A Copenhagen court fines Nordea DKK 155 million as the UK sanctions all ten of Russia's major oil producers

On 12 November 2026 the UK made 20 new designations under its Russia sanctions regime and amended one existing entry. The government says that with Slavneft it is the first country to have sanctioned all ten of Russia's major oil producers, and that the package covers shadow fleet vessels carrying Russian oil and LNG, major coal companies and Rosneft's flagship Arctic project, LLC Vostok Oil. The Sanctions Notice lists nine entities and 11 ships. The entities are PJSC Oil and Gas Company Slavneft, LLC Vostok Oil, the coal producers SUEK and Kuzbassrazrezugol, the petrochemicals group PJSC SIBUR Holding, the engineering company JSC NIPIgazpererabotka, and three UAE-registered companies, Forteza Trading DMCC, Patera FZCO and Novus Energy DMCC. The ships include KORYAK FSU (IMO 9915105), MELICERTES (IMO 9958303) and NELEUS (IMO 9958315). The amendment removes the name Novus Energy DMCC from the entry for Altrum Group FZCO, now that Novus Energy has its own designation. Several of the new targets were already on OFAC's SDN List.

On 9 and 10 November 2026, at the G7 foreign ministers' meeting in Paris, Canada announced two packages under its Special Economic Measures Regulations. The Russia package adds 24 individuals and 38 entities, aimed at Russia's ballistic missile and wider defence industry, its cyber activities and financial enablers, including crypto exchanges; Canada's consolidated list shows Ozon Bank, Yandex Bank, Wildberries Bank, the National Settlement Depository and the exchanges EXMO, Rapira and Aifory among them. The Iran package reimposes sanctions on 11 Iranian entities that Canada delisted in 2016 under the Joint Comprehensive Plan of Action, for contributing to Iran's proliferation-sensitive nuclear and ballistic missile activities or financing its malign activities. They include the National Iranian Oil Company, Bank Mellat, Bank Melli Iran and the Bank of Industry and Mine. Canada says this is its 25th round of Iran-related sanctions and that it has sanctioned more than 3,500 individuals and entities in relation to Russia since 2014.

On 13 November 2026 OFAC designated the Los Mendoza Drug Trafficking Organization under E.O. 14059 and E.O. 13224, as amended, and added a counter-terrorism designation under E.O. 13224 to the Los Huistas Drug Trafficking Organization, which it first sanctioned under E.O. 14059 in March 2022. Treasury says both Guatemala-based groups control trafficking corridors along the borders with Honduras and Mexico and act as logistics partners for the Sinaloa Cartel and Cartel de Jalisco Nueva Generación (CJNG), both designated as Foreign Terrorist Organizations. Concurrently, the State Department designated a third group, Los Lorenzanas, as a Foreign Terrorist Organization and Specially Designated Global Terrorist. The updated SDN entries carry secondary sanctions risk under E.O. 13224 and link Los Mendoza to the Sinaloa Cartel, and Los Huistas to both cartels. Treasury describes Los Mendoza, founded in the 1980s, as one of Guatemala's oldest and most powerful criminal organisations, also linked to contract killings and money laundering.

On 9 November 2026 the Copenhagen City Court (Københavns Byret) fined Nordea DKK 155 million, about EUR 20 million, for breaches of Danish anti-money laundering law between 2012 and 2015. According to Nordea's release, the bank was acquitted on five of the seven counts and fined on the remaining two; the prosecution had sought DKK 6.6 billion, about EUR 880 million. The case tested whether the bank's AML processes and controls were adequate at the time: Nordea says it was not charged with money laundering or with assisting it, and that no current or former employee was charged. Danish press reporting of the National Special Crime Unit's (NSK) statement describes the case as centring on warnings about transactions with currency exchange offices in Copenhagen and on alerts archived without review. The NSK says it will study the judgment and consider an appeal; Nordea says it will review the full verdict and is adequately provisioned. The initial appeal period is two weeks, and any appeal would go to the Eastern High Court (Østre Landsret).

FinCEN's order finding the crypto exchange MEXC Global to be a foreign financial institution of primary money laundering concern in connection with Russian illicit finance was published in the Federal Register on 10 November 2026 (91 FR 72420) and takes effect on 10 December 2026. Issued under section 9714(a) of the Combating Russian Money Laundering Act and announced by Treasury on 6 November, it prohibits covered US financial institutions from engaging in transmittals of funds from or to MEXC Global, including its subsidiaries, branches, offices and successors; the order names affiliated entities in Seychelles, Estonia, Switzerland and the UK. Treasury says the exchange processed at least US$16 billion tied to sanctions evasion, cybercrime and other illicit activity between May 2021 and May 2026, including nearly US$1.5 billion linked to Russian sanctions evasion, about US$1 billion in direct transactions with more than 40 Iranian crypto exchangers and almost US$200 million tied to the A7A5 stablecoin. Treasury says the order does not change Bank Secrecy Act reporting duties or OFAC obligations.

On 11 November 2026 the Central Bank of Kuwait announced that its Board of Directors had imposed two financial penalties totalling KWD 320,000 on a local bank under its supervision, which it did not name. The penalties were imposed under Article 15 of Law No. 106 of 2013 on combating money laundering and terrorist financing, as amended, after an inspection that examined the bank's compliance with the central bank's requirements on combating money laundering, terrorist financing and the financing of the proliferation of weapons of mass destruction. The central bank says the bank breached Article Eleventh and Article Third of its instructions on combating money laundering and terrorist financing issued on 23 July 2013 and amended on 14 May 2019. The notice does not split the total between the two penalties, name the bank, give the inspection period or describe the conduct behind each breach.

On 12 November 2026 the FBI issued a FLASH alert (AC-111226-MS) on FaceStealer, a social engineering scheme it attributes to North Korean state-sponsored hackers known publicly as Sapphire Sleet, APT38 and BlueNoroff, among other names. The FBI says the actors have stolen more than US$400 million in cryptocurrency over the past 18 months. Targets are invited to fake Zoom, Microsoft Teams or Google Meet sessions from hijacked Telegram, LinkedIn, Slack or Discord accounts of people they know. The hackers play secretly recorded webcam video of earlier victims, stage a technical fault and talk the target into running an update or command that installs malware; each new victim's video and contacts then feed the next attack, and in several cases funds were stolen months after the first compromise. The FBI says it has seized more than 900 victim videos, that the group has begun using AI tools, which the FBI calls super intelligence, to generate deepfakes of well-known industry figures, and that it is also targeting open-source software maintainers. The FBI and the Justice Department announced the disruption of cloud infrastructure used in the scheme.