Treasury's Joint OFAC-FinCEN Enforcement Model Signals Structural Shift: Compliance Teams Must Rethink Batch-Based Screening
On October 1, 2026, Treasury took what it called "unprecedented action" against the A7 Network, a shadow banking infrastructure that had processed billions in sanctions-evading transactions for Iran, Russia, and North Korea. The action combined an OFAC designation of the network as a transnational criminal organization with a FinCEN proposed rule that would prohibit transmittals of funds involving the network's Sub-Agents. The coordination wasn't incidental. It was structural.
Treasury took three linked actions on October 1 under Operation Economic Outcast: OFAC designated the A7 Network itself, FinCEN published a finding and proposed rule against the network's Sub-Agents, and FinCEN issued an Alert with red flags and a SAR filing request. The simultaneity matters. These actions demonstrate the administration's willingness to employ a variety of punitive measures, combining actions by both OFAC and FinCEN and the use of blocking sanctions, FinCEN prohibitions, and criminal designations.
This is no longer sanctions compliance on one track and BSA reporting on another. Secretary Bessent stated that Treasury is "dismantling the financial infrastructure that allows Iran and other adversaries to evade sanctions, move illicit funds, and undermine the integrity of the global financial system," sending "a clear message that if you facilitate illicit finance for America's adversaries, you will lose access to the U.S. financial system."
The enforcement architecture expects financial institutions to do more than screen against published lists. According to FinCEN, the A7 Network's Sub-Agents processed more than $17 billion between January 2025 and June 2026, banking at approximately 435 institutions in at least 83 countries. These weren't obscure shell companies slipping through cracks, they were operating at scale, in plain sight, through correspondent banking channels that passed traditional list-based screening.
The regulatory recalibration runs deeper than Iran enforcement. In April 2026, FinCEN issued a proposed rule intended to fundamentally reform financial institutions' AML/CFT programs under the Bank Secrecy Act, supporting Treasury's efforts to modernize the regulatory framework and reduce compliance burden. But the burden reduction comes with a catch: FinCEN is moving away from a process-driven, "check-the-box" compliance model toward an outcomes-based, risk-tiered framework. Under the proposed rule, a program's success is no longer measured by the volume of paperwork it generates, it's measured by whether the program actually detects and disrupts illicit finance.
Under the proposed regulations, having an effective AML/CFT program would be more than a one-time adoption of a risk-based set of internal policies, procedures, and controls. Rather, a financial institution would be required to keep its risk-based set of internal policies, procedures, and controls, and the risk assessment processes that inform them, current as the financial institution's risk profile changes.
For PSPs operating cross-border fiat corridors, this creates a specific architectural problem. Traditional batch screening, where transactions are initiated, then screened overnight against sanctions lists, with alerts reviewed the following business day, cannot deliver what Treasury now expects. Unlike traditional batch screening, which processes transactions after settlement, real-time screening ensures that sanctions or high-risk parties are identified immediately. The distinction is no longer a matter of operational preference. When payments settle in seconds, compliance decisions must keep pace.
The A7 Network enforcement illustrates why. The network relied on a constellation of third-country companies called Sub-Agents, wholly controlled by A7 Network individuals, built to disguise sanctioned or illicit payments as ordinary trade through falsified trade documents, falsified import-export records, and misleading goods descriptions. List-based screening catches the names it knows. It does not catch the behavior patterns that indicate a transaction is being routed through purpose-built evasion infrastructure.
Only six Sub-Agents are named in the proposed rule text. The rest sit on a list FinCEN shares through its secure FI-Portal, not in public. This creates a compliance dependency on information-sharing infrastructure that batch systems cannot efficiently integrate. By the time a batch review identifies a potential Sub-Agent transaction, the payment may have already settled, and the institution's exposure has already materialized.
The competitive dimension compounds the regulatory pressure. The Hongkong and Shanghai Banking Corporation received a stablecoin issuer licence from the Hong Kong Monetary Authority in April 2026, with plans to launch a Hong Kong dollar denominated stablecoin in the second half of 2026. Each stablecoin issued by HSBC will be fully backed by high-quality, liquid assets held in segregated accounts and will meet the highest financial crime compliance standards.
This is not a peripheral experiment. Hong Kong awarded its first two stablecoin licences on April 10, 2026, to HSBC and to a Standard Chartered/Animoca/HKT joint venture. HSBC's stablecoin is positioned as a payments and corporate treasury product, with strategic intent to provide a regulated digital HKD instrument for institutional clients including corporate treasuries, fund managers, and settlement infrastructure.
The architecture of these rails matters. Stablecoins are bearer instruments on public blockchains. The holder owns the token; the issuer holds the reserves. Settlement is final, 24/7, and programmable. Compliance is embedded at the protocol layer, not bolted on after the fact. When a corporate treasury can access bank-issued, compliance-native settlement rails that operate continuously, the batch-screened fiat corridor becomes a legacy option, slower, more expensive, and structurally disadvantaged on the very compliance dimension it was designed to serve.
Treasury's joint rulemaking for permitted payment stablecoin issuers under the GENIUS Act makes this explicit. The proposed rule would treat permitted payment stablecoin issuers as "financial institutions" under the Bank Secrecy Act, require them to establish and maintain AML/CFT programs, and, for the first time, explicitly mandate that a category of U.S. persons maintain an effective sanctions compliance program. The joint FinCEN/OFAC proposed rule would treat permitted payment stablecoin issuers as BSA financial institutions and require them to maintain an effective sanctions compliance program built on OFAC's five framework elements.
The regulatory convergence is deliberate. Stablecoin rails are being designed with integrated BSA-sanctions compliance from inception. Fiat PSPs are being asked to retrofit their batch systems to meet expectations those systems were never architected to deliver.
The question facing compliance infrastructure teams is not whether to upgrade screening capabilities. It is whether the underlying architecture can support what Treasury now demands: continuous compliance that detects behavioral anomalies, integrates with restricted information-sharing channels, and operates at settlement speed. If the answer is no, the gap is not a compliance deficiency to be managed, it is a structural limitation that determines which payment rails institutional clients will choose.
References
[5] HSBC, "HSBC to launch HKD-denominated stablecoin in second half of 2026," April 10, 2026
