Enforcement & Regulatory Risk Radar

Comprehensive FIT/NPSS infrastructure programme, PTSR stablecoin regime, Jaywan domestic scheme, Digital Dirham CBDC and an aggressive AML enforcement campaign post-FATF-grey-list exit.

April 2025 FX liberalisation, Open Finance Decree 353/2025, PSP-as-a-Service (May 2026) and CNDC->NCA transition mark a fast-moving but maturing payments regime.

FMA's remit expanded structurally via DORA, MiCAR CASP supervision, centralised conduct/IT-risk division, and 1-Jan-2026 transfer of sanctions and payment-systems oversight from the OeNB

Nagad governance crisis, PSSA 2024 statutory transition, and first sector-wide Cybersecurity Framework mark intensified regulatory tightening across licensing, resilience, and AML enforcement.

Worldline prosecutorial exposure and NBB 2026 name-and-shame AML policy shift concurrent with MiCA/CASP regime bedding in.

FATF grey-list remediation nearing completion alongside euro-area accession and full MiCA transposition.

C&M Pix supply-chain breach drove 2025-26 cybersecurity package; MED 2.0 and VASP/eFX rules tighten the perimeter.

RPAA full phase-in, FINTRAC AMP escalation, RTR/CDBA phased rollout ongoing.

Layered federal/provincial AML and licensing tightening (Bill C-12, BCFSA MSB mandate, Gaming Control Act) alongside major digital-money modernization (Stablecoin Act, RTR, CDBA), with a persistent cannabis-sector de-ris…

New Stablecoin Act, raised AML penalties (Bill C-12), and Bank Act fraud-duties (Bill C-15) increase regulatory load, while RTR/open-banking and PE-backed acquiring consolidation expand market structure.

Dual federal/provincial licensing regime maturing; stablecoin and open-banking frameworks advancing; FINTRAC enforcement escalating.

FATF June 2026 Plenary found CI substantially completed its grey-list action plan, warranting an on-site assessment; licensing reform consolidating the sector.

2025 licensing enforcement, January 2026 capital increase, continued FATF grey-list status, and correspondent-banking FX friction combine to raise structural risk.

Decreto 0368 de 2026 (open finance) and Bre-B (instant rail) reshape the regime; live SIC scheme action.

AMLA Frankfurt go-live + first DORA fine + MiCAR grandfathering close concentrate regulatory intensity in 2025-26.

August 2025 SIPARD overhaul + March 2026 consumer-protection reglamento reform consultation mark the most significant regulatory developments this baseline.

Simultaneous market-access liberalisation (PSP licensing, foreign-card acceptance, PAPSS) and tightening (crypto ban, AML/CFT strengthening, cybersecurity CII mandates) define the 2025-2026 regulatory posture.

New SEDPES reserve requirement, Digital Credit Concession category, mandatory Defensor del Cliente, FATF-aligned AML/CFT law in force, JPRFM institutional merger.

Continued post-Danske Bank AML litigation activity (2024 LHV court annulment) alongside full MiCA/DORA implementation and an unresolved CASP-authorisation cliff-edge.

Regulatory perimeter consolidating (PSD3/PSR, MiCA, DORA, AMLA, non-bank TARGET access) amid rising enforcement.

CBE PSO/PSP licensing regime in force June 2025 (transition June 2026); record remittances; prohibitive crypto stance.

Dual-track digital-money regime (in-force cedi e-money under Act 987 + enacting crypto regime under Act 1154); active PSP enforcement; rising mobile-money fraud; tightening resilience and data-localisation.

Grey-list removal and 2025 NRA improve standing, but small crypto/iGaming-weighted centre faces structural de-risking and no central bank; correspondent-access dependency persists.

RBI consolidating PA/PPI authorisation, APP-fraud compensation, Ombudsman liability shift, and CBDC/cross-border rail expansion concurrently.

Post-2020-21 foreign-ownership consolidation of acquiring has stabilised under Competition Authority oversight; DORA/TIPS integration advancing operational resilience, though the card-network concentration risk flagged b…

FATF grey-list (retained Jun 2026) + EU high-risk listing drive correspondent-banking de-risking; offset by AML Amendment Act 2025 remediation and PAPSS integration.

OFAC TCO designation of Prince Bank/Prince Group and FinCEN Section 311 action against Huione Group triggered visible deposit-run and heightened correspondent-bank scrutiny of Cambodian counterparties generally.

Stablecoin framework delayed past June 2026 elections; FETA crypto-transfer regime in force Dec 2026; KoFIU AML overhaul; no-fault APP-fraud reform; Naver–Dunamu mega-merger.

New Banking Law signed and in force (two-tier licensing, DFA/stablecoin framework); concurrent EU sanctions transaction ban on VTB Bank Kazakhstan and Nov 2025 AML reform package.

FATF grey-listing (Feb 2025) plus tightened FX/offshore-account rules elevate correspondent-banking de-risking exposure, even as cross-border QR corridors expand market access.

Advanced VASP/stablecoin and consumer-redress regimes alongside major operational-resilience breaches and enforcement actions.

Mature EU-largest EMI/PI hub; AML enforcement intensity high but supervisory framework strengthening (info-sharing reform, Resolution 03-33, DORA).

Baselined as a major EU EMI/PI and MiCA hub; FATF grey-list exit (2023) under enhanced follow-up; correspondent-banking de-risking residual.

Correspondent-banking de-risking from FinCEN Section 311 designations + pending interchange-cap reform + unpublished open-finance regulation create concurrent regulatory and access pressure.

