Financial Crime Developments, Resources and Stories: May 2025 Edition

May 8, 2025
3 min read

Welcome to the May 2025 summary of news you can use as your bank or other financial institution attempts to stay up to date on the world of BSA/AML compliance. Our monthly series of curated news about FinCrime regulatory developments, resources and stories.

In this edition, three main stories emerge:

New AML Rules to Hit UK Rental Leases Starting 15 May 2025
US Aims to Ban Cambodia’s Huione for Alleged Money Laundering
France-Based Banks Encouraged to Demand More KYC Data from Customers

New AML Rules to Hit UK Rental Leases Starting 15 May

New regulations are being introduced that will affect all rental leases in the UK, including all new and renewing leases as well as both personal and company tenancies. At a high level, the rule states that all letting agents will be required to screen all parties against the UK Government’s Consolidated List of Financial Sanctions Targets and retain certified records for at least five years. Additionally, If a match is found (or even suspected), agents will be legally required to report it to the UK’s Office of Financial Sanctions Implementation (OFSI).

How do these new rules impact UK banks’ AML compliance teams? The new AML rules on apartment leases increases banks’ risk exposure and potentially can lead to increased compliance costs. Banks and other financial institutions will need to monitor leasing transactions and flag suspicious activity.

The new rules present far more stringent documentation requirements for companies (or employees being housed by companies) leasing an apartment, as they must present all of the following to the letting agent:

Certificate of Incorporation
Latest Companies House Confirmation Statement
Details of directors and shareholders with over 25% control
Personal ID and proof of address for all directors and beneficial owners

US Aims to Ban Cambodia’s Huione for Alleged Money Laundering

The U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) issued a finding and notice of proposed rulemaking (NPRM) pursuant to Section 311 of the USA PATRIOT Act that identifies Cambodia-based Huione Group as a financial institution of primary money laundering concern and proposes to sever its access to the U.S. financial system.

Huione Group serves as a critical node for laundering proceeds of cyber heists carried out by the Democratic People’s Republic of Korea (DPRK), and for transnational criminal organizations (TCOs) in Southeast Asia perpetrating convertible virtual currency (CVC) investment scams, commonly known as “pig butchering” scams, as well as other types of CVC-related scams.

Given the money laundering risk posed by Huione Group, FinCEN is proposing to prohibit U.S. financial institutions from opening or maintaining correspondent or payable-through accounts for or on behalf of Huione Group.

“Huione Group has established itself as the marketplace of choice for malicious cyber actors like the DPRK and criminal syndicates, who have stolen billions of dollars from everyday Americans,” said Secretary of the Treasury Scott Bessent. “Today’s proposed action will sever Huione Group’s access to correspondent banking, degrading these groups’ ability to launder their ill-gotten gains.

France-Based Banks Encouraged to Demand More KYC Data from Customers

Under new European directives against money laundering, banks have a duty of ongoing vigilance and must comply with stricter KYC (Know Your Customer) obligations to establish customers’ profiles, better manage risks, and process customers’ money in a secure environment.

The enhanced KYC information could be requested at various times, including at account opening, when periodically updating a customer database, or when a transaction is deemed suspicious or unusual.

In addition, for certain transactions, a bank may need to ascertain the identity of the person it is dealing with, as in the case of cash withdrawals at the counter or when issuing means of payment (e.g. delivery of a check book).

Refusal to provide the requested information can see the bank refuse to open an account for a customer, suspend or close the customer’s account, and report any suspected fraud or illegal activity to the authorities.

Although strict, even CNIL (the Commission nationale de l’informatique et des libertés), normally viewed as being very restrictive on data use in France, says banks can ask clients “for any information which can help them estimate your resources” and “any element which gives a good idea of your wealth.”

La Banque Postale also announced that it is introducing a €15 ‘customer file update fee’ if clients do not respond to certain information requests. That arrangement is expected to start during the summer of 2025. As for the information banks will initially require, it includes:

Identification, such as a national identity card, passport, or residence permit.
Proof of domicile, such as utility bills or an apartment lease.
Details of the customer’s business and professional activity, including their tax residence
The amount and source of the customer’s income
The composition and extent of the customer’s assets, with possible supporting documentation to include tax assessments, recent pay slips, a property deed, securities portfolio statements, etc.