooled account is consistent with the customer’s business.

• Assess the level of ML/TF risk associated with the customer using the PCA.

• Take reasonable steps to manage and mitigate the risk arising from the customer’s use of a PCA.

Customers holding pooled accounts will be obliged to:

• Make client identity information available to the bank, upon request.

• Maintain accurate and up-to-date written records of all the monies that are paid in and out of the pooled account for a period of five years from the completion of a transaction

• Provide, upon request, information about itself and its management of the PCA to the bank or a law enforcement authority.

Are virtual IBANs pooled accounts?

A virtual IBAN (vIBAN) enables multiple end users to utilize a single IBAN, whilst ensuring that the payment transactions are linked to each user. A vIBAN is effectively a unique identifier which is linked to an underlying IBAN (often referred to as a ‘master account’). The underlying IBAN can be opened either in the name of the end user of the vIBAN, or, in the name of another entity which then allocates the virtual IBANs to its customers (the end users). Incoming payments addressed to the vIBAN are credited to the underlying master account. Outgoing payments initiated by the end user of the vIBAN are debited from the underlying master account.

Concern has been expressed in some quarters that the proposed MLR amendments regarding pooled accounts could impact on the provision of virtual IBANs to Electronic Money Institutions (EMIs) and Payment Institutions (PIs). The latest UK NRA noted that virtual IBANs have some similarities with pooled accounts, in that fund transfers between virtual IBANs can be executed as ledger adjustments, without a transaction moving between separately addressable accounts. The underlying account issuer has a high degree of dependence on the controls operated by its customer, just as with pooled accounts.

However, there are also key differentiators:

• Virtual IBANs are typically offered as a product type to facilitate the execution of payments, including cross-border transactions. Whereas pooled accounts have a climate money protection objective.

• The customer for a virtual account will typically be a non-bank PSP, subject to authorisation and supervision by a domestic regulator. Whereas, the customer for a pooled account could be outside of financial services (for example, a law firm or lettering agent), or possibly even unregulated (e.g. care homes, property management agents).

• In a virtual IBAN model, the end user (which could be a customer of an EMI or PI) has control over the funds, whereas, in a pooled account situation, only the firm holding the account would have control.

As such, it can be reasonably argued that virtual IBAN models are not ‘pooled accounts’. Whilst there is some read across between pooled accounts and virtual IBANs, it is not anticipated that the MLR amendments regarding pooled accounts will materially impact virtual IBAN offerings.

What will actually change?

Whilst the de-coupling of PCAs and SDD might broaden the range of customers to whom banks consider themselves able to offer PCAs, this does not necessarily mean that obtaining and maintaining a PCA will become any easier for such businesses, as the banks will need to demonstrate the appropriateness of their risk assessment, due diligence and risk mitigation. Businesses wishing to obtain and maintain pooled client accounts will need to be prepared to evidence the robustness of their own client due diligence, fund handling and record keeping measures, and be prepared to commit to providing client identity information, upon demand. The amendments to the MLRs express that disclosures to achieve this do not amount to a breach of other disclosure restrictions (e.g. confidentiality, professional privilege). Firms will be required to move from simplified due diligence for a relatively narrow range of businesses to risk-based due diligence and monitoring for a broader range of businesses.

Read next: Money Laundering and Terrorist Financing Regulations Updates: Next Steps for Firms

---