KYC Failure Statistics 2026
By Axis Intelligence Research
Co-author: Sarah Davis | Last updated: August 7, 2026 | License: CC BY 4.0
Regulators announced $205,000,000 in US civil money penalties for anti-money laundering programme failures in the first seven months of 2026 and £0 in the UK. Of the US total, roughly half will ever reach a treasury. Axis Intelligence Research finds a KYC Penalty Realisation Index (KPRI) of 49.6% in the United States against 70.2% in the United Kingdom — a 20.6-point enforcement gap hiding inside identical headlines.
Quick Answer
Announced KYC and anti-money laundering penalties are not the amounts firms pay. Across six verified 2024–2026 enforcement actions, Axis Intelligence Research calculates that UK firms remit 70.2% of the headline figure and US firms 49.6%, because both regimes discount: the FCA through a flat 30% early-settlement reduction, FinCEN through crediting parallel SEC, FINRA and CFTC penalties against its own assessment. UBS Financial Services was assessed $125m on August 3, 2026; $62m goes to the Treasury.
Key Findings
- Axis Intelligence Research finds that the KYC Penalty Realisation Index stands at 49.6% for US actions and 70.2% for UK actions across the 2024–2026 cohort, a value-weighted gap of 20.6 percentage points.
- FinCEN assessed a $125,000,000 civil money penalty against UBS Financial Services on August 3, 2026 — the largest ever against a broker-dealer — of which $62,000,000 is payable to the US Treasury after $48,000,000 in credited SEC, FINRA and CFTC penalties.
- Axis Intelligence Research finds that 85.7% of the total value of FCA fines published in 2025 came from financial-crime systems-and-controls failures (£106,436,163 of £124,221,367), against 25.9% in 2024 and 0% of the £16,842,723 published so far in 2026.
- UBS failed to adequately monitor more than 61,500 foreign currency wires worth over $10.5 billion between January 2019 and June 2023 — an average of roughly $170,700 per unmonitored transaction — after promising FinCEN in 2018 that it would fix exactly that control.
- Axis Intelligence Research counts 119 published FinCEN enforcement actions since 1999, with annual volume falling from a 2015–2019 mean of 5.4 to a 2021–2025 mean of 3.0 — a 44.4% decline in case count even as individual penalties reached record size.
What Counts as a KYC Failure in Enforcement Terms?
“KYC failure” is shorthand. Regulators do not fine firms for a category called know-your-customer; they fine them for named breaches that cluster around four control points. Getting the taxonomy right matters, because the four failure modes carry very different remediation costs and very different exam exposure.
The first is onboarding due diligence — identity verification, source-of-wealth enquiry, beneficial ownership, adverse-media screening at account opening. The second is ongoing customer due diligence, the periodic refresh that is supposed to catch a customer whose risk profile has moved. The third is transaction monitoring, where the customer risk profile is meant to be tested against actual behaviour. The fourth is suspicious activity reporting, the output the whole apparatus exists to produce.
Nearly every large action of the past two years cites at least three of the four. That is the structural point buried in the enforcement record: KYC does not fail at one control. It fails as a chain, and the chain is only ever as strong as the customer risk profile sitting at its head.
The Axis KYC Control-Failure Matrix — 2024 to 2026
Every published action in the cohort, classified against the four control points as described in the regulator’s own notice.
| Action | Date | Onboarding CDD | Ongoing CDD / refresh | Transaction monitoring | SAR / STR reporting | Source |
|---|---|---|---|---|---|---|
| Metro Bank plc | 2024-11-12 | — | ● | ● | — | fca.org.uk |
| Starling Bank Ltd | 2024-09-27 | ● | ● | ● | — | fca.org.uk |
| Monzo Bank Ltd | 2025-07-08 | ● | ● | ● | — | fca.org.uk |
| Barclays Bank plc | 2025-07-14 | — | ● | ● | — | fca.org.uk |
| Nationwide Building Society | 2025-12-11 | — | ● | ● | — | fca.org.uk |
| Paxful, Inc. | 2025-12-09 | ● | ● | ● | ● | fincen.gov |
| Canaccord Genuity LLC | 2026-03-06 | ● | ● | ● | ● | fincen.gov |
| UBS Financial Services Inc. | 2026-08-03 | ● | ● | ● | ● | fincen.gov |
Axis Intelligence Research classification, derived from each regulator’s published notice or consent order. ● indicates the control point is expressly cited among the findings.
The pattern that survives the classification: ongoing customer due diligence and transaction monitoring are cited in all eight actions. Onboarding is cited in five. Nobody is being fined primarily for failing to check a passport at account opening. They are being fined for what happened in years two through eight of the relationship.
