https://www.compliancecorylated.com/news/near-20-year-aml-failure-costs-ubss-us-broker-dealer-125-million-remediation-ongoing/

UBS Financial Services’ (UBSFS) anti-money laundering (AML) compliance and controls failures spanning almost two decades will cost it up to $125 million in fines, levied by four US regulatory bodies.

The Financial Crimes Enforcement Network (FinCEN), the lead agency on the fine, called out Swiss bank UBS’s US broker-dealer for its “recidivist” and “historically deficient” gaps in transaction monitoring and failure to comply with a 2018 consent order. The Securities and Exchange Commission (SEC), the Commodity Futures Trading Commission (CFTC), and the Financial Industry Regulatory Authority (FINRA) were also part of the enforcement action.

Despite this repeated non-compliance, FinCEN deferred $15 million of the fine until 2028, when it could be waived if UBSFS completes the mandated remediation to regulators’ satisfaction. There was no indication that the firmʼs ability to grow its business would be restricted.

FinCEN and other US regulators found that UBSFS retained ultra-wealthy Russian clients — including ones linked to President Vladmir Putin — as well as corrupt Mexican officials, and a Venezuelan financial services firm. UBSFS did not offboard politically exposed Russian clients until after the full-scale invasion of Ukraine in 2022 and, according to FinCEN, still has some wealthy Russian clients.

The consent order did not specify any conditions that would restrict UBSFS from onboarding Russian or Latin American clients or expansion into high-risk client segments and jurisdictions. A limit on business growth is a common enforcement and supervisory tool, most recently applied on TD Bank for AML failures in 2024.

According to Becki LaPorte, an AML expert at FinScan in Atlanta, limiting growth “speaks a language that the board and the chief executive understand. It affects everything”.

Ongoing remediation

FinCEN ordered a suspicious activity report (SAR) lookback review covering all “foreign currency wire transactions or attempted transactions by, at, or through UBSFS” from 2019 to 2021. This included a “complete data lineage” mapping to see whether transaction monitoring of other products was impacted by the same deficiencies found in the foreign currency wire monitoring.

“The fine is a small part of what they will have to pay in terms of lookback work and remediation,” LaPorte said. “This isn’t a normal lookback. Even a 30-day lookback is difficult, costly and time-consuming. In this case there are some areas that won’t have a system to lookback at.”

UBSFS must now commission an independent review of its current AML programme, including risk-based testing of its high-risk customers. The independent consultant will prioritise customers and transactions with potential ties to the US Southwest border, cartels, and possible narcotics trafficking; Iran; Venezuela; and Russia.

FinCEN has reserved the right to expand the scope of remediation.

2018 commitment, monitoring failures

The deficiencies in UBSFSʼs Bank Secrecy Act (BSA) compliance programme date back to 2004, but between 2019 and 2023 alone, more than 61,5000 foreign currency transactions worth about $10.5 billion were executed and largely unmonitored.

This failure to fix its monitoring system and conduct proper client due diligence, together with insufficient staff training and incompetence, caused the firm to miscategorise high- and higher-risk clients, leading to years-long reliance on manual reports that were “incomplete and very messy”.

As part of its 2018 agreement, which came with a $14.5 million fine, UBSFS promised to install a new automated monitoring system by mid-2019. But within weeks of making a commitment, senior UBS executives knew that the deadline would be missed but failed to notify FinCEN and other US regulators of the setback and non-compliance with the consent order.

“Compliance teams should be in contact with regulators at all times, but especially during a remediation programme. It gives the appearance of partnership,” LaPorte said. More communication could stop problems becoming much bigger.

FinCEN repeatedly pointed to data governance as a contributing factor to the new transaction monitoring systems failures, as well as a lack of “appropriate policies, procedures and internal controls”. The new foreign currency wire monitoring system was not in place until March 2021 and it did not work properly.

Data governance

UBSFS selected the wrong data feed, which meant about 5% of transactions were excluded from monitoring. About 12% of transactions were missing critical counterparty information, a fault cited in the 2018 consent order.

The firmʼs data repository had “no exemption queue” to indicate when foreign currency wires were not being captured by the automated system. This omission caused a failure to “identify the existence of, much less remediate, unmonitored transactions and the root causes that prevented them from being properly monitored”.

“This failure was particularly egregious in light of the large size, scale and complexity of UBSFS’s business,” FinCEN said.

Gaps in foreign currency wire monitoring persisted in some form until late 2023 — five years after the first consent order and nearly 20 years after the original failure began. FinCEN has not capped UBSFS’s ability to execute foreign currency wire volumes while remediation is ongoing.

Excel controls

From 2012 through to “at least” March 2021, UBSFS used a manual control managed in Excel to monitor “foreign currency wires effected through customers’ commodities accounts, even after the 2018 Consent Order and contrary to representations to FinCEN”.

This control required staff to query four separate systems and manually copy and paste data, a process described internally as a “big issue” because the data was “incomplete and very messy”. FinCEN identified three other failures that made the manual monitoring unfit.

The control was not calibrated for the AML/countering the financing of terrorism (CFT) risks posed by the firm’s client base. It used only three parameters, that missed risk indicators such as high-risk jurisdictions, velocity patterns, dormant accounts and round-dollar transactions.

Those parameters were not introduced until 2021 when the automated system was implemented. In one report run, nearly half of the records lacked valid account numbers. The flawed report was run infrequently, quarterly at best. In 2019, two runs covered the entire year’s transactions, FinCEN said.

Zero SARs filed

UBSFS staff discovered a coding glitch in Excel in late 2020, which together with a lack of quality control in generating the report, meant it failed to notice it had systematically undercounted the value of foreign currency wires for roughly two years. “This delayed discovery resulted in a failure to ‘alertʼ on hundreds of transactions,” said FinCEN.

Despite knowing the glitch had affected previous reports, staff took no steps to escalate the issue or assess the scope of the missed transactions. Two months after discovering the issue — and on the back of a visit from the FINRA— UBSFS voluntarily launched a lookback exercise but failed to file any SARs.

This failure occurred despite suspicious activity being identified from a Venezuelan financial institution; a customer whose beneficial owner was under investigation for tax evasion and money laundering; and a Mexico-based customer involved in alleged fraud (who was later kidnapped and murdered).