BPInsights: April 25, 2026

Time for a Reckoning on AML and Crypto

The U.S. financial system exists in two parallel tracks. On one side, banks are investing countless resources to protect the financial system from illicit activity - flagging suspicious transactions, executing stringent due diligence and working closely with law enforcement and national security agencies. On the other side, crypto - the global currency of human traffickers, terrorists, drug cartels and fraud - is flowing freely across wallets and borders, without the same obligations to prevent crime and protect the system. In pending market structure legislation, Congress has an opportunity to close the chasm between these two sides. Lawmakers must take it.

Why It Matters. Crypto funds global criminal networks. Its anonymity and the availability of "mixers" and "tumblers" to obfuscate its origins make it the perfect conduit for circumventing sanctions, financing terrorism and defrauding consumers.

• Illicit crypto addresses received $154 billion in 2025, a 162 percent increase year-over-year, primarily driven by a 694 percent increase in the value received by sanctioned entities.
• According to Chainalysis: "The on-chain money laundering ecosystem - a portion of the overall illicit crypto ecosystem that reflects the laundering of funds rather than the underlying inflows associated with illicit activity - has grown dramatically in recent years, increasing from $10 billion in 2020 to over $82 billion in 2025."
• "The intersection of cryptocurrency and suspected human trafficking intensified in 2025, with total transaction volume reaching hundreds of millions of dollars across identified services, an 85% year-over-year increase."
• The FBI's 2025 Internet Crime Report notes that the agency's Internet Crime Complaint Center received 181,565 complaints last year with a nexus to crypto, an increase of 21 percent from 2024, totaling $11.366 billion in losses, an increase of 22 percent.
• Chinese fentanyl traffickers, Mexican cartels and the Iranian and North Korean regimes are among those using cryptocurrency to evade sanctions and law enforcement.

Stablecoin Legislation. Stablecoins, notably Tether, now account for a majority of illicit transaction volume. Forthcoming stablecoin legislation must confront this problem. The GENIUS Act imposes some AML obligations on U.S. stablecoin issuers, but that coverage is incomplete and does not apply overseas. Congress is considering now whether to extend AML/CFT obligations to all "digital asset service providers" covered by the GENIUS Act, including exchanges and custodial wallet providers, not just a narrow subset of actors. 

• Policymakers face a choice: they can abandon the current regime where only certain financial institutions have consistent obligations to flag suspicious activity for law enforcement, or they can extend that regime to all financial market players as the ecosystem evolves, including the new crypto-related entities entering the market. What makes no sense is continuing to apply intensive AML and sanctions regulation and examination to banks when the worst and most sophisticated actors know they can launder money and avoid sanctions by transferring money to an unhosted wallet, do a little mixing and transact freely in the crypto-verse. The statistics show the criminals have already figured out this loophole; the question is whether Washington will close it.

Five Key Things

1. Crypto Hacks and DeFi Runs

Some disasters come out of nowhere - others are clear many miles away. As predicted in a previous BPI analysis, DeFi lending platforms are unprepared to compensate crypto lenders' losses when loans are made against collateral that loses value. The results demonstrate an alarming truth about the crypto ecosystem: Unlike banking, in which deposit insurance, liquidity and capital requirements keep customers safe in a failure, there's no fallback when systems break.  

What Happened: On April 18, 2026, crypto hackers stole an estimated $290 million from major decentralized finance (DeFi) lending platforms, exposing some lenders to potential losses. The largest DeFi lending platform, Aave, experienced mass withdrawals to the point where some lenders, including stablecoin lenders, were unable to withdraw their funds. The incident not only exposed lenders to significant potential losses-it also highlights the inherent risks of DeFi lending, some of which BPI pointed out last year in a note that flagged Aave in particular.  

Don't Just Trust - Verify. DeFi lending platforms rely on information from third parties that tell the platform what collateral is worth and whether it exists at all. This information may be inaccurate. Trusting poorly verified third-party information exposes customers to losses if loans are made against collateral whose value is misrepresented (or potentially worthless).  

Run Risk. DeFi lending platforms lack sufficient insurance to compensate lenders' losses, as warned by previous BPI analysis that highlighted Aave's apparently inadequate insurance fund. Having inadequate capital means that DeFi platforms are vulnerable to bank run dynamics.

Mixers Muddy the Waters. Crypto mixers help enable criminals to act undetected in the ecosystem by obscuring the identities of wallet holders and crypto users.  

Bottom Line. These risks persist as a result of inadequate regulatory and supervisory standards and will put more customers at risk in the future if left unaddressed. Policymakers should consider these significant risks as they draft rules governing the crypto ecosystem. Learn more here.

