Regulatory Roundup for August 2026: UBS's Record Fine, the CTA Rollback, and Crypto's Compliance Reckoning
- Becki LaPorte
- 6 hours ago
- 6 min read
Regulators on both sides of the Atlantic delivered a heavy month for AML enforcement, headlined by a coordinated $153 million penalty against UBS Financial Services from FinCEN, FINRA, and the CFTC over recidivist transaction-monitoring failures, this represents the largest AML fine ever imposed on a broker-dealer. FinCEN also permanently eliminated beneficial ownership reporting requirements for U.S. companies under the Corporate Transparency Act, while UK and Irish regulators moved in the opposite direction, with the SRA fining a law firm over AML control failures and Ireland launching its first national AML strategy.
Sanctions activity centered on Russia. The Senate passed the Lindsey O. Graham Sanctioning Russia and Iran Act, giving the White House discretionary authority to impose tariffs of up to 100% on major buyers of Russian oil, while the EU adopted its 21st sanctions package marking its largest batch of individual listings in four years, with sweeping new restrictions on Russian banks and crypto platforms. Separately, OFAC settled a modest Iran-sanctions case with a U.S. manufacturer, and the UN published its latest report on the ISIL and Al-Qaida sanctions regime.
Crypto and AI oversight also reached inflection points this month. The EU's MiCA transitional period closed on July 1, forcing crypto-asset service providers without full authorization to cease EU operations, while the same 21st sanctions package introduced the EU's first-ever mechanism for a full third-country ban on crypto services. In the U.S., California's Digital Financial Assets Law took effect, bringing crypto exchanges, custodians, and kiosk operators under a new state licensing regime. Together, this month's developments reflect a consistent theme: regulators are tightening the compliance perimeter around both legacy AML gaps and the newer channels, including crypto and AI-driven tools, that financial criminals are increasingly exploiting.
ANTI-MONEY LAUNDERING
FinCEN Issues Alert on Fraud Schemes Targeting Federal Student Aid
FinCEN has issued an alert urging financial institutions to detect, prevent and report suspicious activity connected to fraud schemes targeting student aid programs administered by the Federal Government. Fraud rings use stolen and fraudulent identities, as well as other tactics, to enroll in educational institutions and unlawfully acquire funds from Federal student aid programs.
FINRA fines RBC Capital Markets for AML Supervisory Failures
FINRA fined and censured RBC Capital Markets $275,000 for failing to establish and implement reasonable AML policies and procedures. According to the settlement letter, RBC improperly configured its surveillance system which missed suspicious activity and other potential money laundering activity.
FinCEN, FINRA and CFTC Impose Record Breaking Fine on UBS Financial Services for AML Failures
UBS Financial Services Inc. was hit with a coordinated set of penalties from three regulators over recidivist AML failures. FinCEN assessed a record $125 million penalty, which represents the largest ever imposed on a broker-dealer for AML violations, for failing to fix transaction-monitoring gaps first cited in 2018 and for inadequate due diligence on high-risk customers tied to Russia and Latin America. FINRA separately fined the firm $20 million for failing to reasonably monitor more than 60,000 foreign currency wire transactions totaling $10 billion, while the CFTC imposed an $8 million penalty over the same inadequate oversight of foreign-currency wire transfers.
FinCEN Permanently Ends Beneficial Ownership Reporting Requirements for Millions of Small Business Owners
FinCEN has issued a final rule, effective August 14, 2026, permanently eliminating beneficial ownership information reporting requirements for U.S. companies and U.S. persons under the Corporate Transparency Act, making permanent the exemptions set out in its March 2025 interim final rule. The rule also relieves U.S. persons with FinCEN IDs from updating or correcting previously submitted information, ends the requirement for foreign companies to report U.S. person company applicants, and exempts foreign pooled investment vehicles from reporting on U.S. persons who control them. FinCEN will delete previously reported information it reasonably believes belongs to a U.S. person, though foreign reporting companies remain obligated to report beneficial ownership information for foreign individuals.
Solicitors Regulation Authority (SRA) Fines Haworth & Gallagher for AML Failures
The SRA has fined Haworth & Gallagher £25,000, plus £600 in investigation costs, after a desk-based review by its AML Proactive Supervision Team found the firm failed to maintain, review, and update compliant policies, controls, and procedures to address money laundering and terrorist financing risks between February 2018 and September 2025.
Ireland Launches First National AML Strategy
Ireland has launched its first National AML/CFT/CPF Strategy, part of the most significant overhaul of the country's financial crime framework in years and tied to its 2026 National Risk Assessment and upcoming FATF Mutual Evaluation. For compliance teams, the priorities to watch are new AML rules for crypto-assets and crypto transfers, tighter beneficial ownership transparency requirements, and stronger supervision of higher-risk sectors like gambling — alongside expanded intelligence-sharing between regulators, Revenue, and law enforcement that could mean more coordinated scrutiny going forward.
