FinCEN And SEC Impose Historic Fine On Broker-Dealer For AML Violations

Key Takeaways

• The Financial Crimes Enforcement Network (FinCEN) assessed an $80 million civil money penalty against Canaccord Genuity LLC (Canaccord) for willful violations of the Bank Secrecy Act (BSA), the largest penalty ever imposed by FinCEN on a broker-dealer.
• In a parallel action, the Securities and Exchange Commission (SEC) imposed a $20 million civil penalty against Canaccord for allegedly failing to maintain an anti-money-laundering (AML) surveillance program that was reasonably designed to detect, investigate, and file Suspicious Activity Reports (SARs) with respect to high-risk trading activity in over-the-counter (OTC) securities.
• Pursuant to the FinCEN order, Canaccord admitted that, despite repeated SEC examination findings showing material deficiencies, it willfully violated the BSA by failing to (1) develop, implement, and maintain an effective AML program, (2) conduct required due diligence on correspondent accounts for foreign financial institutions, and (3) file at least 160 SARs.
• These coordinated settlements signal that broker-dealers must reexamine their AML programs to make sure they are tailored to the risks associated with their operations or potentially face enforcement actions by multiple regulators that appear ready to levy hefty penalties.

Background

On March 6, FinCEN announced a historic enforcement action against Canaccord Genuity LLC, a registered broker-dealer, assessing an $80 million civil money penalty for willful violations of the BSA. FinCEN characterized the resolution as the largest penalty ever imposed on a broker-dealer for BSA violations and described it as a “wake-up call” to the securities industry.

According to the FinCEN consent order, Canaccord failed to develop, implement, and maintain an effective AML program over an extended period. The agency found that the firm did not conduct adequate risk‑based customer due diligence, failed to implement effective internal controls to monitor trading activity, and failed to file at least 160 SARs despite thousands of transactions exhibiting indicia of suspicious or potentially manipulative conduct.

In a parallel action announced the same day, the SEC charged Canaccord with willfully violating Section 17(a) of the Securities Exchange Act of 1934 for failing to file SARs in connection with its OTC market-making business. The SEC found that Canaccord’s AML surveillance relied on exception reports that were poorly designed and, in many cases, left unreviewed for months or years, resulting in widespread reporting failures. As part of that order, Canaccord agreed to a $20 million settlement with the SEC. Canaccord also entered into a Letter of Acceptance, Waiver, and Consent with FINRA to resolve related rule violations, pursuant to which Canaccord agreed to pay a $20 million fine.¹

Scope of the Alleged Misconduct

The FinCEN consent order provides a detailed account of the conduct underlying the resolution and reflects a sustained breakdown in Canaccord’s AML controls over multiple years. FinCEN found that Canaccord’s AML program was fundamentally misaligned with the risks presented by its business, particularly its high‑volume trading in OTC and microcap securities. Although Canaccord generated numerous surveillance reports intended to identify potentially manipulative trading activity – such as wash trades, marking the close, and pump‑and‑dump schemes – FinCEN concluded that these reports were poorly calibrated, inadequately reviewed, and, in many instances, not reviewed at all for extended periods, sometimes spanning months or even years.

FinCEN further determined that Canaccord’s compliance function was severely under-resourced relative to the scale and risk of its trading activity. A small number of compliance personnel, many without sufficient AML experience or training, were responsible for reviewing hundreds of surveillance reports and thousands of alerts. This staffing imbalance resulted in large alert backlogs and prevented meaningful investigation or escalation of red flags, effectively rendering the firm’s surveillance framework ineffective in practice.

Failures to conduct customer due diligence – as required by FinCEN’s 2016 Customer Due Diligence Rule – featured prominently in FinCEN’s findings. The agency concluded that Canaccord failed to conduct adequate, risk‑based due diligence on higher‑risk customers, including customers engaged in suspicious OTC trading and customers with adverse regulatory or public‑source histories. FinCEN noted that Canaccord’s inadequate due diligence caused it to miss links between certain individuals and OFAC‑sanctioned persons, including one individual alleged to have helped Russian oligarchs move funds out of Russia. In another instance, Canaccord received a law enforcement request to perform additional due diligence on a customer that revealed ties to sanctioned individuals in Venezuela. Although Canaccord filed a SAR and internal memoranda recommended closing the account, Canaccord allowed the account to remain open until Canaccord’s clearing firm refused to settle transactions related to that customer’s account. FinCEN also found deficiencies in Canaccord’s oversight of foreign correspondent accounts, including failures to conduct required due diligence and to implement controls designed to prevent those accounts from being used to access U.S. markets for illicit purposes.

Against that backdrop, the FinCEN order makes clear that Canaccord ignored repeated warnings from regulators. FinCEN emphasized that SEC and FINRA examinations identified major AML deficiencies and inadequate controls as early as 2013; however, Canaccord did not remediate those issues and, according to FinCEN, certain employees ultimately provided falsified documentation to regulators.

These systemic failures and the associated breakdowns in escalation and oversight culminated in Canaccord’s failure to file at least 160 SARs, despite thousands of transactions that exhibited indicia of suspicious or potentially manipulative conduct. FinCEN emphasized that these omissions deprived law enforcement of timely and actionable financial intelligence related to suspected securities fraud and market abuse. Compounding these failures, FinCEN found that, during a FINRA examination, Canaccord personnel submitted hundreds of falsified records purporting to show that surveillance alerts had been reviewed when, in fact, they had not – conduct FinCEN cited as evidence of willfulness and weak compliance governance.