Sarah Davis: The industry spends its budget where the friction is visible — onboarding, because that is where conversion is measured and where the vendor demos land. The enforcement record points somewhere else entirely. Refresh cycles have no conversion metric attached, so they get the leftover headcount, and that is precisely where the notices land. In the UBS matter one customer moved to Russia, joined a state-supported technical university, added a Russian phone number to his profile, funded the account exclusively from a same-name Russian bank account — and stayed rated Low-risk, and therefore outside periodic review, for more than eight years. No onboarding control in the world catches that. Only refresh does.
How Much Do KYC and AML Failures Actually Cost in 2026?
Two numbers exist for every enforcement action, and the press almost always reports the wrong one.
FinCEN’s August 3, 2026 action against UBS Financial Services carries a headline of $125,000,000 — the largest Bank Secrecy Act penalty ever imposed on a broker-dealer, according to FinCEN’s news release. The consent order sets out what is actually payable. FinCEN credited $48,000,000 of parallel penalties — $20m to FINRA, $20m to the SEC, $8m to the CFTC — against its own assessment. UBS pays $62,000,000 to the US Treasury within ten days. A residual $15,000,000 falls due by May 31, 2028 and is waivable, at FinCEN’s sole discretion, against qualifying expenses incurred on the mandated independent AML programme review.
The United Kingdom discounts differently but discounts just as hard. Every UK financial-crime penalty in this cohort carries a flat 30% early-settlement reduction. Nationwide Building Society would have been fined £62,969,297 and paid £44,078,500. Monzo’s pre-discount figure was £30,130,475 against a final £21,091,300. Metro Bank’s was £23,821,700 against £16,675,200.
KYC and AML Penalties: Announced vs. Payable, 2024–2026
| Firm | Regulator | Date | Announced / gross | Payable to the state | Realisation | Source |
|---|---|---|---|---|---|---|
| Metro Bank plc | FCA | 2024-11-12 | £23,821,700 | £16,675,200 | 70.0% | fca.org.uk |
| Starling Bank Ltd | FCA | 2024-09-27 | £40,959,426 | £28,959,426 | 70.7% | fca.org.uk |
| Monzo Bank Ltd | FCA | 2025-07-08 | £30,130,475 | £21,091,300 | 70.0% | fca.org.uk |
| Nationwide Building Society | FCA | 2025-12-11 | £62,969,297 | £44,078,500 | 70.0% | fca.org.uk |
| Paxful, Inc. | FinCEN | 2025-12-09 | $3,500,000 | $1,750,000 | 50.0% | fincen.gov |
| UBS Financial Services Inc. | FinCEN | 2026-08-03 | $125,000,000 | $62,000,000 | 49.6% | fincen.gov |
Gross figures are the pre-discount penalty (FCA) or the assessed civil money penalty (FinCEN). Payable is the amount remitted to HM Treasury or the US Treasury, excluding contingent or waivable balances.
One anomaly is worth naming because it is invisible unless you run the arithmetic. Starling’s final penalty of £28,959,426 is not 30% below its £40,959,426 gross — a clean 30% cut would land at £28,671,598. The £287,828 difference implies a non-discounted element of exactly £959,426 sitting inside the total, with the 30% reduction applied only to the £40,000,000 penalty component. Starling is the sole action in this cohort where the discount does not apply to the whole figure, which is why its realisation rate is 70.7% rather than 70.0%.
The KYC Penalty Realisation Index (KPRI)
KPRI — KYC Penalty Realisation Index. The share of announced KYC and anti-money laundering penalty value that a regulator actually collects, expressed as a percentage of the gross or assessed figure.
Formula:
KPRI = ( Σ amount payable to the state ) ÷ ( Σ announced or assessed penalty ) × 100
Inputs and computation, as of August 7, 2026:
United States — gross $125,000,000 + $3,500,000 = $128,500,000; payable $62,000,000 + $1,750,000 = $63,750,000. KPRI (US) = 63,750,000 ÷ 128,500,000 × 100 = 49.6
United Kingdom — gross £23,821,700 + £40,959,426 + £30,130,475 + £62,969,297 = £157,880,898; payable £16,675,200 + £28,959,426 + £21,091,300 + £44,078,500 = £110,804,426. KPRI (UK) = 110,804,426 ÷ 157,880,898 × 100 = 70.2
Baseline reading, August 7, 2026: KPRI-US 49.6 · KPRI-UK 70.2 · spread 20.6 points.
The unweighted mean of individual action ratios gives 49.8 (US) and 70.2 (UK), so the value-weighting is not doing the work — the gap is structural, not an artefact of UBS dominating the US sample.
