On March 6, 2026, FinCEN announced an $80 million civil money penalty against broker-dealer Canaccord Genuity LLC for violations of the Bank Secrecy Act, which FinCEN described as the largest BSA penalty ever imposed on a broker-dealer. The SEC and FINRA each brought parallel actions with $20 million penalties. FinCEN credited those payments and suspended $5 million pending a lookback review of suspicious activity, leaving a net payment to Treasury of $35 million.
The firm was an active market maker in low-priced, thinly traded OTC securities, a business regulators consider high risk for pump-and-dump schemes. FinCEN found that the firm "failed to devote adequate resources to ensure compliance with the BSA," and a preliminary lookback identified at least 160 suspicious activity reports that should have been filed.
Four people, more than 100 reports
According to the public findings, until late 2021 a team of four employees, each with other duties and none with prior AML experience, was responsible for reviewing more than 100 unique surveillance reports, many run daily and producing thousands to millions of line items a year. Some reports went unreviewed for months, and in some cases years. Employees applied arbitrary thresholds to cut the volume down to something they could manage. The firm had no formal AML training before November 2021, and it often learned about customer misconduct from outside parties, such as a clearing firm refusing a transaction, rather than from its own surveillance.
No one can review a million line items. When the number of exception reports exceeds the capacity of the team, the reports stop being surveillance and become a liability: proof the firm had the data and did not act on it.
Warnings that went unaddressed
FINRA's findings describe deficiencies first identified in 2013, when FINRA recommended enhanced electronic surveillance and the firm committed in writing to corrective action. FINRA found inadequate controls again in 2016. FinCEN noted that management had "ample notice" of the problems through repeated examinations. Unresolved exam findings were treated as aggravating factors, not history.
Falsified records
The most serious finding was that when regulators came looking, required reviews had not been performed and records were falsified. The public findings state that one employee falsified nearly 400 documents in response to FINRA requests and another backdated firm policies. The firm self-reported this in 2021 and terminated the employees, but FinCEN still treated it as a significant aggravating factor. When reviews are tracked in spreadsheets and email, it is far too easy for "reviewed" to mean whatever someone types into a cell.
Customer due diligence for everyone was the same
Every customer received the same basic due diligence regardless of risk, ongoing updates were not consistently performed, and a foreign bank correspondent account was onboarded without enhanced due diligence even after concerns were raised. A risk-based program requires that higher-risk customers be identified, rated and monitored differently.
Lessons for compliance officers
- Size the AML team and tools to the business. Reviewers need AML experience, training and time that is not shared with other duties.
- Replace raw exception reports with risk-based alerts tuned to the firm's business, and document why every threshold was chosen.
- Make reviews system-recorded and time-stamped so the audit trail cannot be recreated after the fact.
- Treat every exam finding as a project with an owner, a deadline and evidence of completion.
- Apply customer risk ratings and enhanced due diligence to high-risk customers and correspondent accounts.
Catalyst was built for exactly this problem. Its rules engine turns data feeds into risk-based alerts instead of long reports, its dashboards show supervisors which alerts and tasks are open and overdue, and its case management and audit trail record who reviewed what and when. Customer risk ratings feed directly into continuous AML surveillance, so the highest-risk accounts receive the closest review. Learn more about Catalyst.
About FinWebTech
FinWebTech is a Service as a Software (SaaS) company developing compliance automation applications for the financial services industry. Its flagship product, Catalyst, provides automated AML and trade surveillance, customer risk rating, supervisory controls and task management, trade blotter management, case management, reporting and a document library. Catalyst was designed by an industry experienced Chief Compliance Officer, for compliance.
For more information on FinWebTech and Catalyst, please contact Don Lee at don.lee@finwebtech.com or 1-800-980-0959.
Sources