Regulatory Enforcement Actions: Trend & Thematic Analysis

Author

RegBrief Analytics

Published

October 9, 2026

Q3 2026 | Comprehensive Analysis of AML/Compliance Enforcement Patterns

Executive Summary

Enforcement intensified across the broad base of actions, even though the headline total fell. The period recorded 32 enforcement actions, up from 24 in the prior quarter (+33%). Of these, 27 carried monetary penalties and 5 were resolved without one, for example through consent orders or remediation undertakings. The median penalty rose 28%, from $227,700 to $291,750. Total penalties fell from $289.5 million to $199.5 million, but that comparison is misleading because both quarters are dominated by a single outlier:

  • This quarter’s outlier: UBS Financial Services Inc. accounts for $125.0 million, or 63% of the total, across four parallel actions by FinCEN, FINRA, the SEC and the CFTC. FinCEN’s $125 million penalty credits the $48 million paid to the other three agencies, so the resolution is counted once.
  • Excluding outliers in both quarters: penalties rose from $14.5 million to $74.5 million, roughly a fivefold increase.
  • Mean versus median: the $7.4 million average penalty is about 25 times the median. Most penalties remain modest, and a handful of large actions drive aggregate exposure.

The underlying signal is more actions, higher typical penalties, and a materially heavier mid-to-upper tier of fines.

The US remained the center of financial exposure. Actions came from 12 regulators across 6 jurisdictions.

  • United States: 11 actions and $177.1 million in penalties. Excluding UBS, US penalties of about $52.1 million still represent roughly 70% of the outlier-excluded total.
  • Netherlands: the second most active jurisdiction, with 7 actions and $13.4 million in penalties. A single $9.2 million action accounts for about two-thirds of that amount.
  • United Kingdom: one significant action of $6.1 million.

Institutions should not assume that their exposure is confined to a single primary regulator.

The compliance weaknesses are systemic rather than technical. The 208 findings average about 6.5 per action, which indicates broad program breakdowns rather than isolated lapses.

  • AML program governance was the most frequently cited theme, with 54 findings affecting 21 of 32 entities (66%).
  • KYC and onboarding (46 findings) and investigations and reporting (46 findings) were each cited at roughly 20 entities.
  • Transaction monitoring had 45 findings concentrated in 15 entities, about 3.0 per entity. Where monitoring fails, it tends to fail in several ways at once.
  • Sanctions screening was less frequent, with 17 findings across 7 entities, but carries outsized legal risk.
  • Root causes: process design flaws (45.2%) and governance failures (25.0%) together explain over 70% of findings. Information siloing (8.2%), data quality (7.2%) and resource constraints (5.3%) trail well behind. Regulators are mainly penalizing poorly designed controls and weak oversight, not underfunding or isolated data defects.

Implications for financial institutions. Rising action counts, a higher median and a sharp increase in outlier-excluded penalties together indicate a tightening environment. Recommended priorities:

  1. Run end-to-end process design reviews of onboarding, alert handling and SAR/STR workflows, rather than tuning individual controls.
  2. Strengthen governance evidence, including board and senior management reporting, clear first- and second-line accountability, and documented challenge. Regulators are clearly testing these areas.
  3. Plan for multi-regulator scrutiny. Map obligations across overlapping supervisors such as FinCEN, NYDFS and CFTC in the US and DNB in the Netherlands.
  4. Take non-monetary outcomes seriously. Consent orders and remediation mandates often bring multi-year monitoring and lasting operational cost even without a fine.

Institutions with fragmented data or siloed investigation functions should treat these as aggravating factors. Such weaknesses tend to amplify findings in governance and transaction monitoring.

Dataset Overview

This analysis examines 32 regulatory enforcement actions issued in Q3 2026, with sanctioned activity spanning 2016–2026. The dataset covers multiple jurisdictions and financial services sectors and includes detailed compliance findings1, root cause analysis, and remediation roadmaps.

Key Statistics

  • Total Enforcement Actions: 32 (27 with monetary penalties, 5 non-monetary resolutions)
  • Total Penalties Imposed: $199,549,361
  • Median Penalty: $291,750
  • Average Penalty: $7,390,717
  • Penalty Range: $12,043 - $77,000,000
  • Countries Represented: 6
  • Regulators Involved: 12
  • Industry Sectors: 8
WarningOutlier-adjusted view

A small number of firms dominate the headline total: UBS Financial Services Inc. ($125,000,000, 63% of total). Excluding this firm, total penalties across the remaining 28 actions are $74,549,361 (median $291,750). The distribution and per-country/per-regulator charts below are read with this concentration in mind.

NoteParallel penalties counted once

FinCEN’s $125M penalty credits the $48M paid to FINRA, SEC and CFTC, so UBS’s combined penalty is $125M. Of the $77M payable to FinCEN, $15M (due by 31 May 2028) may be waived to the extent UBS incurs qualifying AML Program Review expenses, so UBS’s total cost could be as low as $110M. All totals, shares and tables in this report count the $48M of credited parallel payments once, so the crediting agency’s figures show its net amount.

