FinCEN Hit UBS With a Record $125 Million 'Willful' BSA Penalty for Repeat AML Failures. What the Recidivist Enforcement Action Means for Your AML Program.

TL;DR

• FinCEN assessed a record $125 million civil penalty against UBS Financial Services on August 3, 2026 — the largest BSA penalty ever imposed on a broker-dealer — for “willful” violations of the Bank Secrecy Act. FINRA fined UBS $20 million the same day, but that isn’t stacked on top: FinCEN credited $48 million paid to the CFTC, SEC, and FINRA against its $125 million. UBS pays FinCEN $62 million, plus $15 million that FinCEN can waive if UBS spends it on the required AML program review.
• The same institution had settled with FinCEN in December 2018 for $14.5 million for similar AML program failures. UBS told FinCEN it would fix the gaps, and then failed to appropriately monitor more than 61,500 foreign currency wires totaling more than $10.5 billion over the next four-plus years.
• FinCEN’s “willful” designation — the worst characterization available — reflects that UBS knew of the deficiencies, was told by regulators, and chose not to remediate adequately.
• The three enforcement lessons: (1) known gaps that aren’t fixed become “willful” violations; (2) transaction monitoring scope — not just the existence of a program — is what examiners evaluate; (3) CDD failures for high-risk customers are examined independently from monitoring failures.

The worst word in a FinCEN enforcement action isn’t “violation.” It’s “willful.”

Violation means you failed to comply. Willful means you knew you were failing to comply — regulators told you, you agreed to fix it, and you didn’t. That’s the story FinCEN told in August 2026 when it imposed a $125 million civil penalty against UBS Financial Services Inc. — the largest BSA penalty ever assessed against a broker-dealer. FINRA fined UBS $20 million the same day — one of the payments FinCEN credited against its own penalty.

The same institution had settled with FinCEN in December 2018 for $14.5 million for substantially similar AML program deficiencies. That settlement included a promise to fix the underlying gaps. What followed, according to FinCEN’s consent order: four more years of the same failures, applied to more than 61,500 foreign currency wires totaling more than $10.5 billion.

That trajectory — settlement, promise, continued failure — is what produced the “willful” designation. And the record fine.

The Double-Barrel Action: What FinCEN and FINRA Each Found

The two enforcement actions are parallel but distinct.

FinCEN’s civil money penalty, filed under FinCEN’s BSA enforcement authority, found that UBS Financial Services willfully violated the BSA by:

• Failing to implement and maintain an AML program reasonably designed to detect and report suspicious transactions involving foreign currency wires
• Failing to reasonably implement its customer due diligence program for high-risk retail customers — particularly those with ties to Russia and Latin America
• Failing to file hundreds of suspicious activity reports in a timely manner

FinCEN’s consent order characterizes the violations as willful based on the institution’s prior settlement, the knowledge of gaps documented in internal records, and the continued operation with known deficiencies for more than four years after the 2018 settlement.

FINRA’s action, brought under FINRA’s AML supervision rules, found that UBS Financial failed to establish and implement an AML compliance program reasonably expected to detect and cause the reporting of suspicious transactions. FINRA’s jurisdiction is supervision of FINRA member firms; FinCEN’s is BSA compliance by financial institutions. Both came to the same underlying conclusion: the monitoring program wasn’t adequate for what it was supposed to cover.

Don’t add the numbers together. FinCEN’s consent order credits $48 million that UBS paid to the CFTC, SEC, and FINRA against the $125 million penalty. UBS pays $62 million to Treasury, and the remaining $15 million is due by May 31, 2028 — waivable to the extent UBS spends it on the required AML program review. Total resolution: $125 million, plus the cost of the mandatory third-party SAR lookback.

Eight Years of Known Deficiencies

The timeline is important because it’s what made the “willful” finding possible.

December 2018: FinCEN assessed a $14.5 million penalty against UBS Financial Services, and FINRA separately fined the firm $4.5 million. Among other things, the 2018 orders found that UBS failed to adequately monitor foreign currency wires. Before that settlement, UBS told FinCEN it expected a new automated monitoring system to fix the problem by mid-2019.

