Board Guide: Building Effective AML Controls

Overview

Enforcement data demonstrates that failures in Anti-Money Laundering (AML) controls are not isolated to specific firm sizes or jurisdictions. A consistent pattern emerges across regulators: deficiencies in programme design, risk-based procedures, and independent testing. These actions, spanning from 2025 to 2026, show FINRA imposing significant fines for systemic AML programme failures. UBS Financial Services Inc. was fined $20 million for failing to establish policies to detect suspicious foreign currency wires from 2019 to 2023. Similarly, RBC Capital Markets, LLC was censured and fined $275,000 for an inadequate AML programme from 2016 to 2023. Smaller firms were also cited. Beta Capital Securities LLC d/b/a Creand Securities was fined $145,000 for a programme that failed to detect suspicious activity and lacked risk-based customer due diligence from 2019 to 2023. Outset Global Trading Limited was fined $130,000 for a programme not reasonably designed for its institutional trading business from 2022 to 2025. Prime Number Capital, LLC was fined $335,000 for failures in its AML programme design and independent testing from 2021 onwards, alongside separate supervisory lapses. Moody Capital Solutions, Inc. was fined $50,000, partly for AML programme deficiencies from 2020 to 2022. The common thread is a failure to design and implement programmes tailored to the firm's specific business risks.

Key Enforcement Actions

Recent enforcement actions highlight the severe consequences of AML control failures. Regulators have imposed significant penalties and, in some cases, revoked operating licences. These actions span multiple jurisdictions and business models, underscoring the universal nature of AML obligations and the critical importance of a risk-based compliance programme. The cases illustrate specific control deficiencies that boards should scrutinise within their own organisations.

In July 2026, FINRA fined UBS Financial Services Inc. USD 20,000,000 for failing to establish and implement adequate AML policies and procedures from January 2019 through June 2023. The specific failure concerned the monitoring and investigation of suspicious foreign currency wire transactions. In the same month, FINRA fined RBC Capital Markets, LLC USD 275,000 for deficiencies in its AML compliance programme from February 2016 through September 2023. The programme was not reasonably designed to detect and report suspicious activity.

In June 2026, FINRA fined Beta Capital Securities LLC d/b/a Creand Securities USD 145,000. From October 2019 to July 2023, the firm failed to establish an adequate AML programme and lacked appropriate risk-based procedures for ongoing customer due diligence. Beyond financial penalties, regulators have imposed the ultimate non-monetary sanction: licence revocation.

In December 2025, the Central Bank of the UAE revoked the licence of Omda Exchange, striking it from the register following identified AML and regulatory failures. Similarly, in August 2025, the CBUAE revoked the licence of Malik Exchange after identifying AML and compliance failures. These actions highlight control failures across different business models and geographies. Boards must ensure their AML programmes are robust and effective, including thorough customer due diligence and suspicious activity reporting. The penalties demonstrate the high cost of non-compliance; effective AML controls are essential for financial integrity.

Analysis

Enforcement data reveals three dominant failure patterns in AML programme design and execution. The first is inadequate risk-based programme design for specific business lines. UBS Financial Services Inc. failed to establish policies to detect suspicious transactions involving foreign currency wires, a high-risk activity for its business, resulting in a $20 million fine. Similarly, Outset Global Trading Limited’s programme was not reasonably designed to monitor its institutional trading in thinly traded low-priced securities, leading to a $130,000 penalty. Beta Capital Securities LLC d/b/a Creand Securities also failed in this area, receiving a $145,000 fine for a programme not designed to detect suspicious activity and lacking risk-based ongoing customer due diligence procedures. Brentwood Capital Advisers LLC faced non-monetary action for related failures in beneficial ownership verification and programme documentation. The second pattern is insufficient independent testing. MCAP LLC was fined $15,000 for failing to conduct any independent testing in 2021 and 2022 and for unreasonable testing in 2023 and 2024. Prime Number Capital, LLC was penalised $335,000 for, among other violations, a failure to conduct reasonable testing of its AML programme. The third pattern involves failures in ongoing customer due diligence, which compounds the first two. Beta Capital’s violation explicitly included this deficiency. Prime Number Capital’s failures also spanned inadequate supervision of foreign currency wires, a core due diligence function. These patterns are consistent, demonstrating that enforcement actions target foundational programme weaknesses rather than isolated procedural lapses.

Regulatory Implications

Enforcement actions against Outset Global Trading Limited, The Ultima Global Markets (USA), Inc., and Pictet Overseas Inc. demonstrate that regulators will impose financial penalties for AML programmes not tailored to a firm's specific business risks. FINRA fined Outset Global Trading Limited $130,000 and The Ultima Global Markets (USA), Inc. $100,000 for programmes that failed to detect suspicious activity in low-priced securities, a key risk of their respective trading and correspondent account businesses. Pictet Overseas Inc. faced a separate FINRA action for similar failures in its low-priced securities transactions.

These monetary sanctions are accompanied by significant non-monetary actions that demand board-level engagement. The OCC issued a cease-and-desist order against United Texas Bank, National Association, citing deficiencies across multiple control areas including board oversight, risk assessment, and internal controls. In Australia, AUSTRAC has launched civil penalty proceedings against Mount Pritchard and District Community Club Ltd for alleged systemic non-compliance.

The collective implication is that a generic compliance framework is insufficient. Regulators expect the board and senior management to ensure the AML programme's design and implementation are dynamically calibrated to the firm's unique risk profile, whether in securities trading, banking, or gaming. Effective oversight requires verifying that controls are specifically designed to monitor and mitigate the risks inherent in the firm's actual business activities.

Key Takeaways

* UBS Financial Services Inc. was fined USD 20,000,000 for failing to establish and implement adequate AML policies and procedures from January 2019 through June 2023.
* Beta Capital Securities LLC d/b/a Creand Securities incurred a fine of USD 145,000; its AML programme was not designed to detect suspicious transactions from October 2019 to July 2023.
* Outset Global Trading Limited was fined USD 130,000; its AML programme was not designed to detect suspicious transactions from January 2022 to December 2025.
* Prime Number Capital, LLC was fined USD 335,000 for failing to establish and implement an AML programme from January 2021.
* Prime Number Capital, LLC also failed to conduct reasonable testing of its AML programme from January 2021.
* MCAP LLC was fined USD 15,000 for failing to conduct any independent testing of its AML programme in 2021 and 2022.

About the Data

This analysis uses 18 topic-filtered actions linked to official regulatory sources across 7 regulators: FINRA, CBUAE, FSMA, OCC, CBI, AUSTRAC, SFC. The records cover 2025-07-03 to 2026-07-31. 8 records contain a monetary penalty verified against the evidence contract. Monetary values retain their source currency; GBP-normalised values are reserved for explicitly labelled aggregate charts. Other records may describe cancellations, prohibitions, investigations, orders or sanctions whose monetary value is not verified. The selection supports this article's analysis but is not a complete catalogue of every action in the period.