Merchant Onboarding: Global Regulatory Update - October 2026

October's regulatory updates show why merchant onboarding needs to look beyond basic identity and name checks. From sanctions evasion networks and more detailed due diligence standards to major AML enforcement actions, regulators continue to highlight the importance of stronger verification, timely risk detection, and ongoing monitoring.

In this update (for merchant onboarding and compliance teams):

What changed: October brought developments across sanctions evasion networks, customer due diligence standards, financial crime guidance, stablecoin regulation, and major AML enforcement actions. Across these updates, regulators are placing greater attention on hidden business connections, effective risk controls, and ongoing compliance beyond initial onboarding.

Why it matters: Merchant onboarding teams need to look beyond basic identity and name screening. Business ownership, banking relationships, regulatory status, and declared activities must be properly verified to identify hidden financial crime risks. October's enforcement findings also show how missed warning signs and weak ongoing monitoring can lead to serious financial and regulatory consequences.

Regulatory signals:

• Sanctions enforcement highlights the importance of identifying hidden ownership links, connected businesses, and banking relationships, not just screening names.
• AMLA's final draft standards and the FCA's proposed guidance place greater emphasis on reliable identity verification, beneficial ownership checks, and risk-based due diligence.
• Stablecoin developments reinforce the need to understand merchant activities and regulatory status, particularly for issuers and custody providers.
• Enforcement in Canada and Australia shows the cost of poor AML controls, inadequate customer checks, and failures to act on suspicious activity.

What to do next:

• Strengthen checks on merchant ownership, connected parties, and banking relationships to identify potential sanctions exposure.
• Verify identity and beneficial ownership information against reliable sources, and prepare onboarding processes for the EU's final draft technical standards and the FCA's proposed UK guidance.
• Capture relevant regulatory information for stablecoin businesses and verify MSB registration status when onboarding Canadian merchants.
• Use ongoing due diligence and timely risk alerts to identify changes after approval, escalate concerns, and maintain clear records of compliance decisions.

‍

🌎 Global

Regulatory Watch: FATF October 2026 Plenary

Effective date: 28 to 30 October 2026

Issued by: Financial Action Task Force (FATF)

Applies to: Financial institutions, PSPs, PayFacs, VASPs, and regulated firms applying jurisdiction risk, sanctions, AML/CFT, or counterparty due diligence controls.

Summary:

• What: FATF's October 2026 plenary brings together its global network to address international financial crime priorities, including fraud, jurisdiction monitoring, and mutual evaluations.
• Why: Outcomes from FATF plenaries can affect jurisdiction risk assessments, AML/CFT priorities, and the due diligence controls applied by financial institutions and payment providers.
• What’s Next: At the time of writing, the plenary outcomes had not yet been published. We will continue to monitor any changes to jurisdiction classifications, fraud priorities, and other developments relevant to merchant onboarding and ongoing due diligence.

Key agenda items:

• FATF will review progress made by jurisdictions under increased monitoring. No updated jurisdiction classifications have been announced ahead of the plenary.
• FATF will advance its roadmap on combating fraud, focusing on a major source of criminal proceeds.
• FATF is expected to discuss mutual evaluation reports for Mexico and the United States, assessing their AML/CFT controls and compliance with FATF Recommendations.
• Barbados, Namibia, and Thailand will participate for the first time through the FATF-Style Regional Body (FSRB) Guest Initiative.

What this means for merchant onboarding teams:

Any changes to FATF jurisdiction classifications may require payment providers to reassess merchant and beneficial ownership risk, update jurisdiction risk settings, and review affected existing relationships.

FATF's fraud priorities and expected Mexico and US evaluations may also highlight areas for stronger identity verification, AML screening, and ongoing monitoring.

Recommended actions:

• Maintain existing jurisdiction risk ratings until FATF publishes confirmed classification changes.
• Ensure merchant and beneficial ownership data can identify exposure to jurisdictions affected by any updates.
• Prepare risk rules to trigger enhanced due diligence and reassess affected merchants when classifications change.
• Review published fraud and mutual evaluation findings to identify any gaps in merchant verification and AML screening.
• Document changes to risk ratings, due diligence reviews, and onboarding decisions for audit purposes.

How OnBoard helps

OnBoard helps firms keep jurisdiction risk current by building country checks into the onboarding process, so list changes don’t mean rework.

