The Financial Crime Guide (FCG) from the Financial Conduct Authority (FCA) offers practical guidance to firms on countering financial crime risks. It covers various crime types, including money laundering, fraud, bribery, and sanctions breaches, providing examples of good and poor practice. The guide emphasizes a risk-based approach, highlighting the importance of governance, risk assessment, policies, procedures, and staff training. It also references relevant legislation and other guidance documents, incorporating case studies to illustrate key points and consequences of non-compliance. Finally, it includes a glossary of common terms.

The UK’s Financial Conduct Authority (FCA) annual report reveals that a significant majority (almost 90%) of cryptocurrency firm registration applications were rejected or withdrawn in the past year. The primary reason for rejection was the applicants' failure to meet adequate anti-money laundering and fraud prevention standards. Only a small fraction of applications were approved. Furthermore, the FCA implemented a new “financial promotion perimeter” for crypto advertising to protect consumers from misleading promotions. The report also highlights increased consumer awareness of cryptocurrency scams.

Meta's decision to replace its third-party fact-checking program with a community-based system, similar to that used by X (formerly Twitter), is the central focus of these sources. This shift, announced by Mark Zuckerberg, is attributed to a perceived "cultural tipping point" towards prioritising free speech and is seen by some as a move to appease the incoming Trump administration. Critics express concerns about increased misinformation and the potential for a rise in scams, highlighting the significant implications for online safety and compliance. The sources present differing viewpoints on the impact of this change, contrasting the potential for greater freedom of expression with the risks of unchecked disinformation. Finally, the sources note that the number of fact-checking initiatives has plateaued and that fact-checking is becoming less prevalent.

This episode covers a policy document from the International Chamber of Commerce (ICC) which provides guidance for small and medium-sized enterprises (SMEs) on conducting effective anti-corruption third-party due diligence. It highlights the increasing legal risks SMEs face regarding bribery and corruption, especially in international business. The guide details a six-pillar framework for investigating potential business partners, covering beneficial ownership, financial background, competency, public records, reputation, and compliance culture. The document also outlines a risk-based approach to determine the extent of due diligence needed and offers practical steps for mitigating identified risks. Finally, it emphasises the importance of record-keeping and ongoing monitoring of third-party activities.

This podcast episode discusses the often-overlooked importance of GRC architecture in achieving effective governance, risk, and compliance. It highlights how siloed GRC teams, focusing on separate risk, compliance, and audit functions, lead to inefficiencies and prevent proactive risk management. The episode advocates for a centralised GRC architecture, integrating data and fostering collaboration between teams to improve information flow and strategic decision-making. This approach aims to move beyond reactive responses and the perception of GRC teams as mere data collectors. The podcast concludes by encouraging listeners to adopt a more collaborative and integrated approach to building better GRC programs.

The Office of the Comptroller of the Currency (OCC) issued a cease-and-desist order to Bank of America for deficiencies in its Bank Secrecy Act (BSA) and anti-money laundering (AML) compliance programs. The order mandates corrective actions, including hiring an independent consultant to review the bank's programs and investigate past suspicious activity reports. This follows a trend of increased regulatory scrutiny of BSA/AML compliance, exemplified by a substantial penalty levied against TD Bank for similar failures. Bank of America will implement remedial measures but faces no financial penalty. The bank had previously disclosed its discussions with regulators regarding these compliance issues. The OCC's action underscores the heightened focus on preventing financial crimes.

The episode argues that current anti-money laundering (AML) programmes in financial services are inadequate, focusing on superficial compliance rather than effective risk management. It highlights the inefficiencies and risks associated with this approach, such as wasted time on false positives and an inability to scale with business growth. The episode advocates for a proactive, data-driven strategy, emphasising the importance of staff education, open communication, and the strategic use of technology. Ultimately, it promotes a shift from box-ticking compliance to integrating robust risk management into the core business. This requires greater investment and a more sophisticated approach to AML.

This episode summarises a Moody's report on compliance and third-party risk management trends for 2024 and 2025. Key themes in 2024 included sanctions evasion, driven by the Russia-Ukraine war and increased US regulation, and a continued focus on anti-money laundering. Looking ahead to 2025, the report predicts a continued emphasis on sanctions compliance, enhanced supplier due diligence (particularly regarding the EU's Deforestation Act and NIS2 directive), and the increasing impact of faster payments and AI on risk management. The report highlights the need for unified risk management systems and the growing role of AI and RegTech in improving efficiency and accuracy, while addressing concerns about bias and data quality. Ultimately, the episode advocates for a more integrated and proactive approach to managing evolving compliance challenges.

This podcast episode categorises six types of hackers: black hats (malicious actors seeking personal gain), white hats (ethical hackers working to improve security), grey hats (operating in a legal grey area), red hats (vigilantes targeting cybercriminals), blue hats (hired testers or those seeking revenge), and green hats (inexperienced learners). The episode explains the key traits and motivations of each type, highlighting their impact on cybersecurity and compliance. Understanding these hacker types allows organisations to develop more effective security strategies and mitigate potential risks. The episode stresses the importance of proactive cybersecurity measures for compliance.

The UK's National Crime Agency (NCA) uncovered a massive, complex money-laundering operation, codenamed Operation Destabilise. Starting with a ransomware investigation, the NCA traced funds through cryptocurrency to a Russian-speaking network linked to street-level drug dealing, sanctioned Moscow elites, and even Kremlin espionage. The investigation revealed a sophisticated cash-for-crypto scheme, connecting low-level criminals to high-level international actors. Law enforcement's challenges included the sheer scale of the operation, its global reach, and jurisdictional limitations, highlighting the interconnected nature of cybercrime, organised crime, and state-sponsored activities. The NCA's success relied on a multi-agency approach and innovative data analysis techniques.