2. Congressional Hearings Examine Scam Economy and Crypto Enforcement

The House Homeland Security Committee this week held a hearing titled "Online Scams, Crypto Fraud, and Digital Extortion: An Examination of How Transnational Criminal Networks Target Americans," featuring witnesses from TRM Labs, USTelecom and cybersecurity research centers. Separately, the House Financial Services Committee held a hearing on Wednesday titled "Evaluating the Effectiveness of U.S. Sanctions Programs." Here are some highlights:

• Industrialization of Fraud: Witnesses cited more than $20 billion in cyber-enabled fraud losses in 2025, up 26% year over year, and described AI as a "force multiplier" lowering barriers for criminals while amplifying phishing, deepfakes and voice cloning at scale. TRM Labs' Ari Redbord called AI-enabled fraud the "most pervasive, economically destructive and dangerous financial crime threat" of his career.
• Crypto as an Illicit-Finance Rail: Witnesses placed cryptocurrency at the center of a criminal ecosystem, linking cartels, Chinese laundering networks and DPRK-linked theft, citing $158 billion in illicit crypto flows in 2025. Redbord urged Congress to pass a digital assets hold law to freeze funds before they reach unhosted wallets - a policy BPI supports.
• Upstream Accountability: Lawmakers questioned why social media companies allow accounts created with fraudulent SIM cards to remain active. BPI has emphasized that tech and telecom platforms should adopt "Know Your Merchant" standards and requirements to verify identities and proactively monitor networks.
• Crypto Enforcement and Sanctions Evasion: At Wednesday's HFSC sanctions hearing, Rep. Sean Casten (D-IL) and Treasury official Jonathan Burke discussed crypto-enabled sanctions evasion, including estimates that Iranian-linked wallets received nearly $8 billion in crypto last year. Casten raised particular concern about the use of mixers - tools designed to obscure transaction trails - and urged Treasury to build cases proactively rather than await new rulemakings. Burke noted that Treasury continues to utilize a range of tools, including proposed rules under the GENIUS Act, to address illicit digital asset activity.

3. Senate Banking Committee Holds Fed Chair Nomination Hearing

Kevin Warsh, the nominee to replace Federal Reserve Chair Jerome Powell, received questions from the Senate Banking Committee at a nomination hearing on Tuesday. The timing of Warsh's confirmation hinges on whether Sen. Thom Tillis (R-NC) continues to withhold support for the nominee pending resolution of the Justice Department's probe into Powell. The DOJ announced Friday it is closing the investigation while the Fed's Inspector General undertakes a review of the underlying building cost overruns, though Pirro has indicated she may still pursue charges depending on the IG's findings. Here are a few highlights of the Warsh hearing.

• Payment System Reform. Sen. Jim Banks (R-IN) asked Warsh how the Fed can defend the dollar's role as foreign countries route payments through China to evade sanctions on Iran and other U.S. adversaries. Banks referred to Warsh's 2021 op-ed warning that China was promoting its digital yuan with the goal of creating an alternative payment system that sidesteps U.S. sanctions. A robust payment system supports the role of the U.S. dollar, Warsh said. "The Fed has a number of payment systems that most financial participants in the world use. I would say they all are in need of substantial reform," Warsh said.Specifically, Warsh noted that FedNow, which some describe as "Fed yesterday," needs "substantial reform" to ensure the U.S. payment system remains the world's safest and most efficient.
• Balance Sheet. On the Fed's balance sheet, Warsh said he hasn't "fixed a particular number" as a goal, but "any changes … in the balance sheet would be part of a public discussion, debated rigorously, and if and when the central bank comes to a judgment about a new balance sheet policy, which I hope the central bank would, it would be described well in advance. As I mentioned, it took 18 years to create this balance sheet problem, and we won't be able to fix it in 18 minutes." Warsh elaborated that "it should be smaller and - at least as important - it should not be holding long-term Treasury assets as if it's the fiscal authority. That's when it gets into politics."
• Debanking and Rep Risk. When asked by Sen. Kevin Cramer (R-ND) about the use of "reputational risk" in customer account closures, Warsh emphasized the need for central bankers to eschew political whims. "Politics have no place, not just in monetary policy, but in supervision and regulation. If central bankers should stand for anything, it's to resist fads, resist trends, call balls and strikes. That's exactly what I would intend to do," Warsh said.
• Digital Assets. Sen. Cynthia Lummis (R-WY) asked Warsh if he believes digital assets should be incorporated into the U.S. financial industry. "Senator, digital assets are already a part of the fabric of our financial industry in the United States," Warsh responded. In response to Sen. Bernie Moreno (R-OH), Warsh agreed that the Fed doesn't have the right to issue central bank digital currency. "I think it would be a bad policy choice," Warsh said.

