ClearSanction Intelligence
Monthly Compliance Brief
Edition 005 · November 2026
November 2026 Compliance Brief
From guidance to governance: emerging expectations for financial-crime controls
- FCA Financial Crime Guide
- Annex 1 AML Supervision
- OFAC Enforcement
- FATF October Plenary
ClearSanction Intelligence
Edition 005 · November 2026
November 2026 Compliance Brief
- FCA Financial Crime Guide
- Annex 1 AML Supervision
- OFAC Enforcement
- FATF October Plenary
ClearSanction Intelligence
In this edition
FCA Financial Crime Guide
Consultation opened 23 October 2026 and closes 24 December 2026.
02Annex 1 AML Supervision
Key regulatory and sanctions developments compliance teams should be aware of this month.
03OFAC Enforcement
Recent enforcement and supervisory findings point towards the need to test controls as connected ope
04FATF October Plenary
New features and roadmap for the ClearSanction platform.
The FCA's Financial Crime Guide Is Under Review: What CP26/38 Means for Compliance Teams
What happened? On 23 October 2026, the FCA opened consultation CP26/38, proposing updates to its Financial Crime Guide. The consultation closes on 24 December 2026. The regulator identifies fraud, cryptoassets, financial and trade sanctions, proliferation financing, data security, financial-crime systems and controls, and money laundering and terrorist financing among the subjects under review.
The FCA says its aim is to keep guidance relevant as threats evolve and firms make greater use of AI and third-party tools. The proposals also reflect the developing cryptoasset regulatory regime, due to commence in October 2027.
Why it matters. Guidance shapes how firms interpret regulatory expectations and assess the effectiveness of their arrangements. The consultation is therefore an opportunity to examine whether existing governance, monitoring, screening, escalation and assurance processes remain suitable. These are proposals, not final requirements. Firms should not present the draft changes as already binding.
Who is affected? FCA-supervised firms, including businesses supervised under the Money Laundering Regulations, Annex 1 financial institutions and cryptoasset businesses. Firms providing technology or outsourced financial-crime services may also need to understand the implications for their clients.
What compliance teams should do next
Editorial interpretation: the strongest message is not that every firm needs more controls. It is that firms should be able to explain why their controls are appropriate, how they operate and how their effectiveness is tested.
Primary source: [FCA, CP26/38: Financial Crime Guide updates (23 October 2026)](https://www.fca.org.uk/publications/consultation-papers/cp26-38-financial-crime-guide-updates).
FCA Restricts Six Annex 1 Lenders: AML Registration Is Not a Substitute for Effective Controls
What happened? On 23 October, the FCA announced restrictions affecting six unregulated lenders, referred to as Annex 1 firms, following concerns about their AML policies, controls and procedures during registration assessments. The restrictions were imposed at the firms' request and limit certain new business or dealings with existing customers. Some firms must undergo independent AML reviews. The FCA also said it was assessing responses to an information request sent to around 900 registered Annex 1 firms.
Why it matters. Annex 1 firms may be registered with the FCA for AML supervision without being authorised under the wider financial-services regime. Registration is not a general endorsement of the firm's financial-crime controls. Nor does a firm's position within a group remove its obligation to assess the suitability of shared controls for its own risks.
Who is affected? Unregulated lenders and other Annex 1 firms, their boards and compliance teams, and regulated banks or payment providers maintaining relationships with them.
What compliance teams should do next
Primary sources: [FCA announcement (23 October)](https://www.fca.org.uk/news/press-releases/fca-restricts-6-firms-following-concerns-over-anti-money-laundering-controls); [FCA Annex 1 supervisory statement](https://www.fca.org.uk/news/statements/fca-applying-increased-scrutiny-annex-1-firms).