• Smart Forms collect merchant and beneficial ownership information needed to assess country-specific risks.
• Automated KYB, KYC and AML checks verify business details and screen merchants for potential compliance risks
• Real-time risk scoring and Automated Decision Engine flag higher-risk merchants and route them for additional review based on configurable rules.
• Ongoing Customer Due Diligence (OCDD) monitors changes in merchant risk profiles after onboarding.
• Audit-ready reporting keeps clear records of risk assessments, reviews, and onboarding decisions.

Source: Financial Action Task Force 

‍

🇺🇸 United States

Regulatory Alert: FinCEN Alert on the A7 Network (FIN-2026-Alert007)

Effective date: 1 October 2026

Issued by: Financial Crimes Enforcement Network (FinCEN), U.S. Department of the Treasury

Applies to: Banks, payment service providers, fintechs, crypto businesses, and firms onboarding or monitoring merchants with trade, cross-border, or stablecoin exposure.

Summary:

• What: FinCEN issued an alert on A7 Network, a global wholesale sanctions evasion and money laundering service with ties to Russia.
• Why: A7 enables cross-border payments in fiat currency and digital assets while concealing connections to sanctioned jurisdictions from financial institutions.
• What’s Next: File suspicious activity reports using the key term “FIN-2026-A7NETWORK” where the red flags fit.

Key findings:

• As of June 2026, A7 operates hundreds of “Sub-Agent” companies with accounts at about 435 financial institutions in at least 83 countries.
• A7 Sub-Agents often form, acquire, or partner with companies established in Hong Kong, Indonesia, the Kyrgyz Republic, Seychelles, Türkiye, and the UAE.
• FinCEN found more than 180 entities processed A7A5 (the ruble-backed stablecoin) transactions totaling at least $179.1 billion between February 2025 and June 2026.
• Treasury designated A7 a transnational criminal organization, and FinCEN proposed a transmittal ban on its sub-agents.
• FinCEN identified newly formed companies with unusually high transaction volumes and goods descriptions that do not match suppliers' business profiles as potential red flags.
• Other flags include blank or minimal websites on specific IP ranges, invoices that look AI-altered or contain out-of-place Cyrillic, and stablecoin OTC firms with unexplained growth.

What this means for merchant onboarding teams:

A7-linked companies can appear to be legitimate trading businesses, making name screening alone insufficient to identify hidden sanctions exposure.

Merchant onboarding teams need stronger checks on ownership, business activities, websites, and trade documents, alongside ongoing monitoring to detect suspicious changes after approval.

Recommended actions:

• Add the A7 red flags to onboarding and monitoring rules, starting with new companies showing sudden high-value activity.
• Check merchant ownership and counterparties for potential connections to A7-controlled businesses.
• Compare goods and services in trade documents against suppliers' business profiles.
• Look at merchant websites for blank or minimal pages and mismatches with the declared business.
• Review stablecoin OTC firms with unexplained growth, particularly in jurisdictions linked to A7 activity.
• Assess red flags together, as FinCEN states that no single indicator confirms suspicious activity.
• Use “FIN-2026-A7NETWORK” in suspicious activity reports where it applies.

How OnBoard helps

OnBoard strengthens merchant onboarding in the US by helping payment providers identify the hidden business, ownership, and transaction risks highlighted in FinCEN's A7 alert.

• AIQ SiteScanner™ flags blank or minimal sites and mismatches between declared and actual business, and monitors websites on an ongoing basis.
• OnBoard AIQ™ reads onboarding documents in real time, catching inconsistencies such as altered invoices or goods that don’t fit the business.
• Automated KYB and AML screening verifies business and beneficial ownership information and screens relevant parties for potential sanctions exposure.
• Ongoing Customer Due Diligence (OCDD) monitors changes in merchant information and risk profiles after approval in real time.
• Risk & Credit Decision Engine routes merchants matching multiple red flags to human review lower-risk applications can progress without unnecessary manual review. 

Source: Financial Crimes Enforcement Network, U.S. Department of the Treasury 

PRE-RECORDED WEBINAR

Scale the Channel, Keep the Control:
Partner-Led Merchant Acquisition

Watch Now - No Form

Sanctions Alert: OFAC Alert to Foreign Financial Institutions on Iran

Effective date: 5 October 2026

Issued by: Office of Foreign Assets Control (OFAC), U.S. Department of the Treasury

Applies to: Banks, payment service providers, acquirers, and firms with correspondent, cross-border, or Middle East exposure.

