FinCEN UBS Penalty Exposes Cost of Unremediated AML Failures

The Financial Crimes Enforcement Network (FinCEN) has assessed a $125m civil money penalty against UBS Financial Services Inc (UBSFS) for wilful violations of the Bank Secrecy Act (BSA), the largest penalty imposed to date on a broker-dealer for BSA failings. UBSFS has admitted that it failed to implement and maintain an anti-money laundering programme meeting the statutory minimum, and failed to file suspicious activity reports.

The aggravating feature is recidivism. UBSFS entered a consent order with FinCEN in December 2018, paying $14.5m in relation to deficiencies that included inadequate monitoring of foreign currency wires arising from weaknesses in its automated monitoring system. Having assured FinCEN that remediation was imminent, the firm did not deliver it, and subsequently failed to monitor more than 50,000 foreign currency wires with an aggregate value exceeding $10bn. Those failures were not disclosed; FinCEN discovered them through an investigation initiated after a regulatory examination, and significant elements of the remediation were only undertaken once that investigation was already underway.

The customer due diligence findings are equally instructive. FinCEN identified failures to consider and mitigate money laundering risk connected to high-risk customers with ties to Russia and Latin America, including inadequate treatment of source of wealth and of adverse media alleging corruption, fraud and money laundering. In at least one instance, concerns raised by a UBSFS affiliate about negative news were not acted upon. Hundreds of suspicious transactions went unreported on a timely basis.

For practitioners in the UK, the transferable issues sit squarely within Regulations 18 to 21, 27, 28 and 33 of the Money Laundering Regulations 2017 and the Financial Conduct Authority's (FCA) expectations on wealth management and high-risk customers. The first is the remediation-assurance gap. Where a firm has given a regulator, a skilled person or an internal audit function a commitment to fix a control weakness, that commitment creates its own exposure. Attestations, section 166 remediation plans and closure of audit findings should be evidenced by tested control effectiveness rather than project milestones, and closure decisions should be capable of independent validation. Governance forums should be able to demonstrate that the board or MLRO was told the truth about residual risk, and when.

The second is the treatment of adverse media and source of wealth in enhanced due diligence. Regulation 33 requires firms to examine the background and purpose of higher-risk relationships and to increase monitoring accordingly. FinCEN's criticism of dispositions that "paper" identified risk rather than assessing and responding to it maps directly onto FCA findings on wealth management files where negative news is rationalised without evidenced enquiry, and where source of wealth is corroborated by client assertion alone.

The third is intra-group escalation. Regulation 20 requires group-wide policies and the sharing of information for AML purposes. Where an affiliate raises a concern about a shared client, UK firms should be able to show the route by which that concern was received, assessed and reflected in the risk rating.

The consent order requires UBSFS to complete a third-party lookback and an independent programme review addressing priority illicit finance risks, with up to $15m of associated expenditure eligible for waiver on satisfactory completion.