4. DOJ Announces End of Powell Probe

The U.S. Department of Justice said Friday that it is closing its criminal investigation of Federal Reserve Chair Jerome Powell - though it's not clear the move will fully resolve the matter. U.S. Attorney Jeanine Pirro said she has directed the Fed's Inspector General to investigate the building cost overruns underlying the inquiry, which had centered on Powell's testimony to Congress about Fed building renovation costs. "I expect a comprehensive report in short order and am confident the outcome will assist in resolving, once and for all, the questions that led this office to issue subpoenas," Pirro said in an X post. "Accordingly, I have directed my office to close our investigation as the IG undertakes this inquiry." Pirro has indicated she may still pursue charges depending on the outcome of the IG report. Whether this announcement will clear the way for the Senate Banking Committee to proceed with Senate confirmation of Kevin Warsh, the nominee to replace Powell, depends on the support of Sen. Tillis (R-NC) and his view of the resolution.

5. Proposed OCC Changes Would Help Fix a Broken Supervisory Appeals System

The OCC's proposed changes to its framework for banks' appeals of supervisory decisions would restore confidence, bolster accountability and improve transparency in the appeals process, the Bank Policy Institute, Independent Community Bankers of America and American Association of Bank Directors said in a comment letter filed this week.

"The appeals process is a fundamental feature of supervision, but it doesn't work if banks lack confidence in the system's impartiality and fear retaliation. The OCC's proposed changes would strengthen accountability and improve fairness in the appeals process."

To learn more, click here.

The Long-Simmering Debate on the 1033 Rule: BPI's John Court Joins 'Mr. Open Banking' Podcast

Who gets access - and who has liability - when it comes to bank customers' financial data? The much-debated answer to this question is the subject of a CFPB rule, known as Section 1033 after the provision of the Dodd-Frank law that authorized it, and it has sparked a legal challenge from BPI and other organizations. BPI General Counsel and Chief Operating Officer John Court discussed this topic with Financial Technology Association CEO Penny Lee in a newly released episode of the Mr. Open Banking podcast. (The episode was recorded in October, but aired in April 2026.) Here are a few highlights.

• Fixing What Wasn't Broken. Court shared BPI's perspective that former CFPB Director Rohit Chopra's rule "replaced a very well-functioning, market-driven, customer-permissioned data sharing ecosystem … with what we thought was a complicated, costly, fundamentally insecure, mandated data sharing framework."
• Fundamental Flaws. The rule mandated that banks share data with a broad swath of data middlemen and forced banks to take responsibility for those third parties' security practices without allowing banks to be more selective about the entities with whom they share. "You're effectively forcing the banks to give data to people who they don't trust to handle the data," Court said. Other objections: Unreasonable compliance deadlines and a prohibition on banks charging fintechs any kind of fee for allowing data access. "If you support open banking, if you support a safe and secure environment where the rights and benefits for the customer are paramount, then this is not your rule. This rule, in our view, will decimate the innovative, growing, evolving, well-functioning data sharing ecosystem that's developing, and that's why we challenged it," he said.
• Fintech Perspective. FTA's Lee expressed her organization's view that BPI's lawsuit threatened the ability of the fintech industry to innovate. FTA filed a motion to intervene on the rule.
• Competition and Free Markets. Both Lee and Court agreed that competition and innovation are imperative. "There is nothing worse than baking into regulation and law these hyper-prescriptive requirements, particularly in an area like this, which is moving so fast every day," Court said.
• Key Question. One major question at the heart of the legal challenge is what Congress meant when they said banks must share customer data with the "consumer or their agent, trustee or representative" - a legal distinction "with a huge difference," Court noted. The Chopra 1033 rule hinged on a broad interpretation of this clause.

Banking Agencies Issue Revised Model Risk Management Guidance

The Federal Reserve, OCC and FDIC late last week issued revised model risk management guidance and rescinded the prior guidance, clarifying that "model risk management should be tailored commensurately to the size, complexity, and model risk profile of a banking organization." The revised guidance highlights factors that influence model risk and the features of effective model development and model use; model validation and monitoring; and governance and controls. It also discusses considerations specific to vendor and other third-party products, including validation of these products. The guidance does not set forth enforceable standards or prescriptive requirements, and non-compliance will not result in supervisory criticism, the agencies noted. The revised guidance also notably scopes out Gen AI and Agentic AI models from its scope. The agencies indicated they will issue a request for information in the near future to address model risk management, in particular banks' use of AI, including Gen AI and agentic AI and AI-based models.