January 2019 – June 2023: In the four-plus years after that settlement, UBS failed to appropriately monitor more than 61,500 foreign currency wires totaling more than $10.5 billion. The new system didn’t go live until March 2021, and planning and testing flaws kept the gap open into the second quarter of 2023. The monitoring gaps weren’t new — they were substantially the same gaps that the 2018 settlement had identified.

August 2026: FinCEN’s consent order documents that UBS represented the problem would be remediated, didn’t deploy the fix until March 2021, and let the monitoring failure persist more than four years after the 2018 order. FinCEN also says UBS didn’t disclose the failings; FinCEN learned of them through its own investigation after a regulatory exam.

That record is the basis for the “willful” designation. It’s also the clearest articulation of what regulators mean when they say willfulness: not malice, but awareness of a legal obligation, awareness of your own failure to meet it, and a choice not to fix it.

The 2018 settlement changed the evidentiary landscape. Before it, UBS could potentially argue that its monitoring program was a good-faith attempt to comply with ambiguous regulatory expectations. After the settlement, that argument was foreclosed. Regulators had already told them what was insufficient. What followed was indefensible.

What “Reasonably Designed” Actually Means

Both actions center on the “reasonably designed” standard under the BSA. That standard is the core requirement for every AML program: the program must be reasonably designed to detect and report suspicious activity. The word “designed” implies that the program’s structure, scope, and methodology must match your actual risk profile.

UBS had a transaction monitoring program. The violation wasn’t that monitoring didn’t exist — it was that the program’s scope failed to cover a high-risk transaction type that ran through UBS’s actual business.

Foreign currency wires are not obscure transactions. For broker-dealers with retail clients in high-risk jurisdictions, they are among the most significant AML risk vectors: international transfers, often large dollar amounts, often crossing into jurisdictions with elevated sanctions and money laundering risk. The fact that UBS’s monitoring didn’t adequately cover them — despite a prior settlement specifically about that gap — is what produced the “knew and didn’t fix” narrative.

What this means for every AML compliance program:

The “reasonably designed” standard doesn’t set a bright-line rule for how many monitoring rules you need or what thresholds to use. It requires that your program be designed to detect the suspicious activity that flows through your specific business — which means your monitoring scope has to match your transaction activity, and your monitoring thresholds have to be calibrated to your risk profile.

The CDD Failure: Where Monitoring Meets Customer Risk

The CDD findings are separate from the monitoring findings but closely related. FinCEN found that UBS failed to conduct adequate due diligence on high-risk retail customers — particularly those with ties to Russia and Latin America.

CDD failure in this context isn’t “we didn’t collect KYC documents.” It’s a failure to reasonably implement the enhanced due diligence framework for customers who warranted it. The distinction matters: FinCEN’s scam center alert earlier this month reinforced that regulators expect CDD to be ongoing, not a one-time onboarding exercise. Customers’ risk profiles change. CDD programs have to keep pace.

The connection to monitoring is direct: if your CDD program isn’t identifying which customers warrant enhanced scrutiny, your transaction monitoring thresholds can’t be calibrated to reflect that risk. The two failures reinforce each other. A customer flagged as high-risk should trigger enhanced monitoring rules. If CDD didn’t flag them, enhanced monitoring rules don’t apply, and the monitoring gap expands.

The SAR Filing Failures

The third category of findings — failure to file SARs timely — flows directly from the first two. If monitoring doesn’t detect a transaction, you can’t file a SAR on it. If CDD doesn’t identify a customer as high-risk, monitoring thresholds that depend on risk tier won’t trigger on their activity.

FinCEN’s consent order requires an independent SAR lookback covering foreign currency wires from the relevant period, plus other products affected by similar monitoring gaps. The consultant must identify suspicious transactions that went undetected, and UBS must file the SARs. A separate independent review of the AML program focuses on the priority risks where the failures concentrated: the U.S. Southwest border and narcotics trafficking, Iran, Russia, and Venezuela.

This creates a secondary exposure problem. Every SAR identified in the lookback is evidence that a SAR should have been filed and wasn’t. Every one of those is an additional BSA violation in the historical record. The mandatory lookback isn’t just expensive — it’s self-documenting additional violations that FinCEN can reference in any future enforcement action.

