Jul 01, 2025
10 min read

Compliance Digest—June 2025

Learn about all the latest compliance updates from the past month.

Every month, Sumsub’s Compliance Team prepares a digest with all the latest updates in the world of AML and beyond. We cover multiple industries from gambling to tax reporting.

If you want to get the latest news every month in one place, subscribe to our newsletter.

Gambling

Gibraltar 🇬🇮

The Government of Gibraltar publishes the Gambling Bill 2025

What happened?

On June 26, 2025, the Government of Gibraltar published the Gambling Bill 2025 in the Gibraltar Gazette, marking the first step in the legislative process before the bill can proceed to parliament. The bill, which repeals and replaces the Gambling Act 2005, proposes new provisions for licensing, regulation and supervision of gambling. It extends the list of activities and categories of licenses, distinguishing between B2C and B2B remote gambling and B2C and B2B non-remote gambling as regulated activities. It also introduces the regime of “approved individuals” which requires persons carrying out regulated functions to be approved by the regulator and the right to appeal to a new Gambling Appeals Tribunal.

The Bill was previously submitted to public consultation at the end of May 2022, but the legislative process got delayed due to a further round of informal consultation with key stakeholders that was required.

Who’s affected: Gambling service providers in Gibraltar

Deadline: N/A

Curaçao 🇨🇼

Curaçao regulator issues announcement on provisional licenses extension

What happened?

On June 23, 2025, the Curaçao Gaming Authority (CGA) announced that the extension of provisional licenses granted to operators, which was issued on December 24, 2024, will expire on June 24, 2025.

According to the announcement, the CGA has contacted those operators whose provisional license will not be extended. Operators who have not received such communication may consider their provisional license extended for an additional six months, until December 24, 2025, under the same conditions.

The announcement applies to both “Green Seal” B2C entities as well as to B2B license holders.

In order to be eligible for a full license, the CGA expects all operators to be fully compliant with the Landsverordening op de kansspelen (LOK) by the end of this second six-month provisional period, including timely completion of all items set out in the CGA portal checklists, as well as adherence to additional policies issued by the CGA in line with LOK requirements.

Who’s affected: Gambling operators with a Curaçao license

Deadline: Each operator will receive the CGA license for the extended period on or before June 27, 2025.

Crypto

Global 🌎

Financial Action Task Force (FATF) finalizes updates to Recommendation 16

What happened?

Last month, the Financial Action Task Force (FATF) updated Recommendation 16, also known as the “Travel Rule,” following its June 2025 Plenary. The revised standards enhance payment transparency in cross-border transactions by strengthening requirements and introducing new measures to combat financial crime, fraud, and errors.

Key updates include:

Clearer assignment of responsibilities within the payment chain
Standardized customer data (name, address, date of birth) for transactions over USD/EUR 1,000
Mandated use of technologies for fraud prevention (e.g., recipient validation)
Clarified exemptions for card-based purchases of goods/services

Who’s affected?

Banks, fintechs, and digital payment providers involved in peer-to-peer cross-border payments over USD/EUR 1,000.
Financial institutions now bear the responsibilities of collecting and preserving accurate sender/recipient data and using fraud-prevention tools

These changes also address new players in the payment ecosystem, extending oversight beyond traditional banks.

Deadline:

The revised Recommendation 16 was officially published on June 18, 2025
Compliance required by 2030 across all jurisdictions implementing FATF Standards

Singapore 🇸🇬

Singapore introduces new regulatory regime for digital token service providers

What happened?

Last month, Singapore’s Financial Services and Markets Act 2022 (FSMA) introduced a new licensing regime for Digital Token Service Providers (DTSPs), effective from June 30, 2025. This new regime applies to individuals, partnerships, or Singapore-incorporated entities that offer digital token services from Singapore to clients outside Singapore.

Entities must either obtain a DTSP license by the deadline, or cease operations. Otherwise they risk facing penalties of up to SGD 250,000 (USD 196K). This regulation significantly expands oversight beyond the previous Payment Services Act 2019, focusing now on outbound services.

Who’s affected?

Any individual, partnership, or corporation that:

Operates from a place of business in Singapore or is formed in Singapore
Provides digital token services
Serves clients outside Singapore

Excluded parties are:

Technical service providers (e.g. protocol developers or API providers who don’t handle funds or tokens)
Providers of limited purpose digital payment tokens (e.g. in-game assets or loyalty points not convertible to money)
Entities already regulated under the Securities and Futures Act, Financial Advisers Act, or Payment Services Act.

Deadline: June 30, 2025. Entities must obtain a DTSP license by this date or cease providing digital token services from Singapore to overseas clients. There will be no transitional period.

Hong Kong 🇭🇰

Hong Kong releases Policy Statement 2.0 on the Development of Digital Assets

What happened?

Last month, Hong Kong’s government released Policy Statement 2.0 on the Development of Digital Assets, building on its October 2022 announcement. It sets out a new strategy to advance Hong Kong as a global leader in digital asset (DA) innovation. Notable features include the introduction of the LEAP framework—covering legal/regulatory streamlining, expanded tokenized products, practical use cases, and talent development.

Who’s affected?

DA service providers in Hong Kong, including upcoming DA exchanges, stablecoin issuers, DA custodian/dealing firms—subject to new licensing regimes under the SFC and HKMA
Financial institutions, fintechs, tokenization platforms, as well as blockchain innovators planning to issue or trade tokenized government bonds, ETFs, metals, renewable energy assets, etc.