OFAC's Bank of America Settlement: When Operational Gaps Undermine Sanctions Screening
What happened? On 13 October 2026, OFAC announced an $11,662,930 settlement with Bank of America, N.A. concerning 475 apparent sanctions violations across several US programmes. OFAC identified issues involving payments with blocked banks, prioritisation of alerts for exact name-and-date-of-birth matches, delays updating watchlists after designations, and human error in handling two business accounts linked to blocked persons. OFAC characterised the apparent violations as non-egregious and largely not voluntarily self-disclosed.
Why it matters. Even sophisticated screening environments can fail if updates are delayed, high-confidence alerts are not prioritised or operational decisions are not executed correctly. The lesson is broader than matching accuracy: the whole control chain matters.
Who is affected? Banks, payment institutions, cross-border businesses and any organisation with US sanctions exposure or a sanctions screening programme that relies on timely list ingestion and manual alert review.
What compliance teams should do next
Primary source: [OFAC enforcement action, Bank of America (13 October)](https://ofac.treasury.gov/recent-actions/20261013_33).
Sanctions Risk Beyond the Bank: Lessons from Pegasus Worldwide Logistics
What happened? On 9 October 2026, OFAC announced a $175,015 settlement with freight forwarder Pegasus Worldwide Logistics. The case concerned four apparent violations involving blocked property through the importation of a machine supplied by a designated company, as well as six apparent violations of OFAC's reporting, procedures and penalties rules. OFAC stated that the firm had failed to respond fully to a subpoena for six months.
Why it matters. Sanctions compliance extends beyond financial institutions and the transfer of funds. Trade participants must understand the sanctions status of suppliers, goods, transactions and related property. Responses to regulatory enquiries also form part of the compliance framework.
Who is affected? Freight forwarders, importers, exporters, manufacturers, logistics intermediaries and financial institutions supporting trade.
What compliance teams should do next
Primary source: [OFAC, Pegasus Worldwide Logistics settlement (9 October)](https://ofac.treasury.gov/recent-actions/20261009).
Practical Compliance Guide
Financial-Crime Controls Readiness Review: Ten Questions for Compliance Leaders
Use the following questions as a management discussion and assurance exercise, not as a substitute for a legal or regulatory gap assessment.
Suggested exercise: choose three recent sanctions alerts, one list-update event and one escalated transaction. Trace each end to end and record any gaps in ownership, evidence or timing.
Regulatory Watch
FCA Financial Crime Guide consultation
Status: Open. CP26/38 opened on 23 October and closes on 24 December 2026. Proposed changes should be evaluated, not described as final rules. [Official consultation](https://www.fca.org.uk/publications/consultation-papers/cp26-38-financial-crime-guide-updates).
FATF October Plenary — four jurisdictions removed from increased monitoring
Status: Published 30 October 2026. FATF removed Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco from its list of jurisdictions under increased monitoring following successful on-site visits. The plenary also adopted mutual evaluation reports for Mexico and the United States and approved work addressing illicit financial flows associated with fraud and scam compounds.
Why it matters: Country-risk screening and due-diligence processes must distinguish the latest FATF monitoring status from a firm's broader jurisdiction-risk assessment. Removal from increased monitoring does not mean a jurisdiction is risk-free or that other applicable controls cease to apply.
What firms should do: Update FATF status references in country-risk methodologies and customer review workflows; assess whether risk-rating changes are warranted using wider evidence; and review FATF's updated statements on high-risk jurisdictions, including Myanmar and Iran. FATF expressed concern over Vietnam's pace of progress under its action plan.
Primary sources: [FATF plenary outcomes, 30 October](https://www.fatf-gafi.org/content/fatf-gafi/en/publications/Fatfgeneral/outcomes-fatf-plenary-october-2026.html); [jurisdictions under increased monitoring, 30 October](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-october-2026.html).
OFAC sanctions-list and licensing changes
OFAC published further sanctions-list updates and general-licence activity during October, including Iran-related actions. Firms with relevant exposure should monitor authoritative list and licence publications, check effective dates and document operational implementation. [OFAC recent actions](https://ofac.treasury.gov/recent-actions).
Enforcement Watch
13 October — Bank of America: $11,662,930 settlement; 475 apparent violations; review watchlist deployment, alert prioritisation and operational handling.