Taken together, FinCEN characterized Canaccord’s deficiencies not as isolated lapses, but as long‑standing, firm‑wide control failures, spanning AML program design, staffing, customer due diligence, surveillance execution, escalation practices, and compliance culture. These findings formed the basis for FinCEN’s determination that Canaccord willfully violated the BSA and warranted the most significant penalty ever imposed by the agency on a broker‑dealer.

FinCEN Raises the Stakes for Broker‑Dealers

Historically, FinCEN has brought very few stand-alone AML enforcement actions against registered broker‑dealers, underscoring the significance of the present resolution. One of the few prior examples is FinCEN’s January 2015 action against Oppenheimer & Co. Inc., in which the agency assessed a $20 million civil money penalty for willful BSA violations tied to deficient AML controls, SAR failures, and inadequate due diligence in connection with suspicious penny‑stock trading and foreign correspondent accounts. Even that action was an outlier in FinCEN’s enforcement history with broker‑dealers at the time and it involved a penalty only one‑quarter the size of the current resolution.

When combined with FinCEN’s decision to impose an $80 million penalty – the largest ever assessed against a broker‑dealer for AML violations – the Canaccord action marks a sharp escalation in both enforcement posture and monetary exposure, and sends a clear signal that FinCEN is prepared to join the SEC in pursuing enforcement actions against broker-dealers where it believes the AML violations are particularly egregious.

Beyond the penalties, the FinCEN order highlights that sustained AML compliance failures can drive concrete business failures. FinCEN noted that, as of November 2025, Canaccord no longer operates its U.S. OTC wholesale market‑making business and has significantly reduced the size and scope of its trade execution business. This underscores that compliance breakdowns can lead not only to enforcement exposure, but also to operational disruption, loss of key business relationships, product and revenue contraction, and strategic retrenchment – particularly where regulators conclude that a firm’s controls are not credible or sustainable for higher‑risk business lines.

Practical Considerations for Companies and Executives

• AML Failures Framed as Core Market‑Integrity Violations. The Canaccord orders make clear that regulators will not view AML breakdowns at broker‑dealers as technical or ancillary issues. FinCEN and the SEC characterized Canaccord’s deficiencies as systemic – spanning surveillance design, staffing, escalation, and governance – and treated those failures as evidence of willfulness rather than isolated lapses. Broker‑dealers, particularly those operating in OTC, microcap, or other higher‑risk trading environments, should expect holistic scrutiny of their AML programs and heightened enforcement exposure where deficiencies persist over time, particularly when raised by examinations as was the case here.
• Surveillance Must Function in Practice, Not Just on Paper. Regulators focused not on whether Canaccord generated exception reports, but on whether alerts were calibrated in a way to provide meaningful review and whether they were timely reviewed, escalated, and resolved by compliance staff who were trained to understand their significance. Large volumes of alerts went unreviewed for months or years, rendering surveillance tools effectively meaningless. The takeaway is clear: Generating alerts without meaningful follow‑through may be treated as no control at all, particularly in business lines associated with elevated fraud or manipulation risk.
• Under‑Resourced Compliance Drives Enforcement Risk. FinCEN cited Canaccord’s under‑resourced, under-staffed, and insufficiently trained compliance function as a core driver of its failures. The agencies’ analysis signals that firms cannot rely on lean compliance models where business volume or risk has materially increased. Alert backlogs and staffing shortfalls are likely to be viewed as affirmative compliance breakdowns, not capacity constraints, underscoring the need to align AML staffing, expertise, and governance with a firm’s actual trading footprint.
• Heightened Expectations for Ongoing Customer Due Diligence. Customer due diligence emerged as a central pressure point. FinCEN highlighted failures to conduct adequate, risk‑based diligence on higher‑risk customers and correspondent relationships, including insufficient monitoring of adverse information and escalation of red flags. Treating due diligence as a static, check‑the‑box exercise – rather than an ongoing risk assessment – can materially amplify enforcement risk when suspicious trading activity later comes to light. Institutions must also reassess and update a customer’s risk profile when new information emerges, such as law enforcement requests, that may warrant enhanced diligence or additional controls.
• Unfiled SARs Can Rapidly Escalate Exposure. Both agencies emphasized the cumulative impact of Canaccord’s failure to file approximately 160 SARs tied to thousands of transactions. Each unfiled SAR was viewed not in isolation, but as part of a broader pattern that transformed reporting failures into a central enforcement theory. Broker‑dealers should reassess escalation timelines, documentation practices, and accountability mechanisms to ensure suspicious activity is promptly identified, investigated, and reported.

Given the scope of potential exposure reflected in the Canaccord orders, broker‑dealers should make continuing, incremental investments to ensure that their BSA programs expand and evolve as their business grows. Outside counsel can help guide BSA programs on a path of continuous improvement by assisting with AML risk assessments, compliance program design, training, and regulatory engagement. Independent compliance counsel can help firms evaluate whether surveillance, staffing, and escalation frameworks are appropriately calibrated to business risk, conduct privileged reviews of existing controls, and advise on remediation strategies before deficiencies become examination findings or enforcement matters. Early involvement of counsel can also be critical in managing interactions with FinCEN, the SEC, and self‑regulatory organizations, particularly where issues may give rise to parallel investigations or cumulative penalties.

The BakerHostetler White Collar, Investigations and Securities Enforcement and Litigation team is composed of dozens of experienced individuals, including attorneys who have served in the U.S. Department of Justice and at the SEC. Our attorneys include three former U.S. Attorneys, former Assistant U.S. Attorneys and unit chiefs, and partners who have served in the SEC’s Division of Enforcement and the SEC’s Office of the General Counsel. Our team has extensive experience in defending regulatory investigations and litigation and in providing compliance counseling.

Foonote

1. FinCEN credited Canaccord’s payments to the SEC and FINRA against the $80 million civil penalty.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.