September 22, 2026

AML Fines of 2025-2026: Lessons From Enforcement Actions

Axle Team

Key takeaways

AML fines in 2025-2026 were smaller in dollar terms than TD Bank's 2024 record but far broader in reach: broker-dealers, an armored-car carrier, P2P crypto platforms, a stablecoin issuer, and community banks all paid.
Recidivism is now the most expensive fact pattern. UBS Financial Services paid $125 million in August 2026 for monitoring failures it had already settled with FinCEN in 2018.
Regulators are penalizing "papering": surveillance reports nobody reviewed, alert backlogs left to age, and CDD files that document risk instead of assessing it.
The common thread is capacity, not technology. Compliance teams that were out-resourced (Canaccord), outgrown (Block), or overridden (EagleBank) produced the same result: unfiled SARs.
FinCEN's proposed whistleblower rule and its data-driven Southwest border operation mean more cases will originate from data and insiders rather than routine exams.

AML fines in 2026 so far are led by FinCEN's $125 million penalty against UBS Financial Services (August 2026) and $80 million against Canaccord Genuity (March 2026), both broker-dealers, plus the DOJ's $9.7 million EagleBank non-prosecution agreement (June 2026). The 2025 docket was dominated by crypto: OKX ($504 million), KuCoin ($297 million), Block ($40 million), and Paxos ($26.5 million).

The headline numbers matter less than the fact patterns. Every one of these actions describes a control that existed on paper and failed in operation. This post walks through the AML fines of 2025 and 2026, then pulls out the five lessons a BSA officer can actually act on.

AML fines 2026 and 2025: the enforcement docket

Jan 2025 — Institution: Brink's Global Services USA. Regulator: FinCEN. Penalty: $37M. Core failure: Unregistered MSB activity, no effective AML program, no SARs on Southwest border bulk-cash shipments.
Jan 2025 — Institution: KuCoin (Peken Global). Regulator: DOJ SDNY. Penalty: $297M+ (forfeiture and fine). Core failure: Unlicensed money transmission, no effective AML or KYC program.
Feb 2025 — Institution: OKX (Aux Cayes Fintech). Regulator: DOJ SDNY. Penalty: $504M+. Core failure: Unlicensed money transmission, U.S. customers served without KYC.
Apr 2025 — Institution: Block, Inc. (Cash App). Regulator: NYDFS. Penalty: $40M plus independent monitor. Core failure: Alert backlog left unaddressed, delayed SARs, weak virtual-currency controls.
Aug 2025 — Institution: Paxos Trust Company. Regulator: NYDFS. Penalty: $26.5M plus $22M compliance investment. Core failure: Deficient due diligence on the Binance partnership, weak transaction monitoring.
Dec 2025 — Institution: Paxful. Regulator: FinCEN (parallel DOJ action). Penalty: $3.5M. Core failure: Lapsed MSB registration, ineffective AML program, late and incomplete SARs.
Mar 2026 — Institution: Canaccord Genuity LLC. Regulator: FinCEN (with SEC and FINRA). Penalty: $80M. Core failure: Under-resourced AML program, unreviewed surveillance reports, at least 160 unfiled SARs.
Apr 2026 — Institution: Community Federal Savings Bank. Regulator: OCC. Penalty: Consent order. Core failure: BSA/AML program, SAR, and 314(a) information-sharing violations.
Jun 2026 — Institution: EagleBank. Regulator: DOJ. Penalty: $9.7M non-prosecution agreement. Core failure: Executives overrode compliance on a decade-long check-kiting scheme.
Jul 2026 — Institution: United Texas Bank. Regulator: OCC. Penalty: Consent order. Core failure: BSA/AML program deficiencies carried over from a 2024 Fed and Texas order.
Aug 2026 — Institution: UBS Financial Services Inc. Regulator: FinCEN. Penalty: $125M. Core failure: Recidivist: unmonitored foreign-currency wires, deficient CDD on high-risk customers.

Two framing notes. First, TD Bank's October 2024 resolution, including FinCEN's $1.3 billion penalty and a four-year monitorship, still sets the ceiling and shapes how every later order was written. Second, the OCC's 2026 bank orders carried no announced civil money penalty, which is normal for first-time program findings. The money follows when the findings are not fixed.

Lesson 1: Recidivism is the most expensive fact pattern

UBS Financial Services settled with FinCEN in December 2018 for $14.5 million over weaknesses in its automated monitoring of foreign currency wires. According to FinCEN's August 2026 release, the firm then "failed to appropriately monitor over 50,000 foreign currency wires with an aggregate value of more than $10 billion" and did not disclose the continuing failure. FinCEN Director Andrea Gacki framed the penalty explicitly: "Today's historic action against UBSFS should send a clear message that recidivist financial institutions will face severe repercussions."

The operational lesson: remediation commitments made in a consent order are the highest-risk promises in your program. Track them like open audit findings with board visibility and independent validation of closure, because the regulator will test them years later.

Lesson 2: Unreviewed output is worse than no output

Canaccord's problem was not a missing monitoring system. It had more than 100 surveillance reports. It had four people, all with other jobs, assigned to read them.

As a market maker, Canaccord was well-positioned to detect and investigate red flags of suspicious activity in the securities for which it provided trading services, but its significantly under-resourced AML program was not proportional to the risks of its business model, which inhibited Canaccord from identifying and reporting suspicious transactions that it processed. This was particularly apparent in Canaccord's transaction monitoring policies, procedures, and internal controls, which relied on an insufficient number of inexperienced staff who were poorly trained and overwhelmed by the number of transactions Canaccord tasked them with reviewing through unreasonably designed surveillance reports.
— FinCEN, Canaccord Genuity LLC press release, March 6, 2026

The consent order adds that several reports "had never led to a single escalation of potentially suspicious activity" over years, and that staff altered records to look like reviews had happened. A rule that generates output nobody reads is a liability, not a control. If your team is carrying a backlog, how to dig out of an AML alert backlog covers the triage sequence regulators expect to see.

