Compliance Digest—September 2025

Every month, Sumsub’s Compliance Team prepares a digest with all the latest updates in the world of AML and beyond. We cover multiple industries from gambling to crypto.

If you want to get the latest news every month in one place, subscribe to our newsletter.

AML 

Global 🌎

FATF and partners launch handbook to strengthen global cooperation against money laundering

What happened?

On September 5, 2025, the Financial Action Task Force (FATF), in collaboration with the Egmont Group, INTERPOL, and the United Nations Office on Drugs and Crime (UNODC), launched a practical Handbook on International Cooperation against Money Laundering. This handbook aims to enhance global collaboration among financial intelligence units (FIUs), law enforcement agencies, and prosecutors to expedite investigations and prosecutions of money laundering activities. It emphasizes the importance of informal cooperation mechanisms, such as secure communication channels and joint analysis, to complement formal legal processes. 

Who’s affected?

• Financial Intelligence Units (FIUs)
• Law Enforcement Agencies (LEAs)
• Prosecutors
• Other competent authorities involved in AML efforts

Deadline:

There is no specific implementation deadline. However, institutions are encouraged to adopt these practices promptly to enhance the effectiveness of international cooperation in combating money laundering.

Read more:

FATF, Egmont Group, INTERPOL and UNODC call for stronger co-operation between countries as they launch handbook to fight money laundering

South Africa  🇿🇦 

FIC issues updated guidance note 7A on FICA compliance requirements

What happened?

On September 1, 2025, the Financial Intelligence Centre (FIC) published Revised Guidance Note 7A, which supersedes both the previous Guidance Note 7A (published on 13 February 2025) and Guidance Note 7 (published on 2 October 2017). This revision introduces updated compliance requirements for accountable institutions under the Financial Intelligence Centre Act (FICA), aligning with the General Laws (Anti-Money Laundering and Combating Terrorism Financing) Amendment Act, 2022 (Act 22 of 2022), and the FIC’s Public Compliance Communication 59 (PCC 59) on beneficial ownership. 

Who’s affected?

All accountable institutions as defined under FICA are impacted by this update. These include financial institutions, legal practitioners, estate agents, casinos, and other businesses engaged in financial services or transactions that may be susceptible to money laundering or terrorist financing risks. 

Impact on business (what affected parties should do):

Affected institutions must:

• Adopt a risk-based approach: Implement measures to assess and mitigate money laundering and terrorist financing risks, tailoring compliance efforts to the specific risks associated with clients, products, services, delivery channels, and geographic locations. 
• Enhance Customer Due Diligence (CDD): Based on the risk assessment, apply appropriate levels of CDD, ensuring thorough verification of client identities and understanding of business relationships. 
• Maintain comprehensive records: Ensure that records related to CDD, transactions, and other relevant information are kept for at least five years, as stipulated by FICA. 
• Develop and implement a Risk Management and Compliance Programme (RMCP): Establish a documented RMCP that is approved by the board of directors or senior management, outlining procedures to identify, assess, monitor, and mitigate risks associated with money laundering, terrorist financing, and proliferation financing. 
• Comply with United Nations Security Council Resolutions: Implement measures to freeze assets and restrict transactions in accordance with relevant UNSC resolutions, ensuring compliance with targeted financial sanctions. 

Deadline:

The revised guidance is effective September 1, 2025. Affected institutions should have already commenced implementing the updated requirements.

Read more: 

REVISED GUIDANCE NOTE 7A ON THE IMPLEMENTATION OF VARIOUS ASPECTS OF THE FINANCIAL INTELLIGENCE CENTRE ACT, 2001 (ACT 38 OF 2001)

Suggested read: The 10 Most Common AML Red Flags to Watch Out for in 2025

India 🇮🇳

India’s RBI introduces 2025 framework for payment aggregators: new KYC, AML, and RegTech opportunities

What happened?
The Reserve Bank of India (RBI) introduced the “RBI (Regulation of Payment Aggregators) Directions, 2025” on September 15, 2025. This framework sets uniform regulatory requirements for all Payment Aggregators (PAs) to strengthen integrity, security, and compliance standards in India’s digital payments ecosystem.

Who’s affected?

• All payment aggregators (PAs) operating in India
• Merchants onboarding through PAs, including small businesses
• RegTech providers acting as agents for PAs (strategic opportunity).

