In a recent Law360 article, Thad McBride and Jamie Parkinson analyzed key financial crime enforcement developments from 2026, including heightened scrutiny of anti-money laundering (AML) programs, proposed changes to the AML regulatory framework, and the growing importance of voluntary disclosure and whistleblower reporting. They also discussed the convergence of AML, sanctions, and anti-corruption enforcement and offered practical considerations for compliance teams navigating an increasingly risk-based regulatory environment.
This article first appeared in Law360 on September 24, 2026, and is republished here with permission from the publication.
AML Takes Center Stage In Financial Crime Enforcement
Throughout the first roughly three quarters of 2026, financial crime enforcement has reflected a shift toward risk-based compliance. The fact that a company maintains formal compliance controls is not sufficient as regulators increasingly focus on practical applications: Are controls appropriately calibrated for — and working to prevent and detect — the company’s particular compliance vulnerabilities?
This is particularly evident with respect to anti-money-laundering enforcement, as demonstrated by the large penalty imposed by the Financial Crimes Enforcement Network on UBS Financial Services in August. It is also evident in enforcement actions involving U.S. economic sanctions administered by the U.S. Department of the Treasury‘s Office of Foreign Assets Control.
Under both regimes, and under the Foreign Corrupt Practices Act, the government is placing greater weight on voluntary disclosure and whistleblower reporting. Correspondingly, in-house counsel and compliance personnel need to ensure that controls facilitate the prompt identification and escalation of potential legal issues.
AML Enforcement Marked by Large Penalties
The two Bank Secrecy Act, or BSA, enforcement actions that FinCEN has announced thus far in 2026 involved broker-dealers, and each set a new record for a broker-dealer penalty when announced.
In August, FinCEN imposed a $125 million civil money penalty on UBS, what FinCEN says is the largest BSA penalty ever imposed on a broker-dealer.[1]
FinCEN said UBS failed to remediate weaknesses identified in a prior 2018 enforcement action, including deficiencies affecting the monitoring of more than 61,500 foreign currency wires totaling more than $10 billion.
FinCEN also identified due diligence failures involving high-risk customers with ties to Russia and Latin America, and it said the firm failed to timely and accurately file suspicious activity reports involving hundreds of transactions.
Notably, the resolution also requires an independent review of UBS’ AML program with a specific focus on risks involving the U.S. Southwest border, cartels and possible narcotics trafficking.
The UBS penalty followed the $80 million penalty against Canaccord Genuity that FinCEN announced in March.[2] FinCEN alleged that Canaccord failed to maintain an AML program reasonably designed for its high-risk, over-the-counter securities business and failed to file at least 160 suspicious activity reports.
In a parallel action, the U.S. Securities and Exchange Commission issued an order finding that Canaccord personnel failed to review or investigate flagged activity and falsified documentation to cover up those failures.[3]
As these matters demonstrate, regulators are looking at the very practical questions of whether controls reflect a company’s actual business, whether alerts are meaningfully investigated, whether customer risk information informs decisions and whether known deficiencies are actually fixed.
FinCEN Reworking AML Framework
FinCEN’s enforcement actions come as the agency is also proposing significant changes to the underlying AML and countering the financing of terrorism framework. An April proposed rule would refocus program expectations on effectiveness and distinguish between program “establishment,” meaning risk-based design, and “maintenance,” meaning whether the program is implemented and operating as intended.[4]
Through this proposed rule, FinCEN is making clear that financial institutions themselves are best positioned to identify their own money laundering, terrorist financing, sanctions and other illicit finance risks.
The rule also incentivizes institutions to direct resources toward higher-risk customers and activities. Relatedly, FinCEN proposes clarifying the role of independent testing so that auditors and examiners assess a company’s compliance program in light of its own risk assessment rather than substituting their judgment for the company’s risk-based decisions.
If finalized, the changes should give companies the autonomy to tailor their compliance programs to actual risk. But the UBS and Canaccord resolutions show what can happen if the programs do not operate as intended.
FinCEN Establishing More Robust Whistleblower Program for AML, Sanctions Issues
FinCEN is also moving to fully implement its statutory whistleblower program. Its proposed whistleblower rule would establish procedures for awards of 10% to 30% of collected monetary sanctions when original information leads to a successful Treasury or U.S. Department of Justice enforcement action.[5]
The program covers BSA violations as well as violations of several statutes underlying U.S. sanctions programs.