Lesson 3: Growth outruns compliance

Block and Paxos are the fintech and crypto versions of the same story. NYDFS found that Block's rapid growth between 2019 and 2020 "contributed to a severe transaction alert backlog, which Block left unaddressed for a significant period of time."

Compliance functions must keep pace with company growth or expansion. The rapid growth of Block's Cash App absent a robust compliance function created risk and vulnerabilities that violated the rules financial services companies operating in New York must adhere to.
— Superintendent Adrienne A. Harris, NYDFS press release on the Block, Inc. consent order, April 10, 2025

Paxos paid $26.5 million and committed another $22 million to compliance investment after NYDFS found its due diligence on the Binance partnership and its transaction monitoring did not match the risk of the relationship. For a fintech, alert backlog age and partner due diligence currency are board-level metrics, not operational details.

Lesson 4: Papering is not diligence

The UBS release contains the sharpest sentence any regulator wrote this cycle about customer due diligence:

Such risk-based CDD does not include, for example, a focus on simply "papering" dispositions of apparent risks but rather an objective identification and assessment of the risks presented—both at the inception of a customer relationship and those that manifest over time—and a proportionate response to meaningfully address such risks, including through the application of commensurate controls.
— FinCEN, UBS Financial Services Inc. press release, August 3, 2026

FinCEN's specific complaint was that UBS had negative news on high-risk customers, and in one case concerns raised by its own affiliate, and closed the file anyway. The same critique applies to alert dispositions. A narrative that restates the alert and concludes "no suspicious activity identified" is papering. A defensible disposition names the evidence, the expected behavior, and why the gap does or does not matter. Our guide to SAR filing mistakes that draw regulator questions lists the patterns examiners flag.

Lesson 5: Overridden compliance is a criminal-division problem

EagleBank is the smallest penalty on the list and the most instructive for governance. The DOJ said senior executives "repeatedly overrode the efforts of compliance personnel to close the accounts and end the illicit conduct" for more than a decade, and the case landed with the Criminal Division's Bank Integrity Unit rather than a civil regulator. Your compliance function needs an escalation path to the board or audit committee that does not run through the executives whose customers are at issue.

The practitioner control that catches most of this: a zero-escalation report

Here is the one control I would add to any program after reading these orders. Every month, list every monitoring rule, surveillance report, and screening list that produced zero escalations in the trailing 90 days. Require the rule owner to write one sentence explaining why.

That single report would have surfaced the Canaccord pattern (reports nobody read), the UBS pattern (a monitoring fix that never shipped), and the Block pattern (alerts aging in a queue). Zero escalations means either the rule is perfectly tuned or nobody is working it, and in practice it is never the first one. It also gives you a clean answer when an examiner asks how you know your alerts are actually reviewed. Pair it with the tuning discipline in transaction monitoring rules tuning and the queue stops hiding problems.

This is also the honest case for AI agents in alert review. An agent that works every alert as it arrives, with a logged rationale and a visible escalation rate per rule, removes the two conditions these orders keep describing: aging queues and unreviewed output. Axle's transaction monitoring alert agent is built for exactly that stage, with humans keeping the escalation and SAR decisions.

Where 2026 enforcement is heading

Whistleblowers. FinCEN proposed rules at the end of March 2026 to operationalize its BSA and sanctions whistleblower award program. Expect more cases to start from an insider's tip rather than an exam.
Data-driven targeting. FinCEN's December 2025 operation against more than 100 money services businesses along the Southwest border was built on FinCEN's own analysis of CTR and SAR filings. The regulator is now mining the reports you file to decide whom to examine.
Named priorities. The UBS order requires an independent review focused on the Southwest border and cartels, Iran, Russia, and Venezuela. Those four are a reasonable proxy for what FinCEN will ask about next.
Remediation credit. FinCEN agreed to waive up to $15 million of the UBS penalty for verified remediation expenses. Documented, timely fixes are worth real money.

FAQ

What was the largest AML fine in 2026?

FinCEN's $125 million civil money penalty against UBS Financial Services Inc. on August 3, 2026, is the largest AML fine of 2026 so far and the largest ever imposed on a broker-dealer for BSA violations. It surpassed the $80 million Canaccord Genuity penalty from March 2026.

Who imposes AML fines in the United States?

FinCEN assesses civil money penalties under the BSA. The DOJ brings criminal cases and negotiates pleas and non-prosecution agreements. The OCC, Federal Reserve, and FDIC issue consent orders and penalties against banks. The SEC and FINRA act against broker-dealers, and state regulators such as NYDFS act against licensed fintechs and virtual-currency firms.

Are AML fines increasing in 2026?

Total dollars swing with a few mega-cases, so year-over-year totals are a poor signal. What is clearly increasing is the range of institution types under enforcement and the number of pipelines that generate cases, including whistleblower tips and FinCEN's own data analysis.

Where to go from here

The AML fines of 2025 and 2026 punished unreviewed alerts, aging backlogs, unkept remediation promises, and CDD files that documented rather than assessed. If any of those describe a queue you own today, see how Axle's agents work every alert with a logged rationale at axleruns.com/platform, or size the impact first with the ROI calculator.

AML Fines of 2025-2026: Lessons From Enforcement Actions

More from the blog