Two Employees Falsified Compliance Records. 160 SARs Went Unfiled. FinCEN's $80 Million Fine Against Canaccord Genuity Shows Exactly How an AML Program Collapses.

TL;DR

• On March 6, 2026, FinCEN, the SEC, and FINRA imposed an $80 million civil penalty on Canaccord Genuity for willful BSA violations — at the time of issuance, the largest penalty ever assessed against a broker-dealer
• Surveillance reports went unreviewed for up to four years; two compliance employees then falsified records to conceal the backlog
• At least 160 SARs went unfiled, tied to thousands of suspicious OTC securities transactions
• Canaccord’s high-risk OTC market-making business was under-supported by an under-resourced AML program that was never redesigned to match the business it was supposed to cover
• The cascading failure pattern — inadequate program design → review backlog → falsified records → unfiled SARs — appears in enforcement actions repeatedly; the case is a template for what regulators treat as willful

The compliance team was running surveillance. The system was generating alerts. The reports were being logged.

They just weren’t being reviewed.

By the time FinCEN examined Canaccord Genuity’s AML program, surveillance reports had been sitting unreviewed for up to four years. Thousands of OTC securities transactions had triggered alerts. At least 160 of them should have generated suspicious activity reports filed with FinCEN. They didn’t.

When examiners started asking questions, they found something worse than neglect: two compliance employees had falsified records to make the backlog disappear on paper.

The result, announced March 6, 2026: an $80 million civil money penalty assessed jointly by FinCEN, the SEC, and FINRA — the largest BSA fine ever assessed against a broker-dealer at that point. The CCO and deputy were separately charged by FINRA.

This wasn’t a case of a firm that ignored AML entirely. It was a firm with an AML program that was designed for a different business than the one it was trying to cover, staffed below the level required to keep up with alert volume, and ultimately papered over rather than fixed. That sequence — wrong design, inadequate resources, concealment — is the specific pattern FinCEN treats as willful.

The Business That Created the Risk: OTC Market-Making

Canaccord Genuity ran a significant OTC market-making operation. OTC securities — penny stocks, small caps, shell companies, and thinly traded issues outside major exchanges — carry substantially elevated BSA risk. FinCEN’s own guidance and a generation of enforcement actions have established that OTC securities markets are routinely used for pump-and-dump schemes, layering, wash trading, and other manipulation techniques that generate illicit profits and obscure their source.

A firm with a major OTC market-making desk is, by definition, handling a product line that FinCEN views as high-risk. The regulatory expectation that follows from that is straightforward: the AML program must be designed and resourced to match. The surveillance scenarios, the SAR filing thresholds, the customer due diligence depth, and the staff capacity for review all need to be calibrated to OTC securities risk — not imported from a lower-risk business segment and applied unchanged.

What FinCEN found at Canaccord was an AML program that had not made that adjustment. The program’s structure and resources reflected a different level of risk than the OTC business actually presented. Alerts were generated — the system was working — but the human review layer that was supposed to convert those alerts into SAR decisions was chronically under-capacity.

That gap between alert volume and review capacity is where the failure began.

The Surveillance Backlog: Four Years of Unreviewed Reports

When a surveillance system flags a transaction, the output is a report that gets routed to a compliance analyst for review. The analyst evaluates the transaction against the alert criteria, looks at account history and context, makes a SAR/no-SAR determination, and documents the decision.

That review process takes time. It requires judgment. It requires personnel who understand the specific risk profile of OTC securities, can recognize manipulation patterns, and know when to escalate.

Canaccord didn’t have enough of those people to keep up with report volume. The result: reports piled up. Weeks of backlog became months. Months became years. By the time FinCEN began its review, some surveillance reports were four years old — still unreviewed, still unresolved, still sitting in a queue.

The transactions those reports covered had continued. Some had involved multiple follow-on trades in the same accounts. Some had continued patterns that, if someone had looked, would have resulted in SAR filings well before the accounts grew into significant problems.

At least 160 SARs were never filed that should have been. Each unfiled SAR is a statutory violation of the Bank Secrecy Act. FinCEN treated each category of SAR-filing failure as a separate violation category, and the combination of volume, pattern, and duration supported a willfulness finding.