Deadline:

August 1, 2025: Licensing regime for stablecoin issuers launches (implementation phase begins)
Public consultations on licensing for DA custodians and dealers will follow soon—typically open for 8–12 weeks. So providers should prepare for submissions in late 2025.

Vietnam 🇻🇳

Vietnam passes a legal framework that formally legalizes crypto and virtual assets

What happened?

On June 14, 2025 Vietnam’s National Assembly passed the Law on Digital Technology Industry, introducing for the first time a comprehensive legal framework that formally legalizes crypto and virtual assets. The law also targets broader digital tech ambition—covering AI, semiconductors, cybersecurity, AML/CFT standards, and digital infrastructure support.

Who’s affected?

Crypto and virtual asset service providers, such as exchanges, wallets, DeFi platforms, token issuers, and custodians operating in or serving Vietnamese users.
The law distinguishes two asset classes: “crypto assets” (e.g., BTC, ETH, NFTs) and “virtual assets” (e.g., gaming tokens, loyalty points).
It also impacts financial institutions and regulatory bodies, which will need to enforce cybersecurity and AML/CFT compliance.
The broader digital tech ecosystem—including AI firms, semiconductor companies, and infrastructure builders—can now access tax breaks, R&D incentives, land-use support, and workforce development programs.

Deadline: The law comes into effect on January 1 2026.

AML

EU 🇪🇺

The European Commission updates its list of high‑risk third-country jurisdictions

What happened?

The European Commission updated its list of high‑risk third-country jurisdictions with strategic deficiencies in anti-money laundering and countering financing of terrorism (AML/CFT) regimes. This update, issued as a delegated regulation under Article 9 of AMLD4, reflects input from the FATF and follows a detailed technical assessment including bilateral dialogues and on-site visits.

Additions: Algeria, Angola, Côte d’Ivoire, Kenya, Laos, Lebanon, Monaco, Namibia, Nepal, Venezuela
Removals: Barbados, Gibraltar, Jamaica, Panama, the Philippines, Senegal, Uganda, United Arab Emirates

Who’s affected?

All EU entities and “obliged entities” regulated under EU AML rules—such as banks, payment providers, crypto firms, and other financial institutions—must now apply enhanced due diligence when dealing with additions on this list. This ensures higher scrutiny and protections when conducting transactions involving these high-risk countries.

Deadline:

The delegated regulation will enter into force one month after its publication, unless blocked by the European Parliament or Council (with a possible second month extension). Once in force, EU entities must immediately apply enhanced vigilance with any newly added jurisdictions.

Lithuania 🇱🇹

Lithuania updates the AML/CFT regulations

What happened?

Last month, Lithuania amended its AML/CFT Law, with a particular focus on cryptocurrency service providers and the exchange of information between financial institutions.

The changes aim to align Lithuania’s legislation with EU Regulation 2024/1620 on the role of the EU Anti-Money Laundering and Terrorist Financing Authority (AMLA), setting out how AMLA’s powers will be applied domestically.

The bill also updates the duties of the Bank of Lithuania as the main AML/CFT authority, strengthens cooperation between national, foreign, and EU bodies, and outlines how financial institutions should identify beneficial owners and trace funds, as well as clarifies when simplified customer checks are allowed. It introduces annual AMLA oversight fees and adds procedures for AMLA inspections in Lithuania.

Who’s affected? All AML-obliged entities in Lithuania

Deadline: July 1, 2025

Money markets and forex

Indonesia 🇮🇩

Indonesia updates regulatory framework for money and foreign exchange markets

What happened?

Bank Indonesia issued PADG No. 13/2025, effective June 10, 2025, which establishes a comprehensive regulatory framework for “Penyelenggara Sarana Transaksi” (Transaction Infrastructure Providers) in Indonesia’s money and foreign exchange markets. This new regulation consolidates and updates previous rules (PADG 2019 and 2018), detailing definitions, licensing criteria, governance duties, risk management, reporting obligations, and enforcement mechanisms.

Who’s affected?

All Transaction Infrastructure Providers (ETP), including:

Electronic trading platform operators
Brokers
Systematic internalizers
Inter‑market ETP Providers under other authorities

Entities already registered or applying under prior PADG regimes will now fall under these updated provisions.

Deadline: The regulation took immediate effect from June 10, 2025.

Tax reporting

UK 🇬🇧

UK enhances AEOI framework with new rules expanding CRS and FATCA compliance

What happened?

Last month, new regulations were introduced to update the UK’s Automatic Exchange of Information (AEOI) framework, expanding the scope and improving the implementation of the OECD’s Common Reporting Standard (CRS) and the US Foreign Account Tax Compliance Act (FATCA). Key updates include:

Expanding CRS to cover electronic money institutions and certain e-money products
Excluding most charities from reporting obligations
Mandating reporting of additional data fields to improve HMRC’s data usability
Introducing a mandatory registration requirement for reporting financial institutions and trustee-documented trusts
Reforming penalty provisions to strengthen enforcement

Who’s affected?

UK financial institutions (including companies, trusts, and partnerships) providing services within scope of FATCA or CRS
Account holders and controlling persons must supply valid self-certifications

Approximately 6,000 entities will now be required to register and perform enhanced due diligence, including around 300 newly in-scope providers under the updated CRS rules. Charities are generally exempted unless they conduct financial services covered by CRS/FATCA.

Deadline:

January 1, 2026: New CRS-related rules take effect.
21 days after laying of the regulation: Mandatory registration and penalties provisions will commence (i.e., likely in late July 2025, assuming laying in early July).

Share this article

Crypto Curacao Digest EU FATF Global Hong Kong Indonesia Intermediate Lithuania