Summary:

• What: OFAC warned foreign financial institutions that dealing with sanctioned Iranian institutions could bring sanctions at any time, without advance notice.
• Why: The alert falls under “Operation Economic Outcast” and recaps recent designations of banks outside Iran.
• What’s Next: Foreign financial institutions continuing to engage in sanctionable Iran-related activity may face further U.S. sanctions or correspondent-account restrictions. 

Key notices:

• Foreign banks that continue dealing with sanctioned Iranian institutions could be sanctioned at any time, with no warning.
• On August 28, FinCEN proposed revoking Banque Misr UAE's correspondent banking access to U.S. financial institutions over Iran-linked activity. 
• Türkiye-based Golden Global Bank and its subsidiaries were designated on 4 September for facilitating transactions for Iran's IRGC-Qods Force.
• VTB Bank was designated on 14 September for involvement in Iranian sanctions evasion, including correspondent relationships with sanctioned Iranian banks.
• The alert points firms to FinCEN’s May 2026 IRGC alert and earlier shadow-banking guidance.

What this means for merchant onboarding teams:

For merchant onboarding teams, this notice reinforces the need to identify potential sanctions exposure beyond the merchant itself, including through beneficial owners, banking relationships, and other connected parties.

Real-time sanctions screening and ongoing customer due diligence (OCDD) are becoming essential for staying alert to new risks and preventing dealings with sanctioned institutions.

Recommended actions:

• Collect banking and settlement details for merchants with cross-border or Iran-related risk exposure.
• Check merchants and counterparties for links to institutions identified in the alert, and verify their current sanctions status. 
• Treat Iran-linked flows through third-country banks as a higher-risk pattern.
• Read the FinCEN IRGC alert and shadow-banking guidance the alert references.
• Document how you assessed bank and counterparty exposure for affected merchants.

How OnBoard helps

OnBoard helps payment providers strengthen merchant onboarding in the US by identifying potential sanctions exposure involving Iranian financial institutions through real-time screening and ongoing monitoring.

• PEP and Sanctions Screening checks merchants, owners, and related parties against global sanctions lists, with real-time updates.
• Smart Forms capture banking, settlement, jurisdiction, and counterparty information based on merchant risk, helping teams collect additional detail where Iran-related exposure may exist.
• Automated Decision Engine escalates merchants with potential links to sanctioned Iranian institutions for further review, without slowing down low-risk applications.
• Ongoing Customer Due Diligence (OCDD) re-screens existing merchants as sanctions lists are updated.

Source: Office of Foreign Assets Control, U.S. Department of the Treasury

‍

Sanctions Action: OFAC Targets Cartel del Noreste's Commercial Network (United States)

Effective Date: October 13, 2026

Issued By: Office of Foreign Assets Control (OFAC), U.S. Department of the Treasury

Applies To: U.S. persons dealing with designated or otherwise blocked parties. Foreign financial institutions facilitating certain significant transactions with designated persons may also face sanctions risks.

Summary

• What: OFAC sanctioned individuals and businesses linked to Mexico-based Cartel del Noreste (CDN), targeting the cartel's commercial network.
• Why: CDN has used legitimate-looking businesses to launder illicit funds and finance cartel operations.
• What's Next: U.S. persons must follow applicable OFAC blocking, reporting, and transaction restrictions for the newly designated parties.

Key Changes

• OFAC designated four individuals and 11 entities connected to CDN, including businesses in horse racing, construction, trucking, and oil and gas.
• Club La Molienda, a racetrack, restaurant, and bar in Nuevo Laredo, was sanctioned for being controlled by CDN.
• OFAC designated businessman Gamaliel Garza Garcia and six related companies, including construction and fuel businesses linked to the cartel's commercial operations.
• OFAC identified construction company CEGESA as having obtained government contracts and subcontracted work to Cartel del Noreste-linked individuals.

What This Means for Merchant Onboarding Teams

For merchant onboarding teams, one missed ownership or control link could mean approving an apparently legitimate business that is connected to a sanctioned cartel network.

The action shows why name screening alone is not enough. Teams need strong beneficial ownership checks, sanctions screening, and ongoing monitoring to identify direct and indirect connections before approval and as relationships change over time.

