Regulatory Watch News

• 

  Treasury Sanctions Exploit Broker Network for Theft and Sale of U.S. Government Cyber Tools

  OFAC

  February 24, 2026

  WASHINGTON — Today, the Department of the Treasury’s Office of Foreign Assets Control (OFAC) designated Sergey Sergeyevich Zelenyuk (Zelenyuk) and his company, Matrix LLC (doing business as Operation Zero), as well as five associated individuals and entities, for their acquisition and distribution of cyber tools harmful to U.S. national security.  Zelenyuk and Operation Zero trade in “exploits”—pieces of code or techniques that take advantage of vulnerabilities in a computer program to allow users to gain unauthorized access, steal information, or take control of an electronic device—and have offered rewards to anyone who will provide them with exploits for U.S.-built software.  Among the exploits that Operation Zero acquired were at least eight proprietary cyber tools, which were created for the exclusive use of the U.S. government and select allies and which were stolen from a U.S. company.  Operation Zero then sold those stolen tools to at least one unauthorized user.

• 

  Solicitation of Application for Membership on the Bank Secrecy Act Advisory Group (BSAAG)

  FinCEN

  February 24, 2026

  SUMMARY: FinCEN is inviting the public to nominate financial institutions, trade groups, and non-federal regulators or law enforcement agencies for membership in the Bank Secrecy Act Advisory Group. New members will be selected for three-year membership terms.

• 

  Using the goAML Web Portal across Multiple Browsers or Tabs with the same account

  FIAU

  February 24, 2026

  The FIAU would like to inform Reporting Entities that Money Laundering Reporting Officers (MLROs) who manage more than one Reporting Entity are advised not to use the goAML Web Portal simultaneously across multiple browser tabs or different browsers while logged in with the same account. Doing so may lead to data inconsistencies in how Reporting Entity selections are displayed during the preparation or submission of reports and messages. This creates a risk that submissions may inadvertently be made on behalf of a different Reporting Entity managed under the same MLRO account. To ensure a smooth and consistent experience, MLROs are encouraged to complete all required actions under one Reporting Entity within a single browser window before switching to another. For any assistance, please contact the FIAU.