Compliance Digest – October 2026

Every month, Sumsub's Compliance Team prepares a digest of the latest updates in AML and beyond, covering industries from AML to iGaming.

If you'd like to get the latest news in one place every month, subscribe to our newsletter.

AML and anti-fraud

Switzerland’s🇨🇭 FINMA Revises Video and Online Identification Circular to Accept the Swiss e-ID and Require Liveness Detection

What happened?

On October 8, 2026, FINMA adopted a partial revision of Circular 2016/7 “Video and online identification.” The circular sets out FINMA’s practice on due diligence for client onboarding through digital channels. The revision reflects the latest technology, in particular the upcoming Federal Act on Electronic Identity Credentials and Other Electronic Credentials (E-ID Act). The main changes are:

• Swiss e-ID accepted: The state-issued electronic identity can be used to identify clients onboarded digitally under the Anti-Money Laundering Act (AMLA). According to the trade press, it is accepted for online identification but not for video identification.
• QR-code documents: Identity documents with a QR code, such as the Swiss driver’s license, are now treated as equivalent to documents with a machine-readable zone.
• Liveness detection required: Online identification must include liveness detection as an additional security measure. This was added after the public consultation to address rising risks from new technologies, particularly AI.
• Residence verification: Digital processes that reliably link the client and their infrastructure to a place of residence may be used to verify residence during online identification.

FINMA also made other selective adjustments.

Who’s affected?

Financial intermediaries supervised by FINMA under the AMLA that onboard clients through video or online identification. This includes banks, securities firms, fund management companies, insurers, and other FINMA-supervised institutions. The revision is also relevant to SRO-affiliated intermediaries whose rules follow FINMA practice, and to identity verification providers serving the Swiss market.

Deadline:

The changes enter into force on November 1, 2026.

Read more: 

FINMA press release (October 8, 2026)

UK’s🇬🇧 FCA Consults on Financial Crime Guide Updates Covering APP Fraud, Money Mules, Crypto, and Sanctions Screening

What happened?

On October 23, 2026, the FCA published Consultation Paper CP26/38, proposing updates to its Financial Crime Guide. The consultation also covers proliferation financing, data security, financial crime systems and controls, and money laundering and terrorist financing. The proposals most relevant to transaction monitoring and screening are below.

1. APP fraud and money mules. The proposed guidance covers onboarding, monitoring, and reporting.

APP fraud red flags:

• changes in behavioral biometrics that don’t fit expected behavior
• changes in expected account turnover
• negative Confirmation of Payee results
• high-value transactions to new payees

Suggested read: Authorized Pushed Payment Fraud: From Reaction to Prevention

Money mule indicators:

• unexpected deposits
• rapid dispersal of funds through account networks
• international transfers
• rapid ATM withdrawals
• changes in dormant-account activity
• changes to credentials, devices, or contact details that don’t fit what the firm knows about the customer.

Suggested read: What Is a Money Mule? Red Flags, Examples, and Prevention

Good-practice examples:

• monitoring both inbound and outbound payments
• considering linked accounts and the wider transaction context
• basing rules on customer information
• regularly reviewing and testing alerts, and calibrating thresholds
• using machine learning proportionately, with staff who understand how the tools work
• for cryptoasset businesses, prescreening outbound transactions for addresses linked to fraud.

2. Cryptoassets. Proposed good-practice examples include:

• assessing higher risks of money laundering and terrorism financing and applying enhanced due diligence (EDD) where appropriate, including where unhosted wallets or privacy-enhancing measures are involved
• using blockchain analytics alongside existing risk-based AML policies, and to identify links to anonymity-enhancing technologies
• applying EDD to transactions involving unhosted wallets.

3. Sanctions screening.

• Trade sanctions: Where a firm has trade-sanctions exposure, it should consider screening for restricted goods and services, high-risk ports and countries, and sanctioned vessels.
• Cryptoassets: Firms should use on-chain and off-chain controls to screen customer activity and respond to possible sanctions evasion.
• Investment activities: Where restrictions apply to specified financial and investment activities, screening may also need to cover those activities. Examples include dealing in certain transferable securities or money market instruments.