Sanctions and Anti-Corruption Risks Continue to Converge
FinCEN is not alone in imposing large penalties. OFAC has announced seven civil enforcement matters so far in 2026 with penalties totaling more than $284 million.[6]
The largest by far — and one of the largest sanctions penalties OFAC has ever imposed on a nonbank — was a $275 million settlement with Adani Enterprises involving apparent Iran sanctions violations.[7] OFAC alleged that red flags should have alerted the company that liquefied petroleum gas purchased through a Dubai-based trader originated in Iran.
Because these purchases were made in U.S. dollars, U.S. financial institutions were unwittingly made to process dollar-denominated payments for Iran’s benefit. Such “causing” of a violation, even when U.S. person involvement is very limited, is treated just like a transaction conducted directly by a U.S. person with a sanctioned party.
Anti-corruption enforcement is more selective but not dormant. The DOJ’s June 2025 Foreign Corrupt Practices Act guidelines prioritize enforcement of matters involving misconduct tied to cartels and transnational criminal organizations — also key targets of U.S. sanctions and AML efforts.[8]
To this end, in July, the Scoular Company agreed to pay more than $10 million and entered into a three-year deferred prosecution agreement over bribes paid through customs brokers in Mexico.[9] Among other things, the DOJ emphasized that at least some portion of the bribes paid were for the benefit of narcotics traffickers and cartels in Mexico.
Overlapping Enforcement Regimes: Practical Steps for Compliance Teams
For compliance teams, these developments highlight how different areas of financial crime risk can overlap. Correspondingly, it is important to conduct risk assessments that reflect these various regimes and potentially others such as export and import controls.
And risk assessment cannot be static: Review is needed whenever the company considers a new market, payment method, business line, acquisition, customer or third party — or when the company identifies a potential deficiency in its existing compliance efforts.
Results of the review then need to feed back into new or updated controls and training. In its order in the UBS matter, among other things, FinCEN noted that it was only several years after UBS identified BSA reporting deficiencies that the company implemented a new monitoring system to address those issues.
While the need to track obligations across multiple regimes increases workloads, companies should also pursue efficiency gains. Sanctions screening, AML know-your-customer efforts and anti-corruption diligence can be consolidated. A red flag identified with respect to one legal obligation often signifies risk more broadly.
When an issue is identified, escalation procedures should be designed for speed. The DOJ’s departmentwide corporate enforcement and voluntary self-disclosure policy offers potentially significant benefits for timely voluntary disclosure.[10] Voluntary disclosure is also a well-established mitigating factor in disclosures under sanctions and export control regimes.
Companies need a process for preserving evidence, understanding the veracity of allegations, identifying potentially affected jurisdictions and promptly considering a disclosure. Otherwise, the disclosure decision may be made for the company, particularly as FinCEN’s whistleblower program offers significant incentives for individuals to report suspected misconduct externally.
Finally, remediation should be documented and tested. The UBS and Canaccord matters show the risk of allowing known deficiencies to persist. Closing an audit finding on paper is not enough if the underlying control still does not work.
Conclusion
Financial crime regulators are emphasizing risk-based compliance and voluntary disclosure while targeting specific conduct for enforcement. The best defense remains a nimble compliance program tailored to a company’s particular needs and risk areas.
[1] https://www.fincen.gov/system/files/2026-07/UBS-Consent-Order.pdf.
[2] https://www.fincen.gov/system/files/2026-03/Canaccord-Consent-Order-No-2026-01.pdf.
[3] https://www.sec.gov/enforcement-litigation/administrative-proceedings/34-104935-s.
[5] https://www.fincen.gov/news/news-releases/fincen-proposes-rule-pay-whistleblowers.
[6] https://ofac.treasury.gov/civil-penalties-and-enforcement-information.
[7] https://ofac.treasury.gov/recent-actions/20260518.
[8] https://www.justice.gov/dag/media/1403031/dl.
[9] https://www.justice.gov/opa/pr/agricultural-company-pay-over-10m-resolve-foreign-bribery-case.