Monetary Penalties Analysis

Total Penalties by Country/Region

The geographic distribution of penalties reveals significant concentration in specific jurisdictions, with enforcement intensity varying considerably across regions.

Figure 1: Total monetary penalties by country

Chart excludes 1 outlier action(s) — UBS Financial Services Inc. ($125.0M) — to keep the remaining bars legible. Full totals are in the summary table.

Regional Penalties Summary Table

Table 1: Summary of penalties by country
Total Penalties Average Penalty Max Penalty Number of Actions
country
US $177,117,994 $17,711,799 77000000.00 11
Netherlands $13,442,924 $2,240,487 9208050.00 7
UK $6,116,710 $6,116,710 6116710.24 1
France $1,408,290 $1,408,290 1408290.00 1
Canada $1,235,950 $154,494 493777.35 8
Germany $227,493 $227,493 227493.00 4

Penalties by Regulator

Different regulatory bodies demonstrate varying enforcement approaches and penalty magnitudes.

Figure 2: Total penalties by regulatory authority

Chart excludes 1 outlier action(s) — UBS Financial Services Inc. ($125.0M) — to keep the remaining bars legible. Full totals are in the summary table.

Regulatory Insights

Regional and regulatory enforcement intensity. The typical action this period was modest. The median penalty was $291,750. Excluding the outlier, total penalties were $74.5M across 23 monetary actions, an average of about $3.2M. The headline $199.5M total is skewed by a single resolution: FinCEN’s $125M penalty against UBS Financial Services Inc., which accounts for about 63% of all penalties. FinCEN credits the $48M UBS paid in parallel to FINRA ($20M), the SEC ($20M) and the CFTC ($8M), so those payments are part of the $125M rather than additional to it. Including UBS, the mean is $7.4M, about 25 times the median. Even without UBS, the distribution remains top-heavy. NYDFS’s $50M action makes up about 67% of the outlier-excluded total. The US produced 11 of 32 actions and about $52.1M of the $74.5M outlier-excluded total.

Outside the US, enforcement is frequent but low-value. The 21 non-US actions total about $22.4M, which is about 30% of the outlier-excluded total.

  • FINTRAC (Canada): the most active regulator, with 8 actions averaging about $154K and none above $494K.
  • DNB (Netherlands): 7 actions, driven by one $9.2M penalty that makes up about 68% of the Dutch total.
  • OFSI (UK): one $6.1M sanctions penalty, which stands out as a single-action signal.
  • BaFin (Germany): 4 actions, of which only one was monetary ($227K).

Five actions carried no fine: 3 from BaFin, 1 from DNB and 1 from the OCC. Such actions typically take the form of consent orders, remediation mandates or orders requiring corrective measures. They still impose substantial cost and supervisory scrutiny, so the monetary figures understate overall enforcement pressure.

Implications for multi-jurisdiction compliance programs. The data shows two different risk profiles.

  • US: severity risk. A few large, multi-agency penalties (FinCEN, NYDFS, SEC, FINRA, CFTC) dominate. A single control failure can lead to eight- or nine-figure exposure, often from several regulators at once. Programs should invest heavily in BSA/AML and sanctions controls for US-nexus business. They should also plan for coordinated, multi-regulator resolutions.
  • Canada, Netherlands and Germany: frequency risk. Regulators bring many actions with small fines, a high share of non-monetary resolutions, and occasional sharp penalties such as DNB’s $9.2M. Reporting timeliness, KYC file quality and remediation follow-through matter more here than catastrophic loss scenarios. Repeated findings can escalate into supervisory restrictions or public naming.
  • UK: OFSI’s $6.1M penalty shows that sanctions enforcement is active outside the US.

Global programs should set common baseline standards for sanctions screening and transaction monitoring across all entities. They should also size local resources by regulator behavior rather than by headline penalty totals. Finally, remediation commitments made under non-monetary orders should be tracked as closely as financial exposure, because unmet commitments are a common path to later monetary penalties.

Penalties by Industry Sector

Figure 3: Total penalties by industry sector (USD)

Chart excludes 1 outlier action(s) — UBS Financial Services Inc. ($125.0M) — to keep the remaining bars legible. Full totals are in the summary table.

Industry Insights

Where the money is: broker-dealers and banks. The 32 actions in the dataset total about $199.5M in penalties, and two sectors account for almost all of it. Broker-Dealer / Investment Firm leads with $125.6M, or 63.0% of the total, from only 8 actions (25% of the count). UBS’s four parallel actions are counted once at $125M, because FinCEN’s penalty credits the $48M paid to FINRA, the SEC and the CFTC. Banking / Financial Institution has the most actions at 11 (34%) but contributes $66.1M (33.1%). Together these two sectors produce 96.1% of penalty value from 59% of actions. The other six sectors account for 13 actions (41% of the count) but only about $7.8M (3.9%). FinTech / Payments is the largest of these at $5.5M across 4 actions. The single Individual action, at $1.4M, exceeds the combined penalties of Gaming, Trust/CSP, Corporate and Real Estate (about $836K across 8 actions). Count and value therefore diverge sharply. Banks attract the most frequent enforcement, but broker-dealers attract the heaviest financial consequences.

