BANKING FRAUD LAW MAP - sebbi.pro ================================= [UK] FCA CP26/38: Financial Crime Guide updates Status: Consultation, opened 23 October 2026, closes 24 December 2026 Asks: Proposed changes to the Financial Crime Guide across fraud, cryptoassets, sanctions, proliferation financing, data security, systems and controls, and money laundering. On fraud the focus is what a firm did with the information its own controls generated: negative Confirmation of Payee results, transactions that depart from expected behaviour, unusual payment values and beneficiary patterns, new payees taking high-value payments, monitoring informed by onboarding information, investigation and intervention, APP fraud and money mules. sebbi: Every alert sealed the moment it fires, every response sealed against it with the role that took it, a gaps list of anything left unanswered, and a sealed evidence pack that answers the question for any period. Source: https://www.fca.org.uk/publications/consultation-papers/cp26-38-financial-crime-guide-updates [UK] FCA Financial Crime Guide (FCG) Status: In force (guidance) Asks: What the FCA expects of financial crime systems and controls: governance, risk assessment, monitoring, and good and poor practice for fraud, money laundering and sanctions. sebbi: 40 banking controls checked against the record, each result sealed; live fraud signals and actions as ongoing evidence. Source: https://www.handbook.fca.org.uk/handbook/FCG/ [UK] FCA multi-firm review: money mules and cashing out Status: Published 23 September 2026 Asks: Firms closed 238,396 suspected mule accounts in 2025. The FCA expects firms to understand how funds move between accounts, look beyond the first receiving account to linked accounts, payment characteristics and context, and keep controls under review. sebbi: Pass-through and many-payers-one-payee indicators on every signal, and sealed records of each mule decision. Source: https://www.fca.org.uk/news/press-releases/firms-crack-down-money-mules-need-do-more [UK] FCA SYSC 6.1.1R and SYSC 3.2.6R Status: In force Asks: Policies and procedures that counter the risk the firm is used to further financial crime, and effective systems and controls. sebbi: Tamper-evident record that the controls exist, ran and were acted on. Source: https://www.handbook.fca.org.uk/handbook/SYSC/6/1.html [UK] FCA Consumer Duty (PRIN 2A) and FG21/1 vulnerable customers Status: In force since 31 July 2023 Asks: Act to avoid foreseeable harm to retail customers, including harm from fraud and scams, and take extra care with customers in vulnerable circumstances. sebbi: Warnings, interventions and vulnerability handling sealed per case; outcome figures in the evidence pack. Source: https://www.handbook.fca.org.uk/handbook/PRIN/2A/ [UK] Payment Services Regulations 2017, as amended in 2024 Status: In force (delay power since October 2024) Asks: A payment firm may delay an outbound payment by up to 4 business days where it has reasonable grounds to suspect fraud or dishonesty by someone other than the payer, must tell the payer about the delay and what is needed, and bears the costs. FCA FG24/6 (22 November 2024) explains the threshold. sebbi: Every CHALLENGE or BLOCK names the power, starts the clock and seals the reasons that formed the suspicion. Source: https://www.fca.org.uk/publication/finalised-guidance/fg24-6.pdf [UK] APP scam reimbursement (PSR Specific Direction 20 and CHAPS rules) Status: In force since 7 October 2024 Asks: Reimburse APP scam victims on Faster Payments and CHAPS up to GBP 85,000 per claim (PS24/7), within 5 business days or 35 with stop-the-clock, claims within 13 months, optional excess up to GBP 100 (never for vulnerable customers), cost split 50/50 with the receiving firm. The firm carries the burden of proving gross negligence. An independent review of the regime is under way, and the PSR's functions are moving into the FCA with these rules preserved. sebbi: Sealed claim position, deadlines and the case history that shows what warnings and interventions came first. Source: https://www.psr.org.uk/our-work/app-scams/ [UK] Confirmation of Payee (PSR Specific Direction 17) Status: In force Asks: Name checking before payment across the UK's payment firms. The PSR fined Bank of Ireland UK GBP 3,779,300 for a 14-month delay in rolling it out. sebbi: Every CoP result recorded with the payment, and every no-match or close-match sealed with what was done about it. Source: https://www.psr.org.uk/our-work/confirmation-of-payee/ [UK] Money Laundering Regulations 2017 Status: In force Asks: Firm-wide risk assessment (reg 18), policies and controls (reg 19), a nominated officer (reg 21), customer due diligence and ongoing monitoring (regs 27 and 28), enhanced due diligence (reg 33), records for 5 years (reg 40). sebbi: Onboarding profile sealed and used in monitoring; every decision kept in a record nobody can edit. Source: https://www.legislation.gov.uk/uksi/2017/692/contents [UK] Proceeds of Crime Act 2002, Part 7 Status: In force Asks: Report knowledge or suspicion of money laundering in the regulated sector (s330); seek a defence against money laundering before proceeding where needed (s335). Do not tip off. sebbi: SAR and DAML steps sealed as case actions, timed against the signal that triggered