Vital4 Resources

Banking-as-a-service lets a chartered bank reach millions of customers it never meets. A new federal proposal is a reminder that the bank still owns every one of them.

In 2026, a $4 billion mortgage fraud syndicate moved through four of Australia’s major banks undetected. Not because the banks lacked compliance programmes. Not because screens weren’t running. But because screening alone doesn’t catch financial crime.

Instant payments are now core financial infrastructure: fast, final, and unforgiving. When a payment cannot be recalled, the sanctions decision has to be right inside a window measured in seconds. The constraint is not speed. It is the quality of the data you screen against.

Your screening data is current. Current as of when? Between September 29 and October 15, OFAC changed its sanctions lists ten times. Roughly one change every other day — and OFAC is one authority among thousands.

That is what Treasury found behind Bank of America’s $1.2B penalty — including more than $1 billion tied to national security and other priority illicit finance risks.

Politically exposed status means a customer gets more scrutiny, not a closed door. Treating it as a yes-or-no flag floods your queue with false positives and quietly excludes people the rules never told you to turn away.

The organized groups behind 2026’s fastest-growing financial crime run one continuous operation. Most institutions still fight it with two: fraud on one side, AML on the other. That seam is the opening.

In April 2026, regulators pulled generative and agentic AI out of SR 11-7, the model-risk framework everyone assumed governed it. That is not a reprieve. It means accountability for every agent now sits squarely with you.

Adverse media is where risk shows up first, and where up to 90% of alerts are noise. Getting it right was never about seeing more of the internet. It’s about context.

OFAC took 869 actions across 47 days in 2026 — and, for the first time in a decade, a wave of them were removals. The list now churns in both directions, and screening built only to catch additions is already behind.

The periodic customer review is in supervised retreat. In 2026, continuous, event-driven KYC has become the default — and the calendar-driven refresh now reads as a control weakness rather than a control.

Federal regulators just codified the end of “reputation risk” as a supervisory tool. The subjective shortcut that drove years of de-risking is gone — and what has to replace it is evidence.

Are you managing FCRA risk with a commodity or a critical asset? VITAL4 is the only global data platform purpose-built to adhere to FCRA data management standards. While legacy providers admit their architecture cannot support regulated use cases, VITAL4 provides the architectural integrity required for insurance underwriting, credit, and employment screening.

FinCEN’s whistleblower program went from a $150,000 ceiling to 10–30% of penalties, backed by a $300 million fund. The economics of staying quiet just collapsed — and that changes what your internal culture is worth.

For thirty years, compliance has been budgeted as the cost of staying out of trouble. The effectiveness era changes that math — and the institutions that see it first will win customers, partners, and deals.

In financial services, a bad hire isn’t just an HR problem — it’s a regulatory event.

Digital cash just became a regulated financial institution. The GENIUS Act’s new AML and sanctions rules pull stablecoin issuers into the same effectiveness-based regime as banks — and the hardest part is the data.

Regulators just invited AI into the AML program. “Invited” isn’t “safe by default.” Here’s what an agentic compliance workflow actually looks like — and what keeps it defensible.

FinCEN pushed the investment-adviser AML rule to 2028. Most firms heard “ignore it.” The advisers who read the delay correctly will treat it as a runway — and build the parts that won’t change.

Reading FinCEN’s final BSA rule before it’s written — and why compliance leaders shouldn’t wait for it.

One tightens screening obligations. The other opens the door for innovation. Both demand the same infrastructure — and the clock is already running.

The old regime measured alerts generated and SARs filed. The new regime measures whether any of it worked. Six metrics every compliance program needs now.

FinCEN’s effectiveness standard is coming. Here is the sequenced roadmap from comment period to exam-ready — and where modern compliance infrastructure fits at every phase.

FinCEN Just Changed the Rules. Most Compliance Programs Aren’t Ready.

FinCEN’s proposed BSA overhaul replaces “check the box” with “prove it works.” What that means for every compliance program in the country.

The compliance industry has normalized 95% false positive rates as a cost of doing business. It isn’t a volume problem — it’s an architecture failure.

The industry spends billions optimizing models for problems that better data would solve. In compliance, that pattern is both expensive and dangerous.

Generative, predictive, and agentic AI each solve different compliance problems. Deploying the wrong paradigm in the wrong place does not just waste budget — it creates risk.

The AI landscape is fragmenting into distinct paradigms — each with different architectures, strengths, and failure modes. Knowing the difference is no longer optional.

AI-powered investigative tools are impressive. But when regulators audit your AML program, they need to see you screened everyone, every time.