Enforcement & Warnings

OCC cease-and-desist against Dallas-based United Texas Bank for BSA/AML compliance deficiencies, carried over from its 2024 Federal Reserve/Texas order as it converted to a national bank charter.

WHY IT MATTERS Crypto-banking bank — United Texas Bank's 2024 order stemmed from its crypto-client business; the C&D follows it onto its new national charter.

NYDFS fined Swedbank $50 million for intentionally excluding its Baltic subsidiaries from document production to conceal ties to Mossack Fonseca and for failing to disclose adverse European regulatory findings.

WHY IT MATTERS Size override: $50m; traditional bank AML/obstruction — in on scale alone.

SAMA revoked the money-exchange licence of Muhammad Hamoud Al-Sharif for Exchange, barring it from conducting exchange operations in Saudi Arabia.

licence revoked/cancelled — exchange licence No. 135-ج/ص, under Article 34(a)/(b) of the Rules Regulating Money Exchange Operations; specific underlying violation not detailed in the notice SAMA

WHY IT MATTERS Exchange house licence revocation — in scope per gate; Arabic-only source, translated.

CBUAE fined a foreign bank branch AED 1.82 million after it failed to issue a customer liability letter within the mandated seven-day period, breaching Market Conduct and Consumer Protection Regulations and Standards.

WHY IT MATTERS Bank/foreign bank branch — always in scope per relevance gate; consumer-protection failure on a payments-adjacent process (liability letter/loan documentation)

ESMA fined Moody's Germany EUR 2,145,000 for four breaches of the Credit Rating Agencies Regulation — negligent reporting-control failures that sent incomplete or incorrect rating and performance data to ESMA and the European Rating Platform.

WHY IT MATTERS Weak fit (CRA, below size override) — data-infrastructure misreporting; flagged for Matt to cull if the line should stay tighter.

Court entered default final judgment against four entities and two individuals behind the fake NanoBit crypto trading platform, a relationship-investment ('pig butchering') scam, ordering a combined $5,518,902 in disgorgement, prejudgment interest and penalties across the defendants.

WHY IT MATTERS Fake crypto asset trading platform; funds wired to Hong Kong accounts — crypto-fraud infrastructure story.

VARA issued a formal Notice of Fines and cease-and-desist order against Peken Global Limited (KuCoin) for operating as a Virtual Asset Broker-Dealer/Exchange without VARA licensing, following the 5 March 2026 alert.

cease-and-desist order (unlicensed activity) VARA

WHY IT MATTERS Unlicensed major global crypto exchange enforcement — VARA beat.

CBUAE imposed an AED 20 million penalty on a foreign bank branch after examinations found significant, repeated failures in its AML/CFT and sanctions framework.

WHY IT MATTERS Bank/foreign bank branch — always in scope per relevance gate; action concerns AML/CFT and sanctions-compliance failures, a core payments/financial-crime control area

The AMF Enforcement Committee fined online broker Bourse Direct EUR 800,000 (plus EUR 50,000 against a director) for transaction-reporting failures across 2021-2023 and an ineffective market-abuse monitoring and alert system.

WHY IT MATTERS Borderline: listed French online retail brokerage/digital trading platform — included as fintech-adjacent digital investment platform.

VARA fined licensed exchange CoinMENA FZE for deficiencies in its AML programme and internal systems and controls, identified via VARA supervisory inspection.

VASP licence (VL/23/09/001, issued 30 Nov 2023) remains in effect, no suspension/revocation VARA

WHY IT MATTERS AML enforcement against a licensed, Gulf-headquartered crypto exchange — core VARA beat.

VARA issued a formal Notice of Fines and cease-and-desist order against MX Global LTD (MEXC) for operating as an unlicensed Virtual Asset Broker-Dealer/Exchange in Dubai from 2022 to April 2026 and for inadequate KYC procedures.

cease-and-desist order (unlicensed activity) VARA

WHY IT MATTERS Unlicensed major global crypto exchange enforcement — VARA beat.

SFC added Aurum / Aurum Foundation Limited to its Alert List as a suspicious virtual asset trading platform.

WHY IT MATTERS Unlicensed virtual asset trading platform warning

FCA publicly censured asset-servicing bank CACEIS UK for financial-crime control failures in servicing WealthTek, with a voluntary ex-gratia payment of £31,714,068 to WealthTek's clients in place of the £23,091,000 penalty the FCA said it would otherwise have imposed — a censure plus voluntary payment, not a fine.

WHY IT MATTERS Size override: largest UK monetary outcome of 2026 to date. Included on scale per desk rule (2026-07-18, Matt) — monetary outcomes at this size are stories regardless of fintech angle.

The CFTC closed its civil case against Celsius founder Alexander Mashinsky by consent order — permanent trading and registration bans — over promoting Celsius as a safe banking alternative while running risky uncollateralised strategies; Celsius took in roughly $20bn before collapsing.

WHY IT MATTERS Individual-only significant-case lane (Matt policy 2026-07-18): the Celsius collapse close-out.

