Reviewed by: Tom Devlin, Managing Director at KYC360 
Last Updated 14/09/26

A recent FinCEN enforcement action highlighted weaknesses in AML remediation, transaction monitoring, customer due diligence, data governance and suspicious activity reporting. While the facts are specific to that action, the lessons are highly relevant for financial institutions more broadly. 

Remediation is only effective when it addresses the risk it was designed to fix. A new system, updated policy or completed milestone may show progress, but firms still need to evidence that the underlying issue has been properly resolved in practice. Regulators increasingly expect firms to prove that controls are operating effectively. 

Remediation Must Become a Working Control  

One of the strongest themes in recent AML enforcement is the gap between promising remediation and proving it works. Where a regulator, internal audit or compliance review has already identified a weakness, firms need more than a plan to fix it. They need clear ownership, senior oversight, interim controls, evidence of progress and independent validation that the issue has been sustainably resolved. 

A delayed remediation programme can quickly become a governance issue. If delivery slips, the risk should be escalated rather than treated as a routine project delay. Where the issue relates to a prior regulatory finding, firms should also consider whether the regulator needs to be updated. A remediation commitment is not a statement of intent. It is a live control obligation. 

A New System Does Not Equal an Effective Control

Technology is often central to AML remediation, particularly where transaction monitoring is involved. But installing a new platform does not automatically solve the underlying risk. A monitoring system is only effective if it receives the right data, applies the right scenarios, captures the right fields and generates alerts that can be investigated properly. If transactions are missing from the feed, counterparty information is incomplete or rejected records are not identified, the firm may believe it has a functioning control while a material part of the risk remains outside the system. 

This is an important distinction. Model testing may show that a scenario works as designed, but that does not prove every relevant transaction has entered the model. Firms need to test the full journey from source system to monitoring platform to alert review. Without that evidence, a new monitoring system may simply create a more sophisticated blind spot. 

Data Gaps Can Undermine an AML Framework  

Data quality should not be treated as a technical concern. In the context of AML, it is a core control requirement. Transaction monitoring, customer risk scoring, sanctions screening, adverse media review and SAR reporting all depend on accurate and complete data. If the data is wrong, missing or siloed, the control framework cannot reliably identify risk. 

Financial institutions should therefore treat AML data governance as part of their broader financial crime control framework. This includes source-to-system reconciliation, field mapping, exception handling, rejected record reporting and clear accountability for resolving data issues. Internal audit and model risk teams also need to look beyond whether a model is performing mathematically. They should test whether the population being monitored is complete and whether the data feeding the system reflects the reality of customer activity. 

The key question is not only, does the control work? It is also, is the control seeing everything it is supposed to see? 

CDD Must Keep Pace With Customer Risk

Customer due diligence cannot be a static onboarding exercise. Customer circumstances change, and AML controls need to respond when they do. This is especially important in wealth management, private banking and broker-dealer environments, where customers may have complex structures, cross-border activity, high-value assets, politically exposed connections or wealth linked to higher-risk jurisdictions. 

Effective CDD should bring together source of wealth, source of funds, adverse media, expected account activity, beneficial ownership, jurisdictional exposure and changes in customer behaviour. These factors should not sit in separate files or systems without affecting the customer’s risk profile. A customer who was low risk at onboarding may not remain low risk forever. New country links, unexpected transaction volumes, adverse media, changes in occupation, new counterparties or unexplained wealth should all trigger a reassessment. 

The lesson for firms is that CDD must remain live. Knowing your customer means continuing to know them throughout the relationship. 

Adverse Media Must Lead to a Decision

Many firms are good at finding adverse media. The harder question is what they do with it. Regulators are unlikely to be satisfied if negative news is simply recorded, rationalised and filed away. Adverse media should prompt an objective assessment of what the information means for the customer’s risk profile and whether enhanced controls are needed. 

That does not mean every allegation requires an exit. But firms should be able to show how they assessed the information, whether it was credible, how it related to the customer’s wealth or activity, and what action was taken as a result. Possible outcomes might include enhanced due diligence, senior approval, closer monitoring, restrictions on certain activity, a change in risk rating, further source of wealth enquiries, SAR consideration or exit. 

The important point is that adverse media should not be treated as a reputational footnote. It is a risk signal, and risk signals need decisions. 

Commercial Pressure Cannot Shape AML outcomes

High-value relationships can create difficult decisions. Customers may be commercially attractive, known to affiliates, introduced through trusted channels or important to revenue-generating teams. But those factors cannot dilute financial crime controls. Where a relationship presents elevated risk, decisions about onboarding, restrictions, monitoring and exit should be based on objective risk assessment. Firms should be particularly careful where business teams, relationship managers or affiliates are involved in explaining or defending a customer’s risk profile. 

A strong AML framework needs independence. Compliance and financial crime teams must be able to challenge explanations, require evidence and escalate unresolved concerns without commercial pressure weakening the outcome. This is particularly important for firms with international groups, affiliate relationships and cross-border clients. Reliance on another part of the group may be useful, but it does not remove the need for the regulated entity to understand and manage its own AML obligations. 

SAR Quality Matters as Much as Timing

Suspicious activity reporting is often discussed in terms of deadlines. Timeliness is critical, but quality matters too. A SAR that is filed late may lose intelligence value. A SAR that omits key counterparties, transaction purpose, linked entities, adverse information or relevant context may also fail to give law enforcement the full picture. 

Firms should therefore test SARs for substance, not just submission. Good SAR governance should ask whether the report explains why the activity is suspicious, connects related activity, identifies relevant parties and provides enough detail for law enforcement to understand the risk. Weak monitoring and weak CDD often show up downstream in SAR quality. If a firm does not understand the customer, expected activity, source of wealth or counterparties, it will struggle to produce meaningful suspicious activity reporting. 

Practical Actions for Financial Institutions

Recent enforcement offers several practical takeaways for firms reviewing their AML frameworks:

• Treat prior regulatory, audit and compliance findings as high-priority governance issues until independent validation confirms they are closed.

• Test transaction monitoring from end to end, including whether all relevant transactions and data fields reach the monitoring environment.

• Create clear exception processes for missing, rejected or unprocessed data. A control that fails silently is not reliable.

• Keep CDD dynamic by updating customer profiles when new information changes the risk picture.

• Document adverse media decisions clearly, including what was found, how it was assessed and what action followed.

• Review SAR quality as well as timeliness, making sure reports contain the information needed to support law enforcement. 

Conclusion

Recent FinCEN enforcement shows that AML remediation must be effective in practice, not just documented in policies, platforms or project plans. A firm can still be exposed if the underlying data is incomplete, customer risk profiles are stale, or suspicious activity is not reported with enough detail to support law enforcement. Financial institutions should be able to show that known issues have been closed, monitoring captures the right activity and CDD reflects current risk. Key decisions should be documented, tested and acted on. Evidence matters as much as design. 

Streamline Risk Management across the Customer Lifecycle

The KYC360 platform is an end-to-end solution offering slicker business processes with a streamlined, automated approach to Know Your Customer (KYC) compliance. This enables our customers to outperform commercially through operational efficiency gains whilst delivering improved customer experience and KYC data quality.

Consolidate your system stack and data vendor relationships with one platform to cover all Onboarding, Screening, Perpetual KYC (pKYC) and CLM tasks, with market-leading data sources pre-integrated under a single license agreement. Live risk scoring and automated data collection enables a shift from periodic to event-driven review, while providing a single actionable picture of real-time risk with all documents and data in one place.

View platform