FINRA’s Reg BI enforcement wave this year demonstrated a similar pattern in the supervision context: when regulators identify a systemic failure through enforcement, the subsequent monitoring of that firm intensifies. After the 2018 settlement, UBS was on a shorter leash. The 2026 action reflects how short that leash had become.

The Compliance Program Lessons

The UBS enforcement action teaches three things that apply to every broker-dealer and financial institution with an AML program.

1. Known gaps that aren’t remediated become willful violations. If your compliance team has documented monitoring gaps, CDD weaknesses, or SAR filing delays — and those findings haven’t been remediated — you have a “known and not fixed” problem. The 2018 UBS settlement is an extreme example, but the underlying principle applies to any documented finding that isn’t addressed: you’ve created evidence of awareness without evidence of action. Document the gap, escalate it, and drive it to closure — the way a mature issues management process requires. And tell your regulator while you’re fixing it. Silence was part of what made UBS’s case so bad: FinCEN says it learned of the continuing gaps through its own investigation, with significant parts of the remediation “not undertaken until FinCEN’s investigation was already underway.” The FinCEN release explicitly encourages institutions to discuss these issues with their regulators, “especially when they relate to matters that have been the subject of prior enforcement actions.” A known gap you disclose, with a dated remediation plan, reads very differently from one an examiner finds on their own. And track remediation with operational evidence (system change logs, rule implementation dates, testing results, SAR filing data), not ticket closures. “We fixed it in 2019” needs proof.

2. Transaction monitoring scope is the first thing examiners evaluate. The question isn’t “do you have a transaction monitoring system?” It’s “does your transaction monitoring cover the transaction types that carry meaningful AML risk for your specific customer base and business model?” For a broker-dealer with international clients, foreign currency wires should be an obvious answer. Map your transaction activity against your monitoring coverage. The gaps are your exposure.

3. CDD failure creates monitoring failure. An EDD policy that isn’t implemented — meaning there’s no documentation that customers who meet high-risk criteria actually received enhanced scrutiny — will show up as a separate finding alongside monitoring failures, not instead of them. Regulators examine both. If your customer risk tiers don’t actually drive who gets enhanced scrutiny, start there: the AML/BSA Risk Assessment Template includes a weighted customer risk rating model with 10 example customer types, alongside an institutional risk assessment that scores 32 fintech risk factors from inherent to residual. It’s built for fintechs rather than broker-dealers, but the logic of tying risk ratings to controls carries over.

So What?

The UBS action is notable for the size of the fine and the “willful” designation, but the underlying violations — inadequate monitoring scope, insufficient CDD for high-risk customers, SAR filing delays — are among the most common BSA exam findings for broker-dealers and money service businesses.

The difference between UBS’s $125 million outcome and a more typical enforcement result is the 2018 settlement. The settlement created a documented record of awareness that foreclosed every good-faith argument. Most compliance programs don’t have a prior consent order as a complicating factor — but they often have documented findings that are weeks or months overdue for remediation.

Run this exercise before your next exam: pull every open AML-related finding in your issues tracker. For each one, check when it was identified and what the documented remediation status is. If there are findings more than 90 days old without a remediation action or an approved extension with documented rationale, you have a potential “knew and didn’t fix” problem — even without a prior consent order.

The 152-indicator KRI Library includes 11 BSA/AML KRIs — SAR filing timeliness, CTR filing accuracy, OFAC screening coverage, CDD/EDD completion, KYC refresh completion, alert aging, alert-to-SAR conversion, transaction monitoring false positive rate, PEP/sanctions match resolution time, BSA staffing ratio and deepfake SAR key-term compliance — the kind of indicators that surface a program falling behind before it becomes a $125 million problem.

“Willful” is an outcome, not a character judgment. It’s what happens when a compliance program treats documented gaps as acceptable operating conditions instead of problems to fix. The UBS timeline makes that trajectory visible in a way that should reframe how every BSA officer thinks about their open findings list.

Sources: FinCEN: Record $125M Penalty Against UBS Financial Services | FINRA: $20M Fine Against UBS Financial (FINRA.org) | BusinessWire: FINRA UBS Announcement | Miller & Chevalier: FinCEN $125M Penalty Analysis | AML Intelligence: UBS Record Fine Coverage