• BPI View. BPI previously called for the model risk management guidance to be rescinded and replaced, citing the guidance's prescriptive nature, disruption to bank operations and barriers to innovation. Read more here.

The Crypto Ledger

Here's the latest in crypto.

• Markup Likely to Slip. Sen. Thom Tillis (R-NC), who has been working with Sen. Angela Alsobrooks (D-MD) on language involving payment of yield on payment stablecoins, told reporters that lawmakers "need to be looking at May as a markup time."  With the Senate out the first week of May, that would mean earliest that the committee could hold a markup would be the week of May 11.
• U.S. Stablecoins Endanger Emerging Markets, According to BIS Chief. Bank for International Settlements General Manager Pablo Hernández de Cos said recently that growing use of U.S. stablecoins for international payments threatens to undermine emerging markets' control of money flows and facilitate regulatory evasion. Hernández de Cos, general manager of the BIS, said rapidly rising stablecoin use could "make it easier to evade capital controls" and intensify "dollarisation risks," according to the Financial Times.
• A Harbor for Scams. A recent American Banker article examined the common ground between social engineering scams and Iran's Strait of Hormuz tolls: cryptocurrency. However, scams and the Iran conflict became more closely intertwined in recent weeks as Reuters reported that "[f]raudulent messages promising safe passage through the Strait of Hormuz in exchange for cryptocurrency have been sent to some shipping companies whose ​vessels are stranded west of the waterway, Greek maritime risk management ‌firm MARISKS has warned."

Waller Calls to Reorganize Fed Reserve Banks' Functions

Federal Reserve Governor Christopher Waller this week called for a shift in the Federal Reserve Banks' operations and governance, with more centralized key functions and less deliberation among regional reserve banks. More agility is needed to manage risks amid fast-moving technological changes, Waller said. "Decisions about HR administration, IT architecture, procurement strategy, and facilities standards need to be made at the system level and not decided district by district," Waller said in remarks prepared for an event Tuesday at the Brookings Institution in Washington. "That requires not just delegation of authority but a genuine shift away from consensus-based operational decisionmaking." He called for incorporating technology into the Fed's risk management strategy. "The pace of technological change today means that the Fed does not have the time to sit back and ruminate about changes," Waller said. "If we are going to ride this wave, and not be drowned by it, we need greater agility to capture efficiencies and manage risks, such as cybersecurity and incorporating AI into our system processes."

Traversing the Pond

Here's the latest in international banking policy.

• BPI Responds to EU Consultation on Competitiveness. BPI this week responded to the European Commission's consultation on the competitiveness of the EU banking sector. BPI warned against the risks of fragmentation across borders, which it called a "a significant structural impediment to EU banking competitiveness." The letter also emphasized the value of open markets and access to credit.
• IMF Urges Banks to Share Data to Fight Fraud. The International Monetary Fund warned in a recent paper that "inadequate frameworks for cybersecurity incident reporting" among banks impede the sector's ability to combat fraud. The IMF recommended a strategic shift toward private threat information sharing between banks both domestically and internationally.
• Asia Regulators Eye Mythos Risks. Asian financial regulators, including in Singapore and Hong Kong, are monitoring bank risks associated with Anthropic's Mythos AI model, according to Reuters.
• ECB's Guindos Expresses Support for Cross-Border EU M&A. When asked about UniCredit's potential acquisition of Commerzbank, ECB Vice President Luis de Guindos said recently: "Regarding banking integration, we have always been in favor of cross-border mergers. We believe that having truly European banks is essential." He went on to say: "What we support is a single banking market with freedom of capital flows and the movement of liquidity among different players. We implicitly support banking integration, cross-border mergers, and having banks that are sufficiently large. The necessary condition is that there is first an integration of goods and services markets. The integration of capital markets and banks comes afterwards."

Member News

BofA Awards $250,000 in Grants to Harry Chapin Food Bank

Bank of America this week announced it has awarded Harry Chapin Food Bank grants to support two initiatives aimed at ending hunger in Southwest Florida. A $200,000 grant will support construction of the food bank's new Hunger Action Center through the nonprofit's ongoing $30 million Feeding the Future capital campaign.

The new distribution center and warehouse, set to be completed later this year in Fort Myers, is expected to increase the food bank's food distribution capabilities from 45 million to 80 million pounds annually of dry, refrigerated and frozen foods.

BPI Job Bank

• Summer Intern, Communications

Upcoming Events

• 4/28/2026: House Financial Services Committee Hearing: "Evaluating the Impact of Capital Proposals on Economic Growth and American Communities" 
• 4/29/2026: House Financial Services Task Force on Monetary Policy, Treasury Market Resilience and Economic Prosperity Hearing on Derivatives and the Treasury Market