A record AML penalty, and governments hand platforms the age check
CyberEyeQ Weekly #42 · 15 October 2026. A record Bank of America AML penalty headlines a week in which governments moved from asking platforms to check ages to handing them the tool, and a dense run of deadlines starts this weekend.
At a Glance
Bank of America pays $1.2B+ for AML failures — FinCEN $1.2B and OCC $750M (credited), announced 13 October.
Türkiye's state age token goes live 1 November — Under-15 ban; 15–17 accounts private and segregated.
Greece votes on under-15 ban 22 October — 1 January 2027 start via state age tokens.
UK scraps per-lender 15% high-LTI cap — PRA/FCA PS19/26 effective 28 October.
FedRAMP proposes easing Class D crypto rule — RFC-0035: CMVP-validated modules MUST to SHOULD.
China minors' internet draft closes Saturday — Comments due 17 October.
Critical Actions
Bank of America: record BSA/AML penalties — On 13 October FinCEN assessed a $1.2 billion civil penalty; FinCEN states the bank admitted it willfully violated the Bank Secrecy Act: no adequate AML program, no required due diligence on foreign correspondent accounts, and failure to file required SARs. The OCC separately imposed a $750 million penalty, which per our tracker FinCEN credits; the OFAC $11.6 million settlement and OCC findings are [Unverified] against agency releases. Action: Benchmark transaction monitoring, SAR escalation timeliness and correspondent due diligence against FinCEN's findings. Source: FinCEN
Türkiye's under-15 ban and e-Devlet age token — effective 1 November (17 days) — Published in the Official Gazette 10 October. Age is proved with an e-Devlet token showing only 15/18 thresholds; existing accounts must be verified by 31 March 2027 and under-15 accounts closed; 15–17 accounts are private, with no livestreaming, personalised ads or infinite scroll, plus parental controls. Confirmed via a press report of the Gazette text, not the Gazette itself. Action: Scope token integration and the segregated-service build now. Source: Resmî Gazete · Hürriyet Daily News
UK PS19/26 removes the firm-specific 15% high-LTI cap — effective 28 October (13 days) — Lenders set their own high-LTI strategy within risk appetite while regulators aim to keep aggregate flow consistent with the FPC's 15% limit; SS2/26 sets governance expectations; firm flows measured on a rolling four quarters. Action: Update high-LTI governance, risk appetite and MI. Source: Bank of England
Enforcement Watch
Cologne court v. Snap — LG Köln (33 O 120/24, 17 September 2026) upheld a vzbv injunction: per our tracker, no ad use of "My AI" chat data without a legal basis, no pre-ticked ad-consent boxes, no pre-selected alcohol/gambling topics for minors. First-instance and appealable; judgment text not read by us [Unverified]. Source: LG Köln judgment
FDA Early Alert — Philips Lumify ultrasound — Issued 9 October; Philips reports eight serious injuries and four deaths as of 29 September. Failure modes: transducer re-registration forced without warning, and USB link instability. Action: Identify units, keep a backup ultrasound modality, circulate Philips' letter. Source: FDA
Deadline Watch
17 Oct — China minors' internet draft comments (China, 2 days) · CAC
19–20 Oct — FDA GenAI device paper feedback; CFTC compute-derivatives RFC; Australia FWC AI Guidance Note (4–5 days)
22 Oct — Greek plenary vote on under-15 bill (7 days)
25–26 Oct — China TC260 ASMM/DSMM drafts; UK Cyber Security and Resilience Bill Lords Report; Colorado ADMT hearing (10–11 days)
28 Oct — UK high-LTI rules and SS2/26 (13 days)
29–31 Oct — Italy email tracking-pixel guidelines (29th); EDPB anonymisation/scraping drafts (30th); Italy NIS2 basic measures (31st) (14–16 days)
1 Nov — Türkiye age-token regime (17 days)
13 Nov / 17 Nov — EDPB fines guidelines comments; FedRAMP RFC-0035 comments per our tracker
14 Dec — CFTC Reg CTX/CAM ANPRM comments · 91 FR 64811
Around the World
FedRAMP — RFC-0035 would change the Class D CMVP-validated-module rule from MUST to SHOULD; dates per our tracker (opened 14 Oct, comments to 17 Nov). Source
United States — CFTC — ANPRM on crypto Regulation CTX/CAM published 13 October; comments 14 December; pre-proposal. Source
United Kingdom — MHRA Strategy 2030 — Published 14 October: 90-to-45-day scientific advice, 14-day phase-1 assessment, new AI-as-medical-device framework. Direction-setting. Source
United States — Florida v. OpenAI — Injunction motion to bar minors from ChatGPT; litigation, no order confirmed; press-sourced.
Italy / France — NIS2 — Italy's measures bind 31 October; France's bill still off the plenary agenda. Source
🔭 Signal Watch — CIRCIA final rule reaches the White House. CISA's Cyber Incident Reporting for Critical Infrastructure Act reporting rule (RIN 1670-AA04) has left the agency and entered Office of Management and Budget review — the last checkpoint before a final rule publishes — after CISA let its September target pass. The review began 1 October 2026, and at this stage is usually measured in weeks, not months. For covered critical-infrastructure operators this is the clearest sign yet that the 72-hour incident and 24-hour ransom-payment reporting duties are close to final text: confirm which of the 16 sectors capture you, map reporting to the proposed clocks, and line up the evidence the rule will expect — the gap between "at OMB" and "in force" is the last quiet window to prepare. Sources: reginfo.gov OIRA review record · CISA CIRCIA NPRM, 89 FR 23644.
Deep Dive
Türkiye · Greece · EU · Age Verification
The age token: verification becomes state infrastructure
For a decade, "age verification" meant a platform's problem: collect an ID, guess from a selfie, or ask nicely. This week two governments changed the question. Türkiye's regulation, effective 1 November, makes a state-issued token from the e-Devlet portal the way to prove age — a yes/no on 15 and 18 that carries no name. Greece's under-15 bill, due for a plenary vote on 22 October, is reported to rely on the same idea through its Kids Wallet and Gov.gr Wallet apps from 1 January 2027, and the European Commission is pushing member states to field a common age-verification app by the end of 2026.
The shift matters less for the ban itself than for who holds the keys. Platforms stop being the verifier and become the relying party: they must accept a government attestation, integrate with a national identity layer, and prove they did so. That is cleaner on privacy — the token discloses a threshold, not an identity — but it fragments fast. A service operating in Türkiye, Greece, France and Australia may face four token schemes, four sets of rules for what a 15-year-old can see, and four deadlines for re-checking existing accounts; Türkiye alone sets 31 March 2027 for that sweep and requires closing accounts that belong to under-15s. Meanwhile pressure is spreading to general-purpose AI, as Florida's injunction motion against OpenAI shows. Here is where the real engineering decision sits...
The analysis continues for CyberEyeQ Pro subscribers. Unlock the full deep-dive recommendations, all five weekly action items, source documents, and jurisdiction-specific compliance checklists.
Subscribe to Pro to read the rest.
Become a paying subscriber of Pro to get access to this post and other subscriber-only content.
UpgradeA subscription gets you:
- Deep dives of each updated regulation
- Source verification documents
- Extended jurisdiction-specific analysis
- Compliance deadline tracker
- Regulation crosswalk