Monoup News Digest: Main Updates from Fintech Industry
Monoup rounds up the key stories you may have missed this week. The scope of financial regulation keeps expanding on several fronts at once: from crypto exchanges now compelled to enforce EU sanctions lists, to traditional payment markets where governments are rewriting the rules of the game.
Uzbekistan is banning P2P transfers through payment institutions' websites in an effort to protect users from fraudulent phishing sites, replacing it with application flows. At the same time Syria is effectively rebuilding its financial institutions from the ground up, rolling out regulation that will open its market to PSPs and EMIs.
Here's a closer look at each story.
Binance to restrict transactions with 11 crypto platforms over Russia-related sanctions
On July 23, the European Union approved its 21st sanctions package against Russia, which for the first time included restrictions targeting a number of crypto services linked to schemes for evading earlier sanctions. Binance has decided to comply with these requirements, despite still not holding an active license to operate in the EU.
Starting August 23, the exchange will stop processing transactions involving ABCeX, Rapira, Aifory Pro, NoOnecrypto, Tradex, Monease, WhiteBird, BitPapa, Exnode, HTX (formerly Huobi), and EXMO, and will be able to place any wallets previously linked to these services under review. This isn't the first wave of restrictions: earlier, on August 7 and 13, similar measures already hit Shelbit, Aban Tether Exchange, A7 Nigeria, A7 Africa, and PilotFinance.
Notably, Binance's move to align with EU sanctions comes amid separate scrutiny from US authorities — in spring 2026, Senator Richard Blumenthal asked the company's leadership to explain $1.7 billion in transactions tied to Iran and Russia. Sanctions compliance has effectively become part of the operating model even for players not formally established within the regulator's jurisdiction.
SafePal discloses a data breach affecting nearly 40,000 customers
Hardware crypto wallet maker SafePal disclosed a security incident affecting 39,798 customers who placed orders between March 2025 and April 2026. The cause was an authorization vulnerability in a plugin used for order tracking — a fairly familiar pattern, where the weak point turns out to be not the device itself but the web service built around it.
Attackers gained access to customers' names, email addresses, phone numbers, delivery addresses, and order details. Seed phrases, private keys, wallet passwords, and payment data — none of which the company stores in the first place — remained unaffected, so user funds were not at risk. The real danger lies in follow-up attacks: phishing, fraudulent calls, and emails impersonating customer support. SafePal has already reported blocking more than 30 fraudulent sites built on the leaked data, and has cut the data retention period in its order-processing system down to 90 days.
The case isn't isolated: a similar scenario involving a logistics plugin hit Trezor's delivery partner just days earlier, exposing around 14,000 records, while back in 2020 Ledger suffered a major breach affecting 300,000 records. Hardware wallets themselves remain reliable — it's the ecosystem of services surrounding them that keeps turning out to be the weak link.
Uzbekistan bans transfers via websites
Starting November 16, new rules take effect in the country, continuing the Central Bank's push against online fraud that began this spring with a ban on P2P transfers through the web versions of banking and payment services.
Under the new rules, logging into an account from a new device will temporarily deactivate any linked bank cards, and reactivating them will require confirmation via an OTP code. Logging into your account through a browser will still be possible, but the transfer function won't work there — it will remain exclusive to the mobile app.
Payment companies and banks that fail to implement additional identity-verification methods will be held liable for customers' financial losses from fraudulent transactions. The rules apply to all banks and fintech services in the country, including Click, Uzum, and Payme.
Syria launches PSP, EMI, and PSO regulation from the ground up
Following the lifting of most international sanctions and the return of Visa and Mastercard to the country in May 2026 — marking their resumption of operations for the first time in 15 years — Syria's Central Bank has gone a step further, approving a state-run system for electronic payments and money transfers.
Under this framework, the country will introduce a formal classification of market participants — payment service providers (PSPs), electronic money institutions (EMIs), and payment system operators (PSOs) — along with the corresponding regulatory infrastructure. The undertaking is a substantial one: decades of sanctions effectively cut Syria off from the global financial system, and the country is now building its payment market regulation almost from scratch, without existing mechanisms to build upon.
The Central Bank isn't expecting international partners to connect to the new system right away, but views this as a likely development down the line — particularly given that Mastercard and Visa have already signed memoranda on developing digital payment infrastructure in the country.
That's the news we selected for you this week. For daily updates in short form, subscribe to our Telegram channel, and for full articles and in-depth breakdowns, visit MonoTalks every Monday.
