This Week in Global Compliance — VTB, BitBank and UK Crypto Rules Reshape Financial-Crime Controls
September 18, 2026 — Week of 12–18 September
Executive Summary
The period of 12–18 September brought together sanctions enforcement, digital-asset regulation and cross-border money-laundering actions across the United States and United Kingdom. The developments are connected by a broader expansion of financial-crime controls beyond traditional banking relationships, with authorities addressing correspondent banking, crypto infrastructure, regulatory perimeter and proceeds recovery.
On 14 September, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned Russia's VTB Bank for alleged involvement in Iranian sanctions evasion. On 17 September, OFAC separately designated Iran-linked digital-asset exchange BitBank and associated entities. In the United Kingdom, the Financial Conduct Authority (FCA) published final cryptoasset perimeter guidance on 16 September, while also taking enforcement action against a former law-firm manager over more than £28 million in misappropriated client money on 15 September. The U.S. Department of Justice (DOJ) also announced the return of approximately $29.7 million in proceeds from a Curaçao fraud, money-laundering and tax-evasion scheme on 17 September.
The week's pattern is directly reflected in the GFN Daily Brief — "Treasury Targets VTB Over Iran Sanctions Evasion" (14 September 2026) and the GFN Daily Brief — "FCA Sets Crypto Authorisation Perimeter Ahead of New Regime" (16 September 2026). Together, these signals show financial-crime controls expanding across traditional financial institutions, digital-asset businesses, professional intermediaries and cross-border proceeds.
Top Signals
1. OFAC extended Iran-related sanctions exposure to a major Russian bank
On 14 September 2026, OFAC designated Russia's VTB Bank under its Iran sanctions authorities, citing the bank's alleged role in establishing correspondent relationships with sanctioned Iranian banks. The measure was taken under Operation Economic Outcast and adds an Iran-related sanctions dimension to an institution already subject to Russia-related restrictions.
Why it matters:
The action creates additional exposure where Russian and Iranian sanctions risks intersect. Financial institutions may need to assess correspondent relationships, ownership structures and transaction flows against multiple overlapping sanctions regimes.
Source: U.S. Department of the Treasury / OFAC, Operation Economic Outcast Sanctions Major Bank Helping Iran Evade Sanctions, 14 September 2026.
2. OFAC targeted a digital-asset exchange within Iran's sanctions-evasion infrastructure
On 17 September 2026, OFAC designated BitBank, its developer Pishtaz Simorgh Electronic Trade Company, and three individuals associated with Iranian financier Babak Zanjani. Treasury stated that BitBank had been used to facilitate hundreds of millions of dollars' worth of Bitcoin transfers to the IRGC during June and July 2026.
Why it matters:
The designation makes clear that digital-asset exchanges can fall directly within sanctions-enforcement strategies when authorities identify them as components of a sanctions-evasion network.
Source: U.S. Department of the Treasury / OFAC, Operation Economic Outcast Disrupts Digital Asset Exchange Enabling the Iranian Regime, 17 September 2026.
Deep Dives
1. Crypto regulation — FCA defined the perimeter ahead of the UK's new regime
On 16 September 2026, the UK Financial Conduct Authority (FCA) published final guidance defining when cryptoasset activities require FCA authorisation. The guidance covers activities including qualifying stablecoin issuance, cryptoasset trading platforms, dealing and arranging, safeguarding and staking.
The FCA stated that the authorisation gateway will open on 30 September 2026, ahead of the new regime expected to begin on 25 October 2027.
The development is covered in the GFN Daily Brief — "FCA Sets Crypto Authorisation Perimeter Ahead of New Regime" (16 September 2026) and represents a different enforcement mechanism from the week's sanctions actions: rather than designating individual actors, the FCA is defining which crypto activities will fall inside the regulated perimeter.
Practical impact:
- Map existing crypto activities against the FCA's newly defined perimeter.
- Assess whether AML, safeguarding and reporting controls correspond to the activities requiring authorisation.
- Track the transition between existing Money Laundering Regulations registration and future FSMA authorisation.
Source: UK Financial Conduct Authority, PS26/18: Cryptoasset Perimeter Guidance, 16 September 2026.
2. Enforcement — Cross-border recovery remained part of the financial-crime response
On 17 September 2026, the U.S. Department of Justice announced that it would transfer approximately $29.7 million to the Government of Curaçao. The funds represented proceeds of an eight-year fraud, money-laundering and tax-evasion scheme involving an unlicensed lottery and unpaid taxes.
The DOJ's Money Laundering, Narcotics and Forfeiture Section obtained a U.S. court order enforcing Curaçao's restraint order against the proceeds.
The case demonstrates a separate but complementary enforcement mechanism to sanctions: international cooperation and asset recovery can extend financial-crime intervention beyond prosecution toward the return of identified illicit proceeds.
Practical impact:
- Maintain visibility over cross-border asset-restraint and forfeiture processes.
- Consider recovery risk alongside transaction monitoring and investigative controls.
- Ensure investigations can preserve evidence and trace proceeds across jurisdictions.
Source: U.S. Department of Justice, Department of Justice Returns Approximately $29.7M in Proceeds of Fraud, Money Laundering and Tax Evasion Scheme to the Government of Curaçao, 17 September 2026.
Data Points
- 14 September: OFAC designated Russia's VTB Bank over alleged Iranian sanctions-evasion activity involving correspondent relationships.
- 15 September: The FCA prohibited former law-firm manager Nurul Miah from working in financial services after findings concerning more than £28 million in client money.
- 16 September: The FCA published final guidance defining activities requiring authorisation under the UK's future cryptoasset regime.
- 17 September: OFAC designated BitBank and related entities as part of its Iran sanctions-evasion campaign.
- 17 September: DOJ announced the return of approximately $29.7 million in fraud, money-laundering and tax-evasion proceeds to Curaçao.
Watchlist
- Further sanctions targeting financial institutions and digital-asset infrastructure connected to Iran.
- Implementation planning ahead of the FCA's 30 September 2026 crypto authorisation gateway.
- Increased scrutiny of cryptoasset firms operating across existing AML registration and future FSMA requirements.
- Cross-border asset recovery actions involving fraud and money-laundering proceeds.
- Continued enforcement against financial-sector personnel with access to client or third-party funds.
Sources
- U.S. Department of the Treasury / OFAC, Operation Economic Outcast Sanctions Major Bank Helping Iran Evade Sanctions, 14 September 2026.
- Financial Conduct Authority, Final Notice 2026: Nurul Miah, 15 September 2026.
- Financial Conduct Authority, PS26/18: Cryptoasset Perimeter Guidance, 16 September 2026.
- U.S. Department of the Treasury / OFAC, Operation Economic Outcast Disrupts Digital Asset Exchange Enabling the Iranian Regime, 17 September 2026.
- U.S. Department of Justice, Department of Justice Returns Approximately $29.7M in Proceeds of Fraud, Money Laundering and Tax Evasion Scheme to the Government of Curaçao, 17 September 2026.
- GFN, Treasury Targets VTB Over Iran Sanctions Evasion, 14 September 2026.
- GFN, FCA Sets Crypto Authorisation Perimeter Ahead of New Regime, 16 September 2026.