Recommended Actions

• Update sanctions screening to include the newly designated individuals and businesses.
• Verify merchant ownership and check for direct or indirect links to sanctioned parties, including those covered by OFAC's 50 Percent Rule.
• Review merchants in horse racing, construction, trucking, and fuel businesses for connections to the designated network.
• Re-screen existing merchants and beneficial owners to identify any newly sanctioned relationships.
• Escalate potential sanctions matches for further review and document screening results and decisions.

How OnBoard Helps

OnBoard strengthens merchant onboarding in the US by helping payment providers identify hidden ownership links and potential exposure to businesses sanctioned by OFAC.

• Automated KYB and beneficial ownership verification helps identify who owns and controls merchant businesses, including potential links to sanctioned individuals and companies.
• PEP and Sanctions Screening checks merchants, owners, and related parties against updated global sanctions lists in real time.
• Automated Decision Engine escalates merchants with potential links to sanctioned cartel businesses for further review without slowing down low-risk applications.
• Ongoing Customer Due Diligence (OCDD) re-screens existing merchants to identify new sanctions exposure after approval.
• Audit-ready reporting records sanctions screening results, flagged matches, and how onboarding decisions were made.

Source: U.S. Department of the Treasury

‍

Regulatory Alert: FinCEN Alert on Iranian Abuse of Religious Charity Networks (United States)

Effective Date: October 15, 2026 (alert issued)

Issued By: Financial Crimes Enforcement Network (FinCEN), U.S. Department of the Treasury

Applies To: Financial institutions subject to applicable Bank Secrecy Act (BSA) reporting requirements, including banks.

Summary

• What: FinCEN issued an alert warning financial institutions about the potential misuse of religious charities and nonprofit organizations to move illicit funds.
• Why: Treasury reports that the Iranian regime has used religious organizations and donations to support regime-linked activities, including terrorism financing.
• What's Next: FinCEN asks financial institutions to identify and report suspicious activity linked to the misuse of religious charity networks.

Key Developments

• FinCEN identified charities that collect donations but show no evidence of charitable work or openly support the Iranian regime or its terrorist proxies.
• Large donations from unknown sources, followed by significant wire transfers to other charities, may signal suspicious activity.
• Charities or their employees trying to avoid financial reporting or recordkeeping rules are another red flag.
• Payments from charities to customers with no clear connection, followed by cash withdrawals or transfers, may be suspicious.
• Treasury reported that some organizations use hawalas and cash couriers to move religious donations to Iran.

What This Means for Merchant Onboarding Teams

For merchant onboarding teams, the challenge is identifying charities and not-for-profit organizations that may misuse donations without treating every nonprofit as suspicious. Understanding their purpose and how they expect to receive and send money helps teams spot unusual activity after approval, while keeping onboarding simple for legitimate organizations.

Recommended Actions

• Verify nonprofit registration, charitable purpose, and business activities during merchant onboarding.
• Collect information on expected donation sources, payment destinations, and fundraising activities based on the merchant's risk level.
• Review charity websites and fundraising materials to confirm their activities align with their stated purpose.
• Escalate merchants with multiple warning signs for enhanced due diligence, including unusual funding patterns where transaction information is available.
• Apply risk-based reviews rather than automatically treating all charities and nonprofits as high risk.
• Include “FIN-2026-IRANCHARITYABUSE” in relevant Suspicious Activity Reports (SARs), as requested by FinCEN.

How OnBoard Helps

OnBoard helps payment providers strengthen merchant onboarding in the US by verifying charities and nonprofit organizations, assessing fundraising activities, and identifying potential risks without slowing down legitimate applications.

• Smart Forms collect information on charitable activities, expected donation sources, and how funds will be used, tailoring questions to each organization's risk level.
• AIQ SiteScanner™ checks whether a charity's website and online activities match its stated charitable purpose.
• Automated KYB and AML screening verifies organization details and screens key individuals and related parties for potential financial crime risks.
• Automated Decision Engine escalates applications with inconsistent charitable or fundraising information for further review, while low-risk applications continue without delay.
• Ongoing Customer Due Diligence (OCDD) monitors changes in nonprofit registration, related parties, and risk profiles after onboarding.

Sources: U.S. Department of the Treasury & FinCEN

Click on a link in a description and get your copy

Download Now

Final Rule: OCC Implements the GENIUS Act for Payment Stablecoin Issuers

Effective date: Published 21 October 2026; effective 18 January 2027

Issued by: Office of the Comptroller of the Currency (OCC), U.S. Department of the Treasury

Applies to: Permitted and foreign payment stablecoin issuers under OCC jurisdiction, custody providers, and firms onboarding stablecoin-related merchants.

