I launched an AML company yesterday. There’s a version of this post where I connect those two things by saying UBS should have bought what we’re selling.

That’s not this post.

The number is the largest Bank Secrecy Act penalty ever levied against a broker-dealer. FINRA, the SEC and the CFTC brought parallel actions the same week.

I’ve held a lead compliance seat under a consent order. The people running that program were not lazy and they were not under-resourced. Read the orders and you find something more uncomfortable than negligence.

The findings aren’t really about missed transactions.

They’re about customers with ties to Russia and Latin America who were rated low risk. There was adverse media linking those same customers to corruption, fraud and money laundering — media the firm already had. In addition, affiliates inside the bank raised concerns about specific customer risk profiles. Those concerns didn’t move the ratings.

The signal was never hiding in the wire data. It was sitting in the actor data, and nothing in the risk detection stack was built to act on it.

Here’s the detail I can’t stop looking at. When the firm moved to an automated monitoring tool in 2021, the implementation omitted roughly a third of the foreign currency wires in the retail accounts it was meant to cover. A third. For more than two years.

Nobody catches that, because a missing third of transactions looks like nothing at all. A missing actor looks like something. When your unit of analysis is the transaction, coverage gaps are invisible by design.

And this is the second time. UBS settled in 2018 over foreign wire monitoring failures. The legacy system stayed in place until 2021, and the tool that replaced it carried the gap I just described. The failures ran to June 2023.

When a control fails twice, under different leadership, with more money behind it, the control isn’t the problem. The model is.

That’s the whole reason Section 2 exists. Not because AML teams aren’t trying, but because the unit of analysis we handed them was never going to be effective.

To every AML officer reading this week’s headlines and quietly recognizing your own program: you are not the failure in this story.

— Debra