Four UBS AML figures add to $173m—but the coordinated penalty was $125m

UBS Financial Services’ August anti-money-laundering resolution can look like a $173 million package if the four announced figures are simply added: FinCEN’s $125 million, the SEC’s $20 million, FINRA’s $20 million and the CFTC’s $8 million. FinCEN’s consent order shows why that total is wrong. Its $125 million civil penalty expressly credits the other agencies’ $48 million. UBS was required to pay $62 million directly to Treasury, while a further $15 million is due by May 2028 but may be waived to the extent FinCEN accepts qualifying review and implementation expenses. The coordinated nominal penalty is therefore $125 million, not $173 million.[1][2][3][4]

The cash consequence has two boundaries. The three parallel agencies account for $48 million and FinCEN required another $62 million, producing $110 million of non-contingent government payments under the published orders. The remaining $15 million could lift the total to the full $125 million, but FinCEN can waive some or all of it only after specified compliance work and at its discretion. Calling the package either $110 million or $125 million without explaining that condition loses part of the settlement’s design.[1]

Three transaction counts describe overlapping perimeters

The same non-additivity problem appears in the transaction figures. The CFTC order says more than 28,000 foreign-currency wires worth at least $8.9 billion were insufficiently monitored or omitted from monitoring through retail customer commodity accounts. FinCEN’s broader order says UBS failed effectively to monitor more than 61,500 transactions worth more than $10.5 billion during its relevant period. The SEC reconstructs the problem as approximately 52,000 legacy-system wires worth about $7.6 billion plus more than 8,000 automated-system wires worth more than $2.7 billion.[1][3][4]

Those are not three independent pools. The CFTC’s jurisdictional subset concerns wires effectuated through commodity accounts at a registered futures commission merchant. The SEC’s broker-dealer order covers customer FX wire monitoring and related suspicious-activity reporting, while FinCEN applies the Bank Secrecy Act to UBS in both its broker-dealer and FCM capacities. Adding 28,000, 60,000 and 61,500 would count overlapping wires more than once. The differences are useful precisely because they reveal the legal and account boundaries used by each regulator.[1][3][4]

Even average-ticket calculations require restraint. Dividing $8.9 billion by 28,000 gives at least roughly $318,000 per CFTC-scope wire; dividing $10.5 billion by 61,500 gives more than about $171,000 for the FinCEN population. These are lower-bound ratios built from rounded minimums, not customer-level averages. They establish scale, not the distribution of wire sizes or the amount that was suspicious. An inadequately monitored wire is not automatically an illicit one.[1][4]

The manual system failed in the way UBS had already promised to fix

The chronology is central. In 2018, UBS resolved earlier AML cases involving foreign-currency wires and represented that it expected to implement a fully automated surveillance system by the end of the second quarter of 2019. The new system was not completed until February 2021. During the intervening period, UBS continued using a manually generated report whose known weaknesses included incomplete data, limited detection scenarios and a process that could require personnel to query as many as four separate systems.[1][3][4]

The CFTC found that the report focused on wire volume, notional value and currency type, but did not capture a broader set of patterns such as high-risk jurisdictions, round-dollar activity, suspicious instructions, deviations from expected behaviour, velocity across products or activity in dormant accounts. It was generally reviewed quarterly, creating backlogs and weakening the prospect of timely intervention. A coding error discovered in October 2020 had prevented more than 400 alerts from being generated; UBS did not immediately escalate and quantify the missed alerts, according to the CFTC order.[4]

This does not mean every omitted scenario would have produced a report or that quarterly review is unlawful in isolation. The finding was that the process was not reasonably designed for the risks UBS was handling, and that the firm continued relying on it after the 2018 cases had already identified the problem. The recurrence changed the enforcement context: FinCEN described UBS as a repeat violator and made the delayed remediation part of its penalty analysis.[1][2][4]

Automation changed the failure mode rather than ending it

When the automated platform went live, the control problem moved upstream into data lineage. One source fed the system a 4 p.m. intraday file instead of the complete end-of-day file. A later change in transaction labels meant the logic continued looking for the old label and failed to recognise some FX wires. Other records arrived without information needed to connect the account posting to the counterparty wire, partly because many transactions lacked a common reference number and the matching logic could be defeated by date differences, rounded exchange rates, currency-code formatting and incorrectly formatted references.[1][3][4]

The automated system also lacked an exception or repair queue until December 2022. If a record could not be ingested or matched, there was no basic mechanism to isolate the failure for resolution. That omission is consequential because a monitoring engine can only analyse the transactions delivered to it in usable form. Strong scenarios and sophisticated scoring do nothing for a wire that never enters the surveillance population.[1][3][4]

The SEC quantified the second phase. From February 2021 through June 2023, more than 8,000 of approximately 190,000 customer FX wires—about 4% by count—were unmonitored or inadequately monitored. They represented more than $2.7 billion, or 20% of the value sent by customers during that phase. The value share was therefore roughly five times the count share. That does not prove the omitted records were deliberately selected or suspicious, but it shows why a small error rate by number can still be material when it captures larger-value transactions.[3]

Late reporting was the downstream result

UBS engaged a consultant in August 2022 to investigate root causes and conduct a lookback. The SEC says the review concluded that the legacy and automated systems had both failed to monitor FX wires adequately. UBS began filing lookback suspicious-activity reports in October 2023; the order says thousands of suspicious transactions totalling approximately $250 million were included in reports that were filed late. That figure is not the value of all inadequately monitored wires and not a regulator’s finding that the entire amount was criminal proceeds.[3]

The case also included customer-due-diligence failures beyond FX data plumbing. Regulators described delayed responses to customers’ links with high-risk jurisdictions, adverse information and changes in residence or employment. The SEC order gives examples but does not convert every customer risk factor into a finding of criminal conduct. The legal failure was inadequate monitoring, risk profiling and timely SAR filing under UBS’s obligations.[1][2][3]

The settlement prices remediation into the penalty

FinCEN’s remaining $15 million creates an unusual incentive boundary. Qualifying expenses can include specified third-party review fees and internal costs tied to implementing enhancements recommended through the ordered review. Ordinary-course AML expenditure does not qualify. FinCEN decides what counts and can request supporting records. The waiver therefore does not reimburse normal compliance; it conditionally converts part of a future penalty payment into independently reviewed remediation spending.[1]

The order also requires a transaction lookback, data-lineage mapping and testing of whether similar gaps affected monitoring for other products. A separate consultant must assess the current programme against specified illicit-finance risks and report the number of customers, transaction values and SARs arising from the work. The next verifiable result is not a press statement that the platform has been fixed. It is whether the ordered mapping, testing and implementation demonstrate that every relevant transaction can be traced from its source through ingestion, matching, exception handling and review.[1]

What the evidence establishes

UBS admitted FinCEN’s statement of facts and willful BSA violations and admitted the facts and supervisory violation in the CFTC order. The SEC settlement incorporated FinCEN admissions while otherwise following its stated settlement terms. The records establish a repeated control failure spanning a manual report and its automated replacement. They do not establish that every affected wire was suspicious, that the three published populations are additive, or that the coordinated sanctions total $173 million.[1][3][4]

The deeper finding is that both the transaction denominator and the penalty denominator change with legal perimeter. The CFTC’s 28,000-wire subset is nested inside a broader BSA population; the three $48 million parallel sanctions are nested inside FinCEN’s $125 million penalty through an explicit credit. Reading those documents together turns four large headlines into a coherent account of one control failure—and prevents the same wires and the same dollars from being counted twice.[1][2][3][4][5]

Report an error or submit an update