📅 Week of 24–30 October 2026 • Weekly Review
Binance disclosed a cross-chain theft of roughly $6.3B across 9 chains on 29 October, more than 4x the $1.46B Bybit hack of 2025 and the largest crypto theft on record. Deposits and withdrawals were suspended, with SAFU and own funds covering users. Issuers froze about $2.7B (Tether 1.76B USDT, Circle 823M USDC, Ripple about $200M), roughly $3.2B is still loose, and Chainalysis ties laundering to DPRK's TraderTraitor.
FATF plenary: grey list down to 18
Bulgaria, Côte d'Ivoire, DRC and Monaco exited the FATF grey list, no additions, taking it from 22 to 18 jurisdictions. A targeted review of major virtual-asset jurisdictions reports in June and October 2027. Why it matters: both feed next-cycle country risk assessments.
21 states challenge the beneficial-ownership rollback
A multistate coalition of 21 states plus DC challenges the 2026 final rule that exempted most US companies from beneficial ownership reporting, over 99.9% of entities originally covered by the CTA. It also seeks to block FinCEN's one-sweep deletion of filed BOI records around 10 February 2027. Why it matters: plan for both outcomes, with the deletion date a hard milestone.
Australia's biggest AML penalty: The Star, A$260M
The Federal Court ordered The Star to pay A$260M for serious AML/CTF breaches, below AUSTRAC's A$400M ask but above the A$100M liquidation threshold argued by the company. Payment runs in 4 installments over 19 months, first within 28 days, after findings that high-risk customers gambled without source-of-funds checks. Why it matters: a benchmark for source-of-funds gaps and remediation math.
GM pays $220M over driver location data
GM pays $220M to 35 states plus DC over sales of driving and location data from the 2016-2024 Smart Driver program. More than 370,000 drivers were wrongly told they were not enrolled, and the settlement requires affirmative express consent. Why it matters: nine-figure pricing of consent and data failures belongs on vendor-risk agendas.
Coinbase enforces MiCA: 14 stablecoins converted in EEA
From 30 October, 14 MiCA-restricted stablecoins left in EEA retail accounts convert at market rate, mostly into USDC. The issuer transitional period expired 1 July 2026, and ESMA's 8 January 2027 outer deadline was pre-empted by 10 weeks. Why it matters: map EEA retail token inventories against that deadline now.
FinCEN doubles down on fraud typologies
Two same-day actions: Alert FIN-2026-Alert009 on foreign-agent-directed payments involving US MSBs, plus a notice on illicit use of charities and non-profits, both backing the White House anti-fraud task force. They landed with a sweep uncovering nearly $30M in Medicaid and SNAP fraud. Why it matters: two typologies for MSB red-flag logic this quarter.
SEC narrows the Treasury clearing mandate
Exemptive order 34-106789 carves out inter-affiliate repo and repo with non-US counterparties from central clearing, ahead of phased compliance dates. Why it matters: rerun clearing-readiness scoping at banks and non-US desks for the narrower perimeter.
First dedicated AI security standard: BS ISO/IEC 27090
The 56-page standard covers data poisoning, prompt injection, model theft and other compromise types, feeding ISO/IEC 27001 and 42001, not a new certificate. Why it matters: the baseline for AI-security controls in ISMS and AIMS audits.
CFTC sues Utah over prediction-market jurisdiction
The CFTC sued Utah to block state action against CFTC-registered event-contract markets, after proceedings against 9 other states and briefs at 4 appeals courts plus 1 state supreme court. Why it matters: the fight decides which regime governs event-contract platforms and their AML/CFT duties.
ECB transition: Lagarde steps down on 7 February 2027
Christine Lagarde steps down on 7 February 2027, after leading the ECB since 1 November 2019 through the TLTRO unwind and the rate-hike cycle. Why it matters: ECB succession shapes the supervision compliance teams plan against.
WEEK'S TAKEAWAYS
- Model chain-level contagion, not just venue risk, after the $6.3B theft.
- FATF grey list fell 22 to 18 — time country-risk refreshes to 2027 outputs.
- BOI records face deletion around 10 February 2027 — hold records, plan both ways.
- Two nine-figure penalties in a week give compliance two benchmark anchors.
- Reconcile EEA token inventories against the 8 January 2027 MiCA deadline.
Sources:
binance.com — https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7
fatf-gafi.org — https://fatf-gafi.org/en/publications/Fatfgeneral/outcomes-fatf-plenary-october-2026.html
oag.ca.gov — https://oag.ca.gov/news/press-releases/attorney-general-bonta-sues-trump-administration-rolling-back-financial-crime
austrac.gov.au — https://www.austrac.gov.au/news-and-media/media-release/star-ordered-pay-260-million-serious-amlctf-breaches
ag.ny.gov — https://ag.ny.gov/press-release/2026/attorney-general-james-secures-220-million-general-motors-selling-drivers
help.coinbase.com — https://help.coinbase.com/en/coinbase/other-topics/other/mica-restricted-stablecoins
fincen.gov — https://www.fincen.gov/news/news-releases/fincen-issues-alert-and-notice-support-new-fraud-prevention-measures-minnesota
sec.gov — https://www.sec.gov/newsroom/press-releases/2026-111-sec-issues-exemptive-relief-treasury-clearing-requirements-certain-inter-affiliate-non-us-repo
bsigroup.com — https://bsigroup.com/en-GB/insights-and-media/media-centre/press-releases/2026/october/new-international-guidance-to-help-organizations-protect-ai-from-security-threats
cftc.gov — https://cftc.gov/PressRoom/PressReleases/9315-26
consilium.europa.eu — https://www.consilium.europa.eu/en/press/press-releases/2026/10/29/press-statement-by-eurogroup-president-kyriakos-pierrakakis-following-the-announcement-of-the-president-of-the-european-central-bank-christine-lagarde-to-step-down-on-7-february-2027/
Continue the conversation: https://t.me/ComplianceExplained · Bluesky
Top comments (0)