5 briefs · 4 new
Dutch banks must conduct critical, thorough ongoing monitoring of high-risk clients — verifying client statements against objective data and acting on risk signals — following DNB's €8.5m AML fine on ABN AMRO
Internet brokers and SFC-licensed VASPs must stop using OTP for login and device binding and adopt phishing-resistant authentication (e.g. passkeys, bound devices) no later than 8 July 2027, with monitoring, incident-reporting and client-awareness measures required sooner
RBI-regulated entities must screen accounts against the amended UNSC ISIL/Al-Qaida listing and act under Section 51A UAPA, ensuring no account is held in the listed name
Third-country-branch reporting teams and AMLA-scope obliged entities must produce reports conforming to the EBA 4.3 DPM, validation rules and XBRL taxonomy — AMLA risk-assessment reporting from 31 December 2026 and CRD Article 48l TCB reporting from 31 March 2027
EU national AML supervisors must assess and classify breaches using AMLA's shared gravity indicators and four-level method, producing consistent enforcement outcomes across Member States
