30 stories
Regulator: CBUAE. Jurisdiction: UAE. AML/BSA fine. The Central Bank of the UAE fined a foreign bank branch 20 million dirhams for repeated anti-money laundering and sanctions control failures, and separately fined its head of compliance 300,000 dirhams.
Regulator: OFAC, FinCEN. Jurisdiction: US. Sanctions violation. Treasury widened its action against the Cambodian scam conglomerate, adding 9 individuals and 26 entities, while FinCEN moved to sever the renamed Huione affiliate H-Pay from the US financial system.
Regulator: Finansinspektionen. Jurisdiction: Sweden. AML/BSA fine. Sweden’s financial supervisor fined Ikano Bank 140 million kronor and issued a formal remark for failing to assess how its corporate products could be used to fund crime. No laundering case was alleged.
Regulator: Garante per la protezione dei dati personali. Jurisdiction: Italy. GDPR enforcement. Italy’s data protection authority fined Poste Italiane 6,624,000 euros and Postepay 5,877,000 euros for embedding device-surveillance software in banking apps and making consent to it a condition of…
Regulator: PRA. Jurisdiction: UK. Integrity/governance. The PRA fined Bank of London Group £2 million for integrity failings and inadequate cooperation over misrepresenting its capital position.
Regulator: SRA. Jurisdiction: UK. AML/BSA fine. The SRA fined Ranson Houghton LLP for AML failures, signalling AML enforcement expanding beyond banks into legal services.
Regulator: EDPB / 25 EU DPAs. Jurisdiction: EU. GDPR enforcement. 25 EU regulators launched a coordinated GDPR transparency enforcement sweep affecting how KYC flows present data processing.
Regulator: FinCEN. Jurisdiction: US. AML/BSA fine. FinCEN assessed an 80 million dollar penalty, its largest ever against a broker-dealer, for years of gamed trade surveillance and at least 160 suspicious activity reports that were never filed.
Jurisdiction: US. Data breach. Cybernews reported an unsecured database it linked to IDMerit that exposed about one billion personal records across 26 countries, over 203 million of them from the United States. IDMerit told Cybernews it does not own, control or store the underlying data.
Jurisdiction: Global. Data breach. A breach via a malicious attachment on a third-party support platform went undetected for 18 months (Jul 2024–Jan 2026).
Jurisdiction: Global. Data breach. A third-party customer service vendor was compromised, exposing roughly 70,000 government ID photos that the vendor held to review age-related appeals.
Jurisdiction: US. Data breach. Coinbase disclosed that a threat actor had paid contractors or employees in support roles outside the United States to collect customer data from internal systems, including names, contact details, masked Social Security and bank account numbers, government ID images…
Showing 30 of 30 stories
You're all caught up.
Get the top AI news and tools straight to your inbox every week.
Weekly · AI news
Join 15,000+ AI enthusiasts
