Billions in AML Fines: What 2025-2026 Enforcement Actions Reveal About Weak Verification

In 2025, there was a total fine of $3.8 billion for Anti-Money Laundering (AML), Know Your Customer (KYC), Customer Due Diligence (CDD), and sanctions. While that might seem like a lot, it was an 18% decline from $4.6 billion in 2024 and the second consecutive annual decline from the $6.6 billion recorded in 2023.

2026 has also seen some tough enforcement actions, including an $80 million penalty against Canaccord Genuity and a $125 million penalty against UBS Financial Services.

This article is not to ruminate on how much regulators fine companies. Rather, it’s to unpack:

• what the companies fail to detect or correct sooner, and
• what could have been done differently.

Case Study 1: UBS Group AG — A Long-Running Investigation Ends in a ₤835 Million Resolution

UBS was accused of unlawfully soliciting wealthy French clients and helping facilitate money laundering between 2004 and 2012.

The investigation started in 2013. And in February 2019, a French court found the bank guilty. The case then moved through several appeals. But in 2023, France’s Supreme Court upheld the judgment.

On September 23, 2025, UBS fulfilled all the financial penalties and agreed to pay €730 million in fines and €105 million in civil damages, making a total of €835 million to the French state.

What UBS Failed to Detect or Correct Sooner

They failed to adequately identify and manage the risks surrounding certain customer relationships.

For a wealth-management business operating across jurisdictions, KYC is only the starting point. The institution needs to understand the customer’s residency & tax position, source of wealth, source of funds, purpose of the relationship, and expected activity.

What Could Have Been Done Differently

UBS could have strengthened its risk-based controls for cross-border and high-net-worth customers. That can include:

• Risk-based customer due diligence for cross-border clients.
• Source of wealth and source of funds verification for high-value relationships.
• Tax residency and jurisdictional risk assessment.
• Ongoing monitoring of customers whose circumstances or activities created new risk.
• Escalation procedures when customer activity conflicts with the information held by the bank.
• Senior compliance oversight of high-risk cross-border business.

Case Study 2: Canaccord Genuity — An Undersized Compliance System That Resulted in a $80 Million Fine

In March 2026, the U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN) imposed an $80 million civil money penalty on Canaccord Genuity LLC for willful violations of the Bank Secrecy Act (BSA).

FinCEN discovered that regulators had repeatedly warned the firm about its weak transaction monitoring. Canaccord committed in writing to address those weaknesses, but the problem persisted.

What Canaccord Failed to Detect or Correct Sooner

Canaccord's AML program was significantly under-resourced. Its transaction-monitoring process relied on inexperienced and inadequately trained employees.

Those employees were overwhelmed by the volume of transactions generated by poorly designed surveillance reports. They didn’t file at least 160 suspicious activity reports involving dozens of over-the-counter securities.

What Could Have Been Done Differently

Canaccord needed an AML program that matches the risk and volume of its business. That could mean:

• Conducting stronger risk-based CDD before and throughout customer relationships.
• Enforcing monitoring rules around over-the-counter securities and microwap activities.
• Employing sufficient staff who are adequately trained.
• Establishing clear procedures to investigate and track remediation to completion.
• Independent testing of solutions from time to time.

Case Study 3: UBS Financial Services — A Recurrent BSA Violation That Resulted in a $125 Million Penalty

In August 2026, FinCEN imposed a $125 million civil money penalty on UBS Financial Services Inc. for willful violations of the Bank Secrecy Act (BSA). This action followed a similar enforcement action against the firm in 2018

FinCEN found that UBSFS had failed to appropriately monitor more than 50,000 foreign currency wires worth over $10 billion.

The agency also found deficiencies in UBSFS’s customer due diligence, particularly concerning high-risk customers with ties to Russia and Latin America.

What UBSFS Failed to Detect or Correct Sooner

The earlier enforcement action had already highlighted problems with its AML controls. Yet the company didn’t fully rectify the lapses in its transaction monitoring and customer due diligence.

