Treasury Postpones AML Rule, Crypto Crime Hits Midyear High, and Russian Universities Teach Sanctions Evasion

This week, John Byrne and Joe McNamara discuss Treasury's decision to postpone the investment advisor AML rule from 2026 to 2028 and reopen the comment process, drawing criticism from anti-corruption groups who warn it sends the wrong signal during the US's ongoing FATF evaluation. The hosts review Chainalysis's midyear crypto crime report showing $2.17 billion already stolen in 2025, with North Korea's $1.5 billion Bybit hack representing the largest single cryptocurrency theft in history. They also examine the newly signed GENIUS Act on stablecoins and its upcoming regulatory requirements. International developments include Russian universities offering Kremlin-backed master's programs in sanctions evasion and the EU's toughest sanctions package in years, which lowers the Russian oil price cap to $48 per barrel. The episode concludes with updates from the Wolfsburg Group on risk-based approaches and previews upcoming webinars on AI in compliance and fraud prevention.

Treasury Postpones AML Rule, Crypto Crime Hits Midyear High, and Russian Universities Teach Sanctions Evasion - Transcript

Joe McNamara: Hey John, how are you this week?

John Byrne: I'm good, Joe. We decided since Elliot and I do these together, unless one of us is traveling like Elliot is, we decided to reduce the overall age of our two participants by 40 years. So thank you for joining us.

Joe McNamara: It's a pleasure to be back. Like I mentioned to Elliot the last time we did these, I thoroughly enjoy sitting down with you guys and running through, the week's worth of compliance news, AML news, and just really great opportunity to kind of learn from the best.

So with that, where do you wanna start this morning?

John Byrne: First, both domestic and international things are going on, but I thought I would start with something that, frankly is not baffling at all. I wasn't surprised to see it, but I want to give people some context. So earlier this week Treasury announced the postponement and the reopening of the investor investment advisor rule.

If you remember, a regulation was proposed, so there was an open comment process, so people did get the opportunity to comment. That closed and there was gonna be a final regulation. It was a final regulation for investment advisors. Something too - as context here, back when the Patriot Act was passed in 2001- in October, 2001 and the regs were being promulgated. Early next year I was with the American Bankers Association, and we pushed the notion that anybody that had, any entity that had, a financial footprint should have some obligation under the Bank Secrecy Act. And that included investment advisors and that was early on, proposed 23 years ago.

And the regulation was finalized last year and this administration decided, as I said earlier this week, to postpone the rule and to reopen the rule. Now reading from the Treasury, the other thing that's important here, Joe, is this is a FinCEN regulation, but you go on FinCEN website, they just link to the Treasury website for the announcement.

Joe McNamara: Correct.

John Byrne: Which is, fairly unusual. But reading excerpts from the press release, “in order to ensure efficient regulation that appropriately balances, costs and benefits...FinCEN today is announcing its intention” - as I said – “to postpone the rule and revisit the scope of the rule at a future date. FinCEN anticipates delaying the effective date of the rule from January 1st, 2026 to January 1st, 2028.”

Now, again, I think it's important to, to make folks aware that there was a comment process. So investment advisors, equity firms, all of those folks were certainly able to file their comments. And so they're gonna reopen that and as everybody knows, it follows administrative procedures.

That's how that process works, right?

You put out a proposal, you do an advance notice. Get comments, but at the notice you get comments and then you do the final rule.

So I guess we're gonna do that again. So that's gonna be interesting on a number of levels.

I do wanna mention one thing. Several groups have commented on this and not all positively, the FACT Coalition who we have talked to many times before, which includes Transparency International, Global Financial Integrity, and groups like that - they issued a press statement right after this quoting from them “FinCEN announced the plan to postpone and reopen the rule. That safeguards according to the press release, $130 trillion in US private investments.”

