Aug 01, 2025
8 min read

Compliance Digest—July 2025

Learn about all the latest compliance updates from the past month.

Every month, Sumsub’s Compliance Team prepares a digest with all the latest updates in the world of AML and beyond. We cover multiple industries from gambling to AML.

If you want to get the latest news every month in one place, subscribe to our newsletter.

AML

UK 🇬🇧

The UK FCA published its ‘Finalised Guidance’ on PEP treatment

What happened?

On July 7, 2025, the Financial Conduct Authority (FCA) published its Finalised Guidance FG25/3 on PEP treatment, replacing prior guidance issued in 2017 (FG17/6), and incorporating legislative changes and findings from a 2024 multi-firm review and consultation. A minor revision was issued on July 15, 2025 to clarify that non‑executive board members (NEBMs) of UK civil service departments should not be treated as PEPs unless they meet the definition in another capacity.

Who’s affected?

All FCA-regulated firms subject to the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (e.g., banks, insurers, wealth managers) engaging with PEPs, their family members, or close associates.
Those needing to update policies, risk assessment protocols, and training to reflect proportional, risk-based EDD based on the updated definitions and sign‑off expectations.

Deadline:

The Guidance takes immediate effect as of its publication on July 7, 2025, with the updated wording (including NEBM clarification) effective from July 15, 2025.
Firms are expected to implement changes promptly, aligning their AML controls—including due diligence, risk assessments, and escalation frameworks—to meet FCA expectations without undue delay.

Crypto

Hong Kong 🇭🇰

Hong Kong finalized stablecoin regime

What happened?

Last month, the Hong Kong Monetary Authority (HKMA) published the following finalized documents effective  August 1,  2025, marking the official launch of the stablecoin regulatory regime:

Final guidelines on supervising licensed stablecoin issuers
Final AML/CFT guidelines for licensed stablecoin issuers
Two explanatory notes: one on licensing, another on transitional provisions for pre-existing issuers.

Who’s affected?

Entities intending to issue fiat‑referenced stablecoins (FRS) in or targeting Hong Kong—including HKMA‑licensed issuers, banks, SVF providers, and SFC‑licensed VASPs—must now comply with the new licensing regime.
Existing FRS issuers operating in Hong Kong (pre‑regime) fall under transitional provisions, if they apply for a license within the specified timeframe.

Deadline:

Regime commencement: On August 1, 2025 the guidelines become enforceable and are officially gazetted
Application deadlines: First feedback window closes on August 31, 2025. Institutions should contact HKMA by this date for regulatory guidance and feedback.
Issuance of licences: HKMA anticipates granting the first stablecoin issuer licences in early 2026, starting with only a small number of applicants.

US 🇺🇸

The US Congress passed the GENIUS Act

What happened?

The US Congress passed the GENIUS Act (“Guiding and Establishing National Innovation for US Stablecoins”), the country’s first comprehensive national law regulating stablecoins—cryptocurrencies pegged 1:1 to assets like the US dollar or other low-risk reserves. Stablecoins must now be fully collateralized by eligible assets, establishing a formal regulatory regime for this rapidly growing sector.

Who’s affected?

Stablecoin issuers operating in, or serving the US market—subject to new capital, custody, and compliance rules.
Crypto exchanges, digital wallets, and financial intermediaries handling stablecoin transactions.
Policy makers and regulators, as the Act lays the foundation for broader federal oversight of digital currencies.

Deadline:

The legislation cleared Congress in mid‑July 2025 and awaits signature by the President, which is expected shortly thereafter.
Once signed into law, it becomes the first binding national regulation governing stablecoins—setting a precedent for cryptocurrency policy in the US.

Gambling

Isle of Man 🇮🇲

The Isle of Man seeks to modernize its gambling legislation

What happened?

On July 2, 2025, the GSC launched a public consultation on proposed reforms across seven existing gambling statutes, including:

Gambling (Anti‑Money Laundering and Countering the Financing of Terrorism) Act 2018
Gambling Supervision Act 2010
Online Gambling Regulation Act 2001
Casino Act 1986
Gaming, Betting and Lotteries Act 1988
Other legacy acts from 2006 and 1984.

The reforms aim to harmonize and modernize regulatory powers across the suite of laws, including unified inspection and investigation powers, standardized definitions (e.g. beneficial owners, controllers, senior managers), and tougher enforcement tools—modeled on the UK Financial Services Act 2008. The goal is to ensure readiness for the 2026 MONEYVAL evaluation by international standards. After consultation, the revised legislation will be submitted to Tynwald (the Isle of Man Parliament) for approval.

