Jun 02, 2025

8 min read

Compliance Digest—May 2025

Learn about all the latest compliance updates from the past month.

Arina Rumyanceva

Legal Counsel at Sumsub

Every month, Sumsub’s Compliance Team prepares a digest with all the latest updates in the world of AML and beyond. We cover multiple industries from AML to crypto.

If you want to get the latest news every month in one place, subscribe to our newsletter.

AML

Cyprus 🇨🇾

Central Bank of Cyprus published its 2025 directive on the prevention of money laundering and terrorist financing

What happened?

Last month, the Central Bank of Cyprus (CBC) published its 2025 directive on the prevention of money laundering and terrorist financing. The directive modernizes and reinforces the compliance framework for banks and other obliged entities, with a focus on simplifying procedures for low-risk customers. Key changes include:

Allowing banks to categorize certain individuals, such as pensioners, with no income beyond their pension, as low-risk, and require less documentation from them
Allowing business relationships to be updated at intervals based on the customer’s risk level, rather than at a fixed frequency for low-risk clients
Accepting copies of identity documents (instead of originals) during updates
Enabling the reuse of previously collected information during the business relationship to minimize repeated data requests
Accepting alternative forms of documentation for those unable to comply due to health or physical limitations
Introducing flexibility in proof of residence, such as accepting government documents or electronic utility bills
Permitting document certification by third parties (e.g., government services) and the use of electronic documents

Who’s affected? Banks and other obliged entities under the CBC’s supervision

Deadline: The new directive comes into effect on June 2, 2025

Read more:

Australia 🇦🇺

Australia released second public consultation on new AML/CTF rules

What happened?

Australian Transaction Reports and Analysis Centre (AUSTRAC) have updated the draft AML/CTF Rules to address feedback on the first round of consultation.

This includes updates to:

allow delayed initial customer due diligence in a wider range of circumstances
provide greater flexibility in determining the lead entity of reporting groups
provide more detail on how to form reporting groups
clarify definitions relevant to value transfer and Travel Rule requirements
where possible, address the challenges businesses may have when implementing or complying with the AML/CTF rules

The second exposure draft of the AML/CTF Rules also introduces new requirements regarding:

the reportable details for threshold transaction reports and suspicious matter reports
the information required for enrolment and registration applications.

AUSTRAC has also released a separate exposure draft outlining amendments to the current rules-based exemptions that will be retained—AML/CTF Rules (Class Exemptions and Other Matters) 2007.

Who’s affected? AML-obliged entities subject to Australia’s AML regulations

Deadline: Submissions are due by June 27, 2025

Gambling

Bangladesh 🇧🇩

Bangladesh launches national online gambling enforcement under new cyber law

What happened?

The Criminal Investigation Department (CID) of Bangladesh initiated a nationwide enforcement campaign targeting online gambling and betting platforms. This is the first major operation under the newly enacted Cyber Security Ordinance 2025. The crackdown was prompted by concerns about the rising prevalence of online gambling, particularly among young people, and the associated social and financial harms such as addiction, family breakdown, and suicide.

The new law criminalizes the operation, promotion, and facilitation of online gambling, including associated transactions, fraud, and manipulation. Offenders face up to two years in prison, a fine of up to one crore taka (approximately $81,845), or both. The CID is urging the public to avoid online gambling, raise awareness—especially among youth—and report suspicious activity to the Cyber Police Centre via official hotlines or email.

Who’s affected? Online gambling operators, promoters, and facilitators in Bangladesh

Deadline: The Cyber Security Ordinance 2025 comes into immediate effect following its gazette notification, and enforcement actions are already underway as of late May 2025

Sri Lanka 🇱🇰

Sri Lanka moves to establish national gambling regulator and legalize online gambling

What happened?