Average penalties: a steep, tiered structure. Average penalties2 fall into three clear tiers:

Tier Sector Average penalty
Top Broker-Dealers ~$17.9M
Middle Banks ~$8.3M
Lower FinTech ~$1.4M
Lower Individual ~$1.4M
Lower Gaming ~$205K
Lower Trust/CSP ~$68K
Lower Corporate ~$61K
Lower Real Estate ~$24K

The broker-dealer average is about twice the banking figure and about 13 times FinTech. The overall average across monetised actions is about $7.4M, but that number is misleading because it is pulled up by the broker-dealer tier.

The data also suggests that within the top two sectors, penalties are probably concentrated in one or two large settlements rather than spread evenly. Confirming that would need case-level figures or medians.

In the lower tiers, the gaming and DNFBP figures (trust/CSP, corporate, real estate) are consistent with a regime of frequent, modest fines. Their sample sizes of 1–3 actions are too small to support firm conclusions.

Implications for compliance investment by sector:

  • Broker-dealers and investment firms: prioritise controls whose failure produces outsized penalties. These include transaction and trade surveillance, AML monitoring for securities activity, and investigations and SAR reporting. A single failure in this sector can cost tens of millions, so investment should be judged by penalty severity rather than how often enforcement occurs.
  • Banks: face high frequency and substantial penalties together, so the case is for broad, programme-wide maturity across KYC, monitoring, screening and reporting. Repeated mid-eight-figure actions point to systemic weaknesses rather than isolated gaps.
  • FinTech / Payments: current penalties are modest, but this is the most likely sector to move up the tiers. Firms are scaling quickly and supervisors are increasingly applying bank-equivalent expectations to them. Building controls ahead of that shift is cheaper than fixing them after enforcement.
  • Gaming, Trust/CSP, Real Estate and Corporate: these sectors carry low penalty exposure in this dataset. Their compliance investment can focus on baseline obligations (customer due diligence, beneficial-ownership checks, suspicious activity reporting) and on reputational and licensing risk. The non-monetary actions here may carry more consequence than the fines suggest.
  • The Individual action: a $1.4M penalty against a person signals continued regulatory appetite for personal accountability. This argues for investment in senior-manager accountability frameworks and documented decision-making in every sector, not only the high-penalty ones.

Compliance Theme Analysis

This section examines the frequency and distribution of compliance failures across key AML/compliance domains.

Theme Frequency Overview

Figure 4: Compliance findings by domain

Theme Frequency Table

Table 3: Detailed breakdown of compliance themes
Number of Findings Number of Entities
domain_display
AML Program Governance 54 21
KYC & Onboarding 46 20
Investigations & Reporting 46 19
Transaction Monitoring 45 15
Sanctions Screening 17 7

Multi-Domain Violation Patterns

Compliance failures often span multiple domains. Understanding which domains tend to fail together helps identify systemic weaknesses.

Table 4: Co-occurrence of compliance domain failures
Unnamed: 0 Domain 1 Domain 2 Co-occurrences
0 0 KYC & Onboarding Transaction Monitoring 14
1 1 Investigations & Reporting KYC & Onboarding 14
2 2 Investigations & Reporting Transaction Monitoring 12
3 3 KYC & Onboarding Sanctions Screening 6
4 4 Sanctions Screening Transaction Monitoring 5
5 5 Investigations & Reporting Sanctions Screening 5

Theme Pattern Insights

Most problematic domains. AML Program Governance is the most pervasive failure area, with 54 findings across 21 entities. It is both the most common and the broadest weakness in the dataset, which suggests that many enforcement actions stem from structural problems rather than isolated control breakdowns. Typical examples are inadequate board oversight, under-resourced compliance functions and ineffective independent testing. KYC & Onboarding (46 findings, 20 entities) and Investigations & Reporting (46 findings, 19 entities) follow closely.

Transaction Monitoring has fewer affected entities (15), but its failures run deepest. It averages 3.0 findings per entity, against roughly 2.3–2.6 for the other domains. Institutions that fail at monitoring tend to fail in several ways at once, such as: - poorly calibrated scenarios - coverage gaps across products or channels - alert backlogs - unvalidated models

Sanctions Screening is the least frequent theme (17 findings, 7 entities). It should not be deprioritized on that basis, because sanctions violations typically carry strict-liability exposure and outsized penalties relative to their frequency.

Multi-domain failure patterns. The co-occurrence data shows a tightly coupled failure chain running from onboarding through monitoring to reporting: - KYC and monitoring: 14 of the 15 entities with Transaction Monitoring findings (93%) also had KYC findings. Monitoring failures almost never occur without upstream customer due diligence failures. Incomplete customer risk ratings, missing expected-activity profiles and stale beneficial ownership data starve monitoring of the context it needs to segment customers and set thresholds. - KYC and reporting: 14 of the 19 entities with Investigations & Reporting findings (74%) also had KYC deficiencies. - Monitoring and reporting: 12 of the 15 monitoring-deficient entities (80%) also had reporting deficiencies. Weak alert generation and thin customer files translate directly into poor investigation quality, late SAR filings and inadequate narratives. - Sanctions and KYC: 6 of the 7 entities with sanctions findings (86%) also had KYC gaps. This points to shared root causes, chiefly poor customer and counterparty data quality, incomplete ownership and control information, and screening lists applied to unreliable underlying records.

