News & Insights

KYC (Know Your Customer) and AML (anti-money laundering) are often used as synonyms, but they are not the same thing. AML is the whole framework: policies, transaction monitoring, sanctions controls and suspicious activity reporting. KYC is the part of that framework that answers two questions about each customer: is this person or company who they claim to be, and how much risk do they bring. Every alert and every report a compliance team files depends on getting those two answers right, and in 2026 both are being tested harder than at any point in the last decade.

Alert threshold calibration is the process of setting, testing and periodically revising the cutoffs at which a transaction monitoring rule generates an alert, so that the alerts an institution investigates are the ones most likely to be suspicious. Done well, it lowers false positives without opening gaps in coverage. Done badly, it either buries investigators in noise or quietly lets reportable activity through. This guide covers how to segment customers, how to test thresholds in both directions, what to document for examiners, and where machine learning fits.

AML scenario tuning is the disciplined process of adjusting transaction monitoring thresholds, parameters, and logic so alerts reflect real risk rather than noise. The rule that matters most: tune continuously, tie every change to the institution's risk assessment, validate it in a sandbox before deployment, and measure the result against defined productivity metrics. Regulators including the FFIEC and FinCEN expect exactly this discipline, and platforms exist to make it repeatable.

On 15 October, the Finchecker team joined fintech founders, banking professionals, compliance specialists, regulators and technology companies at the UN Fintech Forum in Riga. The forum brought together people working on the next stage of European financial services, with discussions covering cross-border payments, fintech licensing, MiCA, compliance, AI and cooperation between banks and fintech companies. For us, it was an opportunity to step outside our day-to-day work, exchange perspectives with people across the financial ecosystem and reflect on the technology challenges facing growing financial businesses.

At the end of September 2026, the Central Bank of Cyprus announced a €750,000 fine against Banque SBA Cyprus. The findings behind it come from an AML compliance audit, an inspection carried out in 2023: three years earlier. The public notice cites the law and the directive that were breached. It does not say which requirements failed. This article won't guess.

Last week, our team came back from Riga Comm — one of the largest business and technology events in the Baltics. Two days, hundreds of conversations, and honestly, a breath of fresh air. We usually live inside the payments, AML and fintech world. Here, we were surrounded by people from logistics, manufacturing, telecom and retail. And the more conversations we had, the clearer one thing became: we're all hitting the same walls. Just from different sides.

Sanctions screening is supposed to be the easy part of AML: a name goes in, a match comes out. In the FCA's file on Euro Exchange Securities UK Ltd (EES), it is where one of the more striking details sits: in one customer file, the screening used an incorrectly spelled name.

The most expensive warning is the one a bank already had. On 29 September 2026, the Swiss regulator FINMA closed its enforcement proceeding against Julius Baer and found serious anti-money-laundering failures. Among them: the bank did not critically review negative media reports about clients linked to two Russian politically exposed persons (PEPs). That is adverse media monitoring failing in its purest form. The information was out there. What went wrong was what happened next.

Ongoing monitoring is the part of AML compliance that starts when onboarding ends and never finishes. On 5 October 2026, the Dutch central bank (DNB) announced a €722,160 fine against Modulr Finance B.V. for not doing it adequately. The amount is modest. The detail behind it is not: a large share of the monitoring was being done by someone else.

Most BIN attacks are stopped by real-time profile-based throttling combined with immediate BIN-range blocking, and prevention follows with EMV 3DS, tokenization, and payment-page integrity controls. In an active attack, blocking comes before investigation: every minute spent analyzing instead of containing lets the testing script generate more declined authorizations and more risk exposure. The sections below walk through detection queries, response steps, and the PCI and EMV controls that keep the attack from recurring.

Adverse media, also called negative news, is public-domain information that indicates a customer or counterparty may pose financial-crime risk. The practical taxonomy compliance teams should adopt splits categories into predicate offences (money laundering, terrorism, bribery, drug trafficking, human trafficking, tax evasion) and reputational or contextual issues (sanctions nexus, regulatory action, civil litigation). Once these categories exist, the next step is operational: tag every alert with a category and a risk stage, then set thresholds accordingly.

Under OFAC's 50 Percent Rule, an entity is treated as blocked when one or more blocked persons own, directly or indirectly, half or more of it in aggregate. That status applies automatically, even when the entity's name never appears on the SDN List, and U.S. persons generally may not transact with it absent specific authorization. The determination hinges on aggregation and indirect ownership tracing, not on the entity's own designation status.