Repeat enforcementUBS Financial Services · FinCEN
A prior monitoring weakness was not meaningfully remediated.
Official finding. FinCEN's 2026 action states that a 2018 order identified weaknesses in automated monitoring of foreign-currency wires; despite assurances of remediation, UBSFS did not meaningfully address the issue for years and later failed to appropriately monitor more than 50,000 such wires.
FCRisk synthesis. Remediation is not complete when the action plan closes; it is complete when the original failure mechanism can no longer recur without being detected.
Primary source — FinCEN ↗
Long-running remediationHSBC · FCA
Weaknesses persisted despite repeated highlighting.
Official finding. The FCA described HSBC's monitoring systems as ineffective for a prolonged period despite issues being highlighted on numerous occasions and noted that remediation took a long time.
FCRisk synthesis. Repeated identification without timely risk reduction points to a remediation governance problem as well as a control-design problem.
Primary source — FCA ↗
Fix without verificationMetro Bank · FCA
The defect was fixed before completeness assurance was fully established.
Official finding. Metro fixed the identified data-feed problem in 2019, but the FCA states that the bank still lacked a mechanism consistently checking that all relevant transactions were fed into monitoring until December 2020.
FCRisk synthesis. Technical remediation and control remediation are different deliverables. The latter requires ongoing proof that the failure mechanism is contained.
Primary source — FCA ↗
Underlying weaknessSantander UK · FCA
Earlier improvements did not adequately address the underlying weaknesses.
Official finding. Santander began an improvement programme in 2013; the FCA states that although changes produced some improvements, Santander later concluded they did not adequately address the underlying weaknesses and in 2017 decided on a comprehensive restructuring of processes and systems.
FCRisk synthesis. A programme can deliver activity and still fail causal closure if the target state does not address structural drivers of the weakness.
Primary source — FCA ↗
Audit findingDanske Bank · Central Bank of Ireland
Internal audit identified monitoring inadequacies before adequate corrective action.
Official finding. The Central Bank of Ireland's enforcement narrative links long-standing monitoring exclusions with an internal-audit finding and delayed adequate remediation.
FCRisk synthesis. Assurance only protects the firm if findings are translated into owned, timely and evidenced corrective action.
Primary source — Central Bank of Ireland ↗
Repeatedly highlightedGuaranty Trust Bank UK · FCA
Weaknesses were repeatedly raised but not fixed appropriately.
Official finding. The FCA states that AML weaknesses were repeatedly highlighted to GT Bank by internal and external sources, including the FCA, but the bank failed to take appropriate action to fix them.
FCRisk synthesis. Repeat findings are a signal to examine issue ownership, root-cause scope, closure governance and the quality of effectiveness testing — not just the individual control action.
Primary source — FCA ↗
Growth · Resourcing · ChangeTD Bank · DOJ / OCC
Known deficiencies remained while risk, products and the business evolved.
Official finding. DOJ states that TD's monitoring programme remained effectively static for years despite known deficiencies, emerging risks and new products/services; the OCC separately imposed growth restrictions and measures intended to ensure sufficient remediation resources.
FCRisk synthesis. Sustainable remediation must be designed against the future operating state, not only the business that existed when the issue was first raised.
Primary source — U.S. DOJ ↗ · Primary source — OCC ↗
