UBS Financial Services’ FX monitoring gaps covered 4% of wires but 20% of value

The foreign-currency wires that UBS Financial Services failed to monitor adequately after introducing an automated system represented about 4% of transactions but 20% of their dollar value, according to the SEC’s August 2026 enforcement order. More than 8,000 wires worth over $2.7 billion were affected between February 2021 and June 2023. The imbalance shows why a system can appear to cover most transactions by number while missing a much larger portion of the money moving through it.[1]

Reading the SEC’s account alongside the Financial Crimes Enforcement Network’s consent order reconstructs where the information failed: transactions lost currency and counterparty context, some never reached the monitoring engine, and others arrived without fields needed to match and analyse them. The same documents show that the widely announced $125 million FinCEN assessment incorporates $48 million payable to three other regulators. Adding those penalties again would count them twice.[1][2]

The actions were announced on 3 August and the SEC highlighted the case again in its November annual enforcement results. This is a reconstruction of the established case, with two practical questions: what did the automation leave outside effective surveillance, and what financial obligations did the coordinated settlement actually impose? Neither the unmonitored amount nor the penalty is a finding that every affected wire involved criminal funds.[1][2][5]

A small count share carried a large value share

The SEC places approximately 190,000 customer FX wires in the automated-system period. More than 8,000 were not monitored or were inadequately monitored, with more than $2.7 billion in dollar notional value. Its rounded shares, 4% by count and 20% by value, imply that the affected group’s share of value was five times its share of transactions. The calculation uses the published percentages, not an undisclosed transaction-level dataset.[1]

That concentration is material to assessing a control. A count-based completeness test treats a small transfer and a large transfer as one record each. A value-based reconciliation asks whether the missing records carry a disproportionate portion of financial activity. Neither replaces investigation of individual transactions, but the UBS figures demonstrate that checking only the percentage of records captured can understate the financial scale of a monitoring gap.[1]

The earlier legacy-system period covered approximately 52,000 inadequately monitored wires worth about $7.6 billion. Comparing 52,000 with 8,000 might suggest a dramatic improvement after automation, but the sources do not give the matched earlier total needed to calculate a comparable coverage rate. The periods also differ in length. The defensible conclusion is that material gaps persisted across both arrangements, not a quantified percentage improvement attributable to the new software.[1]

FinCEN describes more than 61,500 affected foreign-currency wires with aggregate value exceeding $10.5 billion across its reviewed period. Those figures should be attributed to FinCEN rather than constructed by summing the SEC’s rounded phase totals. The orders have related but separately stated populations and amounts. A small difference between their aggregates is not evidence of an additional, independently identified pool of missing money.[1][2]

The information split began before the surveillance engine

The legacy problem arose partly from how a foreign-currency transfer was reflected in a retail brokerage account. Foreign-currency and counterparty details sat outside the dollar debit or credit visible to the monitoring system. A dollar movement could therefore be present while information needed to assess its international context was absent. Monitoring a financial entry is not equivalent to monitoring the complete wire instruction from which that entry arose.[1][2]

For commodities accounts, FinCEN describes a separate manually generated report with limited parameters, unreliable production and infrequent review. One parameter was intended to identify households moving more than the dollar equivalent of $300,000 in foreign-currency wires during a month. A coding problem affected that control. The report’s existence did not establish that all transactions meeting its intended criteria were actually selected and reviewed.[2]

FinCEN also found that management’s intention to increase the manual report’s frequency from quarterly to monthly was never implemented before the control was retired. Frequency and selection accuracy were therefore separate weaknesses: running an incomplete report more often would not repair its missing records, while improving selection would not by itself make delayed review timely. The order documents both dimensions rather than attributing the entire legacy problem to one software defect.[2]

These weaknesses followed earlier regulatory action in 2018. FinCEN says UBS represented that a new automated system would address the deficiencies, but deployment was delayed until March 2021. The SEC’s phase begins with February 2021 transactions; FinCEN explains that the first batch monitored in March contained February’s activity. Those dates describe processing and transaction periods respectively, rather than two contradictory launch dates.[1][2]

Automation inherited three data problems

The first automated-system problem was completeness at ingestion. Some systems supplied a 4pm data feed instead of the complete end-of-day file, so later activity was absent. A change in transaction labels also meant certain entries were not recognised as FX wires and were not transmitted for review. A well-designed detection scenario cannot identify a transaction that never enters its dataset.[1]

The second was incomplete information within records that did arrive. The SEC describes missing or incorrect fields and difficulty linking records from different systems. Unique wire references were absent from some data, requiring matching logic to associate transaction details. Where that logic failed, relevant information about the transfer could remain disconnected. The problem was therefore not limited to a binary distinction between a file received and a file missing.[1]

The third was treatment of exceptions. UBS did not initially have an adequate process to identify and resolve transactions rejected or inadequately matched by the new system, according to the SEC’s findings. A successful scheduled run could coexist with unsuccessful processing of individual records. The case links the input population, the enrichment and matching process, and the treatment of rejected records into one surveillance chain.[1]

The SEC says transmission flaws were resolved by year-end 2022 and testing of those solutions was completed in June 2023. That separates an implemented correction from completed validation. It also matters when interpreting the enforcement period: the finding describes historical systems and transactions. The orders do not establish that those same defects remained in operation in November 2026.[1]

Missing surveillance and late reports are different measures

The next question is what the missed monitoring prevented. UBS began filing retrospective suspicious activity reports in October 2023. The SEC says reports filed late concerned thousands of suspicious transactions with approximately $250 million in value. That is a more specific reporting consequence than the much larger total value of wires affected by surveillance deficiencies. The two amounts measure different populations and cannot be substituted for one another.[1]

