Two record-breaking FinCEN penalties against broker-dealers landed within five months of each other in 2026: $80 million in March, then $125 million in August, the largest BSA enforcement action ever brought against a broker-dealer at the time each was announced. Both cases turned on the same underlying failure: monitoring and due diligence that existed on paper but did not function well enough to catch what mattered. This article extracts the specific, repeatable lessons for any broker-dealer's monitoring programme.
The March 2026 case: staffing and scale mismatch
On 6 March 2026, FinCEN entered a consent order imposing an $80 million civil penalty, later reduced to an immediate $35 million after crediting parallel SEC and FINRA penalties of $20 million each, over an alleged willful failure to implement an effective AML programme between March 2018 and June 2024. FinCEN's findings were specific: at least 160 suspicious activity reports went unfiled, the firm enabled customers with reported ties to illicit actors and a nexus to Russia and Venezuela to trade undetected, and until late 2021 just four employees, none with prior AML experience, reviewed more than 100 unique reports covering millions of line items a year.
FinCEN's language was pointed: management had 'ample notice' of deficiencies through repeated examinations but failed to act, and the firm's underinvestment let it avoid expenses, making noncompliance a de facto cost-saving measure. That framing (treating underinvestment in monitoring as a deliberate cost decision rather than an oversight) is a useful lens for any firm assessing whether its own monitoring headcount and expertise genuinely match its transaction volume.
The August 2026 case: repeat failure after prior warning
On 3 August 2026, FinCEN announced a $125 million penalty against a different broker-dealer, again for willful BSA violations, surpassing the March case as the largest broker-dealer BSA penalty to date. What made this case notable was not only the amount but that it was a repeat offense: FinCEN had previously taken action against the same firm in 2018, and the subsequent failures went undetected until regulators found them independently, rather than the firm identifying and self-reporting them.
The breakdowns were familiar: no adequate AML programme, missed SAR filings, and insufficient customer due diligence on high-risk accounts. The gap between a firm's own remediation claims after a first enforcement action and the reality regulators later found is exactly what examiners are now testing for.
What both cases have in common
Both actions cite the same three failure modes: a monitoring programme not genuinely tailored to the business and its customer base, insufficient staffing and expertise relative to transaction volume, and weak customer due diligence on the accounts that carried the most risk. Both the SEC's 2026 examination priorities and FINRA's 2026 Annual Regulatory Oversight Report reinforce these as active supervisory themes, specifically naming foreign financial institution omnibus account risk, independent testing, customer identification and beneficial ownership procedures, and red-flag detection for suspicious trading and money movement as areas under scrutiny.
Omnibus accounts recur in both the case findings and the regulatory priorities for a reason: they can obscure the underlying beneficial owner of trading activity, which makes monitoring calibrated only to the omnibus account holder, rather than to the underlying activity flowing through it, a structural blind spot.
Turning these cases into a monitoring self-check
A useful internal exercise is to test a firm's own programme against each specific finding: can the firm demonstrate its monitoring staffing and expertise scale with transaction volume, not just headcount on an org chart; does its due diligence process for omnibus and other high-risk accounts look through to underlying activity; and can it show, with dated documentation, that findings from a prior examination were actually remediated rather than just acknowledged. Firms that can answer all three with evidence, not assertion, are in a materially stronger position than either firm in these cases was before its penalty.