Banca d'Italia issued sanctioning measure no. 181 of 16 June 2026 against real-estate crowdfunding platform Recrowd Srl; this is distinct from the July 2025 supervisory suspension of Recrowd's new campaigns under the EU Crowdfunding Regulation.

WHY IT MATTERS Italian real-estate crowdfunding fintech platform — core fintech; low confidence on amount, flagged for recheck.

FCA cancelled a currency/money-remittance API's authorisation after its HMRC AML registration lapsed in May 2024 and it failed to submit two years of regulatory returns or respond to FCA communications.

Authority cancels RVB Currency UK Ltd's authorisation as an Authorised Payment Institution under the Payment Services Regulations 2017, pursuant to regulations 10(1)(e) and 10(1)(h) PSRs FCA

WHY IT MATTERS Authorised Payment Institution under PSRs 2017 — payments-sector licence action.

SFC added the Exio-branded platform and associated domains to its Alert List as a suspicious virtual asset trading platform.

WHY IT MATTERS Unlicensed virtual asset trading platform warning, multi-domain operation

The AFM fined neobank bunq EUR 170,000 for failing to substantively respond within the required 15 working days to seven complaints from customers who were victims of online fraud, across incidents in late 2023 and mid-2024.

WHY IT MATTERS Licensed European neobank — core fintech.

The SEC charged Nathan Fuller, operating through Privvy Investments and Gateway Digital Investments, with raising about $12.3 million from roughly 150 investors on false claims of AI-based crypto arbitrage trading bots, alleged Ponzi-like payments and misappropriation of at least $6.2 million.

WHY IT MATTERS Crypto trading scheme sold on 'proprietary AI trading bots' — borderline individual case included for the crypto/AI-trading angle.

OCC consent order against Community Federal Savings Bank (Woodhaven, NY) for BSA/AML programme deficiencies — 12 CFR 21.21 programme violation, suspicious-activity-reporting violation, and a PATRIOT Act s.314(a) information-sharing violation.

WHY IT MATTERS THE BaaS sponsor-bank row: CFSB is reported (American Banker/Banking Dive) as sponsor bank for Wise, Crypto.com, Airwallex, Chipper Cash and LemFi — the order lands on the bank whose rails a chunk of US fintech runs on.

MAS revoked the Major Payment Institution Licence of digital payment token firm Bsquared Technology after a 2025 onsite inspection found serious breaches — significant risk-management and conflict-of-interest weaknesses, outsourcing failures, and repeatedly providing MAS with false or misleading information from licence application through inspection.

Major Payment Institution Licence revoked with effect from 14 May 2026 under the Payment Services Act 2019 — MAS's own word: 'revoked' MAS

WHY IT MATTERS Licensed digital payment token (crypto payments) firm — genuine for-cause revocation, MAS's own wording.

FCA proposed cancelling a small payment institution's registration after more than ten years of registration with no payment-service transactions and an HMRC AML-registration lapse; the firm is disputing the decision at the Upper Tribunal.

Decision Notice proposing cancellation of registration as a Small Payment Institution under the PSRs; firm has referred the matter to the Upper Tribunal FCA

WHY IT MATTERS Small Payment Institution under PSRs 2017 — payments-sector licence action (not yet final).

The AMF withdrew the DASP registration of AUTOMATA France SAS, trading as crypto platform Vancelian, after finding it had illegally carried out crowdfunding activity without authorisation, which the AMF said also showed its managers and significant shareholders failed good-repute and competence requirements.

withdrawal ('radiation') of registration as a Digital Asset Service Provider (DASP/PSAN) — an AMF College de-registration decision, not a judicial revocation; effective 30 June 2026 after a wind-down period AMF

WHY IT MATTERS Crypto/digital-asset-service-provider licence action — core fintech.

SAMA revoked the payment-services licence of payments company Marta Financial Company for failing to meet licensing requirements under the Payments and Payment Services Law.

licence revoked/cancelled (إلغاء الترخيص) — payment services licence No. 18/م ش م/1443, under Article 21(1)(d) of the Payments and Payment Services Law Implementing Regulations, for failing licensing requirements of Article 17(4) SAMA

WHY IT MATTERS Direct fintech/payments licence revocation by Saudi Arabia's central bank.

The SEC filed a settled action against payments company RYVYL and its two founders for falsely depicting RYVYL as a blockchain-based payments innovator when it actually resold other companies' card and ACH processing; the SEC's release states civil penalties of $230,464 against founders Nisan and Errez plus five-year officer-and-director bars.

WHY IT MATTERS Listed fintech/payments company (formerly GreenBox POS) — fraud case turning on fake blockchain-payments claims.

BaFin fined flatexDEGIRO SE EUR 1,000,000 under Article 17(1) Market Abuse Regulation for failing to promptly publish, via ad-hoc disclosure, insider information about deficiencies found in a 2022 special audit of flatexDEGIRO Bank AG's business organisation.

WHY IT MATTERS One of Europe's largest neobrokers/online trading platforms — core fintech.

