The main thing this week: stablecoins.

Last week, the Fed proposed its first rules for bank-issued stablecoins under the GENIUS Act. Then, yesterday, a Senate subcommittee dropped a report detailing how Iranian oil smugglers and militant groups rely on Tether’s stablecoin to bypass U.S. sanctions. (Tether said it supported freezing about $550 million in cooperation with U.S. law enforcement)

AI agentic commerce is here and big banks want to establish principles that will govern how that works. In Italy, AI fraud also hit a bank, when criminals impersonated a bank lawyer using what investigators believe was a deepfake voice clone.

This week we’ll be looking out for Fed Governor Christopher Waller's remarks on payments infrastructure at the Sibos conference, the Bureau of Economic Analysis's annual benchmark revisions to gross domestic product on Wednesday, and the September employment report on Friday.

Federal Reserve opens GENIUS Act stablecoin rulemaking as banking trades demand non-bank scrutiny

Last week, the Fed Board proposed its first set of rules that would put the GENIUS Act’s framework into practice. One rule sets operating requirements, while the other explains how the Fed would assess applications, including banks’ business plans and finances.

Issuers would have to fully back their stablecoins with approved assets, such as cash and short-term Treasury bills, and hold capital to absorb certain losses. The proposed rules also cover risk management and the safekeeping of assets backing the coins.

Fed governor Michael Barr supported released the proposals for public comment but said more work was needed before stablecoins could be reliable payment instruments. Barr called for feedback on protection against interest-rate and currency risks and clearer rights for holders to get their money back. He also questioned a provision that would prevent the Fed from taking supervisory or enforcement action over money-laundering deficiencies unless they were “significant or systemic.”

The GENIUS Act is moving quickly and traditional banks aren’t enthralled. In July, the OCC proposed application and registration forms asking prospective stablecoin issuers for business plans, reserve and repayment policies, and information about management and risk controls.

On Friday, the Bank Policy Institute, American Bankers Association and two other banking groups urged the OCC to let the public weigh in on applications to issue stablecoins. They also called for closer checks on applicants that aren’t owned by insured banks, including how they manage risk, protect against cyberattacks and recover from disruptions.

Senate investigation details how Iranian groups use stablecoins

A report released Monday by Sen. Richard Blumenthal (D., Conn.) identified Tether’s USDT stablecoin as the primary cryptocurrency used in Iran’s shadow banking system.

Subcommittee investigators traced more than $603 million in USDT moved by two sanctioned Iranian oil smugglers between 2021 and 2025 through a network connected to Hezbollah, the Houthis and Iranian financial institutions.

Tether said it has supported freezing approximately $550 million in Iran-linked USDT in 2026 across global law enforcement requests and argued that public blockchain transparency provides superior tracing compared to cash.

The Senate findings followed the seizure of $84 million across bank accounts held by Montana-based payment processor Capstone. Prosecutors allege Capstone moved money for Tether and crypto exchange Bitfinex without the required license, using a bank in Dominica.

Leave a comment

Kansas Fed study shows B2B ACH transaction volume outpaces checks

A research briefing published by the Federal Reserve Bank of Kansas City shows that ACH has overtaken paper checks as the primary volume rail for B2B transactions. It also shows that paper checks continue to clear a massive corporate dollar value despite wide adoption of the ACH method.

A survey from the Association for Financial Professionals had 87% of respondents saying they still write paper checks for vendor disbursements. The persistence of checks across businesses indicates that corporate migration to electronic clearing remains slowed by manual invoice reconciliation, vendor onboarding friction, and disparate accounting software.

Fees could also explain why checks are still here. Card fees typically charge the recipient a percentage of the payment, making large invoices expensive to accept. ACH bank transfers generally carry a flat per-transaction fee and cost less than checks, making them a close substitute, the briefing said.

Bank of America and five other global banks propose governance principles for AI agentic commerce

A consortium of six commercial banks—Bank of America, Capital One, NatWest Group, ING Group, Commonwealth Bank of Australia, and New Zealand’s ASB Bank—published a set of principles for consumer AI agentic commerce.

The banks define five baseline principles: transparency, safety, privacy, choice, and interoperability. They said these can establish common guardrails around agent identification, user delegation, transaction audit trails, and multi-party liability.

Subscribe now

The principles touch on mechanisms already appearing in the market, like “intent mandates” and identifying the merchant of record. The paper follows the deployment of agentic commerce protocols, such as Google’s Agent Payments Protocol and an open-source standard from Stripe and OpenAI.

The bank consortium announced plans to detail protocol implementations, industry standards, and policy mechanisms in a subsequent paper, inviting tech developers, payment networks, merchants, and regulators to collaborate on shared standards.

Italian private bank hit by €95 million AI voice-clone executive impersonation fraud

Fraudsters used AI voice clones to steal €95 million (about $108 million) from Fideuram, the private banking arm of Italy’s largest lender, Intesa Sanpaolo.

The scheme began in February when Fideuram’s then-chairman, Paolo Molesini, received a WhatsApp message purporting to be from Intesa CEO Carlo Messina. It requested urgent help with an overseas deal that supposedly needed to go through Fideuram’s treasury.

The scammers followed up with a call appearing to confirm the request. Investigators believe they used AI to clone the voice of Paolo Nastasi, the head of law firm A&O Shearman’s Italian operation. Molesini then told his staff to wire money to accounts mainly in China and Hong Kong.