What the index captures. The cash that leaves the firm and arrives at a treasury, against the number that appears in the headline. Nothing else.
What it does not capture. Remediation spend, which in several of these matters exceeds the penalty; the cost of a mandated look-back; parallel criminal penalties; and, on the US side, the possibility that a waivable balance is never waived. UBS’s realisation rises to 61.6% if the full $15,000,000 residual is ultimately paid rather than offset against qualifying expenses. Both readings are published here rather than averaged, because they answer different questions.
Methodology version and revision. KPRI is computed on a fixed cohort of published enforcement actions with both a gross and a payable figure disclosed in the regulator’s own notice or order. Actions where the regulator publishes only one number are excluded rather than estimated — which is why Canaccord Genuity, Brink’s Global Services and Barclays sit outside the index while appearing elsewhere in this dataset.
Sarah Davis: A 30% discount for early settlement is a rational supervisory tool — it clears the docket and funds the next investigation. Crediting another agency’s penalty against your own is a different animal. It means the marginal deterrent of the second, third and fourth regulator showing up is close to zero, because the total was set by whoever assessed the largest single number. If you are modelling AML enforcement exposure for a board, the headline is the wrong input. The payable figure, plus the consultant bill for the look-back, is the number that hits the P&L.
Which Control Failures Show Up Most Often in Consent Orders?
The UBS consent order is unusually granular about failure rates, and those rates are the closest thing the public record offers to a benchmark for what a broken monitoring stack looks like from the inside.
- More than 5% of foreign currency wires were excluded from the automated monitoring system entirely, on a one-month sample taken in early 2022.
- Roughly 12% more were captured but missing counterparty information.
- Nearly 20% of outgoing foreign currency wires lacked a beneficiary address, in a sample reviewed by the firm’s third-party consultant.
- In one run of the interim manual report, nearly half of records lacked a valid account number.
- Adverse-media screening on one ultra-high-net-worth customer returned thousands of hits across more than 300 articles at onboarding; the periodic KYC process later returned more than 150 articles, of which the first 25 were reviewed — a 16.7% review rate.
That last figure deserves to be sat with. It is not a technology gap. Screening worked. It produced 150 results. Someone read a sixth of them and closed the file.
The Data-Quality Substrate
Read across all eight actions and the failures converge on something less glamorous than a missed red flag. UBS selected an incorrect, partial data feed instead of the complete end-of-day feed. It built matching logic vulnerable to exchange-rate rounding. It had no exception queue to catch a wire the monitoring system could not process. Its payment operations team relabelled certain wires from “FX RECEIVED” to “FX RCVD”, which quietly stopped them reaching the monitoring system at all.
Nationwide’s failure has the same shape: it lacked effective systems for keeping due diligence and risk assessments current across its personal current account book, and it knew some of those customers were running business activity through personal accounts at a point when it offered no business current account and had no process for the resulting risk. In one case that reached the FCA’s press release, a customer received 24 payments totalling £27.3m of fraudulent Covid furlough money over 13 months, £26.01m of it inside eight days. HMRC recovered £26.5m. Roughly £800,000 did not come back.
Monzo’s onboarding accepted customers using famous London landmarks as their home address. Starling’s automated sanctions screening had, since 2017, been checking customers against a fraction of the full designated list, and it opened over 54,000 accounts for 49,000 high-risk customers between September 2021 and November 2023 while under a voluntary requirement not to.
Is KYC Enforcement Increasing or Decreasing?
Both, depending on which axis you measure. Axis Intelligence Research counted every action on FinCEN’s published enforcement index and the case-volume trend runs the opposite way to the penalty trend.
FinCEN Published Enforcement Actions by Period
| Period | Actions published | Mean per year | Source |
|---|---|---|---|
| 1999–2009 | 44 | 4.0 | fincen.gov |
| 2010–2014 | 29 | 5.8 | fincen.gov |
| 2015–2019 | 27 | 5.4 | fincen.gov |
| 2021–2025 | 15 | 3.0 | fincen.gov |
| 2026 (to Aug 7) | 2 | — | fincen.gov |
Axis Intelligence Research census of the FinCEN enforcement index, 119 actions total, retrieved August 7, 2026.
Case volume fell 44.4% between the 2015–2019 and 2021–2025 means. Over the same stretch, individual penalty size went the other way: the two 2026 actions alone carry $205,000,000 in assessed penalties between them.