The company collected customers' information but didn’t follow their activities. Thus, they were unable to make effective risk decisions.

What Could Have Been Done Differently

UBSFS could have treated its earlier enforcement findings with more urgency. They could have:

• Established stronger governance over remediation commitments.
• Validated whether required customer and transaction information gets to the monitoring team.
• Conducted targeted testing of high-risk customer controls.
• Reviewed historical transactions affected by known weaknesses.
• Independently tested whether corrective measures work in practice.

Case Study 4: OKX — Unlicensed Money Transmission in the U.S. That Resulted in a $504 Million Penalty

In February 2025, OKX (a popular cryptocurrency exchange platform) pleaded guilty in the United States to operating an unlicensed money-transmitting business. The company agreed to pay more than $504 million in penalties and forfeiture.

According to the U.S. Department of Justice (DOJ), OKX had an official policy that prohibits U.S. citizens from using its platform, but the company didn’t enforce that restriction. From approximately 2018 to early 2024, U.S. customers conducted more than $1 trillion in transactions through the platform.

The DOJ also found that customers could create accounts, receive & transfer funds, and trade without completing KYC. It was discovered that some employees, in fact, assisted customers in bypassing these controls. OKX was finally accused of knowingly violating AML laws and processing more than $5 billion in suspicious transactions & illicit proceeds.

What OKX Failed to Detect or Correct Sooner

The fundamental problem was a disconnect between policy and enforcement. Asking customers to provide identity information is not meaningful KYC if the information is not independently verified.

OKX also failed to adequately monitor transactions and identify sanctions exposure, which allowed suspicious activity to occur at enormous scale before sufficient controls were implemented.

What Could Have Been Done Differently

Basically, OKX could have built a stronger verification system, such as:

• A more reliable country and residency verification rather than relying heavily on IP addresses.
• Device and behavioral intelligence to identify VPN and circumvention patterns.
• Continuous jurisdictional monitoring rather than a one-time location check.
• Mandatory KYC before customers can trade or move assets.
• Strict rules that prevent employees from overriding or bypassing compliance controls.

What These 4 Cases Have in Common

The cases look different on the surface, right?

Yet they have one common characteristic: the failure occurred somewhere between collecting information and acting on that information.

With these five systems in place, the companies would have avoided being fined:

Identity Verification

A financial institution needs an established onboarding system to verify that a customer is who they claim to be. Also, there should be systems that catch deepfake fraud before it becomes a bigger problem.

These controls matter because fraudsters can manipulate individual elements of an identity.

Customer Due Diligence

Customer due diligence takes the information collected during onboarding and turns it into a risk profile. This is where the UBS and Canaccord cases fell short.

FinCEN’s CDD Final Rule requires covered financial institutions to understand the nature and purpose of customer relationships in order to develop customer risk profiles and conduct ongoing monitoring on a risk basis.

Screening

Risk doesn’t remain static. A customer who presented a low or moderate risk during onboarding can become higher risk later. This is why screening should not be treated solely as an onboarding protocol.

The objective here is not a wild hunt for fraudsters, but to check if customers have changed their onboarding information and to check for possible risks.

Behavioral and Transaction Monitoring

A customer can pass every onboarding check and begin to make transactions that are inconsistent with their profile.

The Canaccord case is a clear example. FinCEN found that the firm’s transaction-monitoring program was inadequate and that its processes did not effectively identify or investigate suspicious activity. The firm also failed to file at least 160 suspicious activity reports connected to over-the-counter securities activity.

Remediation

Despite the controls put in place, the company may still be susceptible to fraud. The question is whether the organization identifies the problems and fixes them immediately.

The UBSFS case highlights why this matters. There was already a warning in 2018, but the bank didn’t completely address the lapses. That gave rise to the 2026 enforcement action that cost them $125 million.