The Rescope rule is now supposed to take effect in 2028. The executive director said with this announcement, “Treasury is kicking the can on an already long overdue AML safeguards and that decision”- again, quoting from Ian Gary –“sends a signal to criminals and US adversaries that they can continue to move illicit funds through massive and opaque US private investment sector with impunity”

It's gonna be interesting to see what happens. Joe. We've talked about this under the guise of the Corporate Transparency Act and the, elimination of its coverage for domestic entities that the US is currently going through a mutual evaluation from FATF that will be concluded in 2026. These are two key areas that will definitely be part of the focus of that evaluation. So should be very interesting to see what happens,

Joe McNamara: Absolutely. And to your earlier point too, unsurprising. But not necessarily ‘non-disappointing’, meaning, ‘hey we kind of half expected to see something like this’, but it doesn't make it any less disappointing in terms of, the momentum and certainly some of the direction that we're seeing at the regulatory level here, domestically,

In terms of, other things that we saw this week? I know from a crypto perspective, there were a couple things that came out. I wanted to focus primarily on Chainalysis’s midyear report. Without giving away all of the secrets, which you guys can go in and find it - Chainalysis, I think, posted it either earlier this week or late last week - looks like the 17^th - the update is essentially that stolen funds are surging in terms of what we've seen from a benchmarking perspective from 2022 to now.

But just curious, John, did you pull anything out of that you found overly insightful?

John Byrne: So you're talking about their midyear crypto crime analysis?

Joe McNamara: That's correct, yeah.

John Byrne: Yeah. And again, Chainalysis does great work as I think folks know that, listen to our AML conversations. Jim Lee, former IRS Chief, criminal division, is at Chainalysis. And Jim's been great. I also, as a quick aside, Chainalysis also did a, an overview of Japan's take on stable coins.

So that's something else to take a look at. But according to Chainalysis’s 2025 midyear [report] - has already seen $2.17 billion stolen in crypto, which is again, pretty phenomenal. They're approaching total losses. That they've seen in all of 2024, and they say the majority of the damage stems from North Korea's $1.5 billion hack of Bybit.

And that was the largest single cryptocurrency theft in history.

But, I think, as I've said, and Elliot has said and confirmed throughout our conversations, LinkedIn has become a great place for you to stay on top of these kind of issues. Again, Chainalysis does great work. We've obviously interviewed folks from TRM labs that they've done some excellent work in the crypto and adjacent spaces.

These companies not only comment on activities, but produce their own reports, and they're really valuable from a training perspective and just from a due diligence perspective, frankly.

Joe McNamara: One hundred percent. I think the only other call out I would make too is. They go so far as to talk about from a consumer perspective.

So one of the things that the report, at least midyear calls out is that personal wallet compromises are now representing the better part of almost 24% of all stolen fund activity, year to date in 2025.

When you kind of couple that with, I'd never heard of this term until I went and read this report, but “wrench attacks”, which are physical violence or coercion against crypto holders - again it's one of those things where, to your point, there's a continuous stream of training material and just things to stay on top of from a professional perspective.

From a personal one too, unfortunately, folks are starting to figure things out and in some cases taking nefarious actions against Bitcoin holders and others that quite frankly are just innocent bystanders.

I know you also mentioned that they had a piece about stable coins and kind of Japan's take on that. So why don't we, why don't we run over there?

John Byrne: Yeah, just, it just briefly it's a quick overview. I didn't download the report. Just the, j just the short scope of it.

But I think given what happened in the in the Congress last week, it's important to recognize what other countries are saying regarding issues like stablecoin. So I would just say they talk about the need for a strong infrastructure and that sort of thing, that just came out.

So that's available. So I would urge folks to take a look at that. Like I said, Chainalysis is a great organization to follow. Their reporting is top notch and valuable, as is some of these other groups. But I thought maybe what I would switch to Joe, is last week, Elliot and I talked about the variety of crypto bills that passed the house after they had passed the Senate and then it were signed. They were signed by the President on Friday. One of those acts is called the acronym, and they love acronyms in Congress, the GENIUS Act. It actually means something - believe it or not - it's the Guiding and Establishing National Innovation for US Stablecoins Act.

And I could tell you from from way back when the Patriot Act was crafted, that acronym actually meant something. You could. Google it or look that up as well. But one of the, one of the three bills that passed was what they call the Genius Act, as I mentioned, and it deals with stable coin and related topics.

But I just wanna focus on one aspect of it and how it could potentially impact or will potentially impact the AML/Sanctions community. Reading here from our good friend Dan Stipano, who I've been able to interview, and Dan is with the law firm Davis Polk, they put out a piece that I would urge folks to take a look at.

