Issue #26 | October 20, 2026 | 7 min read
The Brief
On August 3, FinCEN assessed UBS Financial Services $125 million, the largest Bank Secrecy Act penalty ever imposed on a broker-dealer. It's the second time FinCEN has penalized this same entity for the same gap. The first, in December 2018, was $14.5 million for failing to monitor foreign currency wires.
This issue covers what UBS promised FinCEN in 2018, how the replacement monitoring system developed its own blind spots, what one relabeled field did to it, and why the $125 million headline works out to $62 million in cash.
Main Feature
UBS Told FinCEN the Fix Was Coming in 2019. Nobody Tested Whether the Fix Could See the Wires.
The replacement for a monitoring system FinCEN had already penalized dropped wires at the data feed, and nothing was built to notice.
In December 2018, UBS Financial Services consented to a $14.5 million FinCEN penalty because its automated monitoring couldn't capture foreign currency wires moving through commodities and retail brokerage accounts. Before signing, the firm told FinCEN a new system would cover those wires by mid-2019. According to the new consent order, within weeks of signing, senior executives and UBS Head Office knew that date would slip. FinCEN wasn't told. The system went live in March 2021, and the monitoring gap ran until the second quarter of 2023.
Penalty: $125,000,000 (less $48,000,000 credited for FINRA $20M, SEC $20M, CFTC $8M)
Cash to Treasury: $62,000,000, plus $15,000,000 due May 2028 and waivable against remediation costs
Conduct period: Jan 1, 2019 to Jun 30, 2023
Unmonitored: more than 61,500 foreign currency wires, more than $10.5 billion
Prior orders: FinCEN $14.5M and FINRA $4.5M, both December 2018
The years in between ran on an Excel report. For commodities accounts, the control was a manual report with three parameters, assembled by staff who ran a dozen steps across four systems and pasted the results into a spreadsheet. It was meant to run quarterly. In 2019, two runs covered nearly all of the year's transactions. In one run, nearly half the records lacked a valid account number. A January 2019 internal slide deck, written weeks after the consent order, admitted the report was "still not effective" and that regulators had said so. The president of the US holding company insisted it move to monthly. It never did.
Then the spreadsheet code failed. The report flagged households sending more than the equivalent of $300,000 in foreign currency wires in a month, and it had been undercounting wire values for roughly two years. Hundreds of transactions never alerted. Staff found the problem in late 2020 and didn't escalate it. A FINRA examination inquiry prompted a lookback about two months later. The lookback finished in 2021 and produced no SARs. A consultant's lookback years later produced dozens, covering hundreds of transactions.
The replacement system is where this case stops being about delay. UBS selected an incorrect, partial data feed of foreign currency wires instead of the complete end-of-day feed. A one-month sample in early 2022 found more than 5 percent of wires never reached the system, and roughly 12 percent more arrived without counterparty information. In one documented example, the payments operations team changed a label from "FX RECEIVED" to "FX RCVD," and those wires stopped flowing to monitoring. The data repository had no exception queue, so nothing reported what failed to load.
The testing that did exist looked in the wrong place. Monthly model performance reports never flagged a problem, because they measured the model on the data it received. UBS's own order says no group, including Group Internal Audit and Model Risk Management, was responsible for tracing foreign currency wire data back to source. A 2020 internal audit report concluded that compensating controls over the legacy applications were adequate. FinCEN's order calls that finding inaccurate. The gap surfaced in mid-2022, only after a FinCEN investigation asked whether the new system was actually watching the wires. The exception handling was fixed in December 2022. A coherent data management framework wasn't applied until April 2023.
The due diligence findings run parallel. FinCEN cited weak CDD on high-risk customers with ties to Russia and Latin America, and hundreds of suspicious transactions, involving tens of millions of dollars, not reported on time. One Russian oligarch's onboarding negative-news screening returned thousands of hits. UBS reviewed the first twenty-five. A customer later subject to a 2021 Mexican arrest warrant had wires just before the warrant that were never investigated because of the monitoring gap. The SAR was late, and it couldn't identify the originator.
Now the arithmetic. The $125 million is the headline. FINRA, the SEC, and the CFTC took $48 million of it in parallel settlements, and FinCEN credited those against its assessment. UBS pays $62 million in cash to Treasury. The remaining $15 million is waived dollar for dollar against what the firm spends on the required undertakings: a SAR lookback with data lineage testing across other products, and an independent AML program review focused on the Southwest border and cartels, Iran, Russia, and Venezuela. UBS Group reported about $49.6 billion in revenue for 2025. The cash payment is roughly 0.13 percent of one year's revenue. A UBS spokesperson called it closure of "this legacy matter," with the conduct running through June 2023.
Red Flags in This Case
A remediation date promised to a regulator that slips internally within weeks, with no disclosure
An Excel report standing in for an automated control for years, with no quality check on its logic
A monitoring system with no exception queue, so records that fail to load simply disappear
Operations teams free to rename fields without anyone checking the downstream monitoring feed
Performance reports that test a model on the data it received and never on the data it didn't
Negative-news screening that returns thousands of hits, with the first twenty-five reviewed
The question for a program is who owns the claim that every wire reaches the monitoring system. At UBS, by the firm's own account, nobody did. A model performance report, an internal audit review, and a validation of the new system all existed, and each tested something downstream of the problem. The first consent order was about wires the old system couldn't see. The second is about wires the replacement couldn't see, and FinCEN's 2018 settlement was expressly conditioned on the accuracy of the remediation promise.
