Skip to main content
Try Tangos (opens in new tab)
Collage of a bank building, laptop, phone, gavel and coin with tags for Deepfakes, Binance, OCC, FATF and Block, beside the headline "The week in financial crime and risk. Week ending 6 November 2026" and the Tangos logo.

Weekly Intelligence

Weekly Brief, Edition 1: week ending November 6, 2026

Tangos Weekly Brief  |  Week ending

The week at a glance

The buying question is becoming whether controls can work at machine speed and still be explained to an examiner. FATF published its scam-compound report and principles on 5 November; the FBI has attributed the theft of more than US$6 billion from Binance to North Korea’s TraderTraitor group; and the OCC set no new supervisory expectations for bank use of AI. [1][3][14]

In this edition

  • Regulatory radar – FATF principles, the OCC framework and open consultations
  • Adoption and proof – Bank deployments, market consolidation and the value question
  • Crypto control focus – The Binance laundering race and screening continuity
  • Enforcement and threats – Scam compounds, Block's DPA and deepfake identity
  • Questions worth asking – Three questions for your next control review
  • Sourcebook – Labelled references with links

The Week at a Glance

Something new from us. We're introducing the Tangos Weekly Brief – a short, source-checked roundup of the week's regulatory moves, enforcement actions and market signals in financial crime and risk, landing every week.

The buying question is becoming whether controls can work at machine speed and still be explained to an examiner. FATF published its scam-compound report and principles on 5 November; the FBI has attributed the theft of more than US$6 billion from Binance to North Korea's TraderTraitor group; and the OCC set no new supervisory expectations for bank use of AI. [1][3][14]

From Oonagh

From Oonagh: portrait of Oonagh van den Berg beside the quote "Speed without evidence is just faster risk." with the Tangos logo.

My read this week: the crime has gone machine-speed, and supervision is following. FATF says disrupt the whole network end-to-end, not just the payment at the end. The OCC tells examiners to scale control intensity with consequences and agency, not model sophistication. The FCA shows what happens when data never reaches the control at all.

The firms that answer well will show an investigation trail that works at the speed the money now moves, with a record a reviewer can test. Speed without evidence is just faster risk.

Regulatory Radar

Collage of a bank building and a phone with tags for FATF, OCC and FCA, headline Regulatory radar. Three publications, three dates.

FATF sets principles to disrupt scam-compound money flows

The 5 November report maps the payment, virtual-asset, technology and telecoms infrastructure scam networks depend on, and launches six principles: target the wider criminal ecosystem, disrupt flows end-to-end, connect the networks, act across borders in the first 24 to 72 hours, put victims at the centre, and adapt for lasting impact. Virtual assets are a central laundering channel; AI-enabled content, deepfakes and automation are cutting criminals' costs. [1]

Why it matters: the benchmark shifts from detecting victim payments to disrupting networks. Investigations need to connect recruitment signals, payment routes and cash-out points across borders.

The OCC's examiner framework arrives

Bulletin 2026-54 (4 November) sets no new supervisory expectations: examiners should tailor work to each use case's materiality, should not treat AI as a separate risk category, and may classify risk by potential consequences, transfer of agency and degree of human oversight rather than technical sophistication. [3]

Why it matters: examiners will ask consequence-and-agency questions. A use-case inventory should record what happens when an agent fails and who can intervene.

The FCA shows controls failing quietly

Wholesale Banks Supervision Insights 3 (2 November) reports a coding defect that left data un-ingested into a financial crime control, undetected for an extended period; staff use of unapproved AI tools causing data leaks; inaccurate AI-generated code passing human review; and untested kill switches. [4] Separately, proposed Financial Crime Guide changes (consultation open to 24 December) add trade sanctions focus, blockchain-analytics good practice, and a warning that rigid hop-count screening rules are bad practice. [5]

Why it matters: the FCA's examples are a checklist for the evidence you can produce today: data-lineage checks, AI inventories, override and escalation records.