The practical implication is that regulators are increasingly treating these as program-level failures. Fixing one domain in isolation, for example by retuning monitoring scenarios without remediating customer data, is unlikely to satisfy examiners or prevent repeat findings.

Prioritization recommendations. 1. Fix governance first, because it determines whether every other remediation sticks. - Confirm the BSA/AML Officer has adequate authority, staffing and budget. - Establish board-level MI covering alert backlogs, KYC refresh completion, SAR timeliness and open issues. - Make sure independent testing covers the integration points between domains as well as each domain on its own. 2. Treat KYC as the foundation of the program and invest there before or alongside monitoring. - Prioritize customer risk rating methodology, refresh of high-risk files and capture of beneficial ownership. - Feed customer risk ratings and expected-activity attributes directly into monitoring segmentation and thresholds, with documented data lineage between the two. 3. Manage the alert-to-SAR pipeline as a single process with end-to-end metrics. - Track time from alert to case to filing, and quality-assure investigation narratives. - Use feedback loops so that SAR outcomes inform scenario tuning. 4. Ring-fence sanctions controls despite their lower frequency. - Validate screening coverage across all payment and onboarding channels. - Test fuzzy-matching calibration. - Leverage KYC data remediation to strengthen ownership-based screening, such as the 50% rule.

Institutions with limited remediation capacity should sequence the work as governance, then KYC data, then monitoring and investigations together. The co-occurrence data indicates that improvements upstream will compound benefits downstream.

Priority Distribution by Domain

The severity of compliance gaps varies across domains, with different distributions of high, medium, and low priority findings.3

Figure 5: Gap priority distribution across compliance domains

Root Cause Analysis

Understanding the underlying causes of compliance failures is critical for effective remediation.

Overall Root Cause Frequency

Figure 6: Top root causes of compliance failures

Root Cause Summary Table

Table 5: Complete root cause frequency distribution
Frequency Percentage
root_cause
Process Design Flaw 94 45.2
Governance Failure 52 25.0
Information Siloing 17 8.2
Data Quality Issues 15 7.2
Resource Constraints 11 5.3
Insufficient Technology 9 4.3
Cultural/Tone Issues 7 3.4
External Factors 2 1.0
Third-party dependency (Resource Constraints) 1 0.5

Root Causes by Compliance Domain

Different compliance domains exhibit distinct root cause patterns.

Table 6: Cross-tabulation of root causes by compliance domain
Cultural/Tone Issues Data Quality Issues External Factors Governance Failure Information Siloing Insufficient Technology Process Design Flaw Resource Constraints Third-party dependency (Resource Constraints)
domain_display
AML Program Governance 6 1 2 25 3 0 12 4 1
Investigations & Reporting 1 1 0 10 9 0 23 2 0
KYC & Onboarding 0 4 0 6 4 0 32 0 0
Sanctions Screening 0 1 0 4 1 2 7 2 0
Transaction Monitoring 0 8 0 7 0 7 20 3 0

Root Cause Insights

Penalty context and systemic root causes. Enforcement intensity this period is best read through the median penalty of $291,750 and the outlier-excluded total of $74.5 million across the remaining 23 monetary actions (about $3.2 million on average). UBS Financial Services Inc.’s $125 million resolution alone accounts for about 63% of the $199.5 million headline total and more than doubles the overall average to $7.4 million. Even without UBS, the average is about 11 times the median, so most actions resulted in modest fines and a few large cases carried most of the monetary weight. Five of the 32 actions (about 16%) had no monetary penalty. These resolutions typically impose remediation, independent review or lookback obligations, which can be more costly and longer-lasting than a mid-sized fine. Across all actions, two root causes dominate:

  • Process design flaws account for 45.2% of attributed failures.
  • Governance failures account for 25.0%.

Aggravating & Mitigating Factors

Enforcement documents record factors that intensified regulatory concern (aggravating) or earned credit (mitigating). Aggregated across all actions, these reveal what behaviours regulators penalise most and what most reliably reduces exposure.

Table 7: Recorded aggravating vs mitigating factors
Factor Entries Actions
factor_type
aggravating 120 25
mitigating 79 19

Across the roughly dozen actions in this set, the most pervasive aggravating theme is a failure to detect and report suspicious activity that monitoring systems should have caught. It features in about half the cases:

  • the self-clearing broker-dealer that never reviewed red-flag wires;
  • RBC’s three ineffective monitoring rules;
  • the four unreported transactions and the alert backlog flagged by FINTRAC;
  • UBSFS’s 61,500 unmonitored foreign-currency wires totalling over $10.5 billion;
  • MFBV’s undetected flows to high-risk countries;
  • the undetected options spoofing.