The SEC charged Bitcoin Latinum founder Donald Basile and two entities he controlled with defrauding hundreds of investors in a $16 million SAFT offering, including false claims that the LTNM token was insured for up to $1 billion and asset-backed.

WHY IT MATTERS Crypto token (SAFT) offering fraud — Bitcoin Latinum/LTNM.

FCA cancelled a currency-exchange SPI's registration after four failed HMRC AML-registration applications over five years and failure to notify the FCA of those refusals; firm's own Tribunal challenge was struck out.

Authority cancels Taj Exchange Limited's registration as a Small Payment Institution under the Payment Services Regulations 2017, pursuant to regulation 10(1)(e) (as applied by regulation 15) PSRs FCA

WHY IT MATTERS Small Payment Institution under PSRs 2017 — payments-sector licence action.

Banca d'Italia issued AML sanctioning measures against digital-native SME lender Banca Progetto, which entered special administration in 2025-26; the separate ~EUR 40m plea settlement with the Milan Public Prosecutor is a judicial matter, not part of this row.

WHY IT MATTERS Borderline: digital-native SME lending bank ('bank-as-fintech-player'); amount unconfirmed, flagged for recheck.

BaFin fined the German branch of Western Union's banking entity EUR 20,000 for repeatedly failing to report account models to BaFin's account-comparison portal within the required three business days.

WHY IT MATTERS Global payments/money-transfer firm's licensed German banking subsidiary — payments gate.

PRA fined challenger clearing bank The Bank of London and parent Oplyse Holdings £2 million for misleading the PRA over capital positions — including fabricated documents — failing to act with integrity, and failing to maintain adequate financial resources; the PRA's first integrity fine and its first action against a parent financial holding company.

WHY IT MATTERS Challenger/clearing bank — self-styled first new UK clearing bank in 250 years; squarely a fintech-as-bank story.

FCA cancelled a money-remittance SPI's registration after it never obtained HMRC anti-money-laundering registration and never provided payment services since being registered in 2019.

Authority cancels AFG Sarafi Ltd's registration as a Small Payment Institution under the Payment Services Regulations 2017, pursuant to regulations 10(1)(a), 10(1)(e) and 10(1)(h) PSRs FCA

WHY IT MATTERS Small Payment Institution under PSRs 2017 — payments-sector licence action.

FinCEN assessed an $80,000,000 civil money penalty against Canaccord Genuity — the largest ever against a broker-dealer for BSA violations — for willful AML-programme failures including at least 160 unfiled SARs tied to OTC securities-fraud schemes.

WHY IT MATTERS Size override: $80m ≥ $10m against a regulated financial firm. Traditional broker-dealer — no fintech angle; in on scale alone.

VARA issued an Investor and Marketplace Alert warning the public that entities commercially advertising as MEXC were not licensed to provide virtual asset services in or from Dubai.

WHY IT MATTERS Pre-enforcement public warning against a major unlicensed crypto exchange operating in Dubai.

VARA issued an Investor and Marketplace Alert warning the public that entities commercially advertising as KuCoin were not licensed to provide virtual asset services in or from Dubai.

WHY IT MATTERS Pre-enforcement public warning against a major unlicensed crypto exchange operating in Dubai.

As part of a global resolution the SEC filed a proposed final judgment under which Rainberry would pay a $10 million civil penalty over claims it facilitated wash trading to inflate trading volume of the crypto asset TRX in 2018-2019, without admitting or denying the allegations.

WHY IT MATTERS Crypto — Tron/TRX ecosystem wash-trading case; one of the highest-profile crypto enforcement resolutions of 2026.

FCA cancelled the money-remittance firm's payment institution authorisation after its HMRC anti-money-laundering registration lapsed in December 2020 and it stopped providing payment services from November 2020, plus unpaid fees and missed returns.

Authority cancels Stallion Money Limited's authorisation as an Authorised Payment Institution under the Payment Services Regulations 2017, pursuant to regulations 10(1)(e) and 10(1)(h) PSRs FCA

WHY IT MATTERS Authorised Payment Institution under PSRs 2017 — direct payments-sector licence action.

ESMA fined trade repository REGIS-TR EUR 1,374,000 for seven breaches of EMIR and SFTR covering governance, operational risk controls, confidentiality and misuse of data — its first SFTR enforcement case and largest-ever trade-repository fine.

WHY IT MATTERS Post-trade market infrastructure (fintech-adjacent B2B); first-of-kind SFTR action and record TR fine.

FCA brought its first enforcement action under the UK's cryptoasset financial-promotions regime, taking High Court action against offshore exchange HTX for illegally promoting cryptoasset services to UK consumers.

WHY IT MATTERS Offshore cryptoasset exchange — first-ever FCA enforcement action under the cryptoasset financial promotions regime.

DFSA fined DIFC multi-asset execution/prime-brokerage firm Ark Capital Management (Dubai) Limited USD 504,000 for inadequate market-abuse systems and controls (at least 10 unreported suspicious-trading alerts) and for failing to notify the DFSA of a proposed change of control.