The Guide contains no rules and imposes no new requirements. It sets out supervisory expectations, self-assessment questions, and examples of good and poor practice to help firms assess and strengthen their financial crime systems and controls.

Who’s affected?

All firms the FCA supervises for financial crime. This includes firms supervised under the Money Laundering Regulations 2017, such as cryptoasset businesses and Annex I financial institutions. Banks and payment firms are especially affected because of the APP fraud and money mule expectations.

Deadline:

Responses to the consultation are due by December 24, 2026. Feedback and the final Guide text will follow in a Policy Statement.

Read more: 

• FCA: CP26/38 Financial Crime Guide updates
• CP26/38 (PDF)

Thailand’s🇹🇭 BoT Issues Merchant Fraud Management Requirements for E-Payment Acceptance and E-Money Providers

What happened?

The Bank of Thailand (BoT) issued Notification No. 44/2569 on Merchant Fraud Management, dated September 29, 2026. It was published in the Royal Gazette on October 7, 2026, and took effect on October 8, 2026. It includes minimum standards and guidelines and was sent to institutions under Circular BOT.W. 6356/2569. The requirements cover merchant risk assessment and classification, onboarding, ongoing risk management, and monitoring and detection of unusual transactions.

Key monitoring requirements:

• Timely detection: Unusual transactions must be detected promptly. Monitoring conditions must reflect merchant risk and be regularly reviewed and improved to keep up with changing circumstances and fraud patterns.
• High-risk merchants: These need more intensive monitoring, using technology or processes that allow proactive, risk-appropriate examination of transactions.
• Watch list: Operators must keep a watch list of merchants and related websites showing suspicious behavior or transactions. The information must be available to the BoT on request.

The minimum standards list the information to consider when setting up monitoring:

• Business data: goods or services offered, sales, selling locations, merchant information, and the persons authorized to manage the merchant.
• Transaction data: sudden or abnormal changes in daily or monthly sales or per-transaction values, and large volumes of product returns or refunds.
• Other data: adverse news, related persons with political or fraud risk, and compliance with applicable rules and laws.

Who’s affected?

Regulated electronic payment acceptance and e-money providers that serve merchants. The covering circular is addressed to commercial banks, specialized financial institutions, and non-bank electronic payment service providers.

Deadlines:

• October 8, 2026: Notification in force.
• January 6, 2027: Deadline for policy and governance requirements for operators that can’t comply immediately. This is 90 days after the effective date.
• October 8, 2027: Existing merchant risk-management processes must be reviewed and aligned. This is one year after the effective date.

Read more: 

BoT Circular BOT.W. 6356/2569 with Notification No. 44/2569 and minimum standards (Thai, PDF)

Payments

EU🇪🇺 Council Adopts Its First-Reading Positions on PSD3 and the PSR, Leaving Only the European Parliament’s Second-Reading Vote

What happened?

On October 29, 2026, the Council of the EU adopted its first-reading positions on PSD3 and the Payment Services Regulation (PSR) as “A” items, meaning without discussion. The texts are not yet final law. The European Parliament must now approve them at second reading. The chair of the Parliament’s ECON Committee has already said that, if the Council adopted its position in line with the agreed provisional deal, she would recommend that the plenary accept it, subject to legal-linguistic checks. Key changes:

Fraud prevention:

• The PSR extends verification of payee (the IBAN/name check) beyond the existing euro credit-transfer requirements, subject to its scope and exceptions.
• PSPs get a framework, with safeguards, for sharing fraud-related data.
• PSPs are liable if they fail to apply the required fraud-prevention tools. This includes refunds for bank-impersonation (“spoofing”) scams, subject to conditions and exceptions.

Online financial ads: Very large online platforms and search engines must check that financial-services advertisers are authorized, under Commission supervision.

