Good morning ,

1. Main Story: $40m NYDFS consent order against Block - let’s just say they grew v quickly and were targeted by criminals

2. Enforcement Actions & Fines: AML Court Summons for Rabobank

3. Regulatory Updates: US Treasury makes AML/CFT shift explicit - as I spoke about on Mon

1. Block - needed to block more transactions

🇺🇸 United States - NYDFS

Counter-narrative $40m AML fine for Block (formerly Square) (NYDFS).

Here’s my take on why this is even a thing in the new enforcement-lite US approach:

• NY fine - so obviously at state level, not federal - but nonetheless, a reminder that fines will still occur in the US

• Comes on the back of the $80m AML penalty settlement they agreed with 48 state financial regulators in January

• Block’s AML program didn’t adequately reflect its size - in 2023 Block had $23bn revenue… which meant that…

• …on average there were 129 days between an alert and SAR filed; and

• 169k TM backlog of cases in 2021 due to Block’s rapid growth

• Block used two blockchain investigations tools but didn’t automatically generate alerts until the recipient’s wallet terrorism exposure reached 1% and then…

• It didn’t block transactions to wallets with exposure to terrorism-connected wallets until that exposure exceeded 10% (see below)

• Deficient monitoring and risk rating of transactions that used mixers - this one is actually counter the new “Tornado OK” approach at federal level I spoke about before

• Block self-identified 8k customer accounts linked to a Russian criminal network

So, there’s quite a bit going on there.

Here’s what Block has agreed to do to remediate the above:

• Pay the $40m fine

• Continue to devote “significant financial and other resources” to improving its BSA/AML and OFAC program

• Independent monitor for 12 months with comprehensive BSA/AML review of program

Key point for me - certain US States, especially the extremely sophisticated and savvy NYDFS, are still going to be driving FinCrime enforcement actions in spite of a change at federal level.

2. Enforcement Actions, Legal Action & Fines

🇱🇺 Netherlands

Rabobank AML/CFT case

• There’s a huge case unfolding in the Netherlands between the Dutch Public Prosecution and Rabobank (Dutch Public Prosecution)

• I’m going to cover it in-depth on Monday, but here’s the nub of the matter:

  • Dutch Prosecutor has tried to reach agreement with Rabobank for supposed AML/CFT failures from 2016 to 2021 - that has failed for the moment and they are summoning Rabobank to court

  • Rabobank has gone on the offensive and outlined everything it does for AML including having 8k employees solely focussed on it

🇬🇧 United Kingdom

NCA

• You know when certain people say that someone who’s on a Sanctions list doesn’t just go out and try to buy a car?

• Well the NCA just secured their first UK Sanctions breach conviction against a Russian oligarch who did just that (NCA)

HMRC

• HMRC continues with its Compound Settlements

• This time it’s for £3.7m in export control fines in Jan & Feb 2025 for unlicensed exports of military-listed goods and related activity

• But they state it didn’t relate to sanctions (HMRC)

3. Regulatory Updates: New FCA tech, KYCompaniesHouse

🇺🇸 United States

US Treasury

On Wednesday US Treasury Secretary Bessent confirmed the big shift in Sanction policy I highlighted on Monday:

• Focus is on national security & higher-risk areas

• As we’ve seen recently - they’re going after Iran and Mexico

• They’re going to let FIs deprioritise other risks

🇬🇧 United Kingdom

PSR has a new Head of Policy (Claire Simpson - internal promotion) (PSR)

PRA published their 2025/26 business plan - no mention of Financial Crime - was that expected? (PRA)

Have a great Friday!

Paul