Enforcement Tracker
Tracking the world's most significant AML, compliance, data privacy, and data protection enforcement actions — because what regulators penalise today defines what they expect from everyone tomorrow.
Regulatory enforcement is one of the most powerful signals available to compliance professionals. Every penalty issued, every public censure published, and every deferred prosecution agreement announced tells the same story — this is what regulators found unacceptable, this is the standard they are holding firms to, and this is what happens when firms fall short.
The LetsTalkAML Enforcement Tracker logs major enforcement actions across AML, compliance, data privacy, and data protection from regulators around the world. Each entry covers the institution penalised, the regulator involved, the penalty imposed, the core findings, and — most importantly — the practical compliance lessons. This is not just a record of fines. It is an intelligence tool.
2025 in Numbers — The Global Picture
Global AML, KYC, sanctions, and CDD penalties totalled $3.8 billion in 2025, down from $4.6 billion in 2024 and $6.6 billion in 2023 — a decline of 18% year on year. However, this headline figure conceals a significant regional story. Fenergo
2025 will go down as a historic year in two ways: it is the first time in over 20 years that no banks faced a major US AML penalty, with US enforcement instead targeting crypto exchanges, money transmitters, securities firms, and casinos. Crypto exchanges received by far the largest share of US AML fines. Finintegrity
The US remained the single largest AML enforcement jurisdiction globally at $1.676 billion in total penalties, but enforcement activity shifted sharply toward EMEA and Asia Pacific. France became the second-largest enforcer globally at $1.11 billion, driven by a single landmark action. Fenergo
On the data protection side, European regulators levied approximately €1.2 billion in GDPR fines during 2025, with breach notifications surging — for the first time since GDPR came into force, data protection authorities recorded an average of more than 400 personal data breach notifications per day. Bitdefender
📌 This tracker covers publicly reported enforcement actions sourced from official regulatory announcements and reputable public reporting. It is updated regularly. It is provided for informational and educational purposes only and does not constitute legal advice.
How to Use This Tracker
Browse by year to see the enforcement landscape at a point in time
Filter by discipline — AML, Sanctions, Data Privacy, Data Protection — to focus on your area
Filter by region — UK, EU, US, Canada, Asia Pacific — to focus on your jurisdiction
Read the compliance lessons beneath each entry — these are the most actionable part
Subscribe to the LetsTalkAML newsletter to receive enforcement alerts as they are published
2025 | 2024 | Historical Reference | Enforcement Trends
Filter by: All | AML | Data Protection | Sanctions | UK | EU | US
2025 — Enforcement Actions
A landmark year for global AML enforcement. Global AML, KYC, sanctions, and CDD penalties totalled $3.8 billion in 2025. The US remained the single largest enforcement jurisdiction at $1.676 billion, while France became the second-largest enforcer at $1.11 billion driven by a single landmark action. Crypto exchanges dominated US enforcement receiving $927.5 million in fines — the first time in over 20 years that no US bank faced a major AML penalty.
UBS — €835 Million ($985 Million)
Regulator: French Criminal Courts / Parquet National Financier (PNF)
Jurisdiction: France
Discipline: AML / Tax Evasion / Aggravated Money Laundering
Date: September 2025
Penalty type: Criminal settlement — largest single AML penalty globally in 2025
What happened:
UBS Group AG ended a long-running legal case over helping French citizens dodge taxes by agreeing to pay €835 million in fines and damages — a fine of €730 million and €105 million in civil damages to the French state. The case related to activities between 2004 and 2012 in which UBS helped wealthy French clients conceal funds from tax authorities. French courts found UBS guilty of aggravated money laundering and unlawful client solicitation. The settlement resolved a case that had originally resulted in a €4.5 billion penalty in 2019 — at the time the largest criminal fine ever issued in France — before being reduced on appeal. BloombergAML Intelligence
Key regulatory findings:
UBS operated a structured, systemic, and longstanding scheme to solicit wealthy French clients and assist them in concealing assets from French tax authorities
The scheme involved unlawful cross-border solicitation of clients by Swiss-based bankers attending private events in France
Funds were moved to Swiss accounts specifically to evade French tax obligations — constituting aggravated money laundering under French law
The bank's French subsidiary was found to have been complicit in the activities
The case lasted over a decade, demonstrating the long tail of financial crime enforcement and the sustained commitment of French authorities to pursue complex cross-border cases
Compliance lessons:
Cross-border private banking activity requires rigorous compliance with the host country's solicitation and AML laws — the jurisdiction of the client, not just the jurisdiction of the bank, determines legal obligations
Tax evasion proceeds are criminal property for the purposes of AML law — assisting clients in concealing assets from tax authorities constitutes money laundering, not merely a tax matter
