On August 3, 2026, FINRA announced that it had fined UBS Financial Services $20 million for anti-money laundering violations. According to FINRA, from January 2019 through June 2023 the firm failed to reasonably monitor more than 60,000 foreign currency wires totaling over $10 billion, including wires involving high-risk geographic locations, unusually large amounts, transfers with no apparent business purpose and activity in accounts the firm had already filed suspicious activity reports on.
What makes this case worth reading for every compliance officer is not the size of the fine, but how the gaps happened.
A manual review that could not see patterns
From January 2019 to January 2021 the firm relied on a legacy process: a quarterly manual review of a report listing thousands of foreign currency wires. FINRA found that this review could not reasonably reveal suspicious or unusual patterns and often lacked information about the geographic locations involved. A long list reviewed once a quarter is not transaction monitoring. It is a reading assignment, and patterns such as repeated transfers to the same high-risk jurisdiction simply do not stand out on a spreadsheet.
An automated tool that quietly missed a third of the activity
In February 2021 the firm moved to an automated monitoring tool. That should have closed the gap, but FINRA found that an incomplete data file and a labeling change caused the tool to omit a significant share of activity, including about 33% of foreign currency wires in retail accounts approved for foreign currency spot trading. Nothing appeared to be broken. The system ran, alerts were generated, and a third of the relevant wires were never evaluated.
This is the lesson many firms miss. Automation does not end the compliance officer's responsibility; it changes it. Firms must be able to show that every data feed is complete, that changes to source data (a new field label, a new account type, a new product code) are reflected in the rules, and that someone reconciles what the surveillance system received against what the firm actually processed.
Customer risk ratings that never changed
FINRA also found that the firm did not reasonably implement its customer due diligence program for certain retail customers. It failed to timely detect and investigate risk factors such as ties to higher-risk geographies including Russia, unexplained changes in domicile or employment, adverse media and potential political exposure. As a result these customers kept lower risk ratings, which meant their transactions received less scrutiny. Risk ratings are only useful if they are updated when the customer's profile changes, and if the higher rating automatically drives tighter monitoring.
Progressive discipline
This was not the first time. In December 2018 FINRA fined the same firm $4.5 million for failing to reasonably monitor foreign currency wires, and FINRA found that those problems persisted through June 2023. FINRA's Head of Enforcement, Bill St. Louis, said the action "underscores FINRA's approach to progressive discipline, which includes escalating sanctions." Prior findings that are not fully remediated become the starting point for the next, larger penalty. UBS consented to the findings without admitting or denying them.
What firms should do now
- Reconcile surveillance data feeds against source systems on a regular schedule, and test again after any change to file formats, labels or account types.
- Replace periodic manual reviews of long reports with rules that alert on patterns: high-risk geographies, unusual size, frequency and accounts with prior SARs.
- Tie customer risk ratings to events (address, employment, adverse media, PEP status) and let a higher rating automatically tighten monitoring thresholds.
- Track every prior exam or enforcement finding to documented, tested remediation.
Using software such as Catalyst, firms can aggregate multiple data feeds under one rule base, apply risk-based rules driven by each customer's risk rating, and document alert reviews and remediation in one place, with a full audit trail for regulators.
About FinWebTech
FinWebTech is a Service as a Software (SaaS) company developing compliance automation applications for the financial services industry. Its flagship product, Catalyst, provides automated AML and trade surveillance, customer risk rating, supervisory controls and task management, trade blotter management, case management, reporting and a document library. Catalyst was designed by an industry experienced Chief Compliance Officer, for compliance.
For more information on FinWebTech and Catalyst, please contact Don Lee at don.lee@finwebtech.com or 1-800-980-0959.
Sources