WHY IT MATTERS Borderline: DIFC capital-markets firm with leveraged digital-asset exposure, not pure-play fintech — flagged for editorial judgement.

SFC added ADG Platform, operated by Grid FinTech Limited, to its Alert List as a suspicious virtual asset trading platform.

WHY IT MATTERS Unlicensed virtual asset trading platform warning, named operating company

SFC added R-Coin Wallet / R-Wallet, operated by JUMANJIN CO., LIMITED, to its Alert List as a suspicious virtual asset platform.

WHY IT MATTERS Unlicensed virtual asset wallet/platform warning, named operating company

SFC added Ju.com to its Alert List as a suspicious virtual asset trading platform.

WHY IT MATTERS Unlicensed virtual asset trading platform warning

FCA cancelled the small payment institution's registration after it failed to notify a director's US fraud indictment, a change of address, and four years of missing regulatory returns.

Authority cancels iCorp Global Limited's registration as a Small Payment Institution under the Payment Services Regulations 2017, pursuant to regulations 10(1)(e) and 10(1)(h) PSRs FCA

WHY IT MATTERS Registered payments firm (Small Payment Institution) under PSRs 2017 — direct payments-sector licence action.

VARA issued a cease-and-desist order and financial penalty against Vesta Prime Portal Co. L.L.C. for advertising and marketing virtual asset activities in Dubai without a VARA licence.

cease-and-desist order (no VARA licence held) VARA

WHY IT MATTERS Unlicensed virtual-asset marketing operator — direct VARA enforcement beat.

ADGM FSRA accepted an Enforceable Undertaking from digital wealth-management/robo-advisory firm Wealthface Limited after finding capital and liquidity shortfalls, incorrect capital calculations, late or non-IFRS-compliant financial statements, loss of ADGM registered office and unpaid supervision fees between January 2023 and March 2025.

WHY IT MATTERS ADGM-licensed digital investment/robo-advisory platform — core fintech firm.

The SFC reprimanded and fined Saxo Capital Markets HK Limited HK$4,000,000 for distributing SFC-unauthorised virtual asset funds and VA-related products to retail clients on its online platform between November 2018 and November 2022 — 1,446 transactions across 32 products, with no VA-specific product due diligence, suitability assessment or risk warnings.

WHY IT MATTERS Online trading platform fined over virtual-asset product distribution — the SFC's first VA mis-selling case against a licensed firm.

SFC added CoinCola to its Alert List as a suspicious unlicensed virtual asset platform targeting Hong Kong investors.

WHY IT MATTERS Unlicensed VA platform warning.

SFC added Globiance to its Alert List as a suspicious unlicensed virtual asset platform targeting Hong Kong investors.

WHY IT MATTERS Unlicensed VA platform warning.

CBUAE revoked the licence of Omda Exchange and imposed an AED 10 million sanction for AML/CFT and Central Bank Law violations.

licence revoked and struck off the register; AED 10 million financial sanction imposed alongside CBUAE

WHY IT MATTERS Exchange house — named revocation.

SEC charged three fake crypto trading platforms and four WhatsApp 'investment clubs' with misappropriating at least $14 million from retail investors via AI-tip lures, fake platforms, non-existent 'Security Token Offerings' and advance-fee withdrawal demands.

WHY IT MATTERS Fake crypto platform network — the AI-investment-club scam pattern.

FCA cancelled the SPI registration of money-remittance firm First Money Services, which twice submitted annual returns falsely reporting payment transactions after its HMRC MLR registration lapsed in March 2022, and failed to honour a voluntary undertaking to stop providing payment services.

Authority cancelled the Firm's registration as a Small Payment Institution under the Payment Services Regulations 2017, effective immediately FCA

WHY IT MATTERS Payments licence action — false returns post-deregistration; sharper than a pure dormancy case.

The SEC filed final consent judgments against Alameda's former CEO and FTX's former CTO and co-lead engineer, closing out the civil case over the FTX collapse — the $1.8bn fraud in which Alameda was exempted from risk controls and given a virtually unlimited line of credit funded by FTX customer funds.

WHY IT MATTERS Individual-only significant-case lane (Matt policy 2026-07-18): the close-out of the defining crypto-platform collapse case.

FCA cancelled the SPI registration of dormant firm Victorian Money, which had never provided payment services in 7+ years, stopped responding to the FCA from March 2024, and was not HMRC-registered under the MLRs.

Authority cancelled the Firm's registration as a Small Payment Institution under the Payment Services Regulations 2017, effective immediately FCA

WHY IT MATTERS Payments licence action — dormant-shell cleanup; part of the FCA's SPI clean-up pattern.

FCA cancelled the SPI registration of Easyremit, which reported zero payment transactions in every annual return 2018-2024, consistent with dormant-company filings since 2020.

Authority cancelled the Firm's registration as a Small Payment Institution under the Payment Services Regulations 2017, effective immediately FCA

WHY IT MATTERS Payments licence action — dormant-shell cleanup; part of the SPI clean-up pattern.

