The UBS Case: When Having a Compliance System Does Not Mean Controlling Risk

UBS is one of the world’s largest financial groups. Headquartered in Switzerland, it provides private banking, wealth management, investment management and investment banking services. Its United States operations include UBS Financial Services Inc., a company that provides financial and investment services to clients.

In August 2026, the company agreed to pay a penalty of 125 million United States dollars for serious deficiencies relating to its anti-money laundering controls.

The penalty was imposed by the Financial Crimes Enforcement Network (FinCEN), a bureau of the United States Department of the Treasury responsible for safeguarding the financial system from money laundering, illicit finance and other financial crimes.

There is no exact institutional equivalent in Ecuador. Nevertheless, certain FinCEN functions may be compared with those performed by Ecuador’s Unidad de Análisis Financiero y Económico (UAFE), or Financial and Economic Analysis Unit, the Ecuadorian authority responsible for receiving and analysing information intended to identify transactions that may be connected with money laundering and related offences.

What happened at UBS?

The case concerns Anti-Money Laundering (AML) controls, meaning the policies, procedures and mechanisms designed to prevent and detect money laundering.

These controls seek to prevent banks and other financial institutions from being used to introduce proceeds of unlawful origin into the apparently legitimate economy.

To achieve this, a financial institution must identify and understand its clients, assess the source of relevant funds, determine the level of risk associated with a business relationship, monitor unusual transactions and, where required, report suspicious activity to the competent authorities. One internationally recognised practice is Know Your Customer (KYC), meaning the procedures through which an institution identifies and understands its customer and the risks associated with that relationship.

It sounds straightforward. In a major financial institution, it is not.

In Consent Order No. 2026-02, the administrative order formalising the settlement and monetary penalty, FinCEN identified significant deficiencies in the mechanisms used by UBS Financial Services to prevent money laundering. These included issues concerning the oversight of higher-risk clients and the monitoring of certain financial transactions.

UBS Financial Services admitted the facts and violations set forth in the order.

There is also a significant precedent. UBS had already been subject to a FinCEN enforcement action in 2018 concerning compliance deficiencies. When a financial institution of this scale faces problems years later involving its preventive systems, a deeper question arises: is having a compliance system enough?

When the indicators are green

Regulatory and ethical compliance, commonly referred to simply as compliance, consists of establishing policies, procedures and controls intended to ensure that an organisation and the individuals working within it act in accordance with applicable law, regulations and ethical standards.

A company may have all of these elements.

It may have codes of ethics, anti-corruption manuals, risk matrices, specialised compliance departments, periodic training, audits, reporting channels and management control panels displaying indicators of whether established procedures have been completed.

And every indicator may be green.

That green status, however, may be misleading. At best, it establishes that what the organisation chose to measure satisfied a predetermined parameter. It does not necessarily establish that the underlying risk has been eliminated.

A company may report, for example, that one hundred per cent of its employees completed anti-corruption training. Green indicator. It may establish that all suppliers signed integrity declarations. Another green indicator. It may even demonstrate that every report received through its reporting channels was formally processed.

None of those facts, standing alone, establishes that corruption does not exist within the organisation.

Compliance theatre

This is where the concept of Compliance Theatre becomes useful: the appearance of effective compliance created by formal structures and controls whose practical effectiveness may be substantially more limited.

The procedure exists. The form was signed. The training took place. The indicator is green. Yet the risk remains.

This does not necessarily mean that the entire system was designed to deceive. The problem may be more complex. Controls may measure the wrong variables; individuals may become accustomed to mechanically completing procedures; or the internal culture itself may discourage employees from questioning the conduct of those who exercise greater organisational power.

This distinction is particularly important in relation to corruption. An organisation may display an apparently impeccable compliance structure while simultaneously tolerating internal practices that are inconsistent with the values it publicly professes.

Compliance and ethics are therefore not synonymous.

Beyond controls

Controls are indispensable. But they are only part of the solution.

A healthy organisational culture requires something more: people who find professional purpose in their work, develop a genuine sense of belonging to the institution and understand that protecting its reputation and principles is also part of their individual responsibility.

Compensation will remain important. Of course. But where the relationship between an individual and an organisation is reduced exclusively to economic benefit, external controls must bear almost the entire burden of regulating conduct.

By contrast, where there is a shared sense of purpose, confidence to challenge improper decisions, recognition for doing the right thing and a credible expectation that the rules apply equally to those who hold power, compliance ceases to be merely an externally imposed obligation and becomes part of the organisation’s identity.

That distinction is difficult to capture on a control panel.

A genuinely ethical organisation is not one that succeeds in keeping every indicator green. It is one whose day-to-day conduct, particularly when no one is watching, reasonably corresponds with the values it professes to uphold.