Impact on business (what affected parties should do):

1. Use of agents & assisted mode
   • PAs can use agents for merchant due diligence and onboarding.
   • Permitted activities: Digital KYC, Assisted Video KYC (V-CIP) for individuals/proprietors/UBOs/authorized signatories.
   • Conditions: Maintain agent details, audit trails, conduct due diligence on agents, ultimate compliance responsibility remains with PA.
   • Opportunity for RegTech providers like Sumsub to offer KYC/onboarding solutions as authorized agents.
2. Enhanced KYC & Due Diligence
   • Merchant onboarding requires comprehensive Customer Due Diligence (CDD) via Central KYC Records Registry (CKYCR), cross-verification, or local alternatives.
   • Streamlined due diligence for small merchants (≤ ₹40 lakh annual turnover or ≤ ₹5 lakh export turnover).
   • Background and antecedent checks required for all merchants.
   • Ongoing transaction monitoring based on merchant profile.
   • PAs must register with FIU-IND and comply with STR/Cash Transaction reporting under PMLA, leveraging automated real-time screening.
3. Merchant profiling & risk management
   • Assign Merchant Category Codes (MCC) at onboarding and throughout the merchant lifecycle, with real-time validation.
   • Monitor business line changes, AML, PEP, adverse media, and criminal records.
   • Implement advanced technology for fraud detection, data security (PCI-DSS compliance), and regular independent cyber audits.

Deadline:

Regulations are effective from September 15, 2025. PAs should begin implementing compliance measures immediately.

Read more: RBI Master Directions on Regulation of Payment Aggregators, 2025

Crypto 

EU 🇪🇺

ESMA issues guidelines on suitability and reporting for crypto portfolio management under MiCA

What happened?

On September 25, 2025, the European Securities and Markets Authority (ESMA) published Guidelines (ESMA35-1872330276-2031) concerning certain aspects of suitability requirements and the format of the periodic statement for portfolio management activities under the Markets in Crypto Assets Regulation (MiCA). 

Who’s affected?

• Crypto-asset service providers (CASPs) engaged in portfolio management activities within the EU.
• National competent authorities responsible for overseeing compliance with MiCA.

Impact on business (what affected parties should do):

• CASPs must align their portfolio management practices with the suitability requirements outlined in the guidelines. CASPs are also required to implement standardized formats for periodic statements, ensuring transparency and consistency in reporting to clients.
• National competent authorities should integrate these guidelines into their supervisory frameworks to ensure uniform application across the EU.

Deadline:

The guidelines are set to apply 60 calendar days after their publication in all EU official languages, which is expected to be by November 25, 2025.

Read more: ESMA Guidelines on Suitability and Periodic Statements under MiCA

Suggested read: Markets in Crypto-Assets Regulation (MiCA) in the EU: Learn Who MiCA Impacts (2025)

Lithuania 🇱🇹

Bank of Lithuania issues rules for payee verification in the system

What happened?

On August 26, 2025, the Bank of Lithuania introduced a comprehensive set of regulatory measures impacting Crypto-Asset Service Providers (CASPs), asset-referenced token (ART) issuers, electronic money institutions (EMIs), and payment institutions (PIs). These measures include:

• CASP & ART issuer reporting: Effective from 1 January 2026, CASPs and ART issuers must submit quarterly and annual reports covering financial position, profit and loss, revenues, capital adequacy, client portfolios, transactions, and token activities.
• Verification of Payee (VoP) rules in CENTROlink: Resolution No. 03-123, effective from 28 August 2025, establishes operational and risk management standards for participants using the VoP service in the CENTROlink system.
• EMI & PI reporting obligations: Institutions must now submit detailed financial and operational reports, including balance sheets, profit and loss statements, and client funds data, using specific forms such as EM008_01.

Who’s affected?

The new regulations apply to:

• Crypto-Asset Service Providers (CASPs)
• Asset-Referenced Token (ART) issuers
• Electronic Money Institutions (EMIs)
• Payment Institutions (PIs)

Impact on business (what affected parties should do):

Affected institutions should:

• Prepare for reporting deadlines: Ensure readiness to submit the first quarterly reports by April 2026 and the first AML/CTF reports by July 2026.
• Align internal procedures: Adapt internal processes to comply with the new VoP rules and reporting requirements.
• Implement robust risk management: Establish and maintain effective risk management frameworks to meet operational and business continuity standards.

Deadline:

The first quarterly reports, covering Q1 2026, are due in April 2026. The first AML/CTF reports, covering the first half of 2026, are expected in July 2026.

Read more: NUTARIMAS: DĖL LIETUVOS BANKO MOKĖJIMO SISTEMOS CENTROLINK MOKĖJIMO GAVĖJO PATIKROS taisyklių patvirtinimo

UK 🇬🇧

UK’s FCA consults on extending handbook rules to regulated cryptoasset activities

What happened?

On September 17, 2025, the UK’s Financial Conduct Authority (FCA) published Consultation Paper CP25/25, proposing the application of existing FCA Handbook rules to firms conducting regulated cryptoasset activities. This consultation aims to ensure that cryptoasset firms operate with appropriate systems, controls, processes, financial resources, and personnel, aligning them with standards expected of existing Financial Services and Markets Act 2000 (FSMA)-authorized firms.