SANCTIONS
US Senate Passes Sanctions Package to Apply Pressure to Buyers of Russian Oil and Gas
The Senate passed the Lindsey O. Graham Sanctioning Russia and Iran Act of 2026 on August 7 by an 86-11 vote, sending it to the House, which returns from recess in September. Renamed after Sen. Lindsey Graham's death in July, the bill gives President Trump discretionary authority to impose tariffs of up to 100% on major buyers of Russian oil and gas, such as China and India, alongside sanctions on Russian leaders and oligarchs, and extends sanctions on Iran for backing Russia's war effort.
EU Adopts 21st Sanctions Package Against Russia
The Council of the EU has adopted its 21st sanctions package against Russia, its largest batch of individual listings in four years — 218 total, including 48 individuals and 170 entities. The package hits financial services hard, imposing asset freezes on 94 banks and major financial institutions, extending transaction bans to 33 additional Russian credit institutions, and for the first time introducing the possibility of a full third-country ban on crypto-asset services used to help Russia evade sanctions, alongside transaction bans on 14 crypto platforms based in Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan, and Belarus. On energy, the EU paused the automatic adjustment of the oil price cap mechanism until July 2027, added 41 more vessels to its shadow fleet sanctions list, and designated 18 entities in the oil sector including three Russian refineries and a major Belarusian refinery. The package also targets Russia's military-industrial complex with 56 new listings tied largely to long-range drone production, and mirrors several measures against Belarus.
OFAC Fines Rice Lake Weighing Systems for Apparent Violations of Iran Sanctions
OFAC has reached a $60,764 settlement with Rice Lake Weighing Systems, Inc., a Wisconsin-based manufacturer, over eight apparent violations of Iran sanctions. The violations stemmed from Rice Lake's Italian subsidiary, Dini Argeo S.r.l., exporting weighing equipment between July 2019 and November 2021 to a distributor in the UAE with knowledge that the goods would be reexported to an end-user in Iran. OFAC determined the violations were voluntarily self-disclosed and non-egregious, which explains the modest penalty relative to the underlying conduct.
UN Security Council Publishes 38th Report on ISIL and Al-Qaida Sanctions Regime
The UN Security Council's Analytical Support and Sanctions Monitoring Team published its 38th report on the ISIL (Da'esh) and Al-Qaida sanctions regime on August 10, 2026. Among its findings, the report officially attributed the November 2025 bombing near Delhi's Red Fort, which killed 11 people, to Al-Qaida in the Indian Subcontinent (AQIS), noting that AQIS has evolved from a fragmented organization into a regional terrorist entity, building logistics and financial networks through decentralized, small, scattered cells. The report also flagged that Al-Qaida and ISIL have shown sustained interest over many years in developing chemical and biological weapons, though they have not overcome the associated technical challenges, and that instructions for developing such weapons have circulated widely within online terrorist communities.
AI & CRYPTO
MiCA's Transitional Period Closes for EU Crypto-Asset Service Providers
The grandfathering window under Article 143(3) of MiCA closed on July 1, 2026, ending the ability of crypto-asset service providers to operate on legacy national registrations while pursuing full MiCA authorization. Any entity still serving EU clients without a MiCA license is now in breach of EU law and must cease those services; ESMA has confirmed there is no extension mechanism built into the regulation. This directly affects financial-crime exposure, since MiCA's authorization regime imposes materially stricter custody, conflicts-of-interest, and client-asset-segregation requirements than the patchwork of pre-existing national frameworks it replaces.
EU Sanctions Package Introduces First-Ever Third-Country Crypto Ban Mechanism
As part of its 21st sanctions package against Russia, adopted July 23, the EU introduced the possibility of a full third-country ban on crypto-asset services allowing it to prohibit any transaction between an EU operator and any crypto provider used to help Russia evade sanctions. The package also imposed immediate transaction bans on 14 crypto-related service platforms based in Georgia, Panama, the UAE, the Marshall Islands, Kyrgyzstan, and Belarus, marking a structural expansion of sanctions tools specifically targeting crypto as an evasion vector.
California's Digital Financial Assets Law Takes Effect
California's Digital Financial Assets Law (DFAL) licensing requirements went live July 1, 2026, administered by the Department of Financial Protection and Innovation. The law applies broadly to crypto exchanges, wallet providers, custodians, stablecoin businesses, and transaction kiosks serving California residents, requiring a license, a pending application, or a qualifying exemption to continue operating. Kiosk operators face additional fraud-prevention measures, including a $1,000 daily transaction cap intended to limit the use of crypto kiosks by criminal organizations.