Summary:

• What: The OCC issued its final rule implementing the GENIUS Act, setting requirements for permitted and foreign payment stablecoin issuers, plus certain custody activities.
• Why: To establish clear standards for stablecoin reserves, redemptions, and risk management under the new federal framework.
• What’s Next: The rule takes effect January 18, 2027. The OCC will begin accepting applications and waiver requests after OMB approval of the required information collection and will announce when submissions can begin.

Key changes:

• The OCC's final rule sets standards for reserve backing, redemption, and risk management for payment stablecoin issuers.
• The final rule does not cover the GENIUS Act's Bank Secrecy Act, AML, or OFAC sanctions requirements. These will be addressed through separate rulemaking in coordination with the U.S. Department of the Treasury.
• The OCC also issued guidance on application submissions and waiver requests. Applications will open after OMB approval of the required information collection, with the OCC to announce when it begins accepting applications and waiver requests.
• The OCC published revised proposed reporting forms and instructions for payment stablecoin issuers under its supervision.

What this means for merchant onboarding teams:

Although the OCC rule does not directly change merchant onboarding requirements, it makes regulatory status more important when assessing businesses that issue stablecoins or provide custody services.

For onboarding teams, this means understanding each merchant's stablecoin activities and preparing to verify the required approvals or registrations when available, without placing unnecessary requirements on merchants that only accept stablecoin payments.

Recommended actions:

• Identify whether merchants issue stablecoin, provide custody services, or simply accept stablecoin payments.
• Update KYB processes to capture relevant issuer activities and regulatory information before the January 18, 2027 effective date.
• Track the OCC's application and waiver process to prepare for issuer approval and registration checks.
• Check whether foreign stablecoin issuers fall under the OCC's registration requirements.

How OnBoard helps

OnBoard helps payment providers tailor merchant onboarding in the US to different stablecoin activities, verify merchant information, and apply the right level of review.

• Smart Forms collect relevant issuer, reserve, redemption, and custody information based on each merchant's activities, keeping other applications simple and frictionless.
• Automated KYB and beneficial ownership verification checks business and ownership information to support due diligence on stablecoin issuers and custody providers.
• Automated Decision Engine escalates applications with unclear regulatory status or higher-risk stablecoin activities for further review, without slowing down low-risk merchants.
• Ongoing Customer Due Diligence (OCDD) monitors changes in merchant information, business activities, and risk profiles after approval.
• Audit-ready reporting keeps clear records of issuer information, verification checks, and onboarding decisions.

Source: Office of the Comptroller of the Currency

‍

🇬🇧 United Kingdom

Consultation Paper: FCA CP26/38, Financial Crime Guide Update

Effective date: Published 23 October 2026; consultation closes 24 December 2026

Issued by: Financial Conduct Authority (FCA)

Applies to: PSPs, banks, e-money firms, cryptoasset businesses, and other firms subject to FCA financial crime requirements.

Summary:

• What: The FCA published a draft update to its Financial Crime Guide, covering fraud, cryptoassets, sanctions, proliferation financing, data security, systems and controls, and money laundering.
• Why: To keep financial crime guidance up to date with emerging risks, including AI, cryptoassets, and changing sanctions regimes.
• What’s Next: The consultation closes on 24 December 2026. The FCA will review feedback and publish the final guidance in a Policy Statement. 

Key proposed changes:

• Fraud: The FCA proposes using detailed customer profiles, fraud databases, and checks for synthetic or counterfeit documents during onboarding.
• Sanctions due diligence: Proposed guidance covers verifying ownership structures, connected parties, and relevant trade information to identify sanctions risks.
• Sanctions screening: The FCA proposes guidance on screening beyond names, including relevant goods, vessels, ports, and jurisdictions, alongside stronger oversight of screening tools.
• Cryptoassets: Proposed guidance includes enhanced due diligence triggers and the use of blockchain analytics for onboarding and monitoring.
• Identity verification: The FCA proposes expanded guidance on electronic verification, including testing and oversight of third-party financial crime tools.
• Outsourcing: Regulated firms remain responsible for financial crime controls when using outsourced providers, white-label services, or Banking as a Service (BaaS) arrangements.

