Compliance Digest—December 2025

Every month, Sumsub’s Compliance Team prepares a digest with all the latest updates in the world of AML and beyond. We cover multiple industries, from crypto and AML to gaming.

If you want to get the latest news every month in one place, subscribe to our newsletter.

AML

UAE 🇦🇪 Issues 2025 Executive Regulations Implementing the New AML Law

What happened?

Following the enactment of Federal Decree Law No. 10 of 2025 on combating money laundering, terrorist financing, and the financing of the proliferation of weapons (the “New AML Law”), the UAE Cabinet issued Cabinet Decision No. 134 of 2025, setting out the Executive Regulations. These Regulations entered into force on December 14, 2025, repealing and replacing the 2019 AML Regulations, and establishing an expanded and modernized AML/CTF compliance framework aligned with updated FATF standards. The Regulations also explicitly bring Virtual Asset Service Providers (VASPs) within scope.

Who’s affected?

• Financial Institutions (FIs) operating in or from the UAE
• Designated Non-Financial Businesses and Professions (DNFBPs)
• Virtual Asset Service Providers (VASPs)
• Supervisory authorities, including the Financial Intelligence Unit (FIU)
• Entities subject to ultimate beneficial ownership (UBO) transparency requirements

Deadline: December 14, 2025: Executive Regulations entered into force

Read more: Federal Decree by Law No. (10) of 2025 Regarding Anti-Money Laundering, and Combating the Financing of Terrorism and Proliferation Financing

Crypto 

EU 🇪🇺

Basel Committee Reaffirms Basel III Priority and Advances Work on Third-Party Risk and Cryptoassets

What happened?

At the very end of November, following its meeting in Mexico City on 18–19 November 2025, the Basel Committee on Banking Supervision issued a press release outlining key outcomes. The Committee reaffirmed its highest priority of full and consistent implementation of Basel III, approved final principles on the sound management of third-party risk, and agreed to expedite a targeted review of elements of the prudential standard for banks’ cryptoasset exposures. The Committee also discussed financial stability risks, digitalization of finance, regulatory implementation, and the financial impacts of extreme weather events.

Who’s affected?

• Banks subject to Basel III requirements
• Banking supervisors and regulators across Basel Committee member jurisdictions
• Banks engaging in third-party outsourcing and service arrangements
• Banks with cryptoasset exposures
• Market participants relying on Pillar 3 disclosures

Deadline: First quarter of 2026: Consultation on consolidating Basel Committee guidelines and sound practices

Read more: Basel Committee continues to prioritise Basel III implementation, approves final principles on third-party risks and agrees to expedite targeted review of cryptoasset standard

UK 🇬🇧 Lays Final Draft Legislation for Cryptoasset Regulatory Regime

What happened? On December 15, 2025, the UK government laid the final draft legislation in Parliament to establish a new regulatory regime for cryptoassets under the Financial Services and Markets Act 2000. This regime defines which cryptoasset activities require FCA authorization, including trading platforms, custody, staking, and intermediaries. In December 2025, the FCA also published consultations (CP25/40 and CP25/41) on rules and guidance for regulated cryptoasset activities, including market abuse, admissions, and disclosure requirements.

Who’s affected?

• Firms providing crypto trading platforms, custody, or intermediary services in the UK
• Crypto firms planning to engage in regulated activities once the regime is enacted
• Market participants subject to upcoming FCA rules and consultation outcomes
• Consumers and investors protected under the new regulatory perimeter

Deadline:

• Early 2026: Closing dates for FCA consultations (CP25/40 & CP25/41)
• 2027 (expected): Full implementation of the regulatory regime for cryptoassets

Read more:

• UK Government: Draft SI & Policy Note – Regulatory Regime for Cryptoassets
• FCA CP25/40 Consultation: Regulating Cryptoasset Activities

Canada’s 🇨🇦 Central Bank Sets Criteria for ‘Good Money’ Stablecoins Under Upcoming Regulation

What happened?

In December 2025, the Bank of Canada outlined criteria for future stablecoin regulation, indicating that only fiat‑backed, high‑quality stablecoins pegged 1:1 to a central bank currency will be permitted under Canada’s forthcoming stablecoin regulatory framework. The aim is to ensure stablecoins function as “good money,” similar to banknotes or deposits, by requiring robust backing and operational resilience. These comments reflect progress in Canada’s development of a national stablecoin regulatory regime expected in 2026.

Who’s affected?

• Stablecoin issuers and crypto firms planning to operate in Canada once the regulatory regime is in force
• Financial institutions and payment service providers involved in stablecoin infrastructure and liquidity
• Consumers and businesses that use or plan to use stablecoins for payments or digital transactions in Canada
• Regulators and policymakers shaping Canada’s digital finance safeguards and legal framework

Deadline:

No immediate compliance deadline announced in December 2025; the stablecoin regulatory regime is expected to take effect in 2026 as part of Canada’s broader regulatory rollout.

Read more: Bank of Canada lays out criteria for ‘good money’ stablecoins

Suggested read: Global Stablecoin Compliance: GENIUS Act, MiCA, Hong Kong, Singapore, and More Key Rules

Gambling 

EU 🇪🇺

France 🇫🇷 Adopts New Certification Requirements for Online Gambling Operators

What happened?

On December 22, 2025, the French National Gambling Authority (ANJ) adopted and published new technical requirements (ET5 version 1.0) governing the certification of licensed gambling and betting operators, as well as operators holding exclusive rights. The requirements set out updated certification procedures and technical controls applicable to online gaming and betting activities, including security and audit standards.

