top of page
Joseph-Kobi-logo
Let's Build Together

The Risk of Persistent Compliance Failures in Financial Services

Aug 19
3 min read
Hands in business suits point at printed charts and a calculator on a desk, analyzing colorful graphs in a meeting.


19 August, 2026.


By Gold Igwe



In financial services, a regulatory settlement is supposed to mark the beginning of remediation. The latest enforcement action against UBS Financial Services offers a useful case study.


In December 2018, FinCEN assessed a $14.5 million penalty against UBSFS for Bank Secrecy Act violations. Among the findings were weaknesses in the firm’s automated monitoring system for foreign-currency wires. UBSFS assured FinCEN that it would remediate the underlying issues.


According to FinCEN, the problems persisted. The regulator found that UBSFS subsequently failed to appropriately monitor more than 50,000 foreign-currency wires with an aggregate value exceeding $10 billion. The firm also failed to disclose those shortcomings to FinCEN, which discovered them during a later investigation.


The deficiencies extended beyond transaction monitoring. FinCEN identified failures in customer due diligence, particularly involving high-risk customers with ties to Russia and Latin America. The investigation also found that UBSFS failed to timely report hundreds of suspicious transactions.


On August 3, 2026, FinCEN imposed a $125 million civil money penalty on UBSFS for willful violations of the Bank Secrecy Act. It was the largest penalty FinCEN had imposed against a broker-dealer for BSA violations. UBSFS admitted that it willfully violated the law.


A compliance programme is not effective simply because the required policies and controls exist. Its value is determined by whether those controls work in practice, particularly when transactions become numerous, customers become more complex, and risks are difficult to identify through routine processes.


Remediation can become a box-ticking exercise in which a regulator identifies a weakness, the institution agrees to address it, policies are updated,and the matter gradually moves into the past.


In the UBS case, however, significant aspects of the remediation were not undertaken until the regulator’s subsequent investigation was already underway, while FinCEN states that UBSFS continued to fail to monitor foreign-currency transactions well after entering the earlier settlement.


The issue is no longer simply whether an institution made a mistake, but whether management can identify a weakness, allocate the necessary resources, change the underlying process, and establish that the change is working.


As financial institutions grow, controls have to grow with them. A process that works at one level of volume, product complexity, or customer risk may not remain adequate as the institution expands, making the ability to reassess and strengthen those controls an important part of how the organisation manages growth.


Regulatory findings can therefore provide an opportunity to examine how the business actually operates, where accountability sits, and whether the systems designed to manage risk can withstand the scale and complexity of the institution. The objective should not simply be to close a regulatory finding, but to understand why the weakness occurred and whether the organisation has made the changes necessary to prevent it from recurring.


The UBS case is ultimately less about the size of a single penalty than about the consequences of allowing a known weakness to persist after an institution has committed to addressing it. When a control continues to fail despite remediation efforts, the problem extends beyond the original compliance breach and raises questions about the institution’s ability to manage risk effectively.


For financial institutions, the more important lesson is that remediation only has value when the underlying weakness has actually been addressed, and the controls can continue to work as the business evolves.



Sources


Comments

bottom of page