Authorities in Italy, China and Portugal helped recover much of the money, but about €36 million remains missing. They said the remaining funds had passed through overseas accounts and been converted into cryptocurrencies. Milan prosecutors are investigating a suspect living outside Europe for computer fraud.

Last week, Treasury Secretary Scott Bessent previewed changes to half-century-old anti-money laundering thresholds and crypto legislation stalled in the Senate.

This week, the House Financial Services Committee will hold hearings on prudential regulators and the future of central banking.

In enforcement news, a former bank chief executive was sentenced to prison, while payments management firm Corpay agreed to a $100 million settlement over small-business fuel-card fees.

Treasury considers higher AML thresholds

Bessent told lawmakers last week that the Treasury is drafting revisions to the $10,000 anti-money laundering reporting threshold. He said the draft would give banks more flexibility based on how long they have known a customer, while keeping attention on criminal financing.

The move follows years of criticism from banks and credit unions, which say compliance officers file millions of reports to avoid examiner penalties even when the information has little investigative value. FinCEN’s filing data shows that annual suspicious activity reports rose from 1.66 million in 2014 to 3.80 million in 2024, while currency transaction reports exceeded 20 million annually in recent fiscal years.

The proposal isn’t final, and Bessent did not give a timetable.

The current $10,000 threshold for Currency Transaction Reports was established by regulation under the Bank Secrecy Act in 1972 and has never been adjusted for inflation. If it were, that threshold would now exceed $70,000.

Treasury can change the currency-reporting threshold through rulemaking, but broader changes to suspicious-activity reporting would face different legal and supervisory constraints.

The Defense Credit Union Council and the Independent Community Bankers of America pressed Treasury to raise the cash threshold to at least $30,000 and index it to inflation every five years.

What else we’re following

The Senate blocked the CLARITY Act

The Senate voted against opening debate on the Digital Asset Market Clarity Act, falling short of the 60 votes required to proceed. The bipartisan bill was intended to establish federal market rules by dividing oversight between the Commodity Futures Trading Commission and the Securities and Exchange Commission. The crypto industry backed the measure to secure clear statutory boundaries, while Democratic lawmakers raised concerns over ethics rules for government officials.

The American Bankers Association and the Bank Policy Institute argued that allowing nonbank stablecoin issuers to pay interest would drain deposits from community lenders and undermine the commercial banking system. The procedural defeat leaves digital-asset firms operating under existing securities and commodities laws, without the clearer SEC and CFTC boundaries the bill sought to establish.

Leave a comment

BPI challenges ZeroHash’s revised national trust-bank application

The Bank Policy Institute asked the OCC to reject a renewed charter application from crypto firm ZeroHash. The agency had returned the first application without publicly explaining why. Firms like ZeroHash are looking for national trust-bank charters that place their operations under federal banking supervision without requiring FDIC deposit insurance or subjecting their parent companies to commercial bank holding rules.

Last week, BPI said in a comment letter that ZeroHash’s August revised application simply added the word “fiduciary” to its activities without changing how its settlement, clearing, and escrow services actually operate. The trade group contends that standard commercial crypto processing does not meet the legal definition of trust activities, and warned that approving the charter would give digital-asset firms federal preemption without standard bank safety nets.

BPI has also opposed applications from Ripple, Circle, Paxos, Coinbase, and Kraken’s Payward.

Corpay resolves FTC action over fuel-card fees for $100 million

Corpay, formerly FleetCor Technologies, and its chief executive agreed to pay $100 million to resolve a Federal Trade Commission lawsuit over hidden charges on commercial fuel cards sold to small businesses. The FTC alleged that the company advertised per-gallon fuel savings and promised that customers would pay no setup or membership fees, but later added unexpected program charges, minimum-usage fees, and late penalties that erased the promised discounts.

The order concludes litigation filed in 2019. A federal district court granted summary judgment against FleetCor in 2022, finding its fee disclosures deceptive, and a federal appeals court upheld that finding earlier this year. The $100 million will go toward customer restitution.

Former bank chief executive sentenced over wire fraud

Yesterday, a federal court sentenced Tomás Niembro Concha, former chief executive of Puerto Rico-based Nodus International Bank, to more than nine years in prison for his role in a wire-fraud conspiracy that siphoned at least $24.9 million from the institution and led to its liquidation in 2023.

Court filings show Niembro and his partners concealed that bank investments and loans went to companies they controlled, while separately conspiring to evade U.S. sanctions involving a designated Venezuelan national. The court also ordered Niembro to forfeit more than $16.9 million.

It’s a complex set of transactions that are now being investigated for potential fraud. Middesk has Secretary of State records and UCC filings, so we looked at millions of records to try and break it down for you.

Guggenheim Partners co-founder and CEO Mark Walter had owned the Lakers for barely a year when Joshua Kushner and former Disney chief Bob Iger made him a $12.5 billion unsolicited offer for the team.

Walter accepted within 72 hours.

The sale came as federal prosecutors and the Securities and Exchange Commission investigate whether Walter’s private-credit financing operations were fraudulent. Parts of his empire—which includes the Dodgers—appear to have been built through private-credit deals between two insurers he controlled and other companies he owned.

In June, Walter-controlled insurers Delaware Life and Clear Spring Life said a subpoena-sparked internal review found classification errors affecting about $16 billion in private-credit investments.

Some of those deals were structured through layers of entities tied to Walter or his holding company. Insurers must disclose affiliated investments to regulators mainly to protect the assets needed to pay policyholders.

