Monthly GFN Outlook – Global FinCrime & Compliance (November 2025)

🔍 Executive Summary

November 2025 marked a decisive shift across global financial-crime landscapes. Three macro-forces shaped the month:

Regulation is moving faster than implementation. Europe is accelerating simplified and harmonised AML rules, while new supervisory bodies (like AMLA) begin to define cross-border expectations. Fragmented, country-specific approaches are becoming untenable.
Supervision is expanding beyond banks. Regulators like the UK FCA are turning their spotlight onto asset managers, alternative firms, PSPs, and fintech infrastructure — the “periphery” of finance is now a core AML expectation zone.
Criminals are exploiting the fusion of crypto, cyber and AI. Mixers, deepfake fraud, ransomware infrastructure and cross-border laundering cases show that cybercrime and financial crime are no longer distinct categories.

For compliance and fincrime leaders, the message is clear:
2026 will not be about incremental upgrades. It will be about integrating AML, sanctions, fraud and cyber into a unified operational model.

1. The Macro Picture – What Actually Shifted in November

1.1. Regulators want less friction, more standardisation

The European Commission signaled support for simpler, harmonised AML rules, designed to:

improve data-sharing,
standardise supervision under AMLA,
reduce fragmentation across financial and non-financial sectors.

This implies:

Uniform KYC/KYB expectations across member states,
A shift toward reusable identity and risk-data frameworks,
Centralised governance for group-level AML risk.

The institutions best positioned for 2026 will be those who invest in unified risk-data architecture, not country-by-country patchwork.

1.2. De-risking gives way to “risk re-engineering”

Across the month, enforcement patterns show that:

blanket de-risking is losing credibility,
regulators demand granular, evidence-based risk reasoning, and
governance and methodology matter as much as tools.

This pushes institutions toward re-engineering how risk is quantified and documented, rather than simply terminating relationships.

2. Structural Themes of the Month

2.1. Crypto: the “Wild West” is closing

November was particularly intense for crypto-related enforcement:

Founders of major crypto mixers were sentenced for laundering over US$237M in illicit proceeds.
Investigations revealed billions in flows through top global exchanges tied to drug networks, ransomware groups and sanctioned jurisdictions.
Regulators continue tightening VASP regimes.

Implications:

Crypto exposure is now an enterprise-level risk, not a niche product risk.
Institutions must integrate on-chain + off-chain intelligence in monitoring.
Due diligence on custodians, liquidity partners and brokers is now a core control.

2.2. Sanctions and cyber are fully converging

The month’s joint U.S.–UK–Australia sanctions against Russian “bulletproof hosting” providers reinforced a new reality:

sanctions are now a cyber enforcement tool,
infrastructure providers (hosting, payments, cloud) face dual AML–cyber exposure, and
cross-border coordination is becoming standard.

2.3. AI-enabled fraud is reshaping threat models

Deepfake scams triggered major losses in multiple jurisdictions. Core lessons:

First-party “authorized” fraud via AI impersonation is becoming harder to distinguish from legitimate customer behavior.
Static rules and device/IP checks are insufficient; behavioral context is key.
Internal and customer education must adapt beyond classic phishing.

3. Regional Landscape – Where Pressure Is Rising

3.1. Europe – Simplification in strategy, intensification in practice

Key movements:

Push toward harmonised AML rules under AMLA.
Stronger emphasis on FIU interoperability, structured data and cross-border supervision.
Active debates about AI, digital identities, and data spaces in KYC/KYB flows.

What this means:

Fragmented onboarding processes will age out quickly.
Supervisors will expect group-level AML governance.
Institutions with consolidated data systems will negotiate better with regulators.

3.2. United Kingdom – FCA heats up the non-bank sectors

This month, the FCA launched mandatory AML surveys for asset managers and alternative firms, requesting detail on:

governance,
sanctions controls,
crypto exposure,
monitoring methodologies.

Signals:

AML expectations are now horizontal, not just banking-centric.
Boards are expected to own AML decisions, not just rubber-stamp them.