The UK picture is sharper still, and it is the finding most likely to surprise anyone tracking this space. Financial-crime failures accounted for 85.7% of all FCA fine value published in 2025 — £106,436,163 across five penalties out of a £124,221,367 total. In 2024 the share was 25.9%. And of the £16,842,723 the FCA has published in 2026 through its most recent update, not one penalty concerns anti-money laundering or financial-crime systems and controls. The 2026 list is listing rules, market abuse, insider dealing and individual fitness.
FCA Financial-Crime Fines as a Share of Total Fine Value
| Year | Financial-crime fine value | Total fine value | Share | Source |
|---|---|---|---|---|
| 2024 | £45,634,626 | £176,045,385 | 25.9% | fca.org.uk |
| 2025 | £106,436,163 | £124,221,367 | 85.7% | fca.org.uk |
| 2026 (to date) | £0 | £16,842,723 | 0.0% | fca.org.uk |
The FCA’s own count, published in the Nationwide notice, is that it has imposed 13 fines totalling £300,767,526 on banks for anti-money laundering systems and controls failings since 2021 — a mean of £23,135,964 per action.
Sarah Davis: A zero is not the same as an absence. Financial-crime cases take four to six years from opening to final notice — Monzo’s covered conduct ending in 2022, Nationwide’s ending in July 2021 — so a quiet 2026 tells you about the 2020–2021 supervisory intake, not about current risk appetite. The pipeline argument cuts both ways, though. If the FCA opened fewer AML investigations in the years it was rebuilding its enforcement approach, the quiet period runs to 2028. Anyone reading the 2026 zero as a signal that the regime has softened is reading a lag as a policy.
What Does Recidivism Cost?
FinCEN’s index makes one thing computable that is otherwise buried: how often the same institution comes back.
Four entities appear twice on the published enforcement index — Western Union (2003, 2017), Oppenheimer (2005, 2015), TD Bank (2013, 2024) and UBS Financial Services (2018, 2026). Axis Intelligence Research calculates a mean interval of 10.8 years between first and second published action.
UBS compresses that to 7.6 years and pays for the compression. Its December 2018 consent order carried a $14,500,000 penalty and found that the firm had failed to adequately monitor foreign currency wires because of weaknesses in its automated monitoring system. It told FinCEN the new system would be live by mid-2019. It went live in March 2021, flawed, and the monitoring failure persisted into the second quarter of 2023. The second penalty is 8.6 times the first. FinCEN’s director framed it in a single word: recidivist.
The number that gives that framing teeth: UBS did not disclose the delay. FinCEN found it through its own investigation following a regulatory examination.
Methodology
Collection. Every figure in this analysis was retrieved from a regulator’s own publication between August 6 and August 7, 2026. Sources are limited to FinCEN news releases and consent orders, the FinCEN published enforcement index, and FCA press releases, final-notice listings and annual fines pages. No aggregator, vendor survey or law-firm summary was used as the source of any published number; several were used to locate primary documents, which were then retrieved and read.
The enforcement census. Actions were counted row by row from the FinCEN enforcement index as displayed on August 7, 2026. The index shows 119 published actions from 1999 to date. Two 2012 rows relating to the same HSBC matter number appear under different institution categories and are counted as published rows, consistent with the index’s own presentation. The 2017 and 2018 Artichoke Joe’s entries are counted as published, the second superseding the first, again as the index presents them.
KPRI construction. Only actions where the regulator discloses both a gross or assessed figure and a payable figure enter the index. Contingent, waivable and future-dated balances are excluded from the payable numerator and disclosed separately in the text. No currency conversion is performed; the US and UK readings are computed and reported separately because converting between them would introduce an exchange-rate artefact into a ratio that has nothing to do with exchange rates.
Arithmetic. All sums, shares, ratios and implied values were computed in Python against the published inputs before drafting. The implied £959,426 non-discounted element in the Starling penalty was derived algebraically from the published gross and net figures and verified to reconstruct the published net exactly.
Classification. The control-failure matrix reflects only what each regulator expressly cites. Where a notice describes a failure in general terms without attributing it to a specific control point, no mark is recorded.
Figures deliberately not published. Three claims were available and refused. Global AML fine totals circulating for 2025 and 2026 could not be traced to a regulator publication and are excluded. FinCEN’s 2025 total assessed penalty value is not stated because the Brink’s Global Services consent order amount was not retrieved. Canaccord Genuity’s payable figure is described in secondary coverage as $40,000,000 after credited SEC and FINRA penalties; because that number was not confirmed from the consent order itself, Canaccord is excluded from KPRI and appears only with its verified $80,000,000 assessment.
About This Dataset
Contents. Enforcement-level data on KYC and anti-money laundering failures published by FinCEN and the Financial Conduct Authority, covering announced and payable penalty values, control-failure classification, disclosed failure rates from consent orders, and a full census of the FinCEN enforcement index.