And they talk about a couple things. They say that issues with the financing of terrorism to counter that, sanctions compliance, are covered under this act, but it's important to recognize that the expectations are not set out in the legislation and they'll have to be determined through implementing regulation, which is pretty interesting given the attacks from certain sides of the political spectrum who've always suggested, and insisted directly, that we shouldn't have regulators writing regulations. Now remember, it's done this way. You pass a law. And if the law's not specific, then the agencies that are in charge have to figure that out.

Joe McNamara: Correct.

John Byrne: That's why they go through the notice of comment process. So that's what's gonna have to happen here. So that's interesting that nobody raised that. But the key is that there's definitions in the statute. There are some directions that they will be treated under the Bank Secrecy Act, but not specifically how - and also I would mention there are they'll have to decide the primary federal and state payment stablecoin regulators.

They're the ones that are gonna have to issue the regulations. I wouldn't take this to the bank, but I've been told by many that they believe that the OCC will be the federal regulator. But I don't think that's clear yet because the FDIC has a role the other agencies do as well, so we'll have to see how that how that all shakes out.

But anyway so they'll have to be primary federal and state regulators, so they'll have to do the regulations, so there might be some different regulations. State and federal, they could touch on different aspects. It's possible, it's real early yet, but in the Sanctions space, what's interesting is they mentioned that sanctions would have to be covered. But what people fail to recognize is that we're all covered under the sanction rules as individuals and as companies.

It doesn't have to be in legislation. So anyway, the framework has to be crafted. But again, this is the GENIUS act on stable coins. And a couple of things that the Davis Polk folks, recommend is the following:

They say 30 to 60 days after the act is enacted, which is last Friday, Treasury must seek public comment to identify innovative or novel methods. Techniques or strategies that FIS use or have the potential to use to detect illicit activity such as money laundering. And the comments they believe will include topics such as application program interfaces, ai, digital identity verification, and blockchain technology.

So look for something within 30 to 60 days, that's pretty interesting. My guess is probably leaning more towards 60.

But in any event, this is another excellent law firm that does really good work in this space. And I just wanted to give them a shout out and mention the focus that they've had on that.

Joe McNamara: No doubt. And I think my two pieces here, the first is we've already seen some leadership at the state level as it relates to crypto and legislation. And certainly there are more forward-leaning states versus others, and so I would expect that at least those should be taken into account in terms of what's been successful or at least what's been proposed.

I think the other probably overly generalized comment that I have is if you're gonna go talk to FIs about what money laundering looks like, I think their initial response is gonna be, “how much time do you have?”. And trying to figure out. how you can better direct if it turns out to be the OCC that, that, that does this.

John Byrne: Yeah.

Joe McNamara: And in the same vein as bringing it back around to sanctions, I think we saw a very interesting article that came out this week about some higher education that's taking place since kind of being backed by the state government in in Russia.

Did you get a chance to see what they're now offering, as I believe is a master's program?

John Byrne: Yeah. Literally a master's program in sanctions evasion. And this was covered in several publications. I actually received this heads up from one of my students. As I teach a money laundering, terrorism, and corruption class at George Mason, and he sent that along to me and that came from a publication that he subscribes to.

But I have heard about that in other areas. So yeah, they're clearly, as North Korea and China teach folks on how to hack and, do those sorts of things. Russia is doing this as well.

And so Russian universities that you just said they're providing that direction - wthis doesn't get more mainstream coverage is beyond me.

Especially with all the focus on Russia, there's a sanctions bill pending in the Senate that has 85 co-sponsors, and we've heard the president say that he's actively considering additional both sanctions and secondary sanctions in Russia.

But again, going back to this to this report came out July 15th. This is as you said, a “Kremlin backed curriculum for Russian public universities and private institutions, training students to outwit economic sanctions”.

And these programs apparently go back to 2020 and 2022.They teach students how to identify risks, avoid violations, and navigate sanctions frameworks. So pretty interesting.

And then related to sanctions, the EU - there's just a report in the Wall Street Journal that earlier this week that they - are going to levy additional major sanctions with what they're calling the toughest sanctions package in years.

According, again, to the Wall Street Journal. This came out I believe this came out in Monday's edition. So this is because obviously the evasion of Ukraine, they're gonna block attempts to revive the NordStream gas pipelines, lowering a price cap for Russian oil sales and hitting banks with third countries in a move again, according to the article, that could exacerbate tensions with China.