9 October — Pegasus Worldwide Logistics: $175,015 settlement; trade-related blocked-property exposure and delayed response to an OFAC subpoena.
23 October — FCA Annex 1 restrictions: six lenders subject to restrictions; focus on risk assessment, governance and controls.
27 October — Extreme Networks: OFAC announced a $1,529,685 settlement involving nine exports of networking equipment and related services to a Russian defence manufacturer blocked through majority ownership by a designated entity. OFAC classified the apparent violations as egregious and voluntarily self-disclosed. Practical lesson: assess ownership-based sanctions exposure in customer and counterparty controls, not only direct name matches. [OFAC announcement](https://ofac.treasury.gov/recent-actions/20261027).
Emerging Risk
AI, Cryptoassets and Proliferation Financing: A Wider Control Perimeter
The FCA's consultation groups several developments that compliance teams have sometimes considered separately: AI-enabled processes, cryptoasset activities, proliferation financing and data security. This does not establish that the risks are identical or that every firm has exposure to all of them.
The practical challenge is governance. Firms should know which activities and third parties introduce new risks, what data and decisions underpin financial-crime controls, and where human oversight and escalation remain essential.
For teams using automated screening, effectiveness should be assessed against the purpose of the check, the quality of the underlying data, the treatment of Potential Matches and the evidence supporting decisions. More alerts do not necessarily mean better risk detection.
On the Roadmap
Improved Bulk Screening Review
Exploring more focused review filters to help compliance teams distinguish sanctions and PEP screening results. Prioritisation is under consideration.
Multi-User Accounts
Planned support for multiple users within an organisation's account, helping teams collaborate on screening workflows. Delivery timing is not yet confirmed.
Ownership Intelligence
A longer-term product direction focused on helping organisations understand ownership-related sanctions exposure. No release date has been confirmed.
The Intelligence Brief
November in 60 Seconds
Sources and Further Reading
Key regulatory and sanctions developments compliance teams should be aware of this month.
Financial Crime Guide consultation CP26/38
Consultation opened 23 October 2026 and closes 24 December 2026.
Proposals span fraud, cryptoassets, financial and trade sanctions, proliferation financing, data security and AML controls.
Six Annex 1 lenders restricted over AML concerns
FCA announced restrictions on six Annex 1 lenders on 23 October.
MLR registration is distinct from FCA authorisation and does not remove counterparties’ due-diligence obligations.
Bank of America settlement
OFAC announced an $11,662,930 settlement on 13 October relating to 475 apparent violations.
Watchlist updates, alert prioritisation and operational handling can be critical weaknesses.
FATF October plenary removes four jurisdictions from increased monitoring
On 30 October, FATF removed Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco from increased monitoring.
Country-risk models and enhanced review procedures should reflect the latest official FATF status.
Select a realistic sanctions scenario and follow it end to end. Test the data, screening result, investigation, escalation, decision, evidence and breach response rather than reviewing the written procedure alone.
A Control That Exists Is Not Necessarily a Control That Works
Recent enforcement and supervisory findings point towards the need to test controls as connected operational systems rather than isolated policies, alerts or technologies.
“Effective financial-crime compliance depends on whether controls identify the right risk, at the right point, and whether the organisation can act on the information they produce.”
Recent enforcement and supervisory findings point towards the need to test controls as connected operational systems rather than isolated policies, alerts or technologies.
New in ClearSanction
On the roadmap
Improved Bulk Screening Review
Exploring more focused review filters to help compliance teams distinguish sanctions and PEP screening results. Prioritisation is under consideration.
Multi-User Accounts
Planned support for multiple users within an organisation's account, helping teams collaborate on screening workflows. Delivery timing is not yet confirmed.
Ownership Intelligence
A longer-term product direction focused on helping organisations understand ownership-related sanctions exposure. No release date has been confirmed.
Stay ahead of sanctions, PEP and financial crime risk.
Book a demo or start screening with ClearSanction.