OFAC doubles down. Kallas trails a 1,600-name autumn package. Youverify becomes the first MEA compliance vendor positioned for ISO 42001.

The Treasury's Office of Foreign Assets Control published a wide-scope action on 20 August, updating the Specially Designated Nationals List with fresh Counter Narcotics, Counter Terrorism, Cuba-related and Iran-related designations. In parallel, OFAC issued Russia-related General Licence 131I, authorising certain transactions for the negotiation of and entry into contingent contracts for the sale of Lukoil International GmbH and related maintenance activities, and amended two Russia-related Frequently Asked Questions (FAQs 1224 and 1225) and one Cuba-related FAQ (1265). The general licence gives a supervised window for divestment activity around the Lukoil International franchise; the amended FAQs sharpen how third parties should read what remains prohibited outside that window.

Sources: OFAC Recent Actions, 20 August 2026 (20260820); OFAC Russia-related General Licence 131I; amended FAQs 1224, 1225 and 1265, 20 August 2026

On 18 August OFAC published International Criminal Court-related designations, adding named individuals including Tomoko Akane and Abdoulaye Seye, and a Venezuela-related designation of Bluwaves Properties Limited. Alongside the designations, OFAC issued International Criminal Court-related General Licence 12, authorising the wind-down of transactions involving certain persons blocked on 18 August. The pairing of designation and wind-down licence is the operational tell: OFAC expects counterparties to exit exposures in an orderly window rather than freeze them in place.

Sources: OFAC Recent Actions, 18 August 2026 (20260818); OFAC International Criminal Court-related General Licence 12; JD Supra briefings, 18-20 August 2026

EU High Representative Kaja Kallas announced on 17 August that the European External Action Service intends to propose the most far-reaching sanctions package against Russia since the start of the war, targeting around 1,600 individuals and entities and increasing the total listings by roughly a third. The measures are expected to be presented to member states in early September and adopted by October. The package is briefed to include travel bans, transaction restrictions and asset freezes, with a September tranche focused on those involved in trafficking Ukrainian children under the human-rights framework, and a later autumn tranche on hybrid activities including cyberattacks and misinformation campaigns. Kallas placed the running cost to the Russian war machine of European sanctions at around one thousand billion euros.

Sources: European External Action Service briefing, 17 August 2026; Euronews, 17 August 2026; Reuters (via Internazionale), 17 August 2026; Ukrainska Pravda, 17 August 2026

Two weeks after FinCEN's record USD 125 million penalty on UBS Financial Services for repeat Bank Secrecy Act failures, the outside-counsel and consulting reads have settled. Holland and Knight and other firms published detailed compliance-lesson analyses in August, converging on three points: the order lands on a firm with an unclosed 2018 consent order, the operational failures are wire-monitoring and customer due diligence at scale (over 50,000 foreign-currency wires and over USD 10 billion untriaged, hundreds of SARs late or missing), and FinCEN's remediation package (retrospective lookback plus an independent AML programme assessment, with up to USD 15 million waivable against documented review costs) is now the de facto template for peer broker-dealers with open findings. UBS admits the violations were wilful.

Sources: FinCEN news release, 3 August 2026; Holland and Knight, 'FinCEN Imposes Record Penalty on Broker-Dealer' (Insights), August 2026; ACAMS breaking-news alert; KYC360 AML Roundup

Since 1 January 2026, all Designated Non-Financial Business and Profession filings and returns must be submitted exclusively through the SCUML portal under the Economic and Financial Crimes Commission. The portal-only rule closes the physical-lodgement route that many DNFBPs still relied on and pushes them into a machine-readable supervisory pipeline. The enforcement ladder against covered institutions is now visible: Access Bank was fined N35 million in 2026 following a one-year risk-based examination for AML/CFT/CPF lapses, while Zenith Bank absorbed a N15.42 billion penalty in 2025 for equivalent failures. The Central Bank of Nigeria's own H1 2026 directive slate keeps AML automation, open banking and APP fraud rules live in parallel, with the automated AML implementation roadmap due 10 June 2026 already past its filing date.

Sources: SCUML portal notice, 1 January 2026; ANQA Compliance Nigeria AML and Sanctions Compliance Guide, 2026; Zigram AML Compliance Nigeria Guide, 2026; Aluko and Oyebode financial-crime enforcement briefing; Technext CBN H1 2026 directive summary

A FinTech Global piece on 19 August set out the emerging structural cost in compliance operations: payments and gambling firms in particular are spending up to 40 per cent of their compliance-team time simply checking whether rules have changed, rather than acting on the changes themselves. The root problem is regulatory information scattered across regulators, ministries, government portals and industry notices, published in different languages and formats and on no shared schedule. Related FinTech Global coverage the same week called out siloed reporting under tighter rules and the shift from 'compliance by control' to 'compliance by design' as the framing that resolves it. The compliance budget conversation this quarter has moved from headcount to instrumentation.

Sources: FinTech Global, 19 August 2026: 'Regulatory chaos costs firms millions'; FinTech Global, 19 August 2026: 'Why siloed reporting could break under tighter rules'; FinTech Global, 19 August 2026: 'From compliance by control to compliance by design'

FinTech Global reported on 17 August that regulators across the United States, United Kingdom and United Arab Emirates are converging on the same message: financial firms do not need to wait for AI-specific rules before tightening governance around AI systems. The SEC's 2026 Examination Priorities embed AI oversight across information security, operational resiliency and emerging financial technology, which means AI governance is examinable this cycle even where no bespoke AI rule has yet been finalised. The governance gap the article identifies is not accuracy but documentation: model inventory, risk classification and human-oversight records for AML, fraud and KYC AI systems.

Sources: FinTech Global, 17 August 2026: 'AI governance gap puts financial firms at examination risk'; SEC 2026 Examination Priorities

FinTech Global reported on 18 August that ISO 42001, the first international AI management system standard, has become the baseline expectation for enterprise AI deployments, vendor due-diligence questionnaires and regulatory examinations across the European Union, the United Kingdom and Asia-Pacific. The standard sets out an AI policy, a live risk and impact process and 38 controls to apply against real systems, and pairs directly with the EU AI Act's Articles 9 to 15 on risk management, data governance, technical documentation, human oversight and accuracy. Against that market shift, Youverify has become the first compliance vendor in the Middle East and Africa positioned for ISO 42001 accreditation, taking the AI-in-compliance conversation from marketing claim to certified governance. For the Vyra AI compliance assistant and the wider Youverify screening and workflow stack, the certification lock-in is on the governance evidence that auditors and enterprise buyers ask for first: model inventory, human oversight records, risk classification and continuous monitoring.

Sources: FinTech Global, 18 August 2026: 'ISO 42001 becomes new baseline for AI vendor trust'; ISO/IEC 42001:2023 standard; Microsoft Compliance ISO 42001 offering guide; Youverify AI governance accreditation announcement, August 2026