So they're hoping that this move will encourage the US to act as well. So again, the sanctions lower for the first time, the price cap on Russian oil exports. So that's going to be interesting. The cap will be almost 50 bucks or 48 bucks per barrel down from 60 and will be revised every three months to stay15% below the market price for Russian exports, so that's a pretty specific strategic move by the EU.

Joe McNamara: I would agree. And again, we've seen it, and we've probably covered this time and time again over the last few weeks, but certainly beyond is, our European partners are clearly not slowing down when it comes to, what actions they're taking from a regulatory perspective, certainly.

How are they trying to better fortify some of their programs? Both at the highest levels, but also, some of the more regional levels as well. And so, at the very least I'm with you. It'll be interesting to see - certainly what kind of effect this has and some of the other markets, but, ultimately I would consider this a good thing.

John Byrne: I agree. Last thing I wanna mention real quick before we close this down the Wolfsburg group who we've talked about many times, that's a international group of multinational financial institutions have been around since the late nineties, and they offer guidance and recommendations on AML and Sanctions related topics.

They just issued an updated statement on the risk-based approach. Obviously an issue that we're all very familiar with and one that FATF constantly talks about.

The statement does go into the fact that the first guidance was issued back in 2006 by the Wolfsburg group, and [with] this update they continue their push for this, and they say that “the risk-based approach is a key enabler to the concepts of effectiveness and effective outcomes that are core to its work.” And they say, when you design an effective program, you must demonstrate three key elements.

One is proportionality. You should design and maintain the program that's proportionate to its business model. That's determined by your size, your scale, your footprint, your risk appetite.

Prioritization - prioritize attention on an allocation on higher risk customers and activities. That means stopping, reducing or redesigning existing activities that could be considered redundant or unproductive from a risk management perspective.

And third, effectiveness - they should focus on effective outcomes. And they've actually done programming on demonstrating effectiveness - facilitating a more responsive, what they're calling “forward looking and dynamic approach to risk management” Rather than applying a one size fits all. They're gonna continue to update this.

And, the Wolfsberg group is well thought of by the public sector because it's a group of private sector institutions that obviously have footprints around the world and they've done a lot of very compelling work in this space.

And so when like when they speak, people listen.

So if you haven't had a chance, go to Wolfsburg-group.org for that and other reports that, and statements that they've issued.

Joe McNamara: And with that, I'd say them's the news, right John?

Just a couple kind of housekeeping items too. Super excited and obviously at the airing of this, we will have already had it, but super excited about our upcoming webinar this month.

So tomorrow I'll be moderating a panel of AI experts as we're diving into how AI is truly transforming the financial compliance space.

But that also means that August’s webinar’s on the horizon too. And I know John, you're gonna be involved in moderating that one. Any thoughts around, who we've got set up for, our conversations around fraud?

John Byrne: Yeah. We have two experts Ulysses Pineda, who's with, first Citizens, the bank that purchased Silicon Valley Bank, a long time expert in fraud prevention issues. And Don Ford, a member of our advisory board and former IRS CI Chief. This is going to cover a variety of fraud issues.

Obviously, you could do three, four hours on this, but we're gonna focus on, a number of things. Money mules, check fraud phony businesses that get set up and both, all those issues and then what you do either as an FI or those that advise Fis to prevent, detect and report these activities.

And of course, we'll always take your questions. And one more thing before we go. Earlier this week I was happy to have an interview with David Tyree. David is a senior advisor at a company called Valid8, but he's a, also a retired DEA agent. We had a very interesting conversation about all sorts of things that David's been involved in as an agent. And we're gonna post that next week, so look for that.

And I am efforting a couple of other interviews, don't have a date yet, but I'm gonna be interviewing a recently retired bank agency, high-ranking official.

And we're gonna talk about. The careers. We're gonna talk about challenges and those things that's coming up.

So as I always say, if you have people you want us to talk to or topics you want us to consider, send those notes to me or Elliot. Or me and Elliot or Joe.

Joe McNamara: Here we go. All right, John. Hey, thanks again for another great episode and we'll see you guys next week.

John Byrne: Stay safe,

Joe McNamara: Bye Bye.