Who’s affected?

The proposals will affect consumers and firms who conduct, or interact with regulated cryptoasset activities as set out in the Treasury’s draft Statutory Instrument.

Impact on business (what affected parties should do):

Firms planning to undertake any of the regulated cryptoasset activities as set out in the Treasury’s draft Statutory Instrument should:

• Apply for authorization before carrying out any of these activities by way of business in the UK.
• Align internal procedures to comply with the proposed application of existing FCA Handbook rules, including governance, financial crime prevention, operational resilience, and consumer protection standards.

Deadline:

The consultation closes on November 12, 2025, for chapters 1-5, and on October 15, 2025, for chapters 6-7.

Read more: CP25/25: Application of FCA Handbook for Regulated Cryptoasset Activities

Gambling

Slovakia 🇸🇰

Slovakia introduces gambling bonus restrictions and updated advertising rules

What happened?

Draft amendment to the Gambling Act: On September 26, 2025, a draft law was submitted to the Slovak Parliament proposing changes to the Gambling Act. The amendment would restrict gambling bonuses by prohibiting free spins or other free game rounds unless they are accompanied by a deposit. This ban would also apply when such offers are part of marketing campaigns, loyalty programmes or other promotional activities.

New advertising guidance from URHH: Separately, on September 1, 2025, the Slovak Office for the Regulation of Gambling (URHH) issued updated guidance on advertising for gaming rooms and casinos. The new rules prohibit flashing advertisements or invitations to enter gambling establishments, in line with Articles 15(9) and 16(7) of the Gambling Act. They also clarify the requirements for logos or distinguishing marks at entrances and for advertising on or near the exterior of gambling premises. This guidance replaces the 2024 version and takes effect immediately.

Who’s affected?

• Gambling operators in Slovakia, including casinos and gaming rooms
• Marketing and promotional teams responsible for advertising or bonus campaigns.

Impact on business (what affected parties should do):

For gambling bonuses:

• Operators must ensure that no free spins or equivalent bonuses are offered without a deposit.
• Marketing, loyalty programs, or promotional campaigns must comply with the deposit requirement.
• Compliance processes should be updated to prevent offering prohibited bonuses from January 1, 2026.

For advertising:

• Operators must remove flashing advertisements or promotional displays inviting people to gambling establishments
• Ensure compliance with logo and exterior advertising requirements at the premises
• Update marketing materials immediately, as the guidance is effective from September 1, 2025.

Deadline:

• Advertising compliance: Effective September 1, 2025.
• Bonus restriction compliance: Effective January 1, 2026.

Read more: Slovak Gambling Authority – URHH

Suggested read: Bonus Abuse in Gambling: Types, Risks & How to Prevent It 2025

France 🇫🇷

France proposes technical amendments to gambling data reporting standards

What happened?

On September 25, 2025, France notified the European Commission of a draft decision from the Autorité Nationale des Jeux (ANJ) proposing modifications to the technical requirements for data reporting by licensed gambling operators. This notification was submitted under the EU’s Technical Standards Notification Procedure (Directive 2015/1535). The draft decision introduces six amendments aimed at enhancing transparency, traceability, and monitoring in the gambling sector.

Who’s affected?

• Licensed gambling operators in France, including those offering online and instant lottery games, as they must comply with the updated reporting requirements
• Regulatory authorities, such as the ANJ, which will utilize the enhanced data for oversight and enforcement
• Players, who may benefit from improved protections and transparency in the gambling environment.

Impact on business (what affected parties should do):

Gambling operators should prepare to implement the following changes:

• Include an explicit declaration of the foreclosure date for instant lottery games to clarify the deadline for claiming winnings.
• Add a specific XML tag in sports betting event data to improve monitoring of bets, particularly for single bets on multiple matches.
• Remove the mandatory “pseudo” field in player account events, using the player ID alone.
• Update the reasons for refusing access to player accounts for simplification and accuracy.
• Modify the types of deposits to player accounts to reflect current practices.
• Introduce a new cancellation reason, “Latebet,” in sports betting to ensure precise tracking and avoid the generic “Other” category.

Regulatory authorities will need to integrate the updated data structures into their monitoring and compliance systems.

Deadline: Standstill period ends on December 26, 2025.

Read more: Notification Details on TRIS

Sweden 🇸🇪

Sweden proposes amendments to Gambling Act to strengthen measures against unlicensed gambling

What happened?

On September 24, 2025, Swedish investigator Marcus Isgren submitted a proposal to amend the Swedish Gambling Act (2018:1138) with the aim of more effectively combating unlicensed gambling. The proposal seeks to clarify and expand the scope of the Act to better address the challenges posed by unauthorized gambling activities. 