What this means for merchant onboarding teams:

Although these are proposed guidance updates rather than new rules, they highlight where basic onboarding checks may miss fraud, sanctions, and cryptoasset risks.

For merchant onboarding teams, this means placing greater emphasis on risk-based and event-driven due diligence, keeping fraud and sanctions screening up to date, identifying emerging risks early, and reassessing merchant risk throughout the customer relationship rather than relying on one-time onboarding checks. 

Recommended actions:

• Strengthen onboarding fraud checks by using multiple information sources, fraud databases, and checks for synthetic or counterfeit documents.
• Review sanctions due diligence to identify beneficial owners, connected parties, and relevant trade exposure beyond name screening.
• Test third-party screening tools to ensure sanctions lists are updated promptly, screening settings are appropriate, and alerts are handled effectively.
• Introduce event-driven due diligence reviews to reassess merchant risks promptly when new fraud indicators, changes in business activity, or sanctions concerns emerge.
• Apply risk-based enhanced due diligence to cryptoasset merchants, including clear triggers for additional checks and the use of blockchain analytics where appropriate.

How OnBoard helps

OnBoard helps payment providers strengthen merchant onboarding in the UK through fraud detection, sanctions screening, and real-time due diligence, addressing key areas highlighted in the FCA's proposed guidance.

• Automated KYB and beneficial ownership verification verifies merchant identities, business information, and ownership structures in real time, helping identify inconsistencies and potential fraud risks during onboarding.
• OnBoard AIQ™ extracts and validates information from supporting documents, flagging missing or inconsistent details for further review.
• PEP and Sanctions Screening screens merchants, beneficial owners, and relevant related parties against current sanctions lists, helping identify potential exposure before approval.
• Automated Decision Engine and Ongoing Customer Due Diligence (OCDD) apply risk-based rules, escalate higher-risk cases, and trigger further review as merchant information or risk changes after approval. 
• White-label onboarding allows payment providers to extend branded onboarding through partners or distribution channels while keeping merchant data, screening rules, approvals, and compliance oversight centrally governed. 

Source: Financial Conduct Authority & Consultation Paper

‍

🇪🇺 European Union

Regulatory Standards: AMLA Final CDD Regulatory Technical Standards

Effective date: Final draft RTS submitted to the European Commission on October 1, 2026. Once adopted and published in the Official Journal, they are expected to apply six months after entry into force. 

Issued by: Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA)

Applies to: Financial institutions, payment service providers, fintechs, crypto-asset service providers, and other obliged entities under the EU AML framework.

Summary:

• What: AMLA finalized three sets of draft regulatory technical standards and submitted them to the European Commission, covering customer due diligence (CDD), business relationships and linked transactions, and group-wide requirements. 
• Why: They set the detail behind the AML Regulation on what data you collect, how you verify it remotely, and how you screen.
• What’s Next: They apply six months after entry into force, which is 20 days after Official Journal publication, and the texts can still change before the Commission adopts them.

Key changes:

• Customer Due Diligence (CDD): Collect all ID names, place of birth, nationalities, and addresses. Low-risk individuals are exempt from address verification.
• In low-risk situations, obliged entities are required to collect and verify a reduced set of identification data
• Beneficial Ownership: Verify beneficial owners using reliable sources; such as public registers and other reliable national systems.
• Remote Onboarding: Alternative identity verification is permitted when customers cannot present ID in person and cannot access electronic identification means or qualified trust services,
• Sanctions and PEP Screening: Screen customers and beneficial owners, including aliases, trade names, and digital wallet addresses where relevant to sanctions checks.
• CDD Thresholds: Business relationships require CDD and ongoing monitoring. Occasional transactions of €10,000 or more trigger CDD, with exceptions below this threshold.

What this means for merchant onboarding teams:

AMLA's final draft standards give merchant onboarding teams clearer expectations for collecting and verifying customer and beneficial ownership information, applying risk-based checks, and supporting remote identity verification.

The draft standards increase the operational demands of consistent data collection, identity and beneficial ownership verification, sanctions screening, risk-based due diligence, and linked-activity assessment, particularly at scale. 

Recommended actions:

• Automate identity data collection and verification, with reduced information requirements for low-risk customers where permitted.
• Use reliable business registers and independent sources to verify beneficial owners, rather than relying on ownership registers alone.
• Strengthen remote onboarding checks by setting clear rules for alternative identity verification methods and required safeguards.
• Use automated alerts to identify linked activity through shared devices, IP addresses, and common intermediaries.
• Track European Commission adoption and prepare onboarding processes for the final standards.