Who’s affected?

Licensed gambling operators in the Isle of Man (land-based and online), including casinos, betting platforms, lotteries, and iGaming businesses.
Key individuals within firms: senior managers, controllers, beneficial owners, MLROs, and AML compliance officers, who would now fall under robust, lifecycle “fit and proper” scrutiny.
Corporate service providers and associated parties involved in licensing, governance, or compliance—due to enhanced duty and disclosure requirements.
Consumers and the reputation of the jurisdiction—as the reforms reinforce the Isle of Man’s regulatory integrity ahead of the 2026 MONEYVAL peer review.

Deadline:

Consultation period: From July 2 to August 13, 2025 (six weeks in total) for stakeholders to submit feedback.

Read more: Gambling legislation reforms

Italy 🇮🇹

Italy’s regulator postponed the deadline for online gambling concession submissions

What happened?

Last month, Italy’s Customs and Monopolies Agency (ADM) extended the approval process for new online gambling licenses from the original deadline of September 17, 2025 to November 12, 2025. This gives regulators additional time to conduct thorough eligibility and compliance checks on applicants. Application results: 52 submissions from 46 distinct companies have cleared initial technical checks.

Who’s affected?

New entrants and existing operators pursuing online gambling licenses.
Current license holders: Under prior guidance, existing operators can continue their activities until March 2026, after which only those with newly issued licences will be permitted to operate. It remains unclear if the extension affects this arrangement.

Deadline:

New completion deadline for licensing checks: November 12, 2025. Existing licensees can operate through March 2026. After that, only new license holders (from this current round) may continue.

Read more: DETERMINAZIONE DIRETTORIALE

New Zealand 🇳🇿

New Zealand seeks submissions on Online Casino Gambling Bill

What happened?

The Governance and Administration Committee of New Zealand is calling for submissions on the Online Casino Gambling Bill. The bill proposes a licensing regime for online casino gambling aimed at creating a safer, regulated market. It would ban unlicensed operations and advertising, while introducing consumer protections within the licensed framework.

Who’s affected? Market stakeholders

Deadline: August 17, 2025

Online safety

UK 🇬🇧

The UK began enforcement of its Online Safety Act

What happened?

Enforcement of the UK Online Safety Act began on March 17, 2025, with the implementation of illegal content duties, and escalated on July 25, 2025, with full child safety provisions, including mandatory age assurance for access to pornography and harmful content.

Who’s affected?

Search services and all user-to-user platforms (forums, messaging apps, video-sharing sites, etc.) that have UK users or are likely to be accessed by minors.
Pornographic content providers (Part 5 services), which must implement “highly effective age assurance”—live selfies or ID verification—to exclude minors.
Risk category providers will be identified in consultation as Category 1 services, needing extra duties like transparency reporting and stricter enforcement.

Deadline: On July 25, 2025 the Child Safety Codes came into force. Platforms must operationally implement risk mitigation measures from this date.

Meanwhile, Ofcom must deliver statutory reports including:

Age assurance effectiveness by July 2026
Content harmful to children by October 2026
App store oversight report by January 2027

Read more: Online Safety Act

EU 🇪🇺

The European Commission adopted and published the final version of its Guidelines on the Protection of Minors online under the Digital Services Act

What happened?

On July 14, 2025, the European Commission (EC) adopted and published the final version of its Guidelines on the Protection of Minors Online under Article 28(1) of the Digital Services Act (DSA). These guidelines were previously released in draft form for public consultation beginning on May 13, 2025, with feedback accepted through June 15, 2025. The process included a call for evidence (July–September 2024), stakeholder workshops in October 2024 and June 2025, and focus groups with over 150 young people across EU Member States.

Who’s affected?

All online platforms that are “accessible to minors” under the DSA, regardless of whether their terms of service set a minimum age, unless they qualify as micro or small enterprises, which are exempt.
Very Large Online Platforms and Search Engines—due to systemic-risk obligations under Article 34 DSA—are expected to integrate these guidelines into their broader risk assessments.
National regulators and Digital Services Coordinators will reference the guidelines in evaluating platform compliance, though adherence is voluntary.

Deadline:

There is no explicit legal deadline tied to the adoption of the guidelines; they are effective as of July 14, 2025, when published.
Nonetheless, they serve as a significant benchmark that the EC will draw on in enforcement of Article 28(1) DSA. Platforms should conduct a “risk review” (or update existing reviews) promptly, and at least annually or upon significant changes to their service design.

Share this article

AML Crypto Digest Global Hong Kong Intermediate UK