This failure usually compounds a second theme, exposure to elevated-risk geographies or customer types. Examples are FATF grey-list and offshore customers, foreign correspondent and virtual-currency relationships, MoneyGram’s cash-funded transfers to higher-risk countries, Russia- and Venezuela-linked accounts, and the inherently high-risk trust services at Erez.

Multi-year persistence appears in about five actions: RBC, the Dini sales lasting over two years, the Iranian software investor, MFBV, and UBSFS.

The most damaging theme, however, is ignored prior warnings, which is explicit in roughly a third of cases. It includes:

  • the Texas bank’s 2024 cease-and-desist order;
  • MoneyGram’s unimplemented 2019 commitment;
  • UBSFS’s repeat of failures already covered by FinCEN’s 2018 consent order;
  • Erez’s continued breaches after DNB’s 2021 instruction.

Knowledge or intent aggravates the sanctions cases in particular. Dini acted with reckless disregard, and the Iranian individual acted wilfully despite decades of sector experience.

Lack of self-disclosure is rarely cited as an aggravator by name, appearing only at UBSFS, where management knew automation would be delayed but neither told FinCEN nor added interim controls. Quantified real-world harm is likewise cited in only about three cases: the $10.5 billion at UBSFS, and the economic benefit to Iranian commercial and state-linked entities in the two OFAC matters.

On the mitigating side, remediation and control enhancement is nearly universal, appearing in around eight actions. Examples include:

  • the broker-dealer’s programme from August 2023;
  • RBC’s periodic rule assessments;
  • MoneyGram’s revised thresholds and new scenarios;
  • Rice Lake’s distributor vetting and invoice warnings;
  • MFBV’s rebuilt monitoring and partner oversight;
  • CCV’s new remediation plan.

How much credit remediation earns depends heavily on timing and specificity. DNB gave MFBV a 10% reduction and CCV 15% for a concrete plan already being executed, yet gave CCV nothing for a SIRA plan begun before the inspection. FinCEN noted that UBSFS’s lookbacks were “delayed.” Exiting risky relationships is a related and well-received pattern: UBSFS restricted Russia-linked clients, MFBV terminated three outsourcing partners before the investigation, Rice Lake cut off its UAE distributor, and the Iranian investor abandoned his stakes before learning of the probe.

Cooperation is credited in about four cases, including UBSFS’s productions and presentations, Rice Lake’s tolling agreement and MFBV’s constructive attitude. DNB explicitly refused CCV any credit, however, because CCV did only what the law required. Settlement and acceptance produced the cleanest discount, a 15% simplified-settlement reduction for MFBV. A clean five-year history helped Rice Lake, the individual and CCV.

Self-reporting is strikingly rare. CCV’s partial disclosure of an auditor report earned only 5%, and Rice Lake acted on a tip rather than self-reporting. The remaining credits were procedural or proportionality-based: DNB’s 10% cut for its own year-long delay, a shortened violation period that downgraded CCV’s breach from “very serious” to “serious”, Rice Lake’s small share of sales, and the individual’s documented inability to pay.

The practical lesson is that regulators punish broken promises more than original failures. The cases that drew recidivism framing (UBSFS, MoneyGram, Erez and the Texas bank) all involved a firm that had already been told about a gap, or had committed to fix it, and then let it persist without informing the regulator. In the UBSFS case this was paired with explicit findings that disclosure was neither timely nor voluntary.

Conversely, the credit that most reliably converts into a measurable penalty reduction comes from three things:

  • Documented remediation actually under way when the regulator assesses the case.
  • Early exit from high-risk relationships, ideally before an investigation begins.
  • Formal acceptance of findings.

Cooperation that merely meets legal obligations, or remediation that is late or only planned, earns little or nothing. Firms facing a known deficiency should therefore treat any prior commitment as a hard deadline. If they cannot meet it, they should tell the regulator proactively and put interim compensating controls in place, since that silent gap is precisely what turned UBSFS’s case from a monitoring failure into a recidivism finding.

Additional Thematic Analyses

Penalty Severity vs Root Cause

Examining whether specific root causes correlate with higher penalties can inform prioritization.

Total Allocated Penalty by Root Cause (Top 8)

Penalties allocated proportionally across findings by priority weight (high=3, medium=2, low=1).

  • Process Design Flaw: $66,800,806 (72 findings across 26 actions)
  • Governance Failure: $48,951,054 (44 findings across 23 actions)
  • Information Siloing: $37,224,788 (15 findings across 11 actions)
  • Data Quality Issues: $22,189,581 (14 findings across 11 actions)
  • Cultural/Tone Issues: $16,169,594 (7 findings across 5 actions)
  • Insufficient Technology: $4,893,554 (7 findings across 7 actions)
  • Resource Constraints: $1,985,837 (8 findings across 7 actions)
  • External Factors: $1,315,436 (1 findings across 1 actions)

Temporal Patterns

Violation Period Statistics

  • Average violation duration: 1170 days
  • Median violation duration: 1152 days
  • Longest violation period: 2797 days
  • Shortest violation period: 355 days

Strategic Actions by Root Cause

For the three most frequent root cause categories, following are some strategic actions that can be taken to prevent such lapses occurring at your institution. Strategic actions for remaining root causes are in the [Appendix: Strategic Actions — Additional Root Causes].