SFC added HSEX to its Alert List as a suspicious unlicensed virtual asset platform.

WHY IT MATTERS Unlicensed VA platform warning.

SFC reprimanded and fined EFG Bank AG HK$10.85 million for product due-diligence failures on 322 bonds (2015-2020), insufficient customer disclosure on complex products, record-keeping failures and late self-reporting.

WHY IT MATTERS Size override: ≥HK$10m against a regulated financial firm.

FCA fined Nationwide Building Society £44,078,500 for failings in financial crime controls — the largest UK fine of 2025.

WHY IT MATTERS Size override: ≥£10m against a regulated financial firm; traditional mutual bank, in on scale alone.

After a special audit found serious deficiencies in N26's risk management, complaints handling and credit-business organisation, BaFin imposed a remediation and monitoring package including a ban on new Dutch mortgage lending and an additional capital requirement.

business restrictions under §25a(2), §44(1), §45b(1) and §45c KWG: prohibition on new Dutch mortgage lending and related securitisation, special monitor appointed, additional own-funds requirement, mandated remediation of business-organisation deficiencies BaFin

WHY IT MATTERS Core: neobank under an active supervisory restriction — a live 'gap' tracker candidate (when does BaFin lift it?).

FinCEN assessed a $3.5 million civil money penalty against P2P crypto trading platform Paxful for willful BSA violations — failure to register as an MSB, no effective AML programme and unfiled SARs — having facilitated over $500 million in suspicious activity including Iran, North Korea, Venezuela and Backpage.com-linked transactions.

WHY IT MATTERS Core: P2P crypto exchange.

SFC added 9M AI to its Alert List as a suspicious unlicensed virtual asset platform.

WHY IT MATTERS Unlicensed VA platform warning.

SEC charged crypto-focused VC adviser Shima Capital and owner Yida Gao with fraud over $169.9 million raised — a pitch deck inflating a 2.8x prior return to 90x, and an undisclosed $1.9 million personal profit on BitClout tokens sold into the fund's own SPV.

WHY IT MATTERS Core: crypto venture fund — a rare 2025-era new crypto-adjacent SEC action.

ADGM FSRA issued a Final Notice against Kraken's regional entity Payward MENA Holdings for contraventions of anti-money-laundering requirements.

WHY IT MATTERS Core: global crypto exchange's Gulf entity — AML action.

SFC added AmazingTech to its Alert List as a suspicious unlicensed virtual asset platform.

WHY IT MATTERS Unlicensed VA platform warning.

SAMA revoked the licence of Fas Finance Company, a fintech-branded consumer microfinance lender.

licence revoked — SAMA's announcement describes the firm as practising 'consumer microfinance activity using financial technology' SAMA

WHY IT MATTERS Core: SAMA's own wording identifies it as a fintech lender.

SFC added hktweb3.com to its Alert List as a suspicious unlicensed virtual asset platform.

WHY IT MATTERS Unlicensed VA platform warning.

BaFin imposed a record EUR 45 million fine — its largest ever against a credit institution — on J.P. Morgan SE for systematically filing suspicious-activity reports late between October 2021 and September 2022.

WHY IT MATTERS Size override: ≥EUR 10m; BaFin's largest-ever bank fine.

SFC added VEX / Volcano Exchange to its Alert List as a suspicious unlicensed virtual asset platform.

WHY IT MATTERS Unlicensed VA platform warning.

VARA's largest 2025 sweep penalised 19 unlicensed firms for virtual-asset activity and marketing breaches; individual firm names appear only in secondary press, not the fetched VARA notice — verify against VARA's enforcement-outcomes page before naming any firm in print.

cease-and-desist orders — firms were never VARA-licensed; ordered to stop all UAE-facing virtual-asset activity and marketing immediately VARA

WHY IT MATTERS Core VARA beat — the mass action that preceded the 2026 KuCoin/MEXC run.

ADGM FSRA issued a Final Notice against FWS Group Limited for contraventions of anti-money-laundering requirements.

WHY IT MATTERS Borderline: AML Final Notice, entity type unconfirmed — flagged for verification.

SFC added Exolarum to its Alert List as a suspicious unlicensed virtual asset platform.

WHY IT MATTERS Unlicensed VA platform warning.

ADGM FSRA issued a CRS penalty notice against Islamic robo-adviser Wahed Invest for Common Reporting Standard breaches.

WHY IT MATTERS Core: fintech robo-adviser.

ADGM FSRA issued a CRS/FATCA penalty notice against private bank Banque Richelieu GCC for reporting breaches.

WHY IT MATTERS Bank — in gate.

CFPB action against collapsed BaaS middleware provider Synapse, whose ledger failures produced a $60m-$90m gap between partner-bank records and its own, freezing end-customer funds for weeks or months.

WHY IT MATTERS Core: THE BaaS-collapse case — the fintech-bank-partnership beat directly.

NYDFS fined Paxos $26.5 million for failing to conduct proper due diligence on Binance and broader BSA/AML/KYC failures; a blockchain-analytics review found $1.6bn in Binance transactions tied to illicit actors including sanctioned entities.