Last month, the Sri Lankan government published draft legislation—the Gambling Regulating Authority Act 2025—to create a national gambling regulator (GRA) with jurisdiction over all gambling segments except lotteries and social gambling. The bill legalizes and regulates online (digital) gambling, including internet and mobile betting, and brings gambling software development and distribution under regulatory oversight. Existing laws on land-based casinos and horseracing would be repealed, and their regulations and licenses—largely transferred to the new regime. Regulatory details, such as fees, license types, advertising restrictions, and gaming machine approvals will be set by ministerial order and subject to legislative review.

The GRA board will consist of Sri Lankan nationals, with a mix of government officials and appointed members, and will have powers to license, monitor compliance, enforce penalties, and publish operator ratings.

Gambling software developers and distributors must be licensed and are prohibited from releasing products through unregulated platforms. Software must include responsible gambling tools and self-exclusion mechanisms.

Offenses under the act—including illegal gambling operations, advertising, or presence at unlawful venues—are punishable by up to two years in jail and fines up to 10 million rupees (about $33,400)
The GRA will have broad investigative and enforcement powers, including entering and searching gambling premises and accessing online platforms
The move aims to promote tourism, employment, and economic development, while also addressing crime and problem gambling

Who’s affected?

All gambling platforms in Sri Lanka, including land-based, online, offshore, and ship-based operators
Gambling software developers and distributors, who must comply with new licensing and technical standards

Deadline:The draft bill was published in the Government Gazette on May 23, 2025, and issued on May 27, 2025. The legislation still requires parliamentary approval before coming into force, with no specific implementation date set yet

South Africa 🇿🇦

South Africa advances gambling reform and faces national lottery controversy

What happened?

In May, South Africa’s parliament made progress on the long-stalled National Gambling Amendment Bill (B27B), which was first introduced in 2018 and revived in July 2024 after lapsing in the previous parliament. On May 15, the bill was referred to the parliamentary Mediation Committee, which held closed meetings on May 29 and 30 to review the proposal and hear briefings from national and provincial gambling boards.

The National Gambling Amendment Bill proposes the dissolution of the National Gambling Board, the creation of a new National Gambling Regulator, and new powers to block payments to unlicensed operators and forfeit unlawful winnings.

Separately, the Remote Gambling Bill (B11-2024), which aims to regulate online gambling, promote responsible gambling, and prevent underage and criminal gambling activity, is awaiting tabling before the Portfolio Committee of the Department of Trade, Industry and Competition. This bill would shift responsibility for issuing three types of gambling licenses to provincial authorities.

Who’s affected? Gambling operators and stakeholders across South Africa, including land-based and (pending legislation) online gambling operators

Deadline: No fixed deadline for the final passage of the National Gambling Amendment Bill or the Remote Gambling Bill yet. Both are currently under parliamentary consideration. The new National Lottery and Sports Pool Licence has been awarded for a six-year term, but legal proceedings may impact implementation.

Curaçao 🇨🇼

Curaçao Gaming Authority opens applications for certification of independent gaming test houses

What happened?

On May 26, 2025, the Curaçao Gaming Authority (CGA) issued guidelines and invited qualified independent gaming test houses to apply for official recognition.

The new process aims to certify only competent, independent, and technically capable labs to provide testing services for Curaçao-licensed gaming operators.

The guidelines specify eligibility criteria, technical standards, and the application process for test houses seeking recognition.

Recognized test houses will be added to the CGA’s official list of approved providers, ensuring that compliance assessments within the jurisdiction meet high standards of security, fairness, and quality.

Who’s affected?

Independent gaming test houses seeking to provide services to Curaçao-licensed operators
Curaçao-licensed gaming operators, who will need to use recognized test houses for compliance testing

Deadline: No specific deadline was mentioned in the announcement. Applications are open as of May 26, 2025.

Crypto

UK 🇬🇧

UK introduces new cryptoasset reporting requirements for service providers under CARF

What happened?

The UK government is implementing the OECD Cryptoasset Reporting Framework (CARF) starting January 1, 2026.