Who’s affected?

• Online gambling and sports betting operators licensed by the ANJ
• Gambling and betting operators holding exclusive rights in France
• Certification bodies and technical auditors involved in operator certification

Deadline:

The certification process must be completed within six months of commencing operation of a new hardware archiving support device (SMA). In addition, annual certification is required. For authorized operators, this must be completed on the license anniversary date. Operators holding exclusive rights must complete certification on a date agreed upon with the ANJ.

Read more: France National Gambling Authority (ANJ) regulatory announcement published on December 23, 2025

Finland 🇫🇮 Adopts New Gambling Act Introducing Licensing Regime and B2B Software Requirements

What happened?

On December 19, 2025, the Finnish Parliament published the new Gambling Act following its second reading on December 16, 2025. The Act reforms Finland’s gambling framework by maintaining Veikkaus Oy’s monopoly over certain gambling activities while opening others to a local licensing regime. It also introduces mandatory licensing for gaming software suppliers, sets the minimum gambling age at 18, and establishes new supervisory structures and fees.

Who’s affected?

• Gambling operators seeking to offer online casino games, online bingo, online slot games, land-based and online betting, and horse racing in Finland
• B2B suppliers involved in the manufacture, delivery, installation, or adaptation of gaming software
• Current and prospective gambling software providers
• Regulatory authorities, including the National Police Board and the future Licensing and Supervisory Authority

Deadline:

• March 1, 2026: Provisions on applications for gambling and exclusive licenses enter into force
• July 1, 2027: Provisions on gaming software licenses enter into force
• June 30, 2027: End of the National Police Board’s role as gambling regulator
• July 2028: Licensed gambling operators may only use gaming software from licensed suppliers

Read more: The Riksdag's response  RSv  170 /2025 rd — RP 16/2025 rd 

Government bill to the Riksdag with proposed legislation on a new gambling system

Lithuania 🇱🇹 Notifies the European Commission of Requirements for Remote Gambling Platforms

What happened?

On December 18, 2025, Lithuania notified the European Commission of amendments to the Order on Requirements for Remote Gambling Platforms. The proposed amendments modify the method by which data is transmitted from remote gambling platforms to the slot machine control information system.

Who’s affected?

• Remote gambling platform operators in Lithuania
• Operators offering lotteries, online gambling, and sports betting
• Regulatory and technical stakeholders involved in data transmission and monitoring systems

Deadline:

March 19, 2026: End of the European Commission standstill period

Read more: European Commission notification dated December 18, 2025

UK 🇬🇧

UK Gambling Commission Updates on Changes to Key Event Reporting and Consumer Legislation

What happened?

On December 18, 2025, the UK Gambling Commission published regulatory changes that will update financial key event reporting requirements for licensed gambling operators and align parts of the Licence Conditions and Codes of Practice (LCCP) with new consumer legislation introduced by the Digital Markets, Competition and Consumers (DMCC) Act 2024. These changes were made following consultation and are designed to improve the Commission’s oversight of operator finances and ensure consumer protections reflect current law. 

Who’s affected?

• Gambling operators licensed by the UK Gambling Commission
• Licensees required to report financial key events (e.g., changes in ownership, finances, and interests)
• Regulatory and compliance teams tasked with ensuring LCCP adherence
• Consumers benefiting from updated consumer protection provisions embedded in the LCCP

Deadline:

• March 19, 2026: Changes to financial key event reporting come into force. 
• April 6, 2026 (and onward): Certain consumer-related amendments to the LCCP will take effect once provisions of the DMCC Act are implemented; some changes depend on when the Department for Business and Trade enacts related measures to abolish obsolete dispute resolution regulations. 

Read more: Financial key event and consumer legislation changes

LATAM 🌎

Brazil 🇧🇷 Introduces New Taxation Rules for Bettors and Gambling Operators

What happened?

On December 18, 2025, the Brazilian Federal Revenue Service (RFB) published Normative Instruction RFB No. 2,299, introducing new taxation rules applicable to both players and gambling operators. The instruction establishes how winnings are calculated, reported, and taxed, sets exemptions, and imposes new reporting and withholding obligations on operators. The rules apply immediately.

Who’s affected?

• Gambling and betting operators active in Brazil
• Players participating in virtual sports events, real sporting events, and fantasy sports
• The Brazilian Federal Revenue Service (RFB).

Deadline:

• Last business day of April (annually): Deadline for payment of the 15% tax on net prizes
• Last day of February (annually): Operators must issue the ComprovaBet tax document to bettors
• Effective immediately upon publication (December 18, 2025).

Read more: Normative Instruction RFB No. 2,299, issued by the Brazilian Federal Revenue Service

Peru 🇵🇪 Sets Deadline for Audit and Integrity Reports for Remote Gambling Operators

What happened?

On December 15, 2025, Peru’s Ministry of Foreign Trade and Tourism (MINCETUR) announced a deadline for submitting Audit Reports and Technology Platform Integrity and Security Assessment Reports for operators of remote gaming platforms and remote sports betting technology platforms. The reports must demonstrate compliance with approved Technical Standards III and meet specific certification requirements.

Who’s affected?

• Operators of remote gaming platforms in Peru
• Operators of remote sports betting technology platforms
• Certification laboratories authorized by MINCETUR
• Third-party auditors involved in technology platform assessments

Deadline: January 20, 2026: Deadline to submit audit reports and integrity and security assessment reports

Read more: Peru Ministry of Foreign Trade and Tourism (MINCETUR) regulatory announcement published on December 15, 2025