Open banking:

• Obstacles to TPP access are prohibited.
• Dedicated interfaces must meet performance standards.
• Users get permission dashboards to manage and revoke data access.

New structure: PSD3 and the PSR replace PSD2 and EMD2.

• Authorization and supervision sit in PSD3, which brings e-money institutions under the payment institution regime.
• Conduct, transparency, and fraud rules move into the directly applicable PSR.
• Existing payment institutions (PIs) and e-money institutions (EMIs) benefit from transitional arrangements.

Who’s affected?

• Payment service providers, including banks, PIs, and EMIs, as well as TPPs (account information and payment initiation service providers)
• Very large online platforms and search engines that carry financial-services ads

Deadlines:

• Next: European Parliament approval at second reading.
• Expected January 2027: Signature and publication in the Official Journal of the EU. This timing comes from the latest PSMEG discussion and is not yet confirmed.
• 20 days after publication: Entry into force.
• About November 2028: As a general rule, the PSR applies, and PSD3 must be transposed 21 months after entry into force. This estimate assumes January 2027 publication, and some exceptions apply.
• About May 2029: The new VoP provisions apply, six months after the general date (27 months after entry into force). Existing VoP obligations under the Instant Payments Regulation continue on their own timetable.
• Level 2: The EBA will develop technical standards under the final mandates.

Read more: 

• Council position at first reading on the PSR: statement of reasons (8543/26 ADD 1 REV 1, PDF)
• “I/A” item note on PSD3 (14794/26, PDF)
• Council session video (29 October 2026)

Age verification

Türkiye’s🇹🇷 Under-15 Social Media Ban and e-Devlet Age Verification Take Effect for Social Network Providers

What happened?

Türkiye’s Presidential Cyber Security Directorate prepared the Regulation on the Provision of Child-Specific Differentiated Services and Age Verification by Social Network Providers, published in Official Gazette No. 33396 on October 10, 2026. It implements the amendments to Internet Law No. 5651 that Türkiye’s parliament passed in April 2026. The main requirements are:

• Ban on under-15s: Providers may not offer services to children under 15. Age is checked at sign-up with a token generated through the e-Devlet Gateway, which shows only whether the user is above the 15 and 18 age thresholds. Sign-up requests from children found to be under 15 are rejected. Existing accounts found to belong to under-15s will be closed.
• Privacy-preserving tokens: The token does not contain names or other identifying information. The platform must confirm that the token was generated through e-Devlet under the Cyber Security Directorate’s authority, and then determine the user’s age category.
• Rules for ages 15–17: Accounts of users aged 15 to 17 must be private, with no option to make them public. Direct messaging is restricted, and content recommendations are limited. Users in this age group also lose personalized advertising, live streaming, and scrolling feeds.
• Parental controls and complaints: Providers must offer parental control tools for managing spending, usage time, and account settings, plus a free objection mechanism with human review.
• Transparency: Providers must make the reliability of their age-verification methods, their algorithms, and their child-focused service policies clear, auditable, and testable for users, parents, and the Directorate.
• Enforcement: Non-compliant providers get a reasonable period to fix the breach. If they don’t, the sanctions in Additional Article 4 of Law No. 5651 apply.

Suggested read: Age Verification in 2026: Terms and Tradeoffs

Who’s affected?

Domestic and foreign social media providers accessible from Türkiye and their users. Turkish law defines social network providers broadly as platforms that let users create, view, or share content for social interaction.

Adult users may also be affected. Enforcing the ban could require platforms to verify the age of virtually all users, including adults with anonymous accounts. Users who are not residents of Türkiye but are temporarily in the country are exempt from age verification.

Deadlines:

• November 1, 2026: Regulation in force. Age verification applies to all new accounts.
• March 31, 2027: Existing accounts must complete age verification, according to law-firm commentary on the transitional provision. Check this date against the Official Gazette text.