Last week, two banks paused distribution of products tied to Delaware Life. TWG said it was working to resolve regulatory concerns and that there has been no fraud.

The gaps in Walter’s ownership disclosures

In its June corrective filing, Delaware Life’s ownership chart listed 365 companies under Walter, stacked as deep as 12 layers. The insurer had originally said in 2024 that Walter owned only about a third of those.

The names change from deal to deal, but the setup is often the same: Walter’s insurers put money into newly formed companies through firms that manage or arrange the investments.

Walter’s insurers did not always report those relationships consistently, a Middesk analysis found. Delaware Life named Private Debt Investors Feeder as an affiliate in 2024 but it failed to do the same for $412 million of bonds issued by one of the firm’s subsidiaries. Only this summer did the insurer put the bond issuer beneath the Feeder in Walter’s ownership chart.

That inconsistency is present across the insurers’ broader portfolios and those of the two other firms that Guggenheim Partners acquired between 2009 and 2011: EquiTrust Life and Security Benefit. Matching ownership charts against bond schedules and UCC filings, which record a lender’s claim on a borrower’s assets, revealed a financing system that moved billions of dollars through purpose-built entities for more than a decade.

Companies the insurers identified as affiliates tended to share three traits: they used an insurer’s or arranger’s address, had invented financial names and were often only weeks old when the insurers filed liens against them.

Middesk searched the insurers’ remaining 3,500 borrowers for the same pattern and found 9% had it. Most were reported as unaffiliated, although other records tied 135 of them to the wider insurer group.

About 5% of Delaware businesses with liens were both newly formed and abstractly named. Walter’s insurers financed companies matching those traits 18.6% of the time, at least twice the rate of the three other insurers analyzed.

How the network helped finance Bumble

In late 2025, Delaware Life’s third-largest holding in any single issuer was $438 million of bonds from a company we’ll call the CLO. The insurer reported the money as lent to an outside firm. In June, its ownership chart placed the CLO under a company Walter controls.

In April, Bumble needed to refinance a loan and it borrowed $475 million from 28 lenders. Almost half of them were vehicles managed by Walter’s Guggenheim and together they put up about $262 million. Among those 13 Guggenheim-managed companies, there was the CLO and a company we’ll call Bridge.

Bridge put up $73.5 million, the largest commitment of the thirteen. On paper it signed the loan the same way the CLO did, with Guggenheim as its manager.

Bridge was registered in Delaware on one day alongside three siblings with almost the same name. One of those siblings borrowed money with Delaware Life acting as the lenders’ agent. So did the CLO’s own sister companies. None of the other nine Guggenheim vehicles on the Bumble loan has ever borrowed from the insurer that way. EquiTrust, the former Guggenheim-network insurer, has also committed $250 million to that Bridge sibling.

Four offices at the center of the transactions

Prosecutors have narrowed in on four firms: ABS Capital, Bradford Allen, Hudson Trading and Amistad Financial, according to The Wall Street Journal. Delaware Life and Clear Spring filings list investments of $1.27 billion in companies carrying the four firms’ names, and the insurers reported all of them as unaffiliated.

The transactions involving those firms stand out for how quickly liens followed registration. Across the roughly 3,500 businesses that have borrowed from Walter’s insurers, the typical one had been in existence a little over three years when the first lien was filed against it. At Bradford Allen’s address the gap is 23 days. At Hudson Trading’s, it’s under two weeks.

Some 26 companies borrowing from Walter’s insurers used Bradford Allen’s address as their own. They’re all named after Chicago streets. In late 2025, Walter’s two insurers held $1.30 billion of their debt, all of it reported as money lent to unaffiliated companies.

More than 15 companies borrowing $1.19 billion from Walter’s insurers used Hudson Trading’s office in their lien filings. In one case, three of the borrowers were registered on the same day and Clear Spring recorded lending them money within 11 days. Another 25 companies that borrowed $1.58 billion from Walter’s insurers listed ABS Capital’s Miami office as their own. ABS was founded by two former Guggenheim executives.

In 2023, Delaware Life filed a lien against a company called Amistad Debt Warehouse 1, registered 15 days earlier, and recorded buying $69.4 million of its notes the same day. Clear Spring bought $43.4 million of the same notes that day. Both insurers reported the purchase as unaffiliated. Amistad Financial is one of the four firms prosecutors are examining.

In January, just before the insurers were subpoenaed, six companies were registered using tree names: Cherry Wood, Elm, Pine, Birch, Walnut and Willow Avenue Capital. They all had Bradford Allen’s address. Delaware Life bought $380 million of their notes in five days and reported all six as affiliated in its 2026 quarterly filings.

The insurers filed liens against 27 batches of three or more Delaware companies registered on the same day. Each company had a financial name and one of the carriers filed a lien on it within 90 days.

A decade-old pattern

In February 2014, two policyholders filed a proposed class action against Guggenheim Partners, Security Benefit Life, Guggenheim Life (now Clear Spring) and EquiTrust Life. They alleged that the insurers had invested $914 million in nine newly formed Delaware companies while reporting the investments as unaffiliated. The complaint said that more than $1.2 billion in insurer money helped finance the Dodgers purchase.

The plaintiffs voluntarily dismissed the lawsuit the next day. Delaware corporate records confirm a narrower set of facts: the nine companies existed, were registered in two same-day batches through the same commercial filing agent, and six later used Guggenheim’s Chicago headquarters as their mailing address.

