Signal Spotlight · Southeast Asia, financial crime and cross-border enforcement
What happened
The International Conference on Combating Online Scams (ICCOS-2026) took place in Phnom Penh on September 23 and 24, hosted by Cambodia with Prime Minister Hun Manet presiding. It was co-sponsored by the UN Office on Drugs and Crime, INTERPOL, and the Lancang-Mekong Integrated Law Enforcement and Security Cooperation Center, with Inside Asian Gaming also listing the FBI as a supporter. Focus Gaming News reports more than 600 participants, including government officials, law enforcement, financial regulators, technology companies, and cybersecurity specialists.
The Phnom Penh Declaration was adopted on September 24 by delegates from 28 countries and seven international organizations, according to a Cambodian government release and Inside Asian Gaming. The Phnom Penh Post counted 27 countries. The “more than 30” figure in some headlines appears to add countries and organizations together. Inside Asian Gaming lists Australia, China, India, Laos, Malaysia, Myanmar, the Philippines, Singapore, Vietnam, and the United States among the nations in attendance. A full signatory list was not published in the coverage we found.
The declaration sets out 11 commitments: strengthening international cooperation, breaking the criminal chain, disrupting and recovering criminal proceeds, leveraging technological innovation, strengthening policy, legal, and regulatory frameworks, building capacity and resilience, deepening public-private partnerships, protecting trafficked victims and vulnerable persons, implementing the non-punishment principle for victims, preventing fraud and human trafficking, and dismantling online scam compounds and related infrastructure.
The Phnom Penh Post reports that the declaration is voluntary and does not create legally binding obligations. Implementation is subject to the laws in force in each jurisdiction and to full respect for human rights, due process, and privacy. INTERPOL’s Nicholas Court welcomed the declaration and said INTERPOL is ready to make its tools and operational capabilities available to signatories. Cambodia says it expects further endorsements in the coming days, and a Cambodian government release reports that Canada has since endorsed it.
Why it matters
This is a scam declaration. None of the 11 commitments, as reported, mention gambling. Any suggestion that its channels will be used against unlicensed gambling operators is our read, not something the text says, and it depends entirely on how individual countries choose to implement a voluntary framework.
The more direct link is money. The declaration commits signatories to disrupt and recover criminal proceeds, strengthen the exchange of intelligence and financial information, and deepen public-private partnerships. The conference itself included financial regulators and technology companies. In practice, that points first at payment providers, exchanges, and banks, and then at the licensed operators whose payment and KYC processes sit downstream of them. It fits a direction we’ve already seen: FATF’s recent review named e-wallets, mobile money, and virtual assets as key exposure channels for online gambling, and BSP’s shutdown of more than 8,000 merchant accounts fronting for unlicensed casinos targeted the same layer.
The regional overlap between scam and gambling economies is real, though the declaration doesn’t address it directly. The Philippines has its own example: a licensed POGO hub in Porac, Pampanga, Lucky South 99, has been the subject of human trafficking charges, which we’ve covered. That is a reason to expect Philippine authorities to have a stake in how the framework is used.
Cambodia’s role as host deserves a plain note. Cambodian officials told the conference that the country is not the origin of online scams but has been exploited as a location for them, and reported inspecting 832 sites, cracking down on 663, and taking control of 86 major compounds, with four cases involving 15 suspects, including senior officials. Those are the host government’s figures. A declaration signing doesn’t verify them, and the framework’s value will depend on follow-through elsewhere as much as in Phnom Penh.
What to watch
The full signatory list and further endorsements. Cambodia expects more, and Canada has already endorsed. Which additional countries and organizations join will show how broad the framework becomes.
Domestic follow-through in the Philippines, Malaysia, and Vietnam. New regulations, circulars, or bilateral agreements that cite the declaration would show it is being operationalized, not just signed.
The first enforcement action or information request that cites the framework. Whether it involves only scam compounds or reaches gambling platforms will settle the question our inference raises.
What the public-private partnership commitment turns into. A defined role for payment providers, exchanges, or licensed operators would be the clearest sign of how the framework reaches regulated businesses.
What this means for operators
The declaration creates no new legal obligation for you today. The sensible response is to confirm your licensing coverage is clean in every market you serve, and to be ready for information requests arriving through banks and payment partners before any formal enforcement step.
What this means for compliance
Treat this as a signal about direction, not a new rule. Check that suspicious transaction reporting and KYC standards are consistent across every jurisdiction you operate in, and document how you handle requests from payment partners and regulators, so you can respond quickly and consistently if the public-private channel becomes active.
What this means for industry bodies
The public-private partnership commitment is the opening. Associations can ask regulators in the Philippines, Malaysia, and Vietnam how licensed operators are expected to participate, and press for implementation that separates licensed businesses from criminal scam networks. That distinction isn’t automatic in multilateral anti-crime instruments, and it’s easier to secure before implementing rules are drafted.