Read more: 

• Erdem & Erdem: Regulation on child-specific differentiated services and age verification published
• Hürriyet Daily News: Türkiye sets rules for under-15 social media ban

Crypto

US🇺🇸 OCC Finalizes First GENIUS Act Rule for Payment Stablecoin Issuers, Effective January 18, 2027

What happened?

On October 21, 2026, the Office of the Comptroller of the Currency (OCC) issued the first final rule from any federal stablecoin regulator under the GENIUS Act. It was published in the Federal Register on October 23 as Document 2026-21706.

Scope of the rule: It covers all the regulations the OCC must issue under the GENIUS Act, except those on the Bank Secrecy Act, AML, and OFAC sanctions. These will follow in a separate rulemaking coordinated with the Treasury.

Consultation: The final rule incorporates or addresses the comments received on the notice of proposed rulemaking.

New 12 CFR Part 15: Most of the rules sit here, covering:

• activities
• reserve assets
• redemption
• risk management
• audits, reports, and supervision
• state qualified issuers moving to the federal framework
• custody
• applications and registrations
• examination and supervision of foreign issuers
• revocation or rescission of approval
• capital and operational backstop

Other amendments: The rule also revises capital adequacy (12 CFR 3), prompt corrective action (12 CFR 6), assessment of fees (12 CFR 8), and rules of practice and procedure (12 CFR 19).

Notable details:

• Redemption: Redemption must be completed within two business days of the requested redemption date, and issuers must say so in a published redemption policy. The proposed automatic extension was dropped; instead, issuers must notify the OCC within 24 hours if redemption requests exceed 10% of a brand’s outstanding issuance.
• Reserves and reporting: Issuers must publish their reserve composition monthly on their websites and submit weekly confidential reports on Form PS-01. The rule requires a 5% on-demand cash minimum and a 40% single-counterparty limit, with exclusions (for example, the US government).
• Capital: Issuers need an ongoing capital floor of $5 million plus an operational backstop covering 12 months of total expenses.
• Yield ban: The rule applies the GENIUS Act’s ban on paying interest or yield to holders equally to retail and institutional holders. The OCC dropped its proposed presumption on rewards paid by affiliates and third parties in favor of a case-by-case approach.
• Perimeter: A “wrapped” stablecoin, meaning one redeemable for a payment stablecoin rather than monetary value, would not itself be a payment stablecoin. Technology providers fall outside the rule unless they issue payment stablecoins in a covered category or act as covered custodians.

Who’s affected?

National banks, federal savings associations, and federal branches, and their subsidiaries; foreign payment stablecoin issuers; nonbank entities seeking to be or approved as federal qualified payment stablecoin issuers; and state qualified issuers over which the OCC has regulatory or enforcement authority under the GENIUS Act. The custody provisions also cover custody activities by OCC-supervised banks.

Deadlines:

• January 18, 2027: The rule takes effect, the same day as the GENIUS Act.
• Limited waivers: The OCC will grant no waivers to prospective issuers not yet operating, and sees no compelling reason to waive other requirements, noting that issuers have had 18 months to prepare. Issuers already operating in the US that file a substantially complete application by January 18, 2027, can generally expect a waiver of the prior-approval requirement (OCC Bulletin 2026-51). Issuing payment stablecoins after January 18, 2027, without approval or a waiver risks criminal penalties.
• Weekly reporting: Form PS-01 reports start on January 25, 2027, subject to OMB approval.
• Separate rulemaking: The BSA/AML and OFAC rules are still to come, with no date yet.

Read more: 

OCC Bulletin 2026-50: GENIUS Act Regulations, Final Rule

South Korea’s🇰🇷 Draft FX Decree Brings Cross-Border Crypto Transfers Under Registration and Bank of Korea Reporting From December 3, 2026

What happened?

On October 7, 2026, the Ministry of Finance and Economy (MOFE) published a proposed amendment to the Enforcement Decree of the Foreign Exchange Transactions Act for public comment. It sets out the details of the amended Act, which the National Assembly passed on May 7, 2026, and which was promulgated on June 2, 2026. The amended Act includes provisions on monitoring cross-border virtual asset transfers. The draft makes four main changes:

New “virtual asset transfer business”: This covers transfers of virtual assets between domestic and overseas virtual asset service providers (VASPs), and between domestic VASPs and personal wallets.

