Fined for monitoring, ordered to fix the data

1 · The stated deficiency is monitoring; the ordered remedy is data

Across a working sample of thirteen firms carrying a live or recent enforcement action with a remediation dimension (Aug 2026), the headline breach is most often transaction monitoring — the single most-cited category. But the mandate tells a different story. Leading with the regulator and the remedy, rather than the firm:

• BaFin (Germany, order effective Jun 2026) ordered a leading Landesbank to “draw up a plan to update its customer records,” against findings of “significant deficiencies in updating customer data… and a considerable backlog” — a formal, binding plan to bring every overdue record current under the Money Laundering Act.

• FinCEN (US, Aug 2026) ordered a major US broker-dealer a third-party look-back to identify and report the suspicious transactions it had missed, plus an independent review of its AML programme it must implement in full — after more than 50,000 foreign-currency wires worth over US$10bn went unmonitored and due diligence on high-risk clients was found deficient. It was a repeat of a 2018 order: recidivism the regulator explicitly penalised.

• The HKMA (Hong Kong) ordered a bank branch a mandated look-back review and remedial plan.

• BaFin (Germany, May 2026) ordered a trading firm to rebuild customer-risk classification and EDD as part of a full compliance overhaul.

• AUSTRAC (Australia, Jul 2026), via an enforceable undertaking on a major operator, required the risk-assessment methodology itself rebuilt — progress report due Dec 2026, final audit by mid-2027.

Eight of thirteen recent mandates explicitly require re-verifying, re-classifying or reviewing an existing customer book. The others are monitoring and reporting uplifts — which cannot be delivered without verified counterparty and entity data as the input. In other words: regulators do not order firms to buy better monitoring software. They order them to fix their customer data, and prove it.

Four remedy archetypes — what you will actually be told to produce

• Mandated look-back: US & HK bank orders; A retrospective review across a defined historical period, evidenced to the regulator — fixed scope, hard deadline, unavoidably a bulk entity-resolution job

• Customer-data refresh / update plan: German & UK bank orders; A re-verified customer book with a documented remediation plan

• Risk-assessment & customer re-classification: AU operator & German firm orders; Every customer re-scored against a rebuilt methodology — which needs resolved ownership and control data first

• Monitoring & reporting uplift: UK, US, HK & crypto/VASP orders; Better detection and timely reporting — sitting on top of verified counterparty data

The practical point: three of the four archetypes are, at root, a data problem before they are a software problem.

2 · The market is bigger than the fines — because most of it isn’t public

Named AML enforcement is genuinely low-volume, and total penalty value has fallen three years running (Fenergo: US$6.6bn in 2023 → US$4.6bn 2024 → US$3.8bn 2025). It would be easy to read that as a shrinking remediation market. It isn’t — the instruments that actually fund a data rebuild are mostly not enforcement actions, and mostly not announced firm by firm:

• FCA skilled-person reviews (s166), financial-crime lot: 12 of 31 commissioned; FY2025-26

• FCA voluntary outcomes (VREQs, undertakings, attestations): 124 (92 VREQs, 25 undertakings); FY2025-26

• AUSTRAC warning letters: 487; FY2024-25

• AUSTRAC entities assessed for enforcement: 544; FY2024-25

• BaFin AML inspections: 92 (2025) · 114 (2024) + 643 supervisory interviews (2025); —

• MAS supervisory reminders / warnings / letters of advice: 305 / 116 / 86; 18 months to Dec 2024

In the UK alone, twelve financial-crime s166 reviews were commissioned against six AML fines in the same year — remediation mandates outnumbered fines two to one, and none of the twelve names a firm publicly.

3 · Regulators act in cohorts, not one-offs

Even a small sample shows three distinct sweeps: BaFin across the German Landesbanken (a regional-bank cohort ordered within weeks of each other — one on a customer-data backlog, another on customer-due-diligence gaps, same theme, binding orders); the MAS nine-firm sweep (S$27.45m across nine institutions in 2025, a cohort now working through remediation under MAS monitoring); and the AUSTRAC crypto/VASP wave (a licence suspension inside a broader crackdown). A single action is usually a leading indicator for a segment, not just a one-off.

4 · The clock starts at the plan, not the fine

Where mandates carry dates (the AU operator’s Dec-2026 progress report; the VASP’s ~Nov-2026 suspension review; the German bank’s update plan), the pattern is consistent: the decisions get made when the remediation plan is being written, not when the penalty is announced. By the time a programme is stood up, the data approach is usually already fixed.