This framework requires all UK-based cryptoasset service providers to collect and report detailed user and transaction data to HM Revenue & Customs (HMRC).

The new rules extend the international CARF standards to include domestic reporting, increasing transparency and regulatory oversight of cryptoasset activities in the UK. Guidance is available for both service providers (on their reporting responsibilities) and users (on the information they will need to provide). HMRC will provide further updates and detailed instructions as the implementation date approaches.

Who’s affected?

All businesses and entities providing cryptoasset services in the UK
Users of UK-based cryptoasset services, who will be required to provide additional information to service providers

Deadline: The new reporting requirements take effect from January 1, 2026

Hong Kong 🇭🇰

Hong Kong enacts stablecoins licensing regime to strengthen digital asset oversight

What happened?

On May 21, 2025, Hong Kong’s Legislative Council passed the Stablecoins Bill, establishing a licensing regime for issuers of fiat-referenced stablecoins (FRS). The new law requires any person or entity issuing an FRS in Hong Kong—or any FRS referencing the Hong Kong dollar, even if issued outside Hong Kong—to obtain a license from the Hong Kong Monetary Authority (HKMA). The regime sets requirements for reserve asset management, redemption at par value, segregation of client assets, robust stabilization mechanisms, and compliance with anti-money laundering, risk management, disclosure, and audit standards. Only licensed institutions may offer FRS in Hong Kong, and only FRS issued by licensed issuers can be offered to retail investors.

The law restricts FRS-related advertising to licensed issuers, aiming to prevent fraud and scams during a six-month non-contravention period. The HKMA will conduct further consultations on detailed regulatory requirements, and the government plans to expand oversight to virtual asset over-the-counter and custodian services.

Who’s affected?

Any business or individual seeking to issue fiat-referenced stablecoins in or referencing Hong Kong dollars
Existing and prospective stablecoin issuers and virtual asset service providers operating in Hong Kong

Deadline: The Stablecoins Ordinance is expected to come into effect later in 2025, with a transitional period to allow the industry to adapt and apply for licenses

South Korea 🇰🇷

South Korea strengthens crypto regulations ahead of institutional market entry

What happened?

On May 20, 2025, South Korea’s Financial Services Commission (FSC) announced comprehensive new regulations to prepare for the entry of institutional investors into the country’s cryptocurrency market. These measures aim to enhance transparency, prevent money laundering, and ensure investor protection as the market opens up to larger entities. Key regulatory updates concern:

Non-profit organizations: Non-profits are now permitted to receive and liquidate cryptocurrency donations, provided they have a minimum of five years of audited financial history. They must establish internal Donation Review Committees and route all donations through verified Korean won exchange accounts. Only cryptocurrencies listed on at least three major domestic exchanges are eligible for donation, and liquidation is expected to occur immediately upon receipt.
Crypto exchanges: Exchanges are allowed to liquidate user fees paid in crypto solely to cover operational costs, with daily sales capped at 10% of the total planned amount. Sales are restricted to the top 20 tokens by market capitalization across five won-based exchanges. Exchanges are prohibited from selling tokens on their own platforms to prevent conflicts of interest.
Token listing standards: The FSC has introduced stricter listing criteria to curb market volatility. Tokens must meet minimum circulating supply requirements before trading, and market orders are temporarily restricted post-listing. Tokens with low volume or unclear utility, such as so-called “zombie tokens” and memecoins, will face increased scrutiny and potential delisting if they fail to meet liquidity benchmarks or community engagement thresholds.

Who’s affected?

Non-profit organizations
Cryptocurrency exchanges
Institutional investors
Token issuers

Deadline:

June 2025: The new regulations for nonprofits and crypto exchanges are set to take effect
Later in 2025: The FSC plans to extend real-name account requirements to listed firms and professional investors, facilitating their entry into the crypto market

Share this article

AML Crypto Gambling Gaming Global Intermediate