Registration and reporting:

• To register, a VASP must already have completed VASP reporting under the Act on Reporting and Use of Certain Financial Transaction Information and be connected to the FX information network. The draft adds two further conditions: the computer systems needed for the business, and at least two professionals per business office, each with two or more years of FX experience or training designated by MOFE.
• Unlike money changers and overseas payment businesses, virtual asset transfer businesses would not face a minimum equity capital requirement.
• Operators must report virtual asset transfers to the Bank of Korea’s FX Information System. MOFE plans to share that data with the National Tax Service, the Korea Customs Service, the Financial Supervisory Service (FSS), and the FIU.
• The draft has no transitional provision. VASPs that support transfers to and from personal wallets may therefore need to be registered from December 3, 2026.

Reform of overseas payment business:

• Small-amount overseas remittance and other specialized FX businesses are merged into a single “overseas payment business” with six types. Four are existing: small-amount overseas remittance, electronic payment gateway services, e-money, and prepaid payment instruments. Two are new: overseas payment escrow and overseas electronic bill payment.
• Inspection of these businesses is delegated to the FSS, and supervision and sanctions to the Financial Services Commission.
• Once the decree is final, MOFE plans to amend the Foreign Exchange Transaction Regulations to allow foreign-currency prepaid payment instruments to be transferred to others within a set limit. This would bring services previously run under the financial regulatory sandbox into the regulated system.

Stricter rules for money changers:

• New registration requirements: minimum equity capital of at least KRW 10 million (the exact amount to be set by MOFE), and officers must not fall under the disqualification grounds in the Act on Corporate Governance of Financial Companies.
• A “one-strike-out” rule allows registration to be revoked for violations involving voice phishing proceeds, illegal trade payments, or crypto-related illegal remittances.
• Penalty surcharges imposed instead of business suspension can reach up to 100% of the gains from the violation.

The draft also lets the Korea Customs Service inspect service and capital transaction violations it discovers during import and export inspections.

Who’s affected?

• Korean VASPs that transfer virtual assets to or from overseas VASPs or personal wallets. This could include exchanges such as Upbit and Bithumb, where their activities meet the definition.
• Overseas payment providers, including small-amount remittance firms, payment gateways, and e-money and prepaid payment issuers
• Money changers

Deadlines:

• October 26, 2026: Public comment period closed.
• Before December 3: The draft still has to go through regulatory review by the Office for Government Policy Coordination, examination by the Ministry of Government Legislation, a vice-ministerial meeting, and a Cabinet meeting.
• December 3, 2026: Scheduled entry into force, the same date as the revised Foreign Exchange Transactions Act.

Read more: 

MOFE press release: Proposed amendment to the Enforcement Decree of the Foreign Exchange Transactions Act announced for public comment (October 7, 2026, Korean)

iGaming

Serbia’s🇷🇸 Gaming Authority Updates Transaction-Reporting Specifications for Online Operators and Casinos, in Force From November 1, 2026

What happened?

On October 26, 2026, Serbia’s Gaming Authority (Uprava za igre na sreću) published amendments, dated October 23, 2026, to its Instructions on integrating operators’ information and communication systems with its own system. The amendments update the technical specifications for transaction reporting under the rules for special games of chance through electronic communications (online) and special games of chance in casinos.

Online operators:

• Endpoints: All deposits are reported through one endpoint (/lot/deposit) and all withdrawals through another (/lot/withdraw).
• Deposit types: Deposits can be labeled “Promo transfer” (bonus money) or “Other.”
• Payment provider field: This now carries the transaction ID issued by the payment or e-money institution that funded the account.
• New mandatory field: Operators must record the registered name of the company or entrepreneur through which the top-up was made. On-site payments and promo transfers are exempt.