WHY IT MATTERS Core: digital-asset trust company; stablecoin/Binance nexus; also clears size override.

AED 600,000 sanction on a CBUAE-licensed finance company.

WHY IT MATTERS Borderline: NBFC lender adjacent to fintech lending; included per borderline-include rule.

AED 10.7 million sanction on an exchange house for AML/CFT and sanctions-obligation failures.

WHY IT MATTERS Exchange house — in gate.

CBUAE revoked the licence of Gomti Exchange for AML/CFT and sanctions-framework failures.

licence revoked and struck off the register CBUAE

WHY IT MATTERS Exchange house — named revocation.

CBUAE revoked the licence of Al Nahdi Exchange for significant AML/CFT and sanctions-framework failures.

licence revoked and struck off the register CBUAE

WHY IT MATTERS Exchange house — named revocation.

HKMA reprimanded and fined stored-value-facility licensee 33 Financial Services HK$1.6 million for AML/CFT control failures between December 2019 and August 2023, including inadequate CDD and failures in identity verification by outsourced business partners.

WHY IT MATTERS Core: SVF (stored-value/e-wallet) licensee — direct payments gate hit.

CBUAE financial sanction on an exchange house; amount not disclosed on the enforcement listing.

WHY IT MATTERS Exchange house — in gate.

CBUAE financial sanction on a foreign bank branch; amount not disclosed on the enforcement listing.

WHY IT MATTERS Bank — in gate.

FCA fined Barclays Bank plc £39,314,700 for inadequate management of money-laundering risk in its banking relationship with Fowler Oldfield, taking £46.8m over one year from a known money-laundering operation despite law-enforcement warnings.

WHY IT MATTERS Size override: ≥£10m; traditional correspondent-banking AML, in on scale alone.

AED 3 million sanction on a bank for AML/CFT non-compliance.

WHY IT MATTERS Bank — in gate.

A multi-state money-transmitter examination found BSA/AML deficiencies at Wise — infrequent independent AML review, late SARs, transaction-monitoring data-integrity issues — resolved by a $4.2m administrative penalty split across six states plus a lookback of accounts closed March 2023-March 2025.

multi-state consent order (CA, MA, MN, NE, NY, TX) requiring AML/CFT remediation and a lookback review; no admission of wrongdoing NYDFS

WHY IT MATTERS Core: second US action against Wise in six months (after the CFPB's January order) — a pattern row.

Combined AED 4.1 million sanctions across three exchange houses for AML/CFT failures.

WHY IT MATTERS Exchange houses — in gate.

FCA cancelled the SEMI registration of PARAM@ UK after the e-money issuer lost its safeguarding account in 2023-24 and failed over ~21 months to secure adequate safeguarding for e-money holders' funds despite repeated warnings and a voluntary undertaking.

Authority cancelled the Firm's registration as a Small Electronic Money Institution (SEMI) under the Electronic Money Regulations 2011, effective immediately FCA

WHY IT MATTERS Core payments/EMI: safeguarding failure is a live fintech risk theme (client-money protection).

FCA fined Monzo £21,091,300 for inadequate financial-crime systems and controls (2018-2020) and for breaching a VREQ restricting high-risk customer onboarding (2020-2022) — 26,325 accounts opened in breach, including customers using addresses such as Buckingham Palace.

WHY IT MATTERS Core: UK digital challenger bank; the FCA itself frames it as growth outpacing controls.

AED 5.9 million sanction on a foreign bank branch.

WHY IT MATTERS Bank — in gate.

Banca d'Italia fined Olinda SAS — the French entity operating business-banking fintech Qonto in Italy — EUR 390,000 under Art. 62 of Legislative Decree 231/2007 after a 2024 inspection found AML control and due-diligence deficiencies in its Italian operations.

WHY IT MATTERS Core: one of Europe's largest business-banking fintechs.

MAS imposed a S$110,000 composition penalty on MPI OxPay SG for beneficial-owner inquiry and screening failures (May 2021-November 2022).

WHY IT MATTERS Core: licensed payments MPI (listed fintech OxPay's Singapore entity).

MAS imposed a S$140,000 composition penalty on MPI Mobile Community Tech for identity-verification and wire-transfer beneficiary-information failures (September 2021-July 2023).

WHY IT MATTERS Core: licensed cross-border payments MPI.

MAS imposed a S$170,000 composition penalty on MPI J-Dee Remittance Services for customer/beneficial-owner screening failures (July 2022-August 2023).

WHY IT MATTERS Core: licensed cross-border payments MPI.

MAS imposed a S$260,000 composition penalty on MPI Arcade Plaza Traders for AML/CFT breaches (March 2020-August 2023) including screening and wire-transfer information failures.

WHY IT MATTERS Core: licensed cross-border payments MPI.

MAS imposed a S$280,000 composition penalty on Major Payment Institution Remsea for AML/CFT breaches (August 2020-August 2023) including failures to obtain customer addresses, identify beneficial owners and include wire-transfer originator information.