Suspicious activity reporting is an intelligence obligation, not a criminal verdict on the customer. For the broker-dealer rule described in the order, relevant transactions must meet the monetary threshold and the stated grounds for suspicion. The normal filing clock starts after initial detection of facts that may support a report, with defined provisions for identifying a suspect. It does not mechanically begin on the date of every wire. The orders find delayed reporting; they do not publish enough case-level dates to calculate lateness independently for every report.[1]

Customer due diligence was another part of the failure. The SEC and FinCEN describe customers whose risk profiles did not adequately reflect relevant ties to higher-risk jurisdictions or changes in their circumstances. A transaction-monitoring scenario built around an outdated customer profile can miss an unusual pattern even when the transaction data itself is complete. Correcting feeds therefore addresses only one part of the surveillance problem described in the settlement.[1][2]

FinCEN’s examples include inconsistent treatment of information already available to the firm, including residence indicators and the source of customer wealth. The public orders distinguish those customer-profile deficiencies from the technical omissions in FX-wire data. Nationality or a connection to a particular country is not proof of illegality; the issue identified by the regulators was whether the firm applied its own risk assessment and investigative processes to the relevant facts.[1][2]

The penalty bridge is $125m, not $173m

FinCEN assessed a $125 million civil penalty and expressly credited $48 million in payments to the other regulators: $20 million to the SEC, $20 million to FINRA and $8 million to the CFTC. It required a separate $62 million Treasury payment, leaving $15 million due on or before 31 May 2028, subject to the conditional waiver provisions. The four pieces reconcile to the assessed amount.[2][3]

The potential waiver is tied to spending and compliance, rather than simply the passage of time. FinCEN may recognise specified third-party fees and internal implementation costs associated with the required AML programme review, up to the remaining $15 million. Ordinary costs of maintaining the AML programme do not qualify merely because the firm incurs them during the review. FinCEN retains discretion over eligibility and requires compliance with the undertaking.[2]

If the full $15 million qualified, the government and regulator cash payments described by the order would total $110 million, with at least that waived amount represented by approved expenditure instead. That is a conditional scenario, not a finding that UBS has received the maximum waiver. The public records reviewed do not establish the final approved amount. Presenting $125 million plus the other $48 million as $173 million would be wrong regardless of that future decision.[2]

The response includes admissions, remediation and independent review

The legal status of the findings also differs from a blanket settlement without admissions. UBS admitted FinCEN’s statement of facts and civil Bank Secrecy Act violations. The SEC settlement expressly preserves the admissions made in the FinCEN matter while otherwise using its stated no-admission terms. FinCEN explains that civil willfulness can include reckless disregard or willful blindness; this is not a criminal conviction requiring a separate criminal standard to be met.[1][2]

The SEC acknowledged remedial acts, cooperation and undertakings to review the FX-wire monitoring and ongoing customer-due-diligence controls. The CFTC said it recognised UBS’s representations concerning remediation. In its publicly filed BrokerCheck statement, the firm described the four actions as arising from the same facts and circumstances, highlighted the remedial work considered by the SEC, and reported that it paid the SEC’s $20 million penalty on 3 August. That payment statement is attributed to the firm.[1][3][4]

FinCEN’s undertaking goes beyond announcing a replacement system. It requires an independent AML programme consultant, subject to stated independence conditions, to review the controls and report on weaknesses, followed by an implementation process and progress reporting. A separate retrospective review is intended to identify reportable activity that the earlier controls missed. The consultant’s work is evidence to be produced under the settlement, not an independent certification that can already be assumed complete.[2]

The retrospective review extends the evidential question beyond the named FX-wire defects. FinCEN requires data-lineage mapping and testing to determine whether other products were exposed to material monitoring gaps with similar root causes when the automated system was implemented. The obligation to test for those gaps is not a finding that they necessarily existed in every other product. It is a defined way to investigate whether a shared processing weakness had a wider reach.[2]

The order requires the retrospective review report within 180 days of the consent order and the resulting required SAR filings within 90 days of that report, with one 60-day filing extension available as of right. These are relative deadlines in the settlement. The records reviewed do not contain the consultant’s completed report or a public accounting of all resulting filings, so the eventual number of additional reports and affected transactions remains unresolved.[2]

This distinction is particularly consequential because the 2026 case follows the earlier 2018 action. A promise to automate did not settle whether every relevant record arrived, remained linked to its context and generated a properly investigated alert. The new undertakings put examination of the data and governance behind the system into the remedy. Their effectiveness will depend on the review and implementation evidence, rather than the description of the technology alone.[1][2]

What the public record establishes

The documents establish a concentrated value exposure within a smaller count of inadequately monitored wires, a chain of specific data failures and delayed suspicious activity reporting. They also record remedial work and a penalty structure that prevents the parallel assessments being added indiscriminately. They do not quantify how much criminal money ultimately passed through the affected wires or how much could have been prevented through timely reporting.[1][2]

For other intermediaries, the useful test is whether a monitoring process can reconcile its expected transaction population to what was actually analysed, in both numbers and value, and explain the exceptions. For UBS, the next evidential milestones are the independent review, any resulting control changes and FinCEN’s treatment of qualifying costs. The 4%-versus-20% finding makes the broader point concrete: high apparent coverage by record count can coexist with a substantial gap in the financial activity under surveillance.[1][2]

Report an error or submit an update