The complaint raised concerns about the same mechanics now visible in the insurers’ filings: newly formed companies, insurer money moving through them and affiliation labels that changed or conflicted across records.

On to the important stuff.

It’s been a pretty, pretty, pretty big week for crypto and fintech. But more on the sort of quiet, regulatory side. It was a gears-in-motion, wheels-turning sort of week.

So much has happened that I thought it would be a good time to take a look at how we got here. How, all of a sudden, fintech and crypto companies seem to be gaining access to parts of the banking system once reserved for banks…

This week marked the end of the 90 days the Trump administration gave federal regulators to make life easier for fintech and crypto companies.

Did they? Let’s look at what else happened this week.

• Monday: The Treasury Department proposed rules defining which companies need a license to issue stablecoins in the U.S.

• Tuesday: The Securities and Exchange Commission proposed new exemptions that would let crypto issuers to raise up to $75 million from investors with audited financial statements and ongoing reports.

• Wednesday: OCC Comptroller Jonathan V. Gould said 23 of the OCC’s 40 recent charter applications involve digital assets and promised a final GENIUS Act rule by November.

Fintech and crypto companies want independence from banks as gatekeepers. They currently route money through sponsor banks whose hours, pricing, and risk tolerance they don’t control. Some rules also change depending on the state. The new federal options promise one national rulebook and, for some firms, a way around banks as required middlemen.

Things are moving quickly, maybe even too quickly for some… at least for banks. Regulators now have three months to begin acting on their reviews. The Federal Reserve has another month to say whether fintech and crypto firms should get more direct access to the central bank’s payment system.

“Stablecoins’ path to regulation and integration is already under way,” said Blockchain Association chief executive Summer Mersinger, in a June Wall Street Journal letter to the editor under the headline “Stablecoins Aren’t Wildcat Notes.”

How the OCC opened national trust charters to crypto firms

The cascading moves trace back to last year’s GENIUS Act, the stablecoin law pushing crypto firms toward federal charters under a national framework. Since December, the Office of the Comptroller of the Currency has conditionally approved nine national trust charters for crypto companies, giving them a federal license to hold and manage assets without becoming banks.

The American Bankers Association questioned the move and called the shift an opening for “regulatory arbitrage.” The Bank Policy Institute had previously warned that applicants would get to run bank-like operations without the scrutiny that comes with deposit insurance or consolidated supervision.

In February, the OCC rewrote its own rule for what these trust charters are allowed to cover. The old wording limited them to “fiduciary activities,” or managing someone else’s money or assets on their behalf. The new wording allows non-fiduciary work connected to trust-company operations. The OCC said that was always true, just unclear before.

The Conference of State Bank Supervisors said the rule gave the OCC “unfettered discretion” to decide case by case what each trust bank can do. The Independent Community Bankers of America said that the OCC’s conditional approval of Coinbase’s application was a “grave mistake,” and argued that nonbanks were seeking the benefits of a federal bank charter without the regulations banks face.

Last month, stablecoin issuer Circle became the first of that group to win final approval on July 10. Circle CEO Jeremy Allaire said it was a “defining step in bringing blockchain technology and digital assets into the core of the U.S. financial system.”

Last week, the OCC gave preliminary conditional approval to a trust charter for World Liberty Trust Company, the crypto venture linked to the Trump family, to issue its USD1 stablecoin.

Payments fintechs want direct access

The Fed had been studying a stripped-down account for nonbank firms since October, when Fed Governor Christopher Waller floated the idea of a prototype to give basic Federal Reserve payment services to certain institutions. In March, the Kansas City Fed granted a limited-purpose account to crypto exchange Kraken, with an initial term of one year—the first such access to the Fed’s core payment system.

“We’re trying to learn,” said Fed vice chair Michelle Bowman.

In May, the Fed proposed a version of the pilot account as a standing option for other firms. It would have no interest, no overdrafts, no discount-window borrowing, no FedACH access, and overnight balances generally capped at $1 billion.

Subscribe now

In response to the Fed’s proposal, the Financial Technology Association said that cutting out FedACH, the network used for direct deposits and transfers, “substantially limits the utility of the payment account.” Community banks warned that opening the space for non-traditional firms would divert deposits and payment activity away from community banks that support local economic development.

BPI, the ABA and Clearing House jointly asked the Fed to hold new entrants to the same anti-money-laundering standards as insured banks and to block any path from a payment account to a full master account.

Fed governor Michael Barr, the dissenting voice, said it lacked sufficiently specific and robust safeguards against money laundering by firms the Fed doesn’t supervise. The Fed says it wants to finalize the framework by the end of the year. Roughly twenty pending master-account applications are on hold until it does.

The opening still needs guardrails

None of this adds up to fintech and crypto firms simply becoming banks. It adds up to banking functions becoming available piece by piece: settlement without lending, custody without deposit-taking, issuance without insurance.

BPI floated suing the OCC over the charter approvals, arguing the agency is letting firms “avoid obtaining deposit insurance, consolidated supervision.” Better Markets said the FDIC’s proposed stablecoin rule would recklessly import crypto’s volatility into the federal deposit insurance safety net.”

Under the GENIUS act, crypto companies looking for approval have the requirement that every stablecoin be backed one-to-one by cash or short-term Treasurys.

The infrastructure for a parallel financial system is being built one approval at a time. Whether it comes with the same guardrails as the one it’s replacing is still unresolved.

