On March 6, 2026, the SEC and FinCEN announced parallel enforcement actions against a New York-based registered broker-dealer for systemic anti-money laundering (“AML”) failures, imposing combined penalties of $80 million – the largest ever imposed against a broker-dealer for BSA violations. FinCEN’s $80 million headline penalty includes credits of $20 million each to the SEC and FINRA, with $35 million payable directly to the Treasury; the SEC separately imposed a $20 million penalty and a censure. This alert summarizes the key findings, penalties, and practical takeaways for broker-dealers and other financial institutions.
Link to Key Takeaways Key Takeaways
- Broker-dealers in higher-risk markets (i.e., over-the-counter (“OTC”), microcap, and penny stocks) face steep consequences for underinvesting in AML surveillance.
- Unreviewed surveillance reports can constitute willful BSA and Exchange Act violations.
- Customer due diligence (“CDD”) must be individualized and risk-based, not simply a box-checking exercise.
- Firms that acknowledge AML deficiencies to regulators – whether in examination responses, corrective action plans, or consent agreements – but fail to follow through with meaningful remediation can expect regulators to treat those unaddressed findings as evidence of willfulness and an aggravating factor in penalty calculations.
- Facially adequate AML infrastructure – such as collecting onboarding documents, generating surveillance reports, and cataloguing exception data – may be treated as no controls at all absent meaningful analysis, effective critical review, and timely follow-up on flagged activity.
Link to Key Regulatory Findings Key Regulatory Findings
Inadequate AML Program
Both actions center on the broker-dealer’s underinvestment in AML controls relative to the risks of its OTC business. Key surveillance reports were not reviewed, reports that were reviewed relied on arbitrary filters and unreasonable thresholds that rendered them ineffective, and just four employees – none with AML experience or formal training – were responsible for over 100 unique surveillance reports.
Customer Due Diligence Failures
The firm risk-rated account types rather than individual customers, treated CDD as a document-collection exercise rather than an analytical tool, and failed to verify beneficial ownership or resolve obvious inconsistencies.
Failure to File Suspicious Activity Reports
These failures resulted in at least 160 unfiled SARs across dozens of OTC securities and thousands of suspicious transactions.
Link to Sanctions and Remedial Measures Sanctions and Remedial Measures
FinCEN imposed an $80 million penalty ($5 million suspended pending a SAR Lookback), with $20 million each credited to the SEC and FINRA, leaving $35 million payable directly to Treasury. The SEC separately ordered a $20 million penalty and a censure.
The FinCEN order requires the firm to complete a SAR Lookback Review by an independent consultant, deliver a report to FinCEN within 180 days, and file SARs on all covered transactions within 90 days after that. The firm must also cooperate with regulators on an ongoing basis and retain all relevant records for six years.
The SEC credited several remedial steps: additional AML compliance staffing, updated exception reports, revised SAR processes, retention of third-party consultants, new supervision and review protocols, and new trade surveillance tools. FinCEN, however, noted that most of these measures came late and their effectiveness remains unproven.
Link to Practical Implications and Recommendations Practical Implications and Recommendations
Broker-dealers and other financial institutions – particularly those in higher-risk product areas – should be confident the following controls are both in place and followed:
- Conduct a holistic review of AML controls. Firms should assess whether surveillance reports use risk-based parameters, staffing and expertise match the complexity of surveillance obligations, and quality control programs can catch gaps before regulators do. As this action illustrates, the mere existence of surveillance reports and exception-tracking systems is insufficient; regulators will expect firms to demonstrate that flagged activity is subject to meaningful analysis, timely investigation, and appropriate escalation.
- Strengthen CDD processes. CDD programs must go beyond document collection to include individualized, risk-based assessments at onboarding and on an ongoing basis. This includes verifying beneficial ownership, investigating red flags, and updating customer risk profiles when anomalies arise.
- Remediate regulatory findings promptly. Regulators will treat a history of acknowledged-but-un-remediated deficiencies as evidence of willfulness and an aggravating factor in penalty determinations.
Link to Conclusion Conclusion
With $80 million in combined penalties, these parallel actions rank among the most significant AML enforcement actions against a broker-dealer in recent years. The message is clear: regulators will hold firms accountable for prolonged underinvestment in AML infrastructure, and the cost of inaction far exceeds the cost of compliance. Notably, these actions also underscore that merely having the basic infrastructure in place (i.e., collecting onboarding documents, generating surveillance reports, cataloguing exception data) is not enough; without meaningful analysis, effective critical review, and timely follow-up, those facially adequate controls may be treated as no controls at all. Firms should treat this as an occasion to pressure-test their own programs and to remediate gaps before regulators find them.
McGuireWoods will continue to monitor developments in AML enforcement involving broker-dealers, including any further actions stemming from the SEC and FinCEN’s parallel proceedings, related regulatory guidance on surveillance staffing and CDD expectations, and broader BSA compliance trends affecting firms in the OTC, microcap, and penny stock markets. For questions about AML program design and governance, SAR filing obligations, customer due diligence processes, or regulatory examination and enforcement response strategies, please contact the authors of this article or another McGuireWoods attorney with whom you work.