Governance Failure

  1. Establish a Board-Accountable Remediation and Commitment Office: Create a dedicated program office that combines audit findings, issue logs, supervisory letters and regulatory commitments in a single GRC-tracked register. Each item gets a named executive owner, remediation progress is tied to executive performance goals and remuneration, and Internal Audit tests that closed items are actually fixed. This stops missed lookbacks, repeat findings and silent timeline slippage, and makes regulator communication proactive when timelines change.
  2. Implement a Living, Data-Driven Enterprise Risk Assessment Linked to Controls: Replace static periodic assessments with a quantitative risk framework (e.g., EWRA/SIRA) driven by KRIs. Refresh it at least annually and whenever trigger events occur, such as new products, channels, geographies or regulatory changes, and map it directly to policies, customer risk models, monitoring scenarios and testing. Board-level dashboards on inherent risk, residual risk and coverage gaps keep the control environment aligned with the real risk profile as the business changes.
  3. Institute Independent Model, Data and Control Assurance Under a Three-Lines Model: Formalize model-risk governance for monitoring and screening systems, covering scenario effectiveness testing, change approval, drift and anomaly monitoring, and data lineage. Place AML data within enterprise data governance, with schema-change detection and quality KPIs. Support all of this with a risk-based independent testing program whose independence is safeguarded and whose findings reach the board directly, so control decay and data defects are caught internally before an examination finds them.

Information Siloing

  1. Build a Unified Customer Risk Profile and Ownership Graph: Combine onboarding data, advisor and relationship notes, adverse media, alerts, investigations, restrictions and external registry data into a single client-risk view shared across AML, sanctions, payments and operations teams. Use the view to recalculate risk ratings automatically and to propagate designation or ownership changes to all linked entities. This ensures no team acts on an incomplete picture of customer risk.
  2. Consolidate the Suspicious-Activity Lifecycle into One Auditable Case Environment: Integrate monitoring alerts, screening hits, partner and fraud escalations, law-enforcement requests and FIU/SAR decisions into a single investigation record. The record should carry role-based escalation, a full decision audit trail and SAR quality assurance. This removes fragmented evidence, speeds reporting and gives defensible decisions to examiners.
  3. Formalize Cross-Functional Feedback Loops and Regulatory-Inquiry Coordination: Set up governed forums with SLAs and metrics linking AML, the FIU, KYC, surveillance, advisory and operations, so case outcomes and regulatory feedback update typologies, triggers and customer ratings. Open a privileged central case file for every regulatory inquiry, and require business-unit attestations on the duty to supplement or correct submissions. This ensures institutional knowledge consistently reaches regulators and decision-makers.

Process Design Flaw

  1. Deploy Perpetual KYC with a Dynamic, Governed Customer Risk Engine: Move from calendar-based reviews to continuous risk scoring driven by profile, behavioral, transactional, registry and adverse-media signals. Alert dispositions should feed back into risk ratings and automatically trigger EDD. Track refresh-timeliness KPIs and plan analyst capacity from forecasts so review backlogs cannot build up.
  2. Re-Architect Monitoring as a Model-Governed, Risk-Segmented Framework with Verified Data Completeness: Run transaction, sanctions and trade surveillance from a governed scenario inventory calibrated to the institution’s actual typologies and customer segments. Validate it independently with below-the-line and outcome testing on a regular tuning cycle. Back the framework with end-to-end pipeline observability, lineage and completeness attestations by product, which closes the coverage gaps caused by dropped records, partial wire data and static thresholds.
  3. Implement an End-to-End Integrated Investigations and Obligations Platform: Connect alert intake, law-enforcement and production orders, evidence, QA sampling and regulatory filings in a closed-loop workflow. The platform should enforce mandatory approvals and keep immutable decision logs and aging dashboards. Pair it with a GRC system that maps legal obligations to procedures, controls, testing and accountable owners, so reportable cases and regulatory requirements are tracked to completion rather than handled manually.

AI Investment Themes

AI opportunities identified in enforcement actions are mapped directly to the root causes that drove each violation. For the three most frequent root cause categories, the three highest-impact AI use cases are surfaced below, followed by an investment reference table. Use cases for remaining root causes are in the [Appendix: AI Use Cases — Additional Root Causes].

Top Use Cases by Root Cause

Process Design Flaw

Missing controls, poor workflow design, or inadequate compliance procedures.