“The statute applies the same regulatory logic to stablecoins that ensures that the banking sector is safe and reliable,” Blockchain Association chief executive Mersinger said in her June letter.

Leave a comment

Domestic companies will no longer have to report who owns or controls them to the Financial Crimes Enforcement Network. The data collected from U.S. businesses in about 15 million reports submitted between January 2024 and March 2025 will be thrown away.

FinCEN’s decision to finalize its beneficial ownership information reporting rule under the Corporate Transparency Act is the latest turn in a tussle that began in 2021, when Congress decided to give investigators a standardized record of who owns and controls U.S. companies.

The Trump administration halted enforcement against U.S. companies in March 2025, and FinCEN exempted them from future reporting. The rule makes the exemption permanent for U.S. companies, but foreign entities registered in the U.S. still have reporting obligations.

Treasury Secretary Scott Bessent described the rule as “a victory for common sense and American small businesses.” Bessent said the update removed a burdensome requirement without compromising national security. Small-business groups supported the rollback but said the CTA remained a challenge and called it a massive burden on job creators that won’t stop money laundering.

“FinCEN has significantly hindered prosecutors’ ability to identify the bad actors from legitimate businesses,” said National District Attorneys Association executive director Nelson Bunn.

FinCEN initially estimated there would be 32.6 million reporting companies in 2024. It said the rule update removes reporting obligations for roughly 27.5 million companies that had not yet filed or were expected to file in 2025 and 2026. The change cuts the annual reporting burden by some 53 million hours and avoids about $18 billion in modeled compliance costs, FinCEN said.

Banks still face customer-due-diligence requirements

Due diligence is still very much part of the job for banks and compliance teams, and the burden of identifying the people behind a business is now more on them. The Bank Policy Institute, which represents the largest U.S. banks, said as much when the exemption was first announced last year. The trade group asked FinCEN to reduce unnecessary reporting but to preserve useful data for banks and law enforcement.

Financial institutions can still collect ownership information directly from customers, but that creates friction and delays. Compliance teams will no longer be able to use federal files on domestic companies to compare what they get, and state filings are not standardized. Some identify officers, directors, managers, or members without establishing ownership or control.

Leave a comment

Under the system Congress created, a company would file an initial ownership report with FinCEN and update it when its ownership or control changed. Authorized law-enforcement agencies and financial institutions with customer consent could obtain information from that federal registry through restricted channels.

Treasury’s 2026 National Money Laundering Risk Assessment said shell companies can disguise illicit transfers as ordinary business activity and obscure the people behind them. The report said a Chinese money-laundering network moved more than $92 million through shell-company accounts at U.S. banks.

GAO found gaps in state and bank ownership records

In May, the Government Accountability Office said that the exemption at the time applied to more than 99% of the companies that had been expected to file ownership reports with FinCEN. Most were U.S.-formed companies, which were exempted from reporting altogether; the rule also removed U.S. persons from reports filed by foreign companies.

GAO then checked whether banks, state offices, and investigators could still identify the owners of those companies. Banks collect ownership information from their own customers, but not every company has an account covered by federal banking rules. Its review found that state records are not consistent in what they collect, how often companies update them, or who can access them.

Investigators can use subpoenas, suspicious-activity reports, and comme

rcial databases, but those sources do not create one complete record of company ownership. Those details mattered because shell companies can make it hard to identify the people behind money from drug trafficking, fraud, and other crimes.

GAO said Treasury had not shown it could replace the information the federal system would no longer collect and said it should make a plan. The Treasury disagreed.

Challenging the Corporate Transparency Act

The permanent exemption followed legal challenges from a Texas police-supply and uniform business, a Wyoming dairy, and the National Federation of Independent Business. The businesses argued that Congress could not require small, largely local companies to send their owners’ personal information to FinCEN. Small-business groups also backed repeal bills, coalition letters, and advertising campaigns.

One case reached the Supreme Court after a federal judge blocked the CTA nationwide. The Supreme Court lifted the block so the litigation could continue, but it did not decide whether the law was constitutional. The Eleventh Circuit later upheld the CTA in a separate case. As of Friday, the Supreme Court had not decided whether to hear further challenges.

Congress has considered repeal as well. In April, the House Financial Services Committee advanced the Repealing Big Brother Overreach Act. The bill reached the House calendar in June but has not been enacted.

Three other financial regulators also got involved and the four of them issued orders with details of how the bank repeatedly messed up for years. We pieced it all together to get a clear, step-by-step view of at least one example of how they dropped a massive, unmissable, just-google-it ball.

You’ll see I’m not being dramatic…

In 2021, former Fox News producer John Hanick moved more than $3 million in funds and securities into newly opened UBS brokerage accounts. He told the bank the money came from a consulting firm he had left three years earlier.

Hanick had actually worked for Konstantin Malofeev, a Russian oligarch sanctioned in 2014 for financing pro-Russian separatist rebels in Crimea. So the consulting gig was in fact Hanick’s years of helping set up the Fox News-inspired Russian TV network, Tsargrad. The Financial Times reported as much in late 2015 and Salon in 2018.

A financial advisor at UBS knew Hanick had worked in Russia but left it out of the producer’s file, breaking the bank’s own anti-money laundering rules. Without that detail, Hanick received a low-risk rating, which meant he didn’t go through an enhanced due diligence review, an extensive review required for customers presenting greater risk.