Source: FinCEN, Assessment of Civil Money Penalty against UBS Financial Services Inc., Aug. 3, 2026 | FinCEN Consent Order, UBS Financial Services Inc. | FINRA, Aug. 3, 2026
Controls & Testing
Risk & Control Matrix
Risk | Control |
|---|---|
A remediation date promised to a regulator slips and nobody decides whether to disclose it | Central register of regulator commitments owned outside the project team, with date-variance escalation to the CCO and a documented disclosure decision |
Transaction data fails to reach monitoring through partial feeds, mismatched fields, or upstream relabeling | Source-to-monitor reconciliation of record counts and values for each feed, an exception queue for unmatched or rejected records, and change control that routes upstream field changes through monitoring owners |
An interim manual control carries a known gap for years | Documented procedure, independent reperformance of the report logic, run frequency tied to the risk, and a tracked alert backlog |
Performance reporting and audit reviews conclude the system works without testing the data feeding it | Named owner for data lineage testing back to source, with internal audit reperforming conclusions on compensating controls |
Audit Test Steps
An audit program built around this typology could test for it by:
Collecting every remediation commitment made to a regulator in the last three years (orders, exam responses, matters requiring attention) and comparing promised dates to actual completion, then testing whether each delay was escalated and whether a disclosure decision was documented.
Reconciling one month of source-system wire counts and values to what each monitoring system received, and investigating every unmatched record.
Pulling change tickets from payments and operations systems for the last year and testing whether any field label, format, or code change was assessed for its effect on monitoring feeds.
Selecting one manual or interim monitoring control, rebuilding its output from raw data, and comparing the result to the production report, including thresholds and run dates against the stated frequency.
Reading the latest model performance reports and internal audit conclusions on transaction monitoring, and testing whether each validated its input data back to source or only the model's output. Where an exception queue exists, review the volume and aging of its items. Where none exists, report the gap.
Intelligence Briefing
Bank of America takes a $1.2 billion FinCEN penalty, with testing failures in the findings. On October 13, FinCEN assessed Bank of America, N.A. $1.2 billion, the OCC assessed $750 million, and OFAC settled 475 apparent sanctions violations for about $11.66 million. Treasury's headline total is "more than $1.21 billion," which equals FinCEN plus OFAC, so the OCC amount appears to be credited rather than added. The release doesn't spell out the mechanics. The bank admitted willful BSA violations and late reporting of over $5 billion in suspicious transactions, about $1 billion of it tied to Chinese money laundering networks, fraud, and trade-based laundering with a Southwest border nexus. FinCEN found the bank ignored testing that showed significant problems. The OCC found its BSA audit function missed longstanding concerns that examiners later found. Treasury calls it its third-largest penalty and the OCC's largest ever.
Source: U.S. Treasury, Oct. 13, 2026 | FinCEN, Oct. 13, 2026
FinCEN proposes cutting the A7 Network's sub-agents off from the US financial system. Under section 9714 of the Combating Russian Money Laundering Act, FinCEN's October proposal would find transactions involving non-US companies controlled by the A7 Network, a Russia-linked sanctions evasion and laundering service, to be a class of primary money laundering concern. It would use a sixth special measure that lets Treasury prohibit certain transmittals of funds, because the network's A7A5 ruble-backed stablecoin moves outside correspondent banking, where the usual account restrictions don't reach. Comments are due 30 days after Federal Register publication.
Source: FinCEN, Notice of Proposed Rulemaking, A7 Network Sub-Agents
Career Intel
UBS's SAR lookback consultant has to do more than review wires. FinCEN's order requires data lineage mapping and testing across other products to find gaps with the same root cause, and Bank of America's required reviews include data governance. Practitioners who can trace a record from a source system to a monitoring alert, and who can write the test that proves it, are what these undertakings need. Auditors who can sample a population and also reconcile it have a skill set most second-line teams still lack.
AI in Financial Crimes Compliance
In April, the Fed, OCC, and FDIC replaced the 2011 model risk guidance. The Fed's SR 26-2 supersedes SR 11-7 and also SR 21-8, the 2021 interagency statement on model risk for BSA/AML systems. Its footnote 3 states that generative and agentic AI models are not within the scope of the guidance, while the principles do apply to traditional statistical models and non-generative, non-agentic AI. The testing section lists "a critical assessment of data quality, relevance, and inputs" among the activities that evaluate whether a model performs as intended.
That last phrase is the one UBS missed. Its model performance reports tested the model and not the feed. For anyone piloting a language model to draft alert narratives or triage cases, the interagency guidance sets no standard for those tools at all. An examiner will still ask where the inputs came from and how you know they were complete.
Source: Federal Reserve, SR 26-2, Apr. 17, 2026
Tip Line
Got any idea for something you'd want to see covered here? Doesn't have to fit neatly into a category. If you think it's interesting, we probably will too.
Send it to [email protected].
If someone forwarded this to you, welcome.
The AML Brief goes out every Tuesday. Subscribe for free and get the Top 10 AML Red Flags cheat sheet as a thank-you:
[BUTTON: Subscribe → theamlbrief.com]
Already subscribed? Forward this to one colleague who works in financial crimes. That's how we grow.
The AML Brief | theamlbrief.com
Disclaimer: The AML Brief is an independent financial crimes intelligence publication. All content is sourced from publicly available regulatory documents, enforcement actions, and published research. Nothing published here constitutes legal, compliance, or regulatory advice. The AML Brief is not affiliated with any financial institution, regulator, law firm, or employer. For advice specific to your situation, consult a qualified attorney or compliance professional.