How OnBoard helps

OnBoard supports end-to-end merchant onboarding with automated verification and risk-based checks to help firms prepare for AMLA's final draft CDD standards.

• Smart Forms collect required customer and business information, adjusting questions based on risk to keep low-risk applications simple.
• Automated KYB and beneficial ownership verification checks merchant information and business owners against reliable data sources, reducing reliance on manual checks.
• OnBoard AIQ™ extracts and validates information from identity and business documents in real time, reducing manual data entry and verification errors.
• PEP and Sanctions Screening checks merchants and beneficial owners against relevant watchlists, helping identify potential risks before approval.
• Automated Decision Engine applies risk-based rules and routes applications with identified risks, including potential linked activity, for further review without slowing down low-risk merchants.

Source: Authority for Anti-Money Laundering and Countering the Financing of Terrorism 

🇨🇦 Canada

Industry News: FINTRAC 2025-26 Penalties and Registration Revocations

Effective date: Reported 22 to 26 October 2026

Issued by: Financial Transactions and Reports Analysis Centre of Canada (FINTRAC)

Applies to: Financial entities, money services businesses, casinos, real estate, and other reporting entities under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act.

Summary:

• What: FINTRAC’s 2025-26 results show 35 notices of violation worth over $247 million, and 82 money services business registrations revoked.
• Why: FINTRAC is focusing enforcement on higher-risk businesses and failures involving registration, transaction reporting, and AML compliance programs.
• What’s Next: FINTRAC will continue risk-based supervision under its enhanced Supervisory Framework, focusing on businesses with greater money laundering and terrorist financing risks.

Key findings:

• Financial entities received the most notices (12), followed by MSBs (8), and casinos and real estate (5 each).
• More than 55% of FINTRAC's assessment activities focused on MSBs, including virtual currency businesses and payment service providers.
• 82 MSB registrations were revoked for failing to respond to FINTRAC information requests, up from 12 the previous year.
• Nine MSBs received penalties totaling more than $198 million for failures involving registration, transaction reporting, and compliance programs

What this means for merchant onboarding teams:

FINTRAC's record penalties are a stark reminder that poor compliance can have serious consequences, from significant financial penalties to the loss of MSB registration.

For payment providers onboarding regulated MSBs, virtual currency businesses, or other higher-risk merchants, registration status and evidence of appropriate AML controls can be material due diligence inputs. Weak or missing evidence may warrant additional review before approval and closer monitoring throughout the relationship. 

Recommended actions:

• Verify MSB registration against FINTRAC's public registry before onboarding and regularly check for changes or revocations.
• Strengthen due diligence for regulated or higher-risk merchants, particularly MSBs and virtual currency businesses, by reviewing relevant registration information and evidence of AML controls where appropriate. 
• Act quickly on compliance gaps by escalating missing or revoked registrations and reviewing whether affected merchant relationships should continue.
• Keep clear records of registration checks, risk assessments, compliance concerns, and onboarding decisions to demonstrate effective due diligence.
• Review existing monitoring processes to identify changes in merchant risk before they lead to more serious compliance issues.

How OnBoard helps

FINTRAC's enforcement results highlight the importance of verifying MSB registration and identifying material compliance concerns when onboarding regulated or higher-risk businesses. OnBoard supports this by helping payment providers collect, structure, and review relevant evidence through end-to-end merchant onboarding and ongoing due diligence. 

• Smart Forms capture MSB registration details, regulated activities, and relevant supporting evidence about AML controls, with additional questions for higher-risk businesses.
• Automated Decision Engine flags missing registration evidence, incomplete information, or predefined risk indicators for review before a merchant is approved.
• Ongoing Customer Due Diligence (OCDD) helps teams monitor changes in merchant risk and reassess MSBs after onboarding, rather than relying on initial checks.
• Audit-Ready Reporting keeps a clear record of verification evidence, compliance reviews, and decisions, helping firms demonstrate due diligence during FINTRAC examinations.

Source: Financial Transactions and Reports Analysis Centre of Canada

‍

🇦🇺 Australia

Enforcement Action: The Star Ordered to Pay $260 Million in AUSTRAC Proceedings

Effective date: 28 October 2026

Issued by: Australian Transaction Reports and Analysis Centre (AUSTRAC), following court proceedings

Applies to: Casinos, gaming venues, and payment providers and acquirers serving gaming-sector merchants.