Legacy conduct investigations can result in enforcement action a decade or more after the events in question — AML compliance programmes must take a long-term view of conduct risk
The reduction from €4.5 billion to €835 million on appeal does not diminish the severity of the underlying findings — it reflects the legal process, not the seriousness of the conduct
Block Inc. (Cash App) — $80 Million
Regulator: 48 US State Financial Regulators (led by Arkansas, California, Florida, Maine, Massachusetts, Texas, and Washington State)
Jurisdiction: United States
Discipline: AML / BSA / Money Transmission
Date: January 2025
Penalty type: Civil money penalty / Compliance monitorship — first-ever coordinated multistate AML enforcement action
What happened:
In a coordinated enforcement action by 48 state financial regulators, Block Inc. agreed to pay an $80 million fine and undertake corrective action for violations of the Bank Secrecy Act and AML laws. More than 50 million consumers use Cash App, Block's mobile payment service, to spend, send, store, and invest money. Cash App grew very rapidly between 2019 and 2020, adding millions of users and expanding into Bitcoin transactions at a pace that its compliance infrastructure was not resourced or designed to match. This backlog was caused in part by Block's inability to predict the impact of Cash App's growing customer base on alert volumes and staffing needs. The action is historically significant as the first-ever coordinated multistate AML enforcement action of its kind in the United States. Yahoo FinanceSanctions.io
Key regulatory findings:
Block failed to implement and maintain an adequate AML programme proportionate to the rapid growth of Cash App's customer base
Customer identification and due diligence processes were inadequate for the volume and risk profile of users
Suspicious activity reporting was deficient — alert backlogs meant potentially suspicious activity went unreviewed and unreported
Block's compliance infrastructure failed to scale alongside its exponential business growth
In addition to paying the penalty, Block agreed to hire an independent consultant to review its BSA/AML programme and submit a report to the states within nine months, and to correct any deficiencies within 12 months of filing the report. PYMNTS.com
Compliance lessons:
Rapid business growth is not a regulatory defence — AML obligations scale with the business, not the compliance budget
Alert backlogs are a direct indicator of AML programme failure — an overloaded system that cannot process its own outputs is not functioning
The first-ever coordinated multistate action demonstrates that state regulators are willing and able to act collectively on major financial crime compliance failures, creating a new enforcement dynamic for fintech firms operating across multiple US states
Fintech and payment companies must plan compliance staffing and systems for the customer base they are heading toward, not the one they currently have
Nationwide Building Society — £44 Million ($59 Million)
Regulator: Financial Conduct Authority (FCA)
Jurisdiction: United Kingdom
Discipline: AML / Anti-Financial Crime Controls
Date: December 2025
Penalty type: Financial penalty — largest FCA fine of 2025
What happened:
The FCA fined Nationwide Building Society £44 million for inadequate anti-financial crime systems and controls between October 2016 and July 2021. During this period, Nationwide had ineffective systems for keeping up-to-date due diligence and risk assessments for all its personal current account customers and for monitoring their transactions. Nationwide was also aware that some of those customers were using their personal accounts for business activity, in breach of its terms. Nationwide did not offer business current accounts at this point, so did not have the right processes in place to manage the financial crime risks from business activity. FCA
In one serious case, Nationwide missed opportunities to identify a customer using personal current accounts to receive fraudulent Covid furlough payments. The customer received 24 payments totalling £27.3 million over 13 months, with £26.01 million deposited over just 8 days. HMRC recovered £26.5 million, but approximately £800,000 remains unrecovered. FCA
Key regulatory findings:
Nationwide's financial crime risk assessment and CDD processes for personal current account customers were inadequate and out of date for a prolonged period
Transaction monitoring failed to identify suspicious activity patterns, including large-scale Covid furlough fraud flowing through personal accounts
The firm's failure to offer business accounts while knowingly allowing business activity in personal accounts created a structural financial crime risk gap that was not managed
The FCA stated this case forms part of a broader pattern — it has imposed 13 fines totalling over £300 million on banks for AML systems and controls failings since 2021 Browne Jacobson
The failures persisted for nearly five years despite being within the FCA's stated supervisory priorities throughout the period
Compliance lessons:
Knowing that customers are conducting business activity through personal accounts without managing the associated financial crime risk is itself a regulatory failure — the absence of a product does not remove the obligation to manage the risk
Covid-era fraud is now working its way through enforcement processes years after the events — firms should not assume that the passage of time reduces their exposure for historic control failures
Transaction monitoring must be