FATF grey-list status confirmed as of the June 2026 plenary with a 6-point action plan outstanding.

Simultaneous virtual-asset liberalisation and continued FATF/correspondent-banking vulnerability define a two-track risk profile.

Mature, EU-aligned single-supervisor (KNF) market; high BLIK/A2A adoption; unresolved MiCA transposition and heightened hybrid-warfare cyber threat are the principal uncertainties.

MiCA in force, DORA nationalised, Law 239/2025 e-payment mandate, record ROBOR fine, AML Law 86/2025 modernisation — broad regulatory activity across the spine.

OFAC Gazprombank+50-bank designation; digital ruble mandatory rollout from Sept 2026; FATF virtual-asset compliance downgrade.

16th PSP licensed (OFT Tunisie); draft Code des Changes proposes first crypto-asset definition; PAPSS accession live since 2024.

2025 AML-driven licence-suspension wave targeting payment companies ahead of late-2025 FATF on-site, alongside rising minimum-capital thresholds and residual correspondent-banking de-risking.

VASA passage reshapes crypto oversight; fraud-penalty escalation bill advancing; Banking Act criminal-penalty amendments in force.

NBU FX liberalisation (Resolution No. 95, Jan-2026 loan-limit mechanism) continues alongside intensified PSP enforcement actions; correspondent banking access remains war-risk constrained

Two-part stablecoin regime advanced to final FCA rules + BoE draft Code in June 2026, with material easing across capital, holding caps and backing.

Enactment of HB259 (stablecoin licensing) and HB303 (crypto-kiosk consumer protection) alongside pending HB585 (wire-transfer fee) mark the most active Alabama payments-legislative cycle since 2017.

First-in-nation regulatory sandbox and CSBS-aligned MT licensing regime provide a stable structural base; the emergence of a nationally significant stablecoin product (ZLUSD) from an AZ-headquartered payments consortium,…

DFAL 1 July 2026 crypto licensing deadline + active DFPI enforcement; federal cross-border AML pressure on US-Mexico corridor.

Active OAG litigation against Athena Bitcoin (corrected basis) and EarnIn, a pending unverified swipe-fee bill, and the Fed's Payment Account proposal are the dominant risk vectors.

The 2026 SB16/SB18/SB19 package modernizes banking, money transmission, and stablecoin licensing for the first time since 1981, positioning Delaware as a GENIUS Act-aligned regulatory home.

Enactment of the first US state stablecoin-issuer law and a VC-kiosk consumer-protection regime, alongside continued MSB and correspondent-banking enforcement activity.

Correspondent-banking de-risking pressure on Pacific corridor access, alongside continued bank-sector consolidation (Hope Bancorp-Territorial; pending Bank of Hope-SMBC deal).

OCC IL 1192 preemption ruling concurrent with SF449 kiosk enforcement and the Dwolla acquisition/litigation.

Repeated stablecoin bills failed to enact; bipartisan crypto-kiosk consumer-fraud bill passed both chambers but was vetoed.

DACPA + Digital Asset Kiosk Act enactment, IFPA/OCC preemption fight, and Seventh Circuit BIPA retroactivity ruling.

2025 KMTA recodification, 2026 crypto-kiosk licensing extension, and continued BSA/AML enforcement scrutiny of a Kansas-domiciled correspondent bank collectively tighten the state's payments regulatory/risk posture.

Full MTA licensing overhaul (c.169B) plus active AG crypto-kiosk enforcement and unresolved swipe-fee legislative contest.

New stablecoin/digital-asset framework and EWA consumer-protection overhaul, layered on an active OFR enforcement posture.

SB265 Financial Freedom and Innovation Act enacted; crypto ATM fraud restitution fund and 2027 legislative push underway.

Baseline established across all 13 modules: Corner Post/Regulation II vacatur, Roughrider Coin stablecoin pilot, HB1127/HB1447 conduct-cybersecurity laws, and continued community-bank consolidation.

Two 2025-2026 unlicensed-transmission consent orders alongside a contested crypto-legislation status (HB639) create mixed enforcement/liberalisation signals.

Record federal AML enforcement against NJ-headquartered TD Bank plus an aggressive state AG conduct-enforcement posture materially raise the state's payments-compliance risk profile.

Dual MTL/BitLicense regime with stricter-than-CSBS standards, aggressive NYDFS enforcement ($177M+), recent custody/resilience upgrades, and a federal charter-migration wave drawing NY firms toward OCC national trusts.

Crypto-kiosk consumer-protection tightening, new nonbank cybersecurity law, a live interchange-fee legislative threat, and escalating multi-front prediction-market litigation.

Concentrated DFI enforcement sweep (Coinme, CoinZoom) plus co-led $80m multistate Block/Cash App BSA/AML settlement.

Bifurcated master-account outcomes (Kraken granted, Custodia denied) create ongoing uncertainty despite WY's otherwise liberalising regulatory posture.

Sanctions-driven correspondent-banking collapse, FATF grey-list status, disputed SUNACRIP operative status, and a landmark crypto-corruption trial combine to keep VE a high-scrutiny jurisdiction for payments operators.

FATF grey-list status persists (Oct 2025); Decree 340/2025 sanctions in force Feb 2026; restrictive stablecoin/crypto regime under Resolution 05.

FATF grey-list exit (Oct 2025) reduces correspondent-banking and cross-border friction; activity-based reform and PEM/NPU restructuring underway; unresolved crypto exchange-control litigation and no APP-fraud reimburseme…