Who’s affected?

• Unlicensed gambling operators currently operating in or targeting Swedish consumers.
• Payment service providers facilitating transactions related to gambling activities.
• Swedish consumers engaging in gambling activities, both legally and illegally.
• Licensed gambling operators who may face increased competition and regulatory scrutiny.

Impact on business (what affected parties should do):

• Unlicensed gambling operators: May face increased enforcement actions and restrictions, leading to potential business disruptions.
• Payment service providers: Should prepare for potential changes in regulations that may require enhanced due diligence and monitoring of transactions related to gambling activities.
• Licensed gambling operators: Need to stay informed about the proposed changes to ensure compliance and to understand how the amendments might impact their operations.

Deadline:

The proposal is currently under review, and no specific implementation date has been set. Stakeholders are encouraged to monitor developments and prepare for potential regulatory changes.

Read more: Proposal to Amend the Swedish Gambling Act to More Effectively Combat Unlicensed Gambling

Estonia 🇪🇪 & Latvia 🇱🇻

Estonia and Latvia introduce concurrent gambling tax reforms effective January 2026

What happened?

On September 25, 2025, both Estonia and Latvia introduced significant legislative amendments to their gambling tax frameworks. Estonia’s proposal, submitted to the Riigikogu, seeks to amend the Gambling Act and related laws, while Latvia’s draft legislation, prepared by the Ministry of Finance, aims to overhaul its gambling tax system. Both countries are aligning their tax policies to enhance revenue generation and streamline regulatory oversight.

Who’s affected?

• Gambling operators: Both licensed and unlicensed entities operating within Estonia and Latvia.
• Payment service providers: Institutions facilitating transactions related to gambling activities.
• Consumers: Individuals participating in gambling activities, both legally and illegally.

Impact on business (what affected parties should do):

• Gambling operators: Must prepare for increased tax rates and potential changes in licensing requirements.
• Payment service providers: Should anticipate stricter compliance measures and potential adjustments in transaction processing related to gambling activities.
• Consumers: May experience changes in the availability and pricing of gambling services.

Deadline:

Both legislative amendments are set to take effect on January 1, 2026.

Read more:

• Estonia Gambling Law Amendment Proposal
• Latvia Gambling Tax Amendment Draft

Brazil 🇧🇷

Brazilian authorities launch cooperation to block illegal betting sites

What happened?

On September 25, 2025, the Ministry of Finance’s Secretariat for Prizes and Betting (SPA), the National Telecommunications Agency (Anatel), and the National Association of Games and Lotteries (ANJL) signed Cooperation Agreement No. 4/2025.
The agreement aims to strengthen the fight against illegal betting sites in Brazil by creating a cyber and physical laboratory to detect and block unauthorized platforms that operate unfairly against the regulated market.

Who’s affected?

• Illegal betting operators: Sites offering fixed-odds betting without authorization.
• Telecommunications companies: Firms responsible for implementing technical blocks on identified sites.
• Bettors/users: Individuals accessing unauthorized platforms.
• Authorized operators: Companies legally operating in the regulated betting market.

Impact on business (what affected parties should do):

• Illegal operators will face technical blocks and legal actions, putting their operations at risk.
• Telecom companies must implement the technical measures established by the laboratory to comply with the agreement.
• Bettors/users should use only authorized platforms to ensure safety and legal compliance.
• Authorized operators benefit from a stronger regulated market and a more secure competitive environment.

Deadline:

No specific deadline has been set, but implementation is expected to start immediately to ensure the effectiveness of the measures.

Read more: Anatel, Ministry of Finance and ANJL cooperate to block illegal betting sites

Armenia 🇦🇲

Armenia introduces draft order to regulate gambling information reporting

What happened?

On September 24, 2025, Armenia’s State Revenue Committee published a draft order to establish the procedures, format, and distribution methods for information related to lottery and gambling operations. This initiative is part of implementing the Law on Regulation of Gambling Activities, as mandated by the Armenian government’s decree No. 859-A dated September 23, 2024.

Who’s affected?

• Authorized gambling operators: Entities licensed to conduct gambling activities in Armenia.
• Tax and regulatory authorities: Agencies responsible for overseeing and enforcing gambling regulations.
• Players and consumers: Individuals participating in gambling activities.

Impact on business (what affected parties should do):

• Gambling operators: Must comply with the new reporting procedures and formats for submitting operational data.
• Regulatory authorities: Need to integrate the new information into their oversight and enforcement mechanisms.

Deadline: The draft is open for public comments until October 9, 2025.

Read more: Armenian Government’s Unified Website for Publication of Legal Acts’ Drafts