them, with no customer data stored. Source: https://www.legislation.gov.uk/ukpga/2002/29/part/7 [UK] Failure to prevent fraud (Economic Crime and Corporate Transparency Act 2023, s199) Status: In force since 1 September 2025 Asks: Large organisations (two of: over 250 staff, over GBP 36m turnover, over GBP 18m assets) are criminally liable, with an unlimited fine, for fraud by associated persons for their benefit, unless they had reasonable prevention procedures. Government guidance sets six principles: top-level commitment, risk assessment, proportionate procedures, due diligence, communication and training, monitoring and review. sebbi: Dated, sealed proof that the procedures existed and operated at the relevant time, which is exactly what the defence needs. Source: https://www.gov.uk/government/publications/offence-of-failure-to-prevent-fraud-introduced-by-eccta [UK] ECCTA 2023 information sharing to prevent economic crime Status: In force Asks: Relief from civil liability for regulated firms that share customer information to prevent, detect or investigate economic crime. sebbi: Sharing decisions sealed as case actions, so the firm can show when and why it shared. Source: https://www.legislation.gov.uk/ukpga/2023/56/contents [UK] PRA SS1/23 model risk management Status: In effect since 17 May 2024 Asks: Banks identify, tier, validate and monitor models, including AI and machine-learning models used in fraud detection. sebbi: Each fraud decision sealed with its score and reasons, giving a live performance record for validation. Source: https://www.bankofengland.co.uk/prudential-regulation/publication/2023/may/model-risk-management-principles-for-banks-ss [UK] Home Office Fraud Strategy 2026 to 2029 Status: Government strategy Asks: Recognises the role money mule networks play in fraud and pushes firms, regulators and government to disrupt them together. sebbi: Mule indicators and sealed mule decisions a firm can stand behind. Source: https://www.gov.uk/government/organisations/home-office [EU] Instant Payments Regulation (EU) 2024/886: Verification of Payee Status: Applies since 9 October 2025 in the euro area; 9 July 2027 for non-euro Member States Asks: Check the payee name against the IBAN before a euro credit transfer and warn the payer of a mismatch. A provider that fails to warn carries the loss. sebbi: Each verification result and the payer's choice sealed with the payment. Source: https://eur-lex.europa.eu/eli/reg/2024/886/oj [EU] EU Payment Services Regulation and PSD3 Status: Political agreement November 2025; final texts April 2026; adoption expected in the second half of 2026 Asks: Verification of payee for all credit transfers, transaction monitoring as a standalone duty with liability for losses when controls fall short, a refund right for bank-impersonation (spoofing) fraud, and fraud data sharing between providers. sebbi: Monitoring that leaves a sealed trail, ready for the day liability turns on proving the controls worked. Source: https://finance.ec.europa.eu/regulation-and-supervision/financial-services-legislation/implementing-and-delegated-acts/payment-services-directive_en [EU] EU Anti-Money Laundering Regulation (EU) 2024/1624 Status: Applies from 10 July 2027 Asks: One rulebook for customer due diligence, ongoing monitoring and reporting across the EU, supervised with AMLA. sebbi: Monitoring decisions and reports sealed per case, in a format any supervisor can check. Source: https://eur-lex.europa.eu/eli/reg/2024/1624/oj [EU] EU AI Act, Annex III point 5(b) Status: In force; high-risk duties phase in Asks: AI for creditworthiness and credit scoring is high-risk; AI used to detect financial fraud is carved out of that line. Fraud AI still sits under the Act's general duties and the firm's own governance. sebbi: Fraud models get decision receipts anyway, so the carve-out never becomes a blind spot. Source: https://artificialintelligenceact.eu/annex/3/ [EU] Digital Operational Resilience Act (DORA) Status: Applies since 17 January 2025 Asks: ICT risk management, incident reporting and third-party oversight for financial entities. sebbi: Incidents and control events sealed with timestamps a supervisor can verify without trusting the firm. Source: https://eur-lex.europa.eu/eli/reg/2022/2554/oj [US] Bank Secrecy Act: suspicious activity reports (31 CFR 1020.320) Status: In force Asks: Banks file a SAR within 30 calendar days of first detecting facts that may justify one. sebbi: The detection moment is sealed, so the 30-day clock is provable from the first alert. Source: https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1020/subpart-C/section-1020.320 [US] Regulation E error resolution (12 CFR 1005.11) Status: In force Asks: Investigate notified electronic fund transfer errors, generally within 10 business days, with time limits for credits and notices. sebbi: Each investigation step sealed with its date. Source: https://www.ecfr.gov/current/title-12/chapter-X/part-1005/subpart-A/section-1005.11 [US] Federal Reserve SR 11-7 model risk Status: In force (supervisory guidance) Asks: Sound development, validation and governance of models, including fraud models. sebbi: A sealed, per-decision performance trail for every fraud model. Source: https://www.federalreserve.gov/supervisionreg/srletters/sr1107.htm