Also moving: the European Commission urged banks to report platform scams under the Digital Services Act and decides this month on a voluntary anti-scam code of conduct [6]; AMLA's final draft CDD standards shift the test from collecting data to demonstrating proportionate, documented decisions [7]; and the FCA's cryptoasset application window is open, with a 28 February 2027 variation-of-permission deadline ahead of the regime's 25 October 2027 start. [4]

Adoption and Proof

Three market signals with different scopes. They do not form a common performance benchmark; each claim is as reported by its source.

Mashreq live with generative AI

Bank-announced production capability

Mashreq has launched generative AI in its fraud management platform with Clari5 (part of Perfios), targeting detection effectiveness, analyst productivity and investigator support. Clari5 says the AI runs on-premises, is auditable, explainable and under human control; Mashreq says it complements rather than replaces investigator judgement. [8]

Consolidation in identity and AML

Three transactions in three days

Fourthline and Veridas completed their merger on 3 November (up to €65 million in funding, projected combined 2026 revenue above €50 million). Hummingbird acquired Quantimon to feed alert outcomes back into detection models. Covalent Equity Partners made a growth investment in AML Analytics. [9][10][11]

What the numbers say

Vendor research and a practitioner survey

Napier AI's third AML Index estimates US$5.09 trillion was laundered in 2025 (the first recorded fall, down 3.84%), compliance spend of US$227.95 billion (down 4.9%) and US$143.08 billion in unrealised AI-driven savings – modelled estimates, not measured outcomes. [12] In Ireland, 92% of surveyed senior compliance professionals believe organised crime is increasingly using AI for financial crime, and 93% see AI-related dangers as a growing systemic risk. [13]

A test worth applying to any claim: more reviewable work completed at an agreed quality level, with evidence a reviewer can check – not elapsed time alone. The same test applies whether the claimant is a bank, a vendor or an in-house team.

Crypto Control Focus

Collage of a coin with four tags Continuity, Exposure, Calibration, Evidence, headline Four control questions. After the Binance theft.

The Binance theft is an evolving incident. Keep confirmed facts separate from forensic inference.

On 29 October, Binance said hackers stole more than US$6 billion from its hot wallets, the largest crypto theft on record. The FBI has attributed the theft to North Korea's TraderTraitor group and urged virtual asset service providers to block linked addresses; Elliptic, which first attributed the attack, estimates the loss at US$6.43 billion and says funds are being converted mainly into Ether and moved through DeFi and instant-swap services. [14][15] BaFin's anti-financial crime chief warned this week of increased attempts to circumvent Iran sanctions, including through crypto transfers. [17]

Four control questions to test

Illustrative framework; not a reconstruction of the attack.

  • Continuity – if your primary screening service fails, what runs instead, and who answered that before a regulator asked? Elliptic opened Fast Track Monitoring this week as a standby option. [16]
  • Exposure – can you show which wallets and transactions touched addresses linked to the theft, including after funds move through DeFi and instant swaps?
  • Calibration – does screening follow risk rather than a rigid hop count? The FCA's draft guide treats rigid hop rules as bad practice. [5]
  • Evidence – can logs connect identity, screening decisions, overrides and freezing actions into one timeline a reviewer can replay?

Our interpretation

The practical lesson is that laundering now runs on automation, so controls have to run continuously, with a fallback. Investigate the control sequence, not just the alert.

Enforcement and Threats

Collage of a gavel, laptop and phone with tags for Block and Deepfakes, headline Enforcement and identity.