WHY IT MATTERS Core: licensed cross-border payments MPI.

CBUAE imposed a financial sanction plus a six-month new-customer onboarding suspension on a bank's Islamic window.

customer onboarding suspended for six months, alongside a financial sanction CBUAE

WHY IT MATTERS Bank — business-restriction action, gap-trackable (when was it lifted?).

AED 2 million sanction on an exchange house.

WHY IT MATTERS Exchange house — in gate.

CBUAE revoked the licence of Sundus Exchange and imposed an AED 10 million sanction for AML/CFT and sanctions-framework violations.

licence revoked and struck off the register; AED 10 million financial sanction imposed alongside CBUAE

WHY IT MATTERS Exchange house — named revocation.

BaFin fined Solaris SE EUR 500,000 for repeatedly exceeding the large-exposure limit under Article 395(1) CRR between January 2022 and March 2024.

WHY IT MATTERS Core: Germany's principal banking-as-a-service licence-holder — the BaaS beat.

Final default judgment against the My Big Coin virtual-currency fraud (2014-2017, falsely claimed gold-backed token, $6m+ from at least 28 customers): $19,326,324 civil penalty plus $6,442,108 restitution jointly and severally.

WHY IT MATTERS Crypto issuer fraud; also clears size override.

Combined AED 12.3 million sanctions across six exchange houses.

WHY IT MATTERS Exchange houses — in gate.

CBUAE financial sanction on an exchange house; amount not disclosed on the enforcement listing.

WHY IT MATTERS Exchange house — in gate.

AED 100 million sanction on an exchange house for repeat AML breaches including failure to implement remediation from a prior inspection.

WHY IT MATTERS Exchange house — repeat-offender angle; clears size override.

Combined AED 18.1 million sanction on two foreign bank branches for AML/CFT framework failures.

WHY IT MATTERS Banks — in gate.

SEC charged Unicoin and four top executives over an offering that raised more than $100 million from 5,000+ investors on false claims the tokens were asset-backed by billions in real estate, that $3 billion had been sold, and that the certificates were 'SEC-registered'.

WHY IT MATTERS Core: one of the very few NEW crypto enforcement cases the 2025 SEC filed — airport/taxi mass-marketing angle.

Record AED 200 million sanction on an exchange house for pervasive AML/CFT control failures — KYC gaps, weak large-transaction monitoring, absent STR filing. The CBUAE's largest 2025 single sanction.

WHY IT MATTERS Exchange house — headline UAE AML case of 2025; also clears size override.

FDIC and Pennsylvania regulators ordered $650m-asset Quaint Oak Bank to overhaul its third-party risk management covering fintech partners and its BSA/AML programme, including a contingency plan for orderly termination of any fintech-partner relationship and higher capital ratios; no monetary penalty.

joint FDIC/Pennsylvania consent order; no admission of wrongdoing; terminated 30 March 2026 following successful BSA/AML remediation FDIC

WHY IT MATTERS Core: explicit BaaS sponsor-bank/fintech-partner consent order.

SEC charged PGI Global founder Ramil Palafox over a $198 million crypto and forex 'membership' scheme with MLM-style referral incentives, alleging $57 million+ misappropriated including Lamborghini purchases, with Ponzi-like payouts until the 2021 collapse.

WHY IT MATTERS Crypto/forex trading scheme via a named company vehicle.

Helium Network creator Nova Labs consented to a $200,000 penalty over false claims that Lime, Nestlé and Salesforce used the network in its preferred-stock offering; the crypto claims in the same complaint were dropped — a marker of the SEC's 2025 crypto retreat.

WHY IT MATTERS Crypto/DePIN network; the dropped-claims detail is the story.

CBUAE financial sanction on a bank; amount not disclosed on the enforcement listing.

WHY IT MATTERS Bank — in gate.

The Fed fined Discover $100 million for misclassifying millions of consumer credit cards as commercial for ~17 years (2007-2023), overcharging merchants more than $1bn in interchange fees.

WHY IT MATTERS Payments/card-network company; size override; merger-condition enforcement.

Final judgment against UAE-based self-styled crypto market maker CLS Global for manipulating the market for the NexFundAI token by faking an active trading market.

WHY IT MATTERS Crypto market-maker manipulation — UAE-headquartered firm in a US action, a Gulf-angle row.

Companion FDIC action to the Fed's Discover order: $150 million civil money penalty plus restitution for the same 17-year card-misclassification and interchange-overcharging conduct.

WHY IT MATTERS Size override; combined Fed+FDIC outcome of $250m + $1.2bn restitution is the headline number.

ADGM FSRA fined the HAYVN crypto group USD 8.85 million, cancelled Hayvn ADGM's licence and disqualified its former CEO after finding unlicensed virtual-asset services through an unregulated entity and 200+ false documents given to banking partners; no client assets lost.

Hayvn ADGM's Financial Services Permission cancelled; former CEO disqualified indefinitely from ADGM financial services; USD 8.85m in fines across the group ADGM FSRA

WHY IT MATTERS Core: largest 2025 ADGM crypto enforcement action.