  1. (PD-1) Use a governed knowledge graph to map products, systems, client segments, geographies, controls, incidents, and regulatory obligations; flag changes requiring AML/ATF risk assessment. Technology: Graph-Based Learning, Process Automation, Decision Support, Explainable AI

  2. (PD-2) Perpetual KYC event detection. Monitor adverse media, registry changes, ownership changes and transactional behavioural drift to trigger targeted refreshes. Use a workflow-orchestration layer to automate outreach, tracking and escalation. Technology: Pattern Recognition, Natural Language Processing, Predictive Analytics, Process Automation, Explainable AI

  3. (PD-3) Deploy a human-in-the-loop investigation copilot that assembles case timelines, identifies missing evidence, summarizes transaction and customer inconsistencies, drafts report narratives, and flags aging cases. Technology: Process Automation, Natural Language Processing, Generative AI, Decision Support, Explainable AI

Governance Failure

Weak oversight, unclear accountability, or insufficient board/senior management engagement.

  1. (GF-1) NLP extraction of obligations and commitments from AWCs/exam findings into a tracked commitments register with automated milestone monitoring and slippage alerts. Technology: Natural Language Processing, Process Automation, Predictive Analytics

  2. (GF-2) Privacy-compliant monitoring of internal communications on open regulator matters, using NLP to detect red-flag language (such as scope removal to avoid attention) and disagreement between staff and leadership. It routes alerts to the audit committee or an independent oversight function. Technology: Natural Language Processing, Decision Support, Explainable AI

  3. (GF-3) Use control-evidence analytics to compare required workflow steps against completed records, detect recurring procedure deviations, and prioritize QA testing by risk and defect patterns. Technology: Pattern Recognition, Predictive Analytics, Explainable AI, Process Automation

Information Siloing

Relevant facts known internally but not shared with compliance, counsel, or decision-makers.

  1. (IS-1) Knowledge graph of corporate ownership combining KYC, registry and adverse data to propagate designation exposure to subsidiaries, with link prediction for undisclosed relationships. Technology: Graph-Based Learning, Pattern Recognition, Natural Language Processing

  2. (IS-2) Deploy a human-in-the-loop investigation assistant to assemble transaction timelines, linked-account evidence, applicable red flags, and draft case summaries for analyst review and SAR decision support. Technology: Process Automation, Natural Language Processing, Generative AI, Explainable AI

  3. (IS-3) Use NLP to extract entities, allegations, dates, jurisdictions, and source reliability from adverse-media articles, then present evidence summaries and comparable prior dispositions to reviewers. Technology: Natural Language Processing, Process Automation, Decision Support, Explainable AI

Investment Reference Table

Table 8: AI use case investment reference — expected benefit, ROI, and key risks
  Expected Benefit Estimated ROI Risks
Use Case      
PD-1 Improves traceability between business changes, risk factors, mitigating controls, and required approvals. 18+ months; value arises from stronger assurance, reduced missed assessments, and reusable risk-control traceability. Incomplete inventories can produce false assurance; Complex integration and ongoing maintenance burden; Human governance remains necessary for risk acceptance decisions
PD-2 Shifts from periodic to event-driven, risk-based refreshes, so data stays current and unnecessary refreshes fall. Gives an audit trail of why each refresh was triggered. Not quantifiable from the source; benefits accrue over 12-24 months through lower manual effort and recurrence risk. False negatives could miss changes that need a refresh; Alert volume from noisy triggers; Vendor dependency and integration burden; Regulatory acceptance of event-driven refresh as a replacement for fixed cycles needs confirmation
PD-3 Reduces manual evidence gathering and narrative preparation while improving consistency, completeness, and timeliness of escalation decisions. 6-12 months; meaningful reduction in investigation administration, subject to mandatory human review. Compliance Risk: Generated narratives may omit, overstate, or hallucinate facts; human approval is mandatory.; Privacy Risk: Customer data requires strict access, retention, and vendor controls.; Model Risk: Recommendations must be explainable and cannot determine whether to file autonomously.
GF-1 Improves visibility of regulatory commitments and early warning of delays. Low cost; benefit mainly risk reduction; payback hard to quantify. Extraction errors requiring legal review; AI does not substitute for governance accountability
GF-2 Earlier detection of attempts to narrow or conceal responses, and escalation to independent governance bodies before a response is filed. Qualitative: acts as a deterrent control; hard to quantify, payback typically >18 months Employee privacy and labor-law concerns; False positives and chilling effects on candid internal discussion; Reputational risk of perceived surveillance
GF-3 Provides earlier visibility into policy-application failures and focuses second-line testing on higher-risk control breakdowns. Potential 6-18 month payback through reduced manual QA effort and earlier remediation of repeat defects. Poor workflow data can create misleading control-effectiveness conclusions; Detection models may miss novel failure patterns; Control owners may treat risk scores as substitutes for formal testing; Ongoing model monitoring is needed to detect drift
IS-1 Complete, quickly generated exposure maps covering aggregated ownership and control. nan Incomplete or stale registry data; False inferred links; Data privacy
IS-2 Reduces manual evidence gathering, improves case-file completeness, and gives investigators consistent red-flag and escalation prompts. 6-18 month payback potential through faster case preparation and improved quality assurance; no autonomous SAR-decisioning ROI should be assumed. Generated summaries may omit, misstate, or overstate evidence; Sensitive customer and suspicious-activity information requires strict access, retention, and vendor controls; The tool must not autonomously decide whether to file a SAR; Audit trails are required for source evidence, prompts, reviewer edits, and final decisions
IS-3 Accelerates evidence gathering and creates more consistent, audit-ready alert case files without automating final sanctions decisions. Potential 30-50% reduction in first-pass alert research time; final match adjudication should remain human-controlled. Hallucinated or incorrectly summarized adverse-media content; Source-quality and language-translation errors; Compliance risk if users treat AI summaries as final determinations; Vendor and data-residency dependency