Temporal coverage. 1999 to August 7, 2026. Penalty-level detail concentrates on 2024–2026.
Spatial coverage. United States, United Kingdom.
Licence. CC BY 4.0. The dataset may be reused, redistributed and built upon, including commercially, with attribution.
Format. UTF-8 CSV, one row per observation, full provenance columns on every row.
Citation: Axis Intelligence Research, KYC Failure Statistics 2026, 2026.
Cite This Research
APA Axis Intelligence Research, & Davis, S. (2026). KYC failure statistics 2026: What regulators actually charge — and actually collect. Axis Intelligence. https://axis-intelligence.com/kyc-failure-statistics/
MLA Axis Intelligence Research, and Sarah Davis. “KYC Failure Statistics 2026: What Regulators Actually Charge — and Actually Collect.” Axis Intelligence, 7 Aug. 2026, axis-intelligence.com/kyc-failure-statistics/.
Chicago Axis Intelligence Research and Sarah Davis. “KYC Failure Statistics 2026: What Regulators Actually Charge — and Actually Collect.” Axis Intelligence, August 7, 2026. https://axis-intelligence.com/kyc-failure-statistics/.
Frequently Asked Questions
Does a 30% early-settlement discount apply to the whole FCA penalty?
Not always. Three of the four UK actions in this cohort discount the entire figure, producing a clean 70.0% realisation. Starling’s does not: reconstructing the published gross and net figures gives an implied £959,426 element to which the reduction was not applied, leaving 70.7%. When you are modelling exposure, treat the 30% as applying to the penalty component and check whether any disgorgement or restitution element sits outside it.
If FinCEN credits SEC and FINRA penalties, does the firm still pay them?
Yes — the firm pays each regulator, and FinCEN reduces its own assessment by that amount. UBS pays $20m to FINRA, $20m to the SEC and $8m to the CFTC, and those $48m are credited against the $125m FinCEN assessment, leaving $62m for the Treasury. Total cash out is $110m against a $125m headline, with $15m contingent. The credit reduces FinCEN’s collection, not the firm’s total bill.
What triggers a mandated look-back, and what does it involve?
A finding that suspicious activity went unreported because monitoring was broken. UBS must engage an independent consultant to review foreign currency wire transactions across the January 2019 to June 2023 period, complete data lineage mapping and testing to establish whether other products suffered the same gaps, deliver a report within 180 days, and file all resulting SARs within 90 days of that report. Look-backs are typically the largest line item in the total cost of an AML resolution, and they are not the penalty.
Which control point generates the most enforcement exposure — onboarding or refresh?
Refresh. Ongoing customer due diligence and transaction monitoring are cited in all eight actions classified here; onboarding in five. The UBS matter contains the archetype: a customer whose domicile, employer and funding source all changed, who added a foreign phone number to his own profile, and whose Low-risk rating meant he faced no periodic KYC review for over eight years.
Do periodic reviews actually get done when adverse media fires?
The one disclosed data point is not encouraging. On a customer whose onboarding screening produced thousands of hits across more than 300 articles, the later periodic KYC process surfaced more than 150 articles and the first 25 were reviewed — 16.7%. Screening coverage and screening disposition are separate problems, and the enforcement record suggests firms have solved the first far better than the second.
Are challenger banks disproportionately represented?
In the UK cohort, yes by count. Monzo, Starling and Metro Bank are three of the six UK financial-crime penalties in 2024–2025, and the FCA’s notices tie the failures directly to growth outrunning controls — Monzo from roughly 600,000 customers in 2018 to over 5.8 million in 2022, Starling from about 43,000 in 2017 to 3.6 million in 2023. By value, though, incumbents dominate: Nationwide and Barclays together account for £83.4m of the £106.4m in 2025.
Does a firm’s PEP determination hold if a regulator disagrees?
Not in an enforcement setting. UBS adopted an affiliate’s assessment that a customer with a documented close relationship to a head of state was not a politically exposed person, on the rationale that he had cooled off from prior positions, without explaining why close-associate status did not persist. FinCEN treated the determination itself as a CDD failure. The lesson in the order is procedural: the reasoning must be documented and defensible, not inherited.
What should a compliance function benchmark against these numbers?
Three ratios, all computable internally. What share of your transaction population reaches the monitoring system intact — UBS’s disclosed exclusion rate exceeded 5%, with another 12% missing counterparty data. What share of adverse-media results generated at periodic review are actually dispositioned, against UBS’s 16.7%. And how many customers rated Low or Medium have had a material profile change with no corresponding rating movement. The consent orders are, read correctly, a published benchmark set nobody else is treating as one.