Summary:

• What: The Federal Court ordered The Star to pay AU$260 million for serious breaches of Australia's AML/CTF laws.
• Why: The court found that The Star failed to manage money laundering risks and allowed high-risk customers to gamble without proper checks.
• What’s Next: Expect continued scrutiny of casino and gaming operators, and of the firms that serve them.

Key findings:

• The Star failed to properly verify high-risk customers' information and source of funds, and conduct appropriate due diligence.
• More than 1,200 customers gambled through channels carrying elevated money laundering risks.
• Third-party transactions and cash deposits were allowed without recording the third party's identity.
• Junkets continued accessing private gaming rooms despite suspicious activity and known risks, without adequate controls.

What this means for merchant onboarding teams:

The Star’s AU$260 million penalty shows the serious consequences of allowing high-risk patrons to continue gambling without proper checks.

For casinos, pubs, clubs, and gaming venues, verifying a member’s identity at registration is only the beginning. Ongoing due diligence, effective monitoring, and timely escalation are essential to identifying suspicious activity and responding appropriately as risk changes.  

Recommended actions:

• Strengthen patron identity checks during member registration, including checks for previous gambling exclusions.
• Apply enhanced due diligence to high-risk patrons, including verifying their source of funds before allowing high-value gambling.
• Verify and record third-party identities when someone makes cash deposits or transactions on behalf of a patron.
• Use timely or real-time risk alerts, where appropriate, to identify unusual gambling activity, large transactions, and other warning signs that may require further review. 
• Establish clear escalation procedures so staff can act quickly on suspicious activity and keep records of the decisions made.

How OnBoard helps

For Australian casinos, pubs, clubs, and gaming venues, OnBoard supports customer onboarding, real-time risk checks, and ongoing due diligence to help address the compliance failures highlighted by AUSTRAC.

• Digital Member Onboarding automates identity verification and PEP and sanctions screening when new members register, helping identify risks from the start.
• Real-Time Risk Checks and the Automated Decision Engine trigger additional checks when defined risk events occur and route higher-risk patrons for further review or escalation. 
• Ongoing Customer Due Diligence (OCDD) keeps member screening information up to date through scheduled checks, helping venues identify changes in risk after registration.
• Audit-Ready Reporting maintains records of verification checks, risk alerts, and decisions, helping venues demonstrate how compliance concerns were handled.

Source: AUSTRAC 

‍

October’s message for onboarding teams: risk extends beyond the merchant 

October 2026 reinforced the importance of looking beyond basic merchant verification to identify hidden financial crime risks. Across sanctions enforcement, evolving CDD standards, and major AML penalties, regulators highlighted the need for stronger checks, timely risk detection, and effective controls throughout the customer relationship.

Several common themes emerged this month:

• Sanctions exposure extends beyond direct name matches, making beneficial ownership, connected businesses, banking relationships, and intermediaries important parts of due diligence.
• CDD and screening expectations are becoming more detailed, with AMLA's final draft standards and the FCA's proposed guidance highlighting identity verification, risk-based checks, and wider screening coverage.
• Stablecoin regulation is becoming more defined, increasing the importance of understanding whether a business issues stablecoins, provides custody services, or simply accepts stablecoin payments.
• AML enforcement shows the serious cost of non-compliance, with FINTRAC's penalties and The Star's AU$260 million penalty highlighting failures in due diligence, risk management, and ongoing monitoring.
• Real-time risk detection and ongoing due diligence remain essential, helping teams identify changing merchant activities, regulatory status, and financial crime exposure after approval.

These developments show that merchant onboarding cannot rely on one-time checks or disconnected manual processes. Payment providers need reliable business information, effective risk controls, and ongoing oversight to identify warning signs early, act on compliance concerns, and prevent costly failures.

OnBoard by MVSI supports this approach by connecting automated KYB/KYC verification, AML and sanctions screening, AI-assisted document checks, underwriting, risk-based decisioning, and Ongoing Customer Due Diligence (OCDD) in one end-to-end process. This gives payment providers the connected evidence and ongoing risk visibility needed to make trusted onboarding decisions and respond when risk changes throughout the merchant lifecycle.

‍

This content is provided for general information only and does not constitute legal or regulatory advice.