5 · The same data gap drives the screening problem

The evidence above is about remediation orders, but the same root cause shows up in the day-to-day complaint every compliance team has: screening false positives. Vendors keep throwing more sophisticated matching algorithms at the alert pile and the numbers barely move — because the binding constraint isn’t the algorithm, it’s the underlying data. If a name, date of birth, address and ownership chain aren’t broken out, standardised and machine-readable, no matching logic resolves the entity cleanly, and the analyst inherits the noise.

Screening is, at bottom, entity resolution against external reference data — which is exactly the data layer a remediation rebuilds. (Transaction monitoring sits one step further out; it isn’t something a data programme runs directly, but the verified counterparty and entity data it consumes is, again, the same problem.) So the “fix the customer data” mandate and the “our screening drowns us in false positives” complaint are two symptoms of one cause. A firm that cleans and resolves its entity data to satisfy a supervisor tends to find its screening precision improves as a by-product — and vice versa.

What to be sceptical of

Four claims circulate in this market that don’t survive checking:

1. “Enforcement is falling, so the remediation market is cooling.” Penalty value is falling; remediation demand is largely decoupled from fines and sits in s166 reviews, voluntary requirements and warning letters that name no one. Reading the fine line alone understates the work by roughly two to one in the UK data.

2. “Match your controls to the breach you were fined for.” The stated deficiency and the ordered remedy diverge in most of the sample — fined for monitoring, ordered to rebuild the data. Preparing against the headline prepares against the wrong thing.

3. “X% of enforcement carries a remediation mandate.” No regulator and no industry tracker publishes this figure. The only hard data point anywhere is the US, where at least 16 of 40-plus 2024 BSA/AML actions carried an ordered look-back (~38%). Any precise figure quoted for Australia, the UK or Singapore is an inference — treat it as one.

4. “Regulator-approved” or “regulator-endorsed” tooling. No regulator approves vendors or methods. A claim of endorsement is the fastest way to lose a compliance reader who checks — and they all check.

What to do about it now

Four things, none of which require buying anything:

1. Read the mandate, not the fine. When an action lands in your sector, look at what the firm was ordered to produce — a look-back, a re-verified book, a re-classification — not the breach category in the headline. That is the shape of what you would be asked for.

2. Assume the remedy is a data rebuild, and pressure-test your own book now. Ask, before anyone asks you: what proportion of our customer entities could we resolve beneficial ownership on from our current data, and how long would a full re-verification actually take? The honest answer is the size of your exposure.

3. Watch the cohort, not just your own name. If a peer in your segment is ordered — another regional bank, another private bank, another VASP — the supervisory attention is on the segment. The right response is to look at the rest of the segment, including yourselves.

4. Track the leading indicators, not the press cycle. The aggregate supervisory series — FCA s166 volumes by lot, AUSTRAC campaign statistics, BaFin inspection counts — name no firms, but they size and time the waves, and they lead where enforcement lags.

There is no authoritative guide to what supervisors will demand next; this is a reading of what they have actually demanded, from the public record, so a reader can draw their own line.

Sources

• MAS — composition penalty, Padang Trust Singapore

• FCA — Monzo fined £21m for financial-crime control failings

• FCA fines Nationwide £44m (Linklaters)

• bet365 agrees AML remediation plan with AUSTRAC

• HKMA — disciplinary action, Indian Overseas Bank & Bank of Communications

• MAS — regulatory actions against nine financial institutions

• FATF — Mutual Evaluation Report: Singapore, 6 May 2026

• AUSTRAC — enforcement actions taken; Annual Report 2024-25

• FCA — enforcement data 2025/26; skilled-person reviews

• Sidley — MAS 5th Enforcement Report statistics

• K&L Gates — 2024 BSA/AML enforcement: 16 ordered look-backs

• Crowe — 42 vs 29 US BSA/AML actions

• FinCEN — historic US$125m penalty, UBS Financial Services Inc. (3 Aug 2026)

• BaFin — NordLB customer-data update order (effective 14 Jun 2026); Helaba CDD order (Jul 2026); Annual Report 2025 statistics

• Fenergo — global penalties 2025

Every action cited here is on the public record; we lead with the regulator and the remedy, not the firm.

Published by Dligence as part of the “What Good Looks Like” series. Dligence is a compliance-data company; this paper is analysis of the public enforcement record, is not legal advice, and no part of it implies regulatory endorsement of any provider or method.