The Falsified Records: Where Negligence Became Criminal Exposure

The surveillance backlog by itself might have been treated as negligence — a resource failure, inadequate program design, a remediable gap. What converted it to willful violation territory was what happened next.

Two compliance employees falsified records to show that the delinquent surveillance reports had been completed. The documentation that would have appeared in an audit trail — the review log, the completion timestamps, the sign-off records — was fabricated to show work that hadn’t been done.

This didn’t resolve the backlog. It hid it. When examiners examined the AML program records, they found documentation that appeared to show completed reviews. When they went a level deeper and examined whether the reviews had actually been performed — whether the outputs were consistent with genuine analysis, whether related SAR filings had followed — the fabrication became apparent.

Falsifying BSA compliance records is not a compliance gap. It’s a federal crime. The two individuals involved faced FINRA disciplinary proceedings in connection with the action.

For the firm, the falsification was evidence of knowledge: the employees knew the reviews hadn’t been done, knew the program was deficient, and chose to conceal it rather than escalate. That’s exactly the fact pattern FinCEN points to when it makes willfulness findings — not carelessness, but awareness of a known deficiency followed by a decision not to fix it.

The CDD Failure: Foreign Correspondent Accounts

Alongside the SAR failures, FinCEN cited inadequate customer due diligence for foreign correspondent accounts. Foreign correspondent relationships — where a domestic broker-dealer processes transactions on behalf of foreign financial institutions or their customers — are among the highest-risk relationships in the BSA framework.

FinCEN’s Foreign Correspondent Account Recordkeeping and Due Diligence rule (31 CFR 1010.610-611, implementing Section 312 of the USA PATRIOT Act) requires institutions to develop a due diligence program specific to foreign correspondent accounts, with enhanced scrutiny for accounts from jurisdictions with elevated money laundering risk, political exposure, or weak AML regimes.

Canaccord’s CDD program for these accounts was insufficient. The depth of review, the documentation of the correspondent’s AML controls, and the ongoing monitoring calibrated to the correspondent’s risk profile did not meet the regulatory standard. That failure compounded the SAR-filing violations: if you don’t know who your correspondent’s underlying customers are, you can’t make an informed SAR-filing decision.

What the Pattern Reveals: Four Sequential Failures

The Canaccord enforcement action follows a pattern that appears consistently in large BSA enforcement actions:

Each stage made the next one worse. A wrong program design created excess alert volume. Inadequate resources made that volume unmanageable. Failure to escalate allowed the backlog to compound over years. Falsification converted the program failure into willful violation territory and added individual criminal exposure for the employees involved.

The enforcement action didn’t require FinCEN to prove intent at stage one. It required only that someone in the firm knew the program was deficient — which the falsification established — and that the deficiency was not remedied. That’s the willfulness standard.

So What? Four Compliance Program Questions This Case Raises

1. Does your SAR queue have a maximum age?
Surveillance alerts that generate reports should be reviewed and closed within a defined timeframe — typically 30-45 days from alert generation to SAR/no-SAR determination. If your program doesn’t set a maximum age for open surveillance reports and trigger escalation when that age is exceeded, you don’t have a control on queue depth. Canaccord’s queue aged to four years without triggering any escalation or management review.

2. How does your program handle alert volume that exceeds capacity?
If alert volume exceeds the capacity of your review team, what happens? The right answer is: escalation to management, review of alert parameters, additional resourcing, or all three. The wrong answer is: reports go unreviewed. If your answer to “what do we do when the queue grows?” is unclear or doesn’t include escalation to compliance leadership, that gap needs addressing before an examiner asks the same question.

3. Is your AML program designed for the business you actually run?
Product-line risk is the BSA risk assessment’s core job. If your firm has added a high-risk product line — OTC trading, cross-border payments, crypto-linked activity, correspondent banking — and your AML program was designed before that product line existed or without explicit adjustment for it, the program is not fit for purpose. The business changed; the program needs to reflect that. The FFIEC BSA/AML Examination Manual’s structure — products and services, customer types, geographies, delivery channels — is the framework for that review.

