The 2026 Compliance Landscape (Part 1 of 3)

Half of all FCPA investigations were closed in 2025.

Enforcement got easier, right?

Not quite.

2026 is shaping up to be one of the most complex years for banking and compliance I've seen. Not because the rules got harder. In some places, they got softer. But because they got different. Everywhere. All at once.

Here's what's shifting:

1. FATF's 5th Round: The Proportionality Shift

The February 2025 FATF Standards update replaces "commensurate" with "proportionate." This is more than semantics.

Previously, the "commensurate" standard often led to a "zero-failure" mindset — high-friction controls applied broadly to avoid regulatory criticism.

The new standard mandates proportionality. Controls must fit the nature of the risk, not just the magnitude.

The implication? Applying high-level scrutiny to low-risk clients is no longer "playing it safe." It's now a technical compliance failure — because it wastes resources that should be fighting actual financial crime.

The Strategic Opportunity:

→ Customer Onboarding Velocity: Implement Simplified Due Diligence for low-risk segments to reduce onboarding time and abandonment rates.

→ Resource Reallocation: Automate low-risk monitoring, redeploy experienced analysts to complex investigations.

→ Financial Inclusion as Strategy: The mandate explicitly protects against de-risking. Serve segments previously deemed "too costly to comply" with fit-for-purpose controls.

The Risks to Manage:

→ The 3-Year "Cliff": If your jurisdiction has gaps, only three years to fix them before public escalation.

→ Sector-Specific Scrutiny: DNFBPs (lawyers, accountants, real estate) are now assessed independently. Enhance your third-party risk management!

→ Beneficial Ownership "Accuracy" Test: Move beyond collecting data to verifying it. Systems must detect discrepancies, not just record them.

2. Anti-Corruption Enforcement: A Fragmenting Landscape

In the United States, the Trump administration paused FCPA enforcement in February 2025, resuming in June with significantly narrowed priorities. The DOJ now focuses on cases directly harming "US national interests." Roughly half of existing investigations were closed.

Meanwhile, the UK is moving in the opposite direction. The "failure to prevent fraud" offence came into force in September 2025, expanding corporate liability for economic crimes.

Closer to Home: Malaysia's MACC Leans In

While the US pulls back, Malaysia is demonstrating what aggressive anti-corruption enforcement looks like in APAC.

2025 was a landmark year for the Malaysian Anti-Corruption Commission (MACC):

→ RM8.4 billion in assets seized, frozen and forfeited as of November 2025

→ 1,128 arrests, 445 charges filed, 189 convictions secured

→ High-profile operations targeting banking (Ops Tiger — 49 bank officers charged), immigration (Ops Rentas — 27 arrests including 18 enforcement officers), and military procurement (Smuggling and Procurement Probe)

→ Former PM Ismail Sabri under investigation — RM169 million in cash and 16kg of gold bars seized and forfeited

The message from MACC Chief Commissioner Tan Sri Azam Baki is clear: "No one is above the law." The agency's 2026 strategy will focus on enforcement, procurement, and grand corruption — with increased use of AI and data analytics to detect patterns and financial flows.

For organisations operating in Malaysia, this isn't theoretical. It's operational.

The Bottom Line

The rules haven't disappeared. They've scattered.

And in the gaps between enforcement regimes, corruption finds room to breathe. The question isn't whether your organisation is compliant with one jurisdiction — it's whether your framework is resilient enough to withstand the complexity of all of them.

The 5th Round is intolerant of "tick-box" compliance. It rewards effectiveness.

By embracing proportionality, organisations move from a defensive compliance posture to a dynamic one — reducing friction where risk is low, intensifying focus where risk is real.

This isn't just about passing the next evaluation. It's about building compliance frameworks that are both robust AND inclusive. Frameworks that protect the financial system while expanding access to it.

That's the opportunity. The question is whether your organisation is positioned to seize it.

What shifts are you seeing in your jurisdiction?

Next: Part 2 - The Liability Revolution: who pays when fraud succeeds, stablecoin regulation, and ESG chaos.

JFourth works at the intersection of compliance, technology, and financial inclusion, helping organisations harness innovation responsibly while protecting the people the financial system is meant to serve.

Get in touch to learn more.