U.S. tightens oversight on Banque Misr UAE

On Sept. 1, the United States published a proposed special measure on Banque Misr UAE aimed at treating the entity as a financial institution of primary money-laundering concern outside the country. The proposal would require U.S. banks to apply enhanced due diligence to foreign correspondent accounts and take reasonable steps to avoid processing transactions involving Banque Misr UAE.

What does the proposed measure require?

The proposal would require U.S. financial institutions to strengthen risk-based due diligence programs for foreign banks' correspondent accounts. It would also require them to take reasonable steps to avoid processing transactions in U.S. correspondent accounts when those transactions involve Banque Misr UAE.

The notice published in the Federal Register effectively calls for tighter controls on payment flows that could touch the entity. The key issue is the correspondent relationship, a common pressure point in actions of this kind because it forces banks to examine more closely who is transacting, from where, and with which counterparties.

Who is covered and what did regional coverage say?

Regional coverage of the case said the measure is limited to Banque Misr UAE operations in the United Arab Emirates and does not extend to Egypt or other branches outside that country. Ahram Online added that the Central Bank of the UAE and the Central Bank of Egypt said the UAE branches remain operational as normal while they coordinate their response to the U.S. proposal.

That clarification narrows the geographic scope of the matter and keeps it from being read as an action against the entire banking group. For entities with correspondent ties or indirect exposure, the focus is on how transactions linked to the UAE operation are documented and screened.

What changed on SARs, cybersecurity and governance?

In parallel, the OCC, Federal Reserve, FDIC, FinCEN and NCUA issued a joint statement clarifying that SAR confidentiality does not prevent banks from speaking with customers about underlying facts, transactions and related documents, as long as they do not disclose that a report exists. Institutions must assess those communications case by case and design their protocols so they do not reveal, directly or indirectly, that a SAR was filed.

For banks with a U.S. presence, that guidance has a concrete operational impact because it allows conversations about fraud or suspicious activity, but demands caution in customer scripts, escalation procedures and internal documentation. The statement also makes clear that SAR protections remain in force and that the line between explaining a fact and revealing a filing cannot be crossed.

A 2026 Federal Reserve Board report on cybersecurity and operational resilience adds another layer, outlining rules, guidance, tools and resources for supervised institutions handling IT risk, cybersecurity, operational resilience and third-party risk. In a separate layer, an FFIEC governance analysis says boards should conduct periodic cybersecurity reviews, request updated risk maps, named owners, remediation dates, access review results and independent testing.

Taken together, those messages push banks to bring compliance, security and corporate governance into a single agenda. For groups with operations or correspondent relationships in the United States, the standard is no longer just about meeting reporting obligations or isolated controls, but about maintaining documentation, response capacity and board oversight of critical risks.