FinCEN's $125 Million UBS Penalty Breaks the Broker-Dealer Record Again — Three Months After It Was Set. The Lesson Is About What Happens After a Consent Order.

TL;DR:

• On August 3, 2026, FinCEN hit UBS Financial Services with a $125 million civil penalty for willful BSA violations — the largest ever against a broker-dealer, surpassing Canaccord Genuity’s record from just five months earlier.
• This is a recidivist case: UBS had been under a 2018 consent order for the same foreign currency wire monitoring failures and failed to fix them. FinCEN found the firm monitored 61,500+ foreign currency wires inadequately for years after the original order.
• The firm admitted willfulness, did not implement system-level monitoring fixes until 2021, and failed to disclose the ongoing monitoring gap to FinCEN.
• For every BSA officer currently managing consent order remediation or open MRAs: this case is about what happens when you close a matter administratively without fixing it operationally.

In March 2026, FinCEN set a record against a broker-dealer when it penalized Canaccord Genuity $80 million for willful BSA violations. That record lasted five months.

On August 3, 2026, FinCEN assessed a $125 million civil money penalty against UBS Financial Services Inc. — the largest BSA penalty ever imposed on a broker-dealer. UBS also resolved parallel matters with FINRA ($20 million), the SEC ($20 million), and the CFTC ($8 million) — but don’t add them up. FinCEN credited all $48 million against its $125 million penalty, so the total package is $125 million.

The UBS case is different from Canaccord in one critical respect: UBS had already been sanctioned for substantially the same conduct. In December 2018, FinCEN entered a consent order with the firm for inadequate monitoring of foreign currency wires and assessed a $14.5 million penalty. Eight years later, FinCEN found UBS still hadn’t fixed the problem.

This is the recidivist BSA enforcement pattern regulators have been warning about for years. It is now producing nine-figure penalties.

What the 2018 Order Covered

The December 2018 FinCEN consent order against UBS Financial Services identified failures in the firm’s monitoring of foreign currency wire transactions. The firm was required to remediate its AML program, particularly its transaction monitoring controls for foreign currency activity. The penalty at the time — $14.5 million — was significant for a broker-dealer but not in the same category as the major bank AML settlements of that era.

A consent order creates a continuing obligation. The firm’s compliance program is under FinCEN scrutiny from that point forward. Regulatory examiners track the remediation. The expectation is not that the filing of the order closes the matter — it is that the firm does what the order says.

UBS Financial Services did not.

What Happened After the 2018 Order

FinCEN’s 2026 enforcement action lays out the timeline of what followed the 2018 consent order:

The monitoring system was not fixed until 2021. The firm relied on manual, error-prone monitoring of foreign currency transactions for approximately three years after the consent order. At times during this period, foreign currency transactions were missed entirely. The failure to implement system-level transaction monitoring after a consent order specifically requiring it is not a program design gap — it is a remediation failure.

The ongoing monitoring gap was not disclosed to FinCEN. The 2026 order includes a finding that UBS failed to disclose to FinCEN that its foreign currency wire monitoring remained inadequate during the remediation period. This is a significant aggravating factor. A covered institution under a consent order has an implicit — and in many cases explicit — obligation to be transparent with regulators about the status of required remediation. Discovering that gaps persisted without disclosure is treated by FinCEN as evidence of willfulness rather than negligence.

61,500+ foreign currency wires totaling more than $10.5 billion went inadequately monitored. The scale of the monitoring failure over the remediation period produced an enormous backlog of transactions that were never assessed for suspicious activity. Many should have been filed as SARs and were not.

High-risk customer due diligence was deficient. In addition to the monitoring failures, the 2026 order found that UBS failed to conduct appropriate customer due diligence on high-risk customers with ties to Russia and Latin America. The illicit finance priorities in the required independent review — U.S. Southwest border, cartels, Iran, Russia, Venezuela — reflect the customer risk profile FinCEN found was not being managed.

The Willfulness Finding

In the 2026 FinCEN order, UBS admits it willfully violated the BSA (as the term is used in civil BSA enforcement). Willfulness is not a casual finding. It means the firm knew about its BSA obligations, had the resources to address them, and failed to do so — not through inadvertence or resource constraints, but in a manner that reflected knowing disregard of legal requirements.

In the BSA enforcement context, willfulness findings:

• Carry significantly higher penalty exposure than negligent violations
• Create personal liability risk for compliance officers and senior executives in some circumstances
• Are harder to remediate with a consent order because regulators treat subsequent violations as deliberate recurrence, not accidental failure

For a firm that had been under a FinCEN consent order since 2018, the willfulness finding in 2026 means FinCEN concluded the firm knew what it was supposed to do, knew it wasn’t doing it, and either didn’t think the enforcement risk was material or decided to close the compliance ticket without closing the operational gap.

The Penalty Structure

The $125 million penalty reflects FinCEN’s expanded approach to BSA enforcement at broker-dealers. The financial structure of the 2026 order:

The $15 million conditional waiver is tied to qualifying remediation expenditures and UBS’s implementation of the independent reviewer’s recommendations. It is an incentive for real remediation, not a discount.