Block's proposed US$764 million AML settlement

Block disclosed in its quarterly filing an agreement in principle with the US Department of Justice on a proposed three-year deferred prosecution agreement over alleged Bank Secrecy Act AML programme failures: estimated gross cost of around US$964 million, reducing to approximately US$764 million after credits for earlier settlements, accrued at 30 September. The agreement is not yet binding and remains subject to final terms and court approval. [18]

Scam compounds: victims on two fronts

FATF documents people from at least 80 jurisdictions trafficked into Southeast Asian scam compounds – an estimated 120,000 in Myanmar alone – and scam victims in more than 100 jurisdictions. Thailand reports illicit funds can exit the financial system in three to five minutes. Cited results: the US Scam Center Strike Force disrupted around 1.4 million accounts; Indonesia's Anti-Scam Centre blocked over 515,000 accounts and returned US$10.9 million; the UK's Scam Signals is associated with a 41% reduction in people scammed. [1][2]

Figures as reported by FATF and national programmes; methodologies differ. [1]

Investigation angle: connect the recruitment ad, the mule account, the instant-payment rail and the over-the-counter crypto desk into one case file.

Deepfake identity keeps widening

Identity-verification providers warned this week that a video call can no longer serve as sole proof of identity, citing the Arup deepfake CFO case (HK$200 million) and FBI warnings on AI impersonation. [19] This week's FATF report adds that AI-enabled content is reducing scam networks' costs and scaling their reach. [1]

Questions Worth Asking

  • If your primary screening service went down today, what would you tell your regulator tomorrow?
  • What evidence would your examiner need to see how your AI use cases are tiered by consequence and oversight?
  • Which parts of your alert-to-case trail could you replay end-to-end for a reviewer?

Frequently asked questions

What are the FATF's six principles for disrupting scam-compound money flows?

They come from the FATF report Combating End-to-End Illicit Financial Flows linked to Scam Compounds, published 5 November 2026. The six are: target the wider criminal ecosystem; disrupt illicit flows end to end; connect the networks; act at speed across borders, where the first 24 to 72 hours are critical; put victims at the centre; adapt for lasting impact.

What does OCC Bulletin 2026-54 change for banks using AI?

It sets no new supervisory expectations. It tells examiners to tailor their work to the materiality of each AI use case, and not to treat AI as a separate risk category. They may classify risk by potential consequences, transfer of agency and degree of human oversight, rather than technical sophistication. Banks should be ready to show what happens when an agent fails and who can intervene.

What should an AI audit trail show an examiner?

Enough to replay a decision. The FCA's Wholesale Banks Supervision Insights 3 names the gaps: data that never reached a financial crime control, incomplete AI inventories and untested kill switches. A trail an examiner can test covers data lineage into each control and a complete AI use-case inventory. It also needs logs that link identity, screening decisions, overrides, escalations and freezing actions into one timeline.

Sourcebook

Checked against available sources on 6 November 2026. Dates are publication dates; labels mark official, company, survey, vendor and secondary material.