4. Does your surveillance system’s output have ownership?
Someone in your organization needs to be accountable for surveillance report disposition. That means: a designated owner, a completion standard, a queue aging report that goes to compliance leadership, and a documented process for what happens when reviews don’t happen on time. If surveillance is automated but the output is unowned, the automation gives you a false sense of coverage.

The CCO and Deputy: What FINRA Did

Separate from the institutional penalty, FINRA brought disciplinary proceedings against Canaccord’s Chief Compliance Officer and the CCO’s direct report. The proceedings focused on supervisory failures — specifically, failure to adequately supervise the AML staff responsible for surveillance reviews and failure to escalate the growing review backlog to firm management.

Personal liability in BSA enforcement follows a three-part pattern that regulators have articulated: affirmative misconduct, obstruction of the examination, or wholesale failure of supervisory responsibility. The Canaccord CCO case fell into the third category — the individuals with compliance oversight responsibilities were aware or should have been aware of the surveillance backlog and did not act to remediate or escalate it.

For compliance program leaders, this case reinforces what the August 2026 CCO liability analysis covered: documentation of what you knew, when you knew it, and what you did about it is not just good practice. It’s how you distinguish between a program that failed and one that was deliberately concealed.

How This Compares to the UBS Action Six Months Later

In August 2026, FinCEN assessed a $125 million penalty against UBS Financial Services — surpassing Canaccord to become the new record BSA fine for a broker-dealer. The UBS case focused heavily on the recidivist angle: UBS had already settled similar failures in 2018 and had not fixed the underlying program.

The two cases in sequence define what BSA enforcement in the broker-dealer space looks like in 2026:

• Both cases: Willful violation findings, multi-regulator coordination (FinCEN + SEC + FINRA), undersized AML programs for high-risk business lines
• Canaccord specifically: Falsified compliance records, OTC market-making risk, foreign correspondent CDD
• UBS specifically: Recidivist pattern (same failure resurfacing after a prior action), foreign currency wire monitoring, high-risk CDD

FinCEN’s message across both cases is consistent: an AML program that doesn’t match the risk profile of the business it covers will eventually be found, and if personnel knew it was deficient, the penalty will be sized accordingly.

Building the SAR Program That Survives Examination

The specific failures in the Canaccord case translate into concrete program design elements:

Surveillance system governance: Define maximum alert ages. Create automated queue aging reports. Establish escalation triggers. Assign a named owner to the surveillance output process.

SAR committee cadence: If your SAR filing decisions go through a committee, ensure the committee meets frequently enough to handle volume. For a high-risk product line, that may mean weekly reviews, not monthly.

AML program risk assessment refresh: When your firm adds a new product line or customer segment with elevated risk, the BSA risk assessment should be updated to reflect that change — not when you get an MRA, but when the business changes.

Independent testing scope: Your AML independent testing (the fourth pillar of a compliant BSA program) should specifically test SAR completeness — comparing the transactions that triggered alerts to the SARs that were actually filed. If your independent testing doesn’t include SAR completeness testing, you have a gap.

Record integrity: Compliance records are legal documents. Falsification of compliance records is not a procedural violation — it’s criminal. A compliance culture in which employees falsify records is one that has never received the message that accurate documentation of what happened is the point, not documentation of what management wants to have happened.

The FINRA Reg BI enforcement wave and the Canaccord case together illustrate a theme in broker-dealer regulation in 2026: the supervisory failures that create the biggest enforcement exposure are the ones that were known internally and not addressed.

Key Sources

• FinCEN Civil Money Penalty — Canaccord Genuity LLC (March 2026)
• Paul Weiss: FinCEN, the SEC, and FINRA Assess $80 Million Penalty Against Canaccord Genuity
• McDermott Will & Emery: FinCEN Imposes Record $80 Million Penalty on Canaccord Genuity
• Radical Compliance: Lessons From the Canaccord $80M Penalty
• NYU Compliance & Enforcement: FinCEN, SEC, and FINRA Assess $80M Penalty on Canaccord Genuity