UBSFS is registered as both a broker-dealer and a futures commission merchant, which is why the CFTC, SEC, and FINRA all had parallel jurisdiction alongside FinCEN.

The Remediation Orders

The 2026 consent order requires two significant remediation obligations beyond the financial penalty:

Third-party lookback. An independent consultant must review the period during which foreign currency wire monitoring was deficient and identify transactions that should have been filed as SARs but were not. Those SARs must then be filed. Lookbacks on years of transaction history are operationally expensive — often tens of millions of dollars in consultant fees alone — and can surface additional regulatory exposure if the suspicious activity involves ongoing customer relationships.

Independent AML program review. An independent reviewer must assess UBSFS’s AML program with specific focus on the illicit finance risks FinCEN has flagged: the U.S. Southwest border, cartels and narcotics trafficking, Iran, Russia, and Venezuela. The review must result in a program that is demonstrably designed to detect and report activity in these categories.

What This Means for BSA Officers Managing Consent Orders and MRAs

The UBS case establishes the most visible recent data point on what happens to financial institutions that treat consent order remediation as a compliance paperwork exercise rather than an operational transformation.

The specific failure pattern:

1. Consent order issued with specific remediation requirements
2. Firm closes the administrative matter without implementing required system changes
3. Monitoring gap continues for years post-order
4. Firm does not disclose ongoing gap to regulator
5. Regulator discovers gap in subsequent examination
6. Penalty is multiples of the original order, with willfulness finding

This pattern is not limited to broker-dealers. It is the same pattern that produced multi-billion-dollar penalties against major banks and the basis for the OCC’s “unsafe and unsound” escalation authorities under the 2026 final rule.

For any BSA officer currently managing consent order remediation, an open MRA, or a matter in examination, the UBS case has three practical implications:

Track remediation with documented evidence, not ticket closure. Closing a remediation task in a compliance system does not constitute evidence of completion. FinCEN, OCC, and FINRA examiners look for operational evidence: system change logs, transaction monitoring rule implementation dates, testing results, SAR filing data. “We addressed this in 2019” requires the documentation to prove it.

Disclose ongoing gaps to examiners proactively. If your monitoring system has a gap that you are in the process of fixing, disclose it. The willfulness aggravation in the UBS case is partly about the failure to disclose. Proactive disclosure of a known gap — with a documented remediation plan and timeline — is treated differently from a gap that examiners discover themselves.

Risk-assess your foreign currency and high-risk customer programs specifically. FinCEN’s enforcement focus in 2026 has consistently hit foreign currency activity, trade-based money laundering (American Express, $350 million), and high-risk customer segments tied to Russia, Iran, and Latin America. If your BSA risk assessment was last updated before these became explicit FinCEN priorities, it may not reflect your current risk environment.

The Record Is Now $125 Million — And It Was Set in August

The Canaccord $80 million record in March 2026, the UBS $125 million record in August 2026, and the American Express $350 million OCC penalty in October 2026 are not coincidences. They are a sustained enforcement cycle. Two of them are FinCEN broker-dealer records set five months apart.

The common thread across all three actions is not the industry sector or the specific transaction type. It is program adequacy — whether the BSA program was designed, staffed, and operated to actually detect suspicious activity, not just to exist as a documented compliance artifact.

For an institution currently operating with known program gaps, a stale risk assessment, or a consent order that is “closed” on paper but not operationally remediated, the question is not whether an enforcement action is possible. It is whether your program evidence would hold up to an examiner who has spent the last year reviewing these cases.

Internal Resources

If your risk assessment is older than your last consent order or Matter Requiring Attention (MRA), rebuild it before an examiner does. The AML/BSA Risk Assessment Template is built for fintechs: it scores 32 risk factors from inherent to residual, maps a 30-control inventory to the BSA program pillars, and rolls it up into a board summary dashboard, so every remediation item ties back to a scored risk.

Related enforcement cases:

• FinCEN’s Record $80M BSA Fine Against Canaccord Genuity: Every Broker-Dealer’s Wake-Up Call
• The OCC Just Hit American Express With a $350 Million AML Fine
• FinCEN’s AML/CFT Program Modernization NPRM: The Risk-Based Standard That Will Change How Programs Are Evaluated

External Sources

• FinCEN News Release: FinCEN Assesses Historic $125 Million Penalty Against UBS Financial Services Inc. for Recidivist BSA Violations
• American Banker: FinCEN Fines UBS $125M for Money Laundering Recidivism
• InvestmentNews: UBS Hit with $125 Million in AML Penalties as FinCEN Imposes Record Broker-Dealer Fine
• Miller Chevalier: FinCEN Imposes $125 Million Civil Penalty Against UBSFS for Continued AML Compliance Failures
• BakerHostetler: FinCEN Ups Ante on Broker-Dealer AML Obligations