Land-based casinos:

• Table events: A new section requires reporting of each table’s opening, pausing, filling, crediting, closing, and reconciliation, plus a full daily reconciliation. This builds on the casino information system Rulebook (Official Gazette No. 47/2026), which requires a dedicated module to calculate, monitor, and control transactions for each table and for all tables in the casino.
• Message contents: Every message must include the table’s sticker number, event time, event ID, and gaming date. Amounts are reported in Serbian dinars (RSD).

The update does not change identification requirements. It gives the regulator much clearer visibility into money flows. Each deposit is linked to a specific payment record at a named institution, and withdrawals and bonus money are reported separately. This makes it easier to spot cases where the person who passed KYC isn’t the one funding or cashing out the account.

Who’s affected?

Gaming operators licensed in Serbia whose systems are connected to the Gaming Authority’s system:

• operators of online games of chance
• land-based casinos.

Deadline:

The amendments apply from November 1, 2026. Operators’ system integrations must already reflect the new specifications.

Read more: 

Revised Instructions for integrating operators’ information and communication systems with the Gaming Authority’s system (published 26 October 2026)

Spain’s🇪🇸 Royal Decree 813/2026 Requires Online Gambling Operators to Verify Payment Method Ownership on Deposits and Withdrawals

What happened?

Royal Decree 813/2026 was published in the Official State Gazette on October 8, 2026. It amends Spain’s AML/CFT rules and requires online gambling operators to check that the holder of the payment method used for deposits and withdrawals is the same person as the gambling account holder. It amends Article 21 of Royal Decree 304/2014, the regulation implementing Spain’s AML law (Ley 10/2010). The decree makes two main changes:

Payment ownership checks (Article 21.2):

• Operators must build payment ownership checks into their standard CDD/KYC workflows, across all digital channels, including desktop and mobile.
• The bank account, card, or e-wallet must belong to the registered player. This applies to deposits and withdrawals, not only at onboarding.
• No specific technical solution is mandated.
• Personal identification and payment ownership verification are separate checks, so players may be asked for the second even if they have already completed the first.

Non-face-to-face identification (Article 21.1(d)): Operators using “other secure” remote identification procedures must now meet the minimum requirements in SEPBLAC’s general authorizations. These are the live videoconference procedure (February 2016) and the asynchronous video-identification procedure (May 2017). This aligns the regulation with SEPBLAC’s March 2025 guidance for online gaming operators.

The Ministry of Consumer Affairs said data from the DIRECCIÓN GENERAL DE ORDENACIÓN DEL JUEGO (DGOJ) showed that people impersonating others used payment methods whose ownership was hard to verify in real time. The decree is part of a wider reform adapting Spain’s rules to international requirements, including the FATF evaluation of Spain. It also covers sectors beyond gambling.

The wider reform of Spain’s Gambling Act (Ley 13/2011) has stalled. Parliament has been dissolved ahead of the November 29 general election, so the file now depends on the next government. This does not affect Royal Decree 813/2026, which sits in AML legislation.

Who’s affected?

• Online gambling operators with a state license
• Players using bank accounts, cards, or e-wallets. Payment method ownership must match the registered account holder
• Compliance is supervised by SEPBLAC, Spain’s FIU. The DGOJ must be notified of contract terminations.

Deadlines:

• October 28, 2026: The decree entered into force, 20 days after publication. New accounts must comply from that date. Existing accounts have a six-month transition period for operators to adapt their payment methods and technical systems.
• Until April 28, 2027: Unverified existing players can keep depositing and playing, but operators may not process withdrawals until they verify payment ownership.
• April 28, 2027: If verification is still incomplete, the operator must terminate the contract unilaterally, notify the DGOJ, and return existing balances, including winnings not yet paid out. This is without prejudice to the operator’s AML/CFT obligations.

Read more: 

• BOE: Royal Decree 813/2026 (BOE-A-2026-20915)
• Ministry of Consumer Affairs press release (28 October 2026, Spanish)