Appendix

Priority Level Definitions

Priority levels are assigned using a deterministic decision tree applied during document extraction:

  • High — penalty >$10M attributable to this gap; regulator labelled the conduct “egregious”; gap enabled actual illegal activity; or criminal referral was made
  • Medium — significant control weakness attracting explicit regulatory criticism; contributed to the penalty but was not the primary driver
  • Low — documentation or procedural gap only; technical non-compliance with no evidence of exploitation

Data Sources

Currency note: Q3 2026 penalty amounts are recorded in each regulator’s native currency (CAD, EUR, GBP, SGD, USD) and converted to USD at run time via rates.json (the pipeline is run without --amounts-in-usd). This differs from Q2 2026, whose amounts arrived pre-converted to USD. All dollar figures in this report are therefore USD equivalents at the rates.json rates.

Coverage note: Q3 2026 combines actions captured by the RegBrief n8n workflows (July 1 – September 30, 2026) with 16 AML actions identified in a post-quarter capture audit and analyzed with the same prompt, including the separate FINRA, SEC and CFTC orders in UBS Financial Services’ coordinated resolution alongside FinCEN’s.

  • Primary Data: Regulatory enforcement action records (regbriefsQ32026.csv)
  • Fields Analyzed: Entity, regulator, industry, penalty amounts, violation periods, findings by domain, root causes, priorities
  • Time Period: 2016-2026
  • Geographic Coverage: 6 countries, 12 regulators

Source Documents

Entity Regulator Source Document(s)
Beta Capital Securities LLC d/b/a Creand Securities FINRA [1]
ABN AMRO Bank N.V. DNB [1]
United Texas Bank, N.A. OCC [1]
RBC Capital Markets, LLC FINRA [1]
MoneyGram International SA ACPR [1]
UBS Financial Services Inc. FinCEN [1]
Rice Lake Weighing Systems, including Italian subsidiary Dini Argeo S.r.l. OFAC [1]
New Brunswick Lotteries and Gaming Corporation FINTRAC [1]
Nova Scotia Gaming Corporation FINTRAC [1]
U.S. Person-1 OFAC [1]
Erez Corporate Service B.V. DNB [1] [2]
Caisse populaire acadienne ltée (also operating as UNI Financial Cooperation) FINTRAC [1]
Pathwise Credit Union FINTRAC [1]
Your Neighbourhood Credit Union Limited FINTRAC [1]
Caisse populaire Alliance limitée (operating as Caisse Alliance) FINTRAC [1]
Modulr Finance B.V. DNB [1]
AOS, Inc. dba TradingBlock (CRD #128605, Chicago, Illinois) FINRA [1]
VIP Realty Inc. (also operating as Royal LePage Integrity Realty Inc.) FINTRAC [1]
Atlantic Lottery Corporation Inc. (also operating as Atlantic Lottery) FINTRAC [1]
CCV Group B.V. (referred to as CCV Netherlands B.V. in the source article) DNB [1]
CCV Group B.V. DNB [1] [2]
Swedbank AB (publ) and Swedbank AB, New York Branch NYDFS [1]
Landesbank Hessen-Thüringen Girozentrale (Helaba) BaFin [1]
Norddeutsche Landesbank Girozentrale (Nord/LB) BaFin [1]
Cadence Growth Capital GmbH BaFin [1]
Volksbank Düsseldorf Neuss eG BaFin [1]
International Trust Services B.V. (ITS) DNB [1]
Erez Corporate Service B.V. DNB [1] [2]
Citibank, N.A., London Branch (CBNA London) OFSI [1]
UBS Financial Services Inc. FINRA [1]
UBS Financial Services Inc. SEC [1]
UBS Financial Services Inc. CFTC [1]

Report Generated: 2026-10-09 05:56:12

Report Period: Q3 2026

Footnotes

  1. Findings are discrete compliance gaps identified within each enforcement action document. Each enforcement action may contain multiple findings across one or more compliance domains.↩︎

  2. Averages are calculated only over actions that carry a disclosed monetary penalty, so they exceed total penalties divided by total action count. About 27 of the 32 actions carry a monetary amount: Broker-Dealer averages over 7 of 8 actions ($125.6M ÷ $17.9M), Banking over 8 of 11, and Trust/CSP over 2 of 3. The remaining 5 actions are likely non-monetary outcomes such as undertakings, licence conditions or censures, or cases where the amount was not disclosed.↩︎

  3. See [Appendix: Priority Level Definitions] for the criteria used to assign each priority level.↩︎