3.3. North America – Enforcement as a teaching method

In the U.S., November brought:

Heavy sentences for crypto-mixing founders.
Coordinated sanctions on cyber-criminal infrastructure.
A global insider-trading + laundering case involving multiple jurisdictions.

Regulators and prosecutors are using high-visibility cases as public playbooks for industry behavior.

3.4. Latin America & Emerging Markets

Key dynamics:

U.S.–Mexico coordination on casino-based laundering tied to cartels.
Emerging markets modernizing AML frameworks under international pressure.
Fraud and digital scams accelerating faster than institutional response capacity.

4. Threat Typologies in Focus

4.1. Crypto-centric laundering

Key patterns:

mixers breaking audit trails,
brokers/custodians acting as laundering conduits,
state-sponsored groups using crypto for cash-out.

Questions for institutions:

Can you explain your total crypto exposure in one slide?
Do your models differentiate legitimate privacy use from high-risk patterns?
Do partner-risk frameworks reflect 2025 ecosystem realities?

4.2. Casinos, gaming and entertainment as laundering channels

Insights:

Tourism-driven cash-heavy sectors remain prime laundering vectors.
Weak integration between gaming, financial and KYC systems creates blind spots.
Cross-border cooperation is closing “regulatory silos”.

Institutions interacting with these sectors must assess:

typologies for cash-outs, chargebacks, unusual merchant activity,
geographic risk and counterparty structures.

4.3. AI-enabled fraud and “Social Engineering 2.0”

Deepfake-driven scams highlight:

behavioral anomaly detection is crucial,
legacy fraud models are quickly becoming outdated,
training must evolve to incorporate video-call impersonation and real-time deception.

5. Regulatory & Enforcement Tracker (With Commentary)

5.1. Reforms & high-impact initiatives

Europe pushes for simplified AML rules tied to AMLA’s future supervisory role.
Cross-border FIU data-sharing becomes a priority.
Regulators are aligning expectations around AI explainability and model governance.

Implications:

Institutions need a 12–24 month roadmap covering:
- risk data consolidation,
- model governance uplift,
- sanctions and crypto capability upgrades.

5.2. Sector-specific supervision is intensifying

Examples across jurisdictions:

FCA’s crackdown on asset managers,
targeted reviews of non-bank sectors,
scrutiny over sanctions implementation capacity.

The bar is rising for governance, documentation and risk justification.

5.3. Defining enforcement cases of November

Crypto mixer founder sentences show that anonymity tooling = criminal liability when knowingly misused.
Russian ransomware infrastructure sanctions show that support actors are as exposed as criminals.
Global insider-trading ring highlights persistent weaknesses in cross-border capital markets.

6. Strategic Reading for Chief Compliance & FinCrime Officers

6.1. Three board questions for Q1 2026

Are we architected for a harmonised regulatory environment, not a fragmented one?
Do we have a single source of truth for AML + sanctions + fraud + cyber risk?
Are we building capabilities for the convergence era, or maintaining siloed structures?

6.2. Practical priorities for the next 3–6 months

Risk data architecture
- consolidate customer + transaction data,
- define canonical risk metrics.
Sanctions & crypto uplift
- tighten screening logic,
- update partner-risk models.
Fraud & AI
- launch behavior-based fraud detection pilots,
- educate internal teams on deepfake-driven scams.
Governance & narrative
- build a FinCrime Narrative Pack for the board,
- codify risk appetite and escalation pathways.

7. Outlook – What to Watch in December & Early 2026

Evolution of EU AMLA and harmonised rulemaking.
Supervisory expansion into non-bank sectors, gaming, crypto-infra.
High-profile sanctions and cyber enforcement.
Early case law or regulatory guidelines shaped by AI-enabled fraud.

The underlying message:

The threat landscape is no longer “AML vs fraud vs cyber.”
It's an integrated system of risk.
Institutions who operate in silos will fall behind — operationally and competitively.

GFN will continue to track and decode these developments, providing actionable intelligence for leaders steering the global fight against financial crime.