Our monthly round up of news items which help businesses understand the risks around AML and more
Criminals lose, compliance wins, the smarter way to safeguard your business.
Cyber Security
Iran linked attack shuts down UK power generator
A small UK power generator was taken offline for four days following a cyber incident in July, according to reporting confirmed in part by the UK government. Officials have not publicly identified the facility or formally attributed the attack, but media reporting has linked it to Iranian‑affiliated actors; the government said the event posed no risk to the wider energy system. The incident occurred alongside suspected Iran‑linked intrusions affecting US water utilities, raising concern over hostile actors’ interest in industrial control systems that sit behind energy, water and manufacturing infrastructure.
The fact that the affected generator was small should not dilute the lesson. Cyberattacks against operational technology, such as programmable logic controllers used to run industrial processes can move quickly from digital intrusion to physical disruption.
A four‑day outage, even at a minor facility, illustrates how threat actors may test access, resilience and response arrangements before targeting higher‑value infrastructure. Public attribution remains cautious, but the reported event reinforces the need to plan for disruptive attacks, not merely data theft or ransomware.
For risk, compliance and due diligence teams, critical‑infrastructure exposure should be assessed across the full supply chain: technology suppliers, maintenance contractors, energy‑intensive customers and third parties with privileged access. Scenario‑based cyber training should include operational outages, supplier compromise and the potential for state‑linked activity, helping organisations connect cyber resilience with business continuity, fraud prevention and wider financial‑crime risk.
Organised Crime
Gold Laundering moves from supply chain Issue to bank supervision risk
Gold’s price and portability have long made it attractive to organised crime, but attention is shifting from the mine and refinery to the financial institutions that support the trade. UNODC and FATF have highlighted a set of recurring mechanisms: illegal extraction, mislabelling of origin, false documents, corruption and the laundering of value through apparently legitimate supply chains. Once illicit gold is refined and blended with legitimately sourced material, tracing its physical origin becomes extremely difficult, leaving the financial and documentary trail as the more reliable route to detection.
The exposure is particularly acute for correspondent banks, trade‑finance teams and firms onboarding minerals exporters or refiners. Red flags can include newly formed exporters moving significant volumes before they have an established customer base, multi‑jurisdictional documentation chains that do not align with the stated trade, payments involving high‑risk mining regions, and changes in ownership or business activity that lack a credible commercial explanation. The article notes that more than 80% of financial institutions have some exposure to this risk, yet 40% have not taken action.
For AML and EDD teams, gold should therefore be considered a financial crime and organised‑crime risk, not solely an ESG or responsible‑sourcing concern. Effective controls depend on connecting beneficial ownership, sanctions and PEP information, adverse media, trade documentation and transactional behaviour across the customer lifecycle. A risk assessment that brings these signals together can help firms identify when a legitimate‑looking commodity business may instead be providing a route for criminal proceeds into the formal economy.
Regulatory
SRA flags high street businesses, ghost Directors and “passporting” as AML risks
The SRA’s latest money laundering and terrorist financing sectoral risk assessment focuses attention on businesses that can look entirely routine, mini‑marts, barbershops, vape shops, nail bars and car washes,but may be vulnerable to exploitation by organised crime.
It identifies cash‑intensive businesses and nominee arrangements as higher risk because genuine beneficial ownership, control and source of funds can be difficult to establish. The regulator also highlights the use of “ghost directors”, those individuals who are unconnected with, and may not understand, the business but agree to appear on company records for a fee while others exercise the real control.
For solicitors, the practical implications extend beyond onboarding. The SRA advises particular care in commercial property work involving cash‑intensive businesses, company matters involving unconnected or nominee directors, and transactions funded by companies whose turnover, profitability or activity does not fit their age, size or apparent operations. It also warns against “passporting” clients between offices, jurisdictions or business units without reassessing whether earlier due diligence remains appropriate for the new instruction, especially where the earlier work sat outside the scope of the Money Laundering Regulations.
The update is a timely prompt to treat existing due diligence as evidence with a shelf life, not a permanent compliance passport. Law firms should refresh client and beneficial‑ownership checks when circumstances change, verify that Companies House information remains current, and investigate anomalies rather than simply accepting familiar documents or prior internal approvals. EDD‑Pro can support this process by providing a structured, auditable workflow for verifying ownership, documenting source‑of‑funds enquiries, recording risk rationale and escalating higher‑risk matters consistently across the firm.
Comment – Cases like this show why strong AML controls, robust monitoring and effective enhanced due diligence are essential. Find out how EDD-Pro can help your team identify risk earlier, streamline investigations and keep your compliance process audit-ready.