  1. FATF – Scam compounds: illicit financial flows report and principles – https://www.fatf-gafi.org/en/publications/Methodsandtrends/combating-illicit-financial-flows-linked-to-scam-compounds.html – 5 November 2026 | official
  2. AML Intelligence – FATF President: worst still to come from fraud and scams – https://www.amlintelligence.com/2026/11/news-ai-digitalisation-and-better-connected-payments-mean-worst-still-to-come-from-fraud-and-online-scams-fatf-chief/ – 3 November 2026 | secondary
  3. OCC – Bulletin 2026-54: Super Intelligence supervisory framework – https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-54.html – 4 November 2026 | official
  4. FCA – Wholesale banks supervision: Insights 3 (Autumn 2026) – https://www.fca.org.uk/publications/multi-firm-reviews/wholesale-banks-supervision-insights-3-autumn-2026 – 2 November 2026 | official
  5. Baker McKenzie – FCA Financial Crime Guide: proposed sanctions changes – https://sanctionsnews.bakermckenzie.com/uk-financial-conduct-authority-publishes-sanctions-focused-proposed-changes-to-its-financial-crime-guide/ – 4 November 2026 | secondary legal analysis
  6. AML Intelligence – Compliance Council: DSA scam reporting and code decision – https://www.amlintelligence.com/2026/11/why-the-eu-wants-banks-to-report-social-media-scams-and-latest-on-ai-fraud-key-points-from-november-2026-compliance-council/ – 5 November 2026 | secondary
  7. FinTech Global – AMLA final CDD draft standards: what changes – https://fintech.global/2026/11/03/why-amlas-new-cdd-rules-raise-the-stakes-for-compliance/ – 3 November 2026 | secondary; vendor-quoted
  8. The Paypers – Mashreq launches generative AI with Clari5 – https://thepaypers.com/fraud-and-fincrime/news/mashreq-adds-generative-ai-to-its-fraud-platform-with-clari5 – 4 November 2026 | secondary; bank and vendor statements
  9. Business Wire – Fourthline and Veridas complete merger – https://www.businesswire.com/news/home/20261103282546/en/Fourthline-and-Veridas-Complete-Merger-to-Create-a-European-Leader-in-Bank-Grade-Digital-Identity – 3 November 2026 | company statement
  10. A-Team Insight – Hummingbird acquires Quantimon – https://a-teaminsight.com/briefs/hummingbird-acquires-quantimon-to-connect-aml-detection-with-alert-outcomes/ – 3 November 2026 | secondary
  11. PE Professional – Covalent growth investment in AML Analytics – https://peprofessional.com/2026/11/covalent-equity-partners-makes-growth-investment-in-aml-analytics/ – 4 November 2026 | secondary
  12. FinTech Global – Napier AI AML Index, third edition – https://fintech.global/2026/11/06/money-laundering-losses-fall-for-first-time-but-3tn-at-stake/ – 6 November 2026 | vendor modelled estimates
  13. Compliance Institute – AI in financial crime survey – https://compliance.ie/Public/Public/News/Most_Compliance_Experts_Think_AI_Being_Used_for_Financial_Fraud.aspx – 3 November 2026 | survey of 114 senior professionals
  14. AP – FBI says North Korean hackers behind Binance crypto heist – https://apnews.com/article/binance-crypto-hack-north-korea-fbi-883f18140c1e21ce0c38781e72cbe315 – 31 October 2026 | news agency; FBI attribution reported
  15. Elliptic – How compliance teams can identify funds from the Binance hack – https://www.elliptic.co/insights/how-compliance-teams-can-identify-funds-from-the-binance-hack/ – 2 November 2026 | vendor analysis; US$6.43bn estimate
  16. Elliptic – Fast Track Monitoring launch – https://www.elliptic.co/newsroom/elliptic-opens-up-fast-track-monitoring/ – 5 November 2026 | company statement
  17. AML Intelligence – BaFin warns of Iran sanctions evasion, including crypto – https://www.amlintelligence.com/2026/11/news-bafin-warns-of-rising-attempts-to-evade-iran-sanctions-including-through-crypto/ – 4 November 2026 | secondary
  18. The Paypers – Block reaches preliminary US$764m AML agreement with DOJ – https://thepaypers.com/fraud-and-fincrime/news/block-reaches-preliminary-usd-764-mln-aml-agreement-with-the-us-doj – 5 November 2026 | secondary; figures from Block quarterly filing
  19. FinTech Global – Why video calls are no longer proof of identity – https://fintech.global/2026/11/04/why-video-calls-are-no-longer-proof-of-identity/ – 4 November 2026 | secondary; vendor framing
  20. Agentic Tribune – FCA Quantum Experimentation Group for AML tools – https://agentictribune.com/article/20261105-fca-to-launch-quantum-experimentation-group-in-2027-to-test-anti-money-laundering-tools – 5 November 2026 | secondary
  21. KYC360 – AML Roundup: FATF principles, FBI Binance attribution – https://kyc360.com/knowledge-hub/resources/aml-roundup-6th-november-2026-fatf-sets-principles-for-disrupting-scam-compound-proceeds – 6 November 2026 | secondary aggregation

How to read this edition: news is attributed to the source named. Bank and vendor performance figures are the organisations' own reported claims, not independent measurements; index and survey numbers are as published by their owners. "Secondary" marks trade-press reporting of an organisation's claim. "Why it matters" lines, "our read" items and Oonagh's market perspective are editorial analysis.

Back to all weekly briefs