Identity and trust: KYB, KYC and ongoing monitoring
07
Rules and risks
2 min read · Chapter 7 of 10
How the rules work
What's written and what's enforced differ, and in 2025-2026 the US and Europe moved in opposite directions.
The US is loosening the paperwork and keeping the penalties. The ownership register shrank to foreign companies. October 2025 guidance dropped automatic 90-day reviews of continuing activity and the need to document decisions not to file a report. FinCEN's April 2026 proposal for AML programs would limit enforcement over upkeep failures to "significant or systemic" ones, and counts AI tools as evidence that a program works. An August 2025 executive order took reputation risk out of bank supervision and put exits on political grounds under scrutiny. Even so, the big penalties kept coming, as the table below shows.
Canada raised the stakes. Maximum FINTRAC penalties rose 40-fold in March 2026, and FINTRAC issued a record 35 penalty notices worth over CAD 247M in 2025-26, mostly against money services businesses.
The EU tightened. From July 10, 2027 the AMLR fixes refresh cycles (one year for high risk, five for the rest), how ownership is calculated, what data you collect on each person (including place of birth and nationality, which US rules don't ask for), and a draft standard makes a government digital ID the preferred way to verify people remotely.
October 2024
- Who
- TD Bank (US)
- Amount
- About $3.1B
- What triggered it
- About 92% of transaction volume never monitored, 2014-2023
October 2024
- Who
- Starling (UK)
- Amount
- About £29M
- What triggered it
- Screened customers against only a fraction of the UK sanctions list; onboarded high-risk customers despite a restriction
January and April 2025
- Who
- Block (Cash App)
- Amount
- $80M and $40M
- What triggered it
- Due diligence, monitoring and a report backlog after rapid growth
July 2025
- Who
- Monzo (UK)
- Amount
- About £21M
- What triggered it
- Onboarded 34,000+ high-risk customers in breach of a restriction while growing from 600,000 to 5.8 million customers
July 2025
- Who
- Barclays (UK)
- Amount
- £42M
- What triggered it
- Onboarding and monitoring of two clients
October 2025
- Who
- A payments and crypto money services business (Canada)
- Amount
- About CAD 177M
- What triggered it
- About 1,000 missed suspicious transaction reports
March 2026
- Who
- Canaccord Genuity
- Amount
- $80M
- What triggered it
- An under-resourced program that missed suspicious activity
April 2026
- Who
- A payments-heavy New York savings bank
- Amount
- Order, no fine
- What triggered it
- Payments growth without proportionate controls; alerts closed automatically
The triggers tell you more than the amounts do. Almost every case here is a program that grew faster than its monitoring, and a weak identity check on its own rarely shows up.
What mistakes cost
Mistakes here get paid for in several ways.
- Growth. A consent order on your sponsor bank can freeze new onboarding and new products for months while the regulator approves each one.
- Remediation. Lookbacks, re-verifying existing customers and outside consultants often cost as much as the fine, and the fintech's team does the work. I'd rank this as the costliest one, because when a monitoring program can't keep up, the fix lands on every customer at once.
- Fraud losses. TransUnion put lenders' exposure to suspected synthetic identities on new US accounts at about $3.3B in the first half of 2025. Whoever extended the credit owns it.
- Lost customers. Every document request loses applicants, and over-correction after an order (mass exits) hurts good customers, which since 2025 also draws regulatory attention in the US.
- Penalties and lawsuits. From FTC penalties under INFORM to biometric class actions to billion-dollar bank cases. People are exposed too: TD's case brought prosecutions of employees, and FinCEN started paying whistleblowers up to 30% of sanctions over $1M in 2026.