# What the UBS fine shows about long-term supervisory review > SwissGRC analyses the USD 125 million FinCEN fine against UBS Financial Services. It argues that GRC teams should tie every open finding to dated evidence of effectiveness instead of relying on status reports. - URL: https://swissgrc.com/ar/ubs-fine-long-term-supervisory-review-evidence-tracking/ - الناشر: SwissGRC® - تاريخ النشر: 2026-08-24 - آخر تحديث: 2026-09-17 ## معلومات أساسية - FinCEN imposed a fine of USD 125 million on UBS Financial Services Inc., the highest ever issued against a broker-dealer for Bank Secrecy Act violations. - The fine follows a USD 14.5 million penalty in 2018 for the same weakness, the monitoring of foreign currency transactions. - UBS Financial Services promised to fix the monitoring system by mid-2019, but the automated solution went live only in 2021. - Between January 2019 and June 2023, more than 61,500 foreign currency transfers with a volume of USD 10.5 billion remained unmonitored. - The current consent order requires an independent third party to review undetected suspicious transactions and the AML programme, and FinCEN credits up to USD 15 million of the costs if the review and its recommendations are completed satisfactorily. - SwissGRC recommends linking every open finding to a verified, dated piece of evidence of effectiveness, defined before the next internal audit cycle. FinCEN imposed a fine of USD 125 million on UBS Financial Services Inc., the highest ever issued against a broker-dealer for violations of the Bank Secrecy Act. This followed a fine of USD 14.5 million in 2018 for the same weakness: the monitoring of foreign currency transactions. At the time, UBS Financial Services had committed to fixing the monitoring system by mid-2019, but only delivered the automated solution in 2021. In the meantime, more than 61,500 foreign currency transfers with a volume of USD 10.5 billion remained unmonitored. In short The record fine of USD 125 million against UBS Financial Services shows that supervisory authorities do not require the promise of a measure, but its demonstrable implementation over years. Continuous, documented tracking of remediation measures with evidence of effectiveness, rather than a one-off promise, would have changed the path from the first fine in 2018 to the current sanction. 125USD million Fine imposed by FinCEN on UBS Financial Services FinCEN, press release 61,500transfers unmonitored foreign currency transactions 2019 to 2023 Wealth Management, cited in FinCEN consent order 14.5USD million Fine from the 2018 consent order Compliance Week ## How did the record fine against UBS come about? The fine is the result of a relapse: UBS Financial Services had already paid for the same shortcomings in 2018 and failed to implement the promised correction on time. In 2018, a consent order was reached with FinCEN, under which UBS Financial Services paid a fine of USD 14.5 million for various AML deficiencies. At the time, the company assured the US financial supervisory authority that it would remedy the weaknesses in the monitoring system for foreign currency transfers by mid-2019. The existing system was inadequate: transactions were reviewed at most quarterly, based on an error-prone, improvised Excel process. Despite these known weaknesses, implementation was delayed, and a modern automated monitoring system did not go live until 2021. In the meantime, between January 2019 and June 2023, more than 61,500 foreign currency transfers with a total volume of USD 10.5 billion remained unmonitored. This is the second enforcement action taken by FinCEN against the same company. ## Which commitment was not enough for the supervisory authority? A one-off commitment to remedy deficiencies was not enough for FinCEN, which required ongoing proof of actual implementation. FinCEN expects financial institutions to remedy identified AML compliance deficiencies promptly, and found that UBS Financial Services continued to fail at monitoring foreign currency transactions even after settling with FinCEN, the SEC and FINRA for the same shortcomings. Significant parts of the remediation were only addressed once FinCEN’s investigation was already underway. The current consent order therefore demands more than a renewed commitment. UBS Financial Services must engage an independent third party to conduct a retrospective review of undetected suspicious transactions as well as a comprehensive review of the AML programme. Only if this review is completed satisfactorily and the recommendations are implemented will FinCEN credit up to USD 15 million of the costs. ## What evidence tracking would have made the difference? A continuous, verified record of the implementation status of every single remediation measure would have changed the path to the record fine, not another action plan. Between the commitment made in 2018 and the actual go-live in 2021 lay the gap that FinCEN ultimately priced expensively. What would have been effective was a chain of evidence linking every committed measure to a verified implementation status: test results for the new system, documented sampling, and tracking of open findings through to demonstrable closure. This idea aligns with the insight discussed in “Risk management serves the achievement of objectives, not itself”: a control promise without ongoing evidence of effectiveness remains paper. A comparable pattern, in which a one-off commitment concealed a persistent control gap, is also shown in “EUR 89 million in losses from overlooked ICT risk controls under DORA”. ## Why does recidivism weigh so heavily with the supervisory authority? A second violation of the same obligation signals to the supervisory authority that internal