Last week, the Financial Crimes Enforcement Network slapped UBS with a $125 million penalty for recidivist and willful Bank Secrecy Act violations, the largest ever AML fine imposed on a broker-dealer and FinCEN’s second action against the bank. The regulator said that between January 2019 and June 2023, UBS failed to monitor more than 61,500 foreign currency wires worth over $10.5 billion and breached its own customer due diligence rules for high-risk customers.

Hanick’s episode is one of several examples listed in orders released by FinCEN, the Financial Industry Regulatory Authority, the Commodity Futures Trading Commission and the Securities and Exchange Commission. The orders show how UBS’s anti-money laundering program missed red flags or failed to act on them.

UBS has admitted to FinCEN that the violations were willful and has agreed to work with a third party to review the transactions. Its anti-money laundering program will go through an independent review as well. The orders don’t name Hanick but together the details from the four orders match the dates and story of the Fox News producer and his relationship with the oligarch.

The bank’s internal checks did not find Hanick’s publicly reported relationship until shortly before he was indicted for U.S. sanctions violations in March 2022. The bank made the connection when Hanick’s spouse applied for a $1 million line of credit. UBS later filed a suspicious activity report and exited the relationship only after Hanick’s indictment was unsealed.

Why UBS received a record AML penalty

FinCEN called the UBS penalty “the largest penalty ever imposed against a broker-dealer for BSA violations to date.” Regulators have brought related cases against other broker-dealers, but those cases involved different rules, narrower failures or additional violations.

The $125 million UBS penalty includes payments to four regulators. UBS must pay $62 million to the Treasury, while the SEC, FINRA and the CFTC will receive $20 million, $20 million and $8 million. FinCEN credits those payments against the total. Another $15 million may be waived if UBS completes an independent review and pays for improvements to its anti-money laundering program.

FinCEN also issued a record $80 million penalty in March to Canaccord Genuity for failing to monitor trading in low-priced stocks. The regulator said Canaccord did not file at least 160 suspicious activity reports. Its problems were similar to UBS’s: weak monitoring, weak customer reviews and missed reports.

These cases arise from similar failures in compliance programs, such as missing obvious red flags, filing late or incomplete suspicious activity reports and allowing customer profiles to go stale. Merrill Lynch, for example, used the wrong reporting threshold and missed about 1,500 reports. LPL Financial left thousands of accounts open even though its own policies required the firm to restrict or close them.

Canaccord and UBS drew the two largest broker-dealer BSA penalties in part because regulators found failures extending beyond individual transactions into customer reviews, data feeds, monitoring systems and management oversight.

How UBS’s transaction monitoring failed

UBS was fined in 2018 for similar problems. The bank had promised regulators to replace the deficient process monitoring foreign-currency wires with automated monitoring by the middle of 2019. UBS executives knew the promised deadline wasn’t feasible but chose not to tell FinCEN.

While the new process was set up, employees had a manual process that took a dozen steps to manually query four different systems and then copy the data points into an Excel spreadsheet. An SEC order said that roughly 52,000 wires worth $7.6 billion were not adequately monitored until the new system was implemented in February 2021.

FinCEN said an internal lookback UBS ran during that period produced no suspicious activity reports, including on transactions involving a customer under investigation for money laundering and tax evasion, and a “Mexico-based customer who was involved in alleged fraud and was later kidnapped and murdered.”

UBS never mapped how wire data traveled between its systems and didn’t verify that the transactions reached the monitoring software. The system was regularly fed a 4:00 p.m. data extract, missing everything that came after. Then it missed more foreign transactions after an operations team changed a transaction label that was not updated in the monitoring system.

The SEC said that between February 2021 and June 2023 roughly 4% of 190,000 wires were not adequately monitored under the new system. Those transactions made up 20% of the value moved, or $2.7 billion.

The high-risk customers UBS misjudged

Other cases followed the same pattern as Hanick’s. UBS opened six accounts for a Russian oligarch with ties to Vladimir Putin because he held $1.5 billion at a UBS affiliate and hadn’t been charged with a crime. When reports tied him to a scheme moving billions of euros offshore, his UBS advisor recommended the bank disregard the news.

A college professor moved to Russia by 2014 to work for a research institution affiliated with a man sanctioned in 2018. UBS kept listing his U.S. university as his source of wealth and left him rated low risk. An employee added a Russian phone number to his file in 2019 without reassessing his rating and the same happened again in 2021, after two analysts found public information about his Russian job.

UBS changed the rating in 2022 during an internal review and filed a SAR in July, covering eight years and 23 incoming wires worth more than $2.2 million.

A group including a former UBS advisor opened more than 40 accounts for dozens of shell companies across multiple branches, making one set of investors look like many so they could claim a bigger share of sought-after IPO stock.

FinCEN said the scheme survived mainly because UBS never checked whether the companies shared owners. The group’s shells listed mailbox services and submitted blank due diligence forms but UBS failed to spot those until a regulator asked about one of the accounts.

The FBI says crypto investment fraud cost Americans $7.3 billion in 2025. The criminal networks are now using AI to run the scams at scale. OpenAI last week wrote a report about the operations of a group in Cambodia that it shut down back in February.

The court documents are currently sealed, so we can’t see the full machinery yet. But a recent case in Queens lets us look under the hood…

In early 2023, Tiffany Yang befriended other users on Facebook Messenger using a fake profile under the name “Lily Lyst.” Eventually, Lyst would talk them into putting their savings into an investment platform that didn’t really exist.