NYDFS fined Block $40 million for BSA/AML, cybersecurity and consumer-protection failures at Cash App: alert backlog grew from ~18,000 to 169,000, SARs filed on average 129 days late, and over 8,000 accounts opened by a Russian criminal network using falsified information.

WHY IT MATTERS Core: BitLicense + money transmitter licensee; pairs with the CFPB's January $55m action — same firm, two regulators, one quarter.

CBUAE fined five banks for CRS/FATCA reporting breaches; amounts not broken out per entity.

WHY IT MATTERS Banks — in gate.

NYDFS joined a CSBS/MTRA multi-state consent order against money transmitter Sigue, which ceased operations and surrendered licences after failing transmission-liability obligations to consumers — a surrender in insolvency, not a revocation.

multi-state consent order tied to licence surrender following insolvency; net-worth and transmission-liability violations NYDFS

WHY IT MATTERS Core: money transmitter insolvency — consumer-funds risk beat.

BaFin fined N26 Bank SE EUR 15,000 for failing to notify BaFin in time that its supervisory board had approved a loan to an executive within the required four-month window.

WHY IT MATTERS Core: licensed German neobank.

VARA issued a consumer and marketplace alert naming MKAN Coin DMCC as fined for advertising unlicensed virtual-asset activity accessible within the UAE.

WHY IT MATTERS Unlicensed VA operator — VARA beat.

OCC Formal Agreement with Patriot Bank (Stamford, CT) over violations and unsafe practices including BSA/AML risk management and payment activities oversight; terminated 17 months later after remediation.

WHY IT MATTERS Payments-partner bank — 'payment activities oversight' is the OCC's own wording; Patriot sponsors prepaid/payments programmes.

CBUAE examination found AML/CFT policy and procedure failures at an anonymised exchange house; AED 3.5 million sanction.

WHY IT MATTERS Exchange house — payments gate.

FinCEN assessed a $37 million civil money penalty against Brink's Global Services USA — its first action against an armoured-car company — for willful BSA violations: unregistered MSB money transmission, no AML programme and unfiled SARs on bulk-currency shipments across the Southwest border.

WHY IT MATTERS Size override: $37m; MSB/money-transmission conduct — first-of-kind action.

CFPB consent order against Wise US for deceptive ATM-fee disclosures on remittance transfers plus EFTA/Reg E disclosure, error-resolution and recordkeeping failures; the penalty was slashed by the new administration months later.

WHY IT MATTERS Core: cross-border payments fintech; the penalty-slashing is itself a story.

SFC reprimanded and fined Hang Seng Bank HK$66.4 million for fund-sales misconduct (churning, 111 accounts), mis-sold derivatives to non-qualified clients, and retaining HK$22.4 million in undisclosed excess fees across 2014-2023.

WHY IT MATTERS Size override: ≥HK$10m against a regulated financial firm.

DFSA found Al Ramz failed to report suspicious wash trades executed through its online trading platform on Nasdaq Dubai (a temporary 27% price spike); the firm disputed the finding and lost at the Tribunal in 2026.

WHY IT MATTERS Borderline: online trading platform; contested-then-upheld arc is the story. Source is the DFSA's own Thomson Reuters-hosted Rulebook (dfsa.ae 403s and its listing page carries unreliable dates).

NYDFS fined PayPal $2 million for cybersecurity regulation violations after a December 2022 gap let unauthorised parties access Forms 1099-K with customers' unredacted names, dates of birth and Social Security numbers.

WHY IT MATTERS Core: major payments platform; NYDFS cybersecurity enforcement.

CFPB fined Equifax $15 million over FCRA failures: improper dispute reinvestigations, reinsertion of deleted disputed data, failure to block identity-theft-linked data, and sale of inaccurate credit scores after a test-code error entered production.

WHY IT MATTERS Size override: $15m; credit-data infrastructure.

CFPB found Cash App operated for years without adequate customer-service or fraud-prevention infrastructure, enabling fraudulent third-party 'support' lines, misusing chargebacks instead of EFTA dispute investigations, and misrepresenting fraud protections.

WHY IT MATTERS Core: major consumer payments fintech (Cash App).

Court entered final judgment against crypto lender Abra for failing to register the offers and sales of its retail crypto lending product Abra Earn; $1.65 million civil penalty, consented without admitting or denying.

WHY IT MATTERS Core: retail crypto lending platform.

Default judgment against Mosaic Exchange and its CEO for fraudulently soliciting Bitcoin with fabricated AUM, profit rates and exchange partnerships (2019-2021): $468,600 restitution, $60,980 disgorgement, $660,000 penalty.

WHY IT MATTERS Crypto exchange fraud scheme.

CFTC found Gemini made false or misleading statements during the 2017 self-certification of a bitcoin futures contract; Gemini paid $5 million and accepted a permanent injunction the agency itself is now seeking to unwind.

WHY IT MATTERS Core: major crypto exchange; the 2026 vacatur motion is a marker of the US crypto-enforcement retreat.