controls no longer provide reliable self-correction, and increases the risk of external tips. The UBS Financial Services case is seen as a warning to anyone who underestimates recidivism and hesitant action in combating money laundering. This focus carries additional weight now that a new whistleblower programme is intended to strengthen AML enforcement, since an earlier fine makes a tip from within the company more likely. Where a first fine failed to bring about real change, employees lose confidence in an internal solution, and expect the authority to act more forcefully the second time. For the GRC function, this means that documented tracking demonstrates to the supervisory authority, and to the workforce itself, that findings are taken seriously. ## What does this mean for your own GRC function? Those responsible should link every open finding to a verified, dated evidence of effectiveness, rather than relying on status reports. The first verifiable step: internal audit or the compliance function determines, for every finding arising from a supervisory review, which evidence would justify its closure, and documents this evidence before the next internal audit cycle. A comparable principle of ongoing rather than one-off evidence tracking is discussed in “TPRM in transition: EBA guideline, DORA and MaRisk at a glance” for the management of third parties. Anyone who today merely marks findings from reviews as closed, without systematically archiving the evidence of effectiveness, is structurally repeating the pattern that led to escalation over years in the UBS Financial Services case. For practice ## Key points - Supervisory authorities do not assess the promise of a measure, but its verified implementation status over years. - A gap between promised and actual implementation weighs significantly more heavily on a second violation than on the first. - Every open finding should be tied to a specific, dated piece of evidence of effectiveness, not a status report. - Recidivism measurably increases the risk of internal tip-offs, because employees lose confidence in an internal solution. FAQ ## Frequently asked questions How high is the FinCEN fine against UBS Financial Services? FinCEN imposed a fine of USD 125 million on UBS Financial Services. It is the highest sanction ever issued against a broker-dealer for violations of the Bank Secrecy Act, and the second enforcement action taken by FinCEN against the same company. Why was UBS Financial Services already fined in 2018? In 2018, UBS Financial Services paid a fine of USD 14.5 million for various AML deficiencies in the monitoring of foreign currency transactions. The company committed to replacing the existing, error-prone monitoring system with an automated solution by mid-2019. What must UBS Financial Services now do in addition to paying the fine? The current consent order requires UBS Financial Services to engage an independent third party to carry out a retrospective review of undetected suspicious transactions as well as a comprehensive review of the AML programme. If this review is completed satisfactorily and the recommendations are implemented, FinCEN will credit up to USD 15 million of the costs. How many transactions remained unmonitored at UBS? Between January 2019 and June 2023, more than 61,500 foreign currency transfers with a total volume of USD 10.5 billion remained unmonitored, because the promised automated monitoring solution did not go live until 2021, instead of by mid-2019 as promised. What role does a whistleblower programme play in AML violations? FinCEN has introduced a whistleblower programme intended to strengthen AML enforcement. An earlier fine makes a tip-off from within the company more likely, because employees lose confidence in an internal solution when findings are repeatedly not remedied effectively. Sources 1. [Historic $125 Million Penalty Against UBS Financial Services Inc.](https://www.fincen.gov/news/news-releases/fincen-assesses-historic-125-million-penalty-against-ubs-financial-services-inc)FinCEN 2. [Record-setting AML penalty against UBS was years in the making](https://www.complianceweek.com/best-practices/fincen-record-setting-aml-penalty-against-ubs-was-years-in-the-making/)Compliance Week ## الأسئلة الشائعة ### How high is the FinCEN fine against UBS Financial Services? FinCEN imposed a fine of USD 125 million on UBS Financial Services. It is the highest sanction ever issued against a broker-dealer for Bank Secrecy Act violations and the second FinCEN enforcement action against the same company. ### Why was UBS Financial Services already fined in 2018? In 2018, UBS Financial Services paid USD 14.5 million for AML deficiencies, including weak monitoring of foreign currency transactions. It committed to fixing the monitoring system by mid-2019. ### How many transactions remained unmonitored at UBS Financial Services? Between January 2019 and June 2023, more than 61,500 foreign currency transfers with a total volume of USD 10.5 billion remained unmonitored. The automated monitoring system went live only in 2021. ### What must UBS Financial Services do besides paying the fine? It must engage an independent third party for a retrospective review of undetected suspicious transactions and a comprehensive review of the AML programme. If the review is completed satisfactorily and the recommendations are implemented, FinCEN credits up to USD 15 million of the costs. ### What does evidence tracking mean for a GRC function? Every open finding is linked to a verified, dated piece of evidence of effectiveness rather than a status report. Internal audit or compliance defines which evidence justifies closure and documents it before the next internal audit cycle.