The Financial Crimes Enforcement Network (“FinCEN”) announced a $125 million civil money penalty on Aug. 3, 2026, against UBS Financial Services Inc. (“UBS”)—the largest Bank Secrecy Act (“BSA”) penalty ever assessed against a broker-dealer—for willful violations of the Bank Secrecy Act. The Securities and Exchange Commission (“SEC”) separately imposed a $20 million penalty for related failures. At the center of both actions was a finding that UBS failed to remediate anti-money laundering (“AML”) deficiencies identified in a prior 2018 consent order, allowing monitoring failures to persist for years.
The UBS matter illustrates a broader trend: regulators are not only examining whether institutions have AML deficiencies, but also how they respond once those deficiencies become known. For institutions undertaking voluntary remediation—whether following internal audits, whistleblower complaints, merger integration or the identification of control weaknesses—the structure and governance of the remediation effort itself can carry significant legal and regulatory consequences.
The Enforcement Landscape: Recidivism and Remediation Failure
The enforcement actions filed by FinCEN and the SEC against UBS were driven mostly by recidivism. In 2018, UBS paid a $14.5 million penalty for AML monitoring deficiencies and represented it would remediate the underlying issues. FinCEN found that UBS failed to do so adequately, subsequently failing to monitor over 50,000 foreign currency wire transactions totaling more than $10 billion—and did not disclose the continued failures to FinCEN.
The SEC’s parallel action found that from January 2019 through June 2023, UBS failed to adequately monitor foreign currency wire transactions due to flaws in its automated and manual monitoring systems. UBS ultimately engaged a consulting firm and began filing lookback Suspicious Activity Reports (“SARs”) in October 2023 which identified—albeit in an untimely fashion—thousands of suspicious transactions totaling approximately $250 million in value.
This remediation was insufficient in light of UBS’ violations. In a press release, FinCEN Director Andrea Gacki stated: “Repeat violators of the Bank Secrecy Act jeopardize the integrity of our financial system, especially those that expose it to high-risk customers and activities without effective controls.” Notably, this action reflects a growing trend of parallel AML enforcement by multiple regulators—including the SEC, whose independent jurisdiction over AML matters has been subject to debate.
Why the Structure of Remediation Matters
AML remediation is rarely a purely operational exercise. Once significant deficiencies are identified, institutions face questions regarding regulatory exposure, self-disclosure obligations, board oversight responsibilities and potential enforcement risk. Remediation projects generate extensive documentation through gap assessments, root-cause analyses, board presentations and remediation roadmaps that may later become evidence in regulatory examinations, enforcement proceedings or civil litigation.
Two structural considerations deserve particular attention:
Privilege and Document Management: If assessments and internal communications are created primarily as ordinary business records rather than for the purpose of obtaining legal advice, they may be subject to disclosure. While privilege determinations are fact-specific and no structure guarantees protection, involving counsel early—and establishing clear reporting lines, consultant engagement structures and document-management protocols—can strengthen privilege arguments in appropriate circumstances.
Regulatory Positioning: The UBS consent order demonstrates that regulators evaluate not only the original deficiency but also the quality and timeliness of the institution’s response. FinCEN specifically noted that UBS did not disclose its continued monitoring failures and that significant remediation was not undertaken until FinCEN’s investigation was already underway. Counsel can advise on self-disclosure strategy, regulatory engagement and escalation obligations—decisions that are far more effective when made before documents are created and positions are established.
Key Risks of Conducting Remediation Without Legal Oversight
When conducting remediation without a legal team involved, companies open themselves up to various avenues of risk:
- Discoverable Assessments: Gap analyses and investigation reports generated without a legal framework may be produced in litigation or enforcement proceedings.
- Inconsistent Communications: Large remediation efforts involve multiple stakeholders. Without centralized oversight, organizations risk generating conflicting descriptions of deficiencies and regulatory exposure—creating credibility challenges.
- Shifting Regulatory and Enforcement Landscapes: Regulatory requirements evolve, as do enforcement priorities and expectations. Counsel who are familiar with these changes can provide necessary guidance to ensure that remediation efforts continue to meet those evolving standards.
- Board Governance Exposure: Regulators increasingly emphasize board accountability. The UBS consent order, for example, requires an independent review of UBS’ AML program and implementation of recommendations. Boards must be able to demonstrate effective oversight, meaningful reporting and adequate resource allocation throughout remediation.
Practical Steps for Organizations
- Engage Counsel Early: Involve experienced counsel at the beginning of the remediation effort so that legal considerations inform the project’s structure, governance and documentation from the outset.
- Consider the Structure of Remediation Carefully: Define decision-making responsibilities, reporting lines, escalation procedures and oversight mechanisms. Document whether consultants are providing operational support, assisting counsel in rendering legal advice, or both.
- Separate Legal and Operational Functions Where Practical: Distinguish communications seeking or providing legal advice from ordinary business communications.
- Assume Future Regulatory Scrutiny: Conduct remediation efforts with the expectation that regulators will later examine the institution’s response—including timing, scope and effectiveness.
The UBS enforcement action reflects an unmistakable message: regulators will impose severe consequences where institutions fail to remediate known AML weaknesses and will scrutinize the remediation process itself. Institutions that delay involving counsel risk generating documents, communications and governance records without the benefit of a legal framework designed to support available protections. At a time of heightened enforcement focus on recidivism and remediation effectiveness, privilege, governance and regulatory strategy should be addressed at the outset of any significant AML remediation effort—not after the work is already underway.