In October, Queens District Attorney Melinda Katz charged Yang with stealing at least $2 million from 17 victims. By then, Yang had distributed over $5 million through 97 bank accounts that were tied to multiple shell companies all registered to her Flushing apartment.

Pig butchering runs on a script—a jingliao—that leads the victim to a fraudulent website to invest in virtual currency. The scammer coaches the victim and uses the fraudulent website to show fake profits and get the victim to invest more. The fattening of the pig.

Over the course of a year, Yang got one of her victims to put up to $1.1 million into what he believed to be his account on SpreadEx Ltd., a real gambling and investing service. She led him to a fake version of the site he used for months but once he tried to withdraw funds, the site disappeared—butchering the pig.

Investigators traced one victim’s $45,000 deposit into the supposed SpreadEx account and found Yang on the other end. The money had landed in the account of Jian Ma Foot Spa 2 Inc., one of at least 97 shell companies that bank records tied to Yang’s Flushing apartment.

Cloning business identities

The complaint named only six of the companies that Yang controlled. Running those names on Middesk’s entity graph didn’t immediately yield connections but it revealed a pattern in how they had been created.

The fraud network registered the companies in daily batches of three or more. They hijacked the identity of legitimate businesses, some with active licenses. Following that pattern, we found more than 20 real New York businesses whose identities were stolen around the same time that Yang’s companies were being registered.

Share The Middesk Brief

The fraudsters added a surname at the beginning of the new registered company name, such as Chen New Funny Nails Inc. or Chen Graceful Nails Inc., and registered them at the address of the real New Funny Nails Inc. The strategy got them past identity verification screenings at multiple major banks.

Those business bank accounts were ultimately where the stolen funds landed once the victims deposited what they thought were investments.

In October, law enforcement searched the apartment and found Yang in the living room. She had $80,000 in cash and checkbooks in the name of various companies from multiple banks.

The Largest Cryptocurrency Seizure In History

Schemes like Yang’s are usually run overseas. Days after Yang’s arraignment, U.S. authorities indicted Chen Zhi, chairman of the Cambodian conglomerate Prince Holding Group. They said Zhi allegedly ran a vast fraud and money-laundering operation and they were seizing about 127,271 bitcoin, worth roughly $15 billion.

The government says the bitcoin it wants to seize is the proceeds of “pig butchering” investment scams run at mass scale out of forced-labor compounds in Cambodia and laundered through Prince Group’s businesses.

Prosecutors alleged that Prince Group is part of a booming Southeast Asian scam economy built on trafficked labor. They pointed to an estimate of 350,000 people working in compounds across Cambodia, Laos and Myanmar that pull in up to $75 billion a year.

The compounds “housed vast dormitories surrounded by high walls and barbed wire, and functioned as violent forced labor camps,” prosecutors said. Workers are trained to build relationships with victims and to spin up social media accounts in bulk. Two facilities alone ran 1,250 phones controlling 76,000 social media accounts, according to court filings.

OpenAI said last week that a network of users in Cambodia used its models to “create and support the operation of fake online personas, generate and translate messages sent to scam targets, create promotional content for their fraudulent schemes, and assist with day-to-day operations.” The company shut the network down back in February. It did not say the network was connected to Prince Group.

Just like in Yang’s case, victims wired funds to shell companies registered in Brooklyn and Queens. They watched the fake balances climb and deposited more. If they asked to cash out, the scammers would go quiet.

Prosecutors say the stolen funds were then routed to the compound’s accounts and laundered back to Prince Group and its executives.

The New York Connection

Last month’s indictment talked about two members of a larger network in China and it said that the people were connected to a third man: Cheng Wei Huang.

A quick search on federal court records turns up two other cases involving Huang: a 2024 money laundering one and a 2023 kidnapping. Huang had posed as an FBI agent and abducted a couple in Queens, allegedly on orders of a local Chinese organized-crime figure. The couple had supposedly stolen from a crime syndicate they worked for.

Prosecutors linked Huang’s 2024 money laundering case to last month’s arrest in the pig butchering network. Neither Huang nor the recent arrests are tied to the Prince Group case.

Huang waived indictment and pleaded guilty in both of his cases but his sentencing has been repeatedly adjourned, a pattern that some might read as a cooperation deal. For now, his sentencing is scheduled for December but we might hear of other developments before that happens.

Leave a comment

Recently, The Miami Herald and Argentinian newspapers confirmed that the FBI was investigating the matter.

Apparently, as Argentina struggled to beat the magnificent and tiny Cape Verde, U.S. authorities were on a video call with Guillermo Tofoni, AFA’s longtime international match promoter until the parties had a falling out in 2021.

They were likely asking him about the man who took over after.

Argentina’s football team has been beating every single one of its opponents for over a month now and and today they might reach the World Cup final for the seventh time in the country’s history.

At the same time, U.S. authorities have been examining an alleged money laundering scheme involving the Argentinian Football Association (AFA), its president, Claudio “Chiqui” Tapia, and the association’s foreign agent.

Last December, Argentinian police raided AFA’s headquarters as part of a money laundering investigation initiated by the local tax agency. Authorities claim that the association’s biggest sponsors, Sur Finanzas, evaded billions of pesos in taxes. Local media says Tapia paved the way for Sur Finanzas to become the primary sponsor of AFA tournaments.

Weeks later, U.S. bank records obtained by sports promoter Guillermo Tofoni for a separate contract lawsuit against AFA revealed another strand. It showed AFA-related revenue handled by its commercial agent, TourProdEnter, whose Florida filings name Faroni’s wife, Erica Gillette, as manager and whose later bank records reportedly identify Faroni as an owner and signatory.

TourProdEnter transferred almost $57 million to about ten Miami companies described as having no verifiable operations, according to reports. The companies were registered under different managers but several shared addresses, agents or administrative infrastructure. Some listed managers denied knowing about the transfer to local media.

Reporters also identified roughly $8 million invoiced to AFA by five now-inactive Miami firms, with at least part of that route reportedly passing through TourProdEnter.

Now, FBI agents and federal prosecutors in Miami and Washington are reportedly examining TourProdEnter’s transactions.

There are a lot of entities, people and money involved. So, we decided to take a look and break it all down for you:

THE TIMELINE

THE FLOW

THE NETWORK

My name is Inti Pacheco and I’ll be your guide (most times). I’m a data journalist who worked for about a decade at The Wall Street Journal, writing about those topics.

We’re also here to collaborate and hear from our industry peers, customers, experts… and from you. Tell us what you think we should dig into 👀.

Subscribe now

… back to FinCEN

For a usually slow-moving agency, FinCEN has been on a tear during the first half of 2026.

Two years ago, FinCEN was mostly executing a Congressional to-do list, rolling out beneficial ownership reporting and extending anti-money laundering (AML) rules to new sectors. Now it has reversed course, delaying the investment adviser AML rule, gutting beneficial ownership reporting, and swapping process-driven compliance for an outcomes-based model.

Financial institutions and other organizations aren’t complaining. Or at least not a ton.

In June, FinCEN said fraud information can now be shared under the 314(b) safe harbor, which protects financial institutions from liability when they share information about suspicious activity. That includes transaction data, IP addresses, and device identifiers, among others.

The update dropped after the agency received 112 comments on its April rule proposal to reform programs fighting illicit finance. The agency said in its proposal that programs would be judged on effectiveness over process.

Overall, folks supported the direction of the rule but said it lacked clarity. Some basically said it was kind of pointless because of how vague some terms were.

“A bank can satisfy every element of the proposed definition and still run a program that fails to produce useful results.“ — iKinetiq Innovation Solutions president Stuart Brock.

We parsed the 112 comments about the proposal submitted on Regulations.gov by financial institutions of all sizes (and their big associations).

Here’s what they talked about:

Sharing more on fraud

Financial institutions have been enabled to share more information now that fraud offenses qualify as specified unlawful activities, the legal threshold to trigger the safe harbor.

Will it solve fraud? No. Are financial institutions satisfied? Not fully. But compliance experts and organizations who have been calling on this for years said it’s a step in the right direction.

The guidance for the Section 314(b) safe harbor requirements hadn’t been updated since 2020. Industry groups had long pushed FinCEN to explicitly cover fraud in the safe harbor, and Congress had broadly called for AML modernization.

It will make things easier for participants to fight fraud. It’ll definitely help the big fraud information-sharing networks owned by Nasdaq and a consortium that includes JPMorgan Chase. Banks and other financial institutions will have an easier time protecting themselves and each other.

Leave a comment

The Bank Policy Institute said the update was a “critical step in helping banks to disrupt fraud and scams in real-time.” BPI also said it encouraged Congress and other agencies to remove legal uncertainty and establish clear safe harbor for banks.

As of late 2020, there were over 7,000 organizations participating in FinCEN’s 314(b) program. There’s likely many more now but the agency stopped updating the number.

How was information shared before?

The big banks have had their own thing for a while.

JPMorgan Chase, Wells Fargo, and others, own a data consortium called Early Warning Services. It counts 5,000 banks, credit unions, payment companies, merchants and government agencies as members. It said it screened $11 trillion in payments and stopped $3.7 billion in potential fraud.

Some 2,800 organizations use Nasdaq’s FRAMLxchange, which lets them share data on suspicious activities under the 314(b) safe harbor.

Both Nasdaq and BPI/Clearing House, the trade group representing EWS’s bank owners, said in their comments that FinCEN’s rule proposal didn’t address the sharing mechanics to handle cross-institutional collaboration. A lot of what the new guidance says about information sharing was in the proposal comments.

Here’s how many of the comments submitted by trade associations, fintech companies and other financial institutions addressed topics that ended up in the 314(b) guidance:

How will things change?

Fraud teams hesitated to use 314(b) when fraud did not map cleanly to money laundering. The guidance will let them move fast and cross-institutionally, just like the fraudsters do.

A suspicion of fraud alone is now sufficient to trigger information sharing. Banks do not need to identify specific proceeds of fraud being laundered. Bank A can alert Bank B about the invoice scam the moment they suspect it, without needing to prove a money laundering connection first.

Neither EWS nor Nasdaq said much about the guidance but the update will work as a tailwind for both. Criminals often spread activities across institutions and these networks alert investigators about risky entities. These systems let investigators share notes and data to collaborate privately.

Assuming they share more information, businesses can benefit from faster resolution if their accounts get wrongly flagged. The catch is that fraud detection already generates false positives and faster signal sharing could make the problem spread across institutions.

This move means FinCEN is now trying to get the broader market to do what the big banks already set up for themselves outside the program.

The Middesk Brief decodes complexity for business owners and the institutions that serve them.

Tell us what we should look at in the comments:

Leave a comment