Find the latest press releases, brand assets and media information.
At the end of September 2026, the Central Bank of Cyprus announced a €750,000 fine against Banque SBA Cyprus. The findings behind it come from an AML compliance audit, an inspection carried out in 2023: three years earlier. The public notice cites the law and the directive that were breached. It does not say which requirements failed. This article won't guess.
Last week, our team came back from Riga Comm — one of the largest business and technology events in the Baltics. Two days, hundreds of conversations, and honestly, a breath of fresh air. We usually live inside the payments, AML and fintech world. Here, we were surrounded by people from logistics, manufacturing, telecom and retail. And the more conversations we had, the clearer one thing became: we're all hitting the same walls. Just from different sides.
Sanctions screening is supposed to be the easy part of AML: a name goes in, a match comes out. In the FCA's file on Euro Exchange Securities UK Ltd (EES), it is where one of the more striking details sits: in one customer file, the screening used an incorrectly spelled name.
The most expensive warning is the one a bank already had. On 29 September 2026, the Swiss regulator FINMA closed its enforcement proceeding against Julius Baer and found serious anti-money-laundering failures. Among them: the bank did not critically review negative media reports about clients linked to two Russian politically exposed persons (PEPs). That is adverse media monitoring failing in its purest form. The information was out there. What went wrong was what happened next.
Ongoing monitoring is the part of AML compliance that starts when onboarding ends and never finishes. On 5 October 2026, the Dutch central bank (DNB) announced a €722,160 fine against Modulr Finance B.V. for not doing it adequately. The amount is modest. The detail behind it is not: a large share of the monitoring was being done by someone else.
Most BIN attacks are stopped by real-time profile-based throttling combined with immediate BIN-range blocking, and prevention follows with EMV 3DS, tokenization, and payment-page integrity controls. In an active attack, blocking comes before investigation: every minute spent analyzing instead of containing lets the testing script generate more declined authorizations and more risk exposure. The sections below walk through detection queries, response steps, and the PCI and EMV controls that keep the attack from recurring.
Adverse media, also called negative news, is public-domain information that indicates a customer or counterparty may pose financial-crime risk. The practical taxonomy compliance teams should adopt splits categories into predicate offences (money laundering, terrorism, bribery, drug trafficking, human trafficking, tax evasion) and reputational or contextual issues (sanctions nexus, regulatory action, civil litigation). Once these categories exist, the next step is operational: tag every alert with a category and a risk stage, then set thresholds accordingly.
Under OFAC's 50 Percent Rule, an entity is treated as blocked when one or more blocked persons own, directly or indirectly, half or more of it in aggregate. That status applies automatically, even when the entity's name never appears on the SDN List, and U.S. persons generally may not transact with it absent specific authorization. The determination hinges on aggregation and indirect ownership tracing, not on the entity's own designation status.
KYC crypto (Know Your Customer for cryptocurrency platforms) is the identity verification process used by VASPs, exchanges, and Web3 businesses to authenticate users, prevent financial crime, and ensure regulatory compliance. However, in 2026, KYC crypto process is under more sustained attack than almost any other sector...
For a dating or adult platform, identity verification exists to answer a question no other segment asks in quite the same way: is the person behind this profile a real, live, consenting adult, and are they who their profile says they are. In 2026, both halves of that question are under sustained, documented attack — not from a handful of bad actors, but from automated operations running at a scale that only became possible in the last year.
Identity verification for a payment provider has to solve a harder version of the same problem a bank solves: confirm a real applicant, fast enough that verification never becomes the reason someone abandons signup, against fraud tooling that's gotten radically cheaper in the last two years.
Before a merchant can process a single payment, its acquirer or PSP runs identity and business verification on it — confirming the business is real, its owners are who they say they are, and the application isn't part of a fraud pattern. Understanding how that process actually works explains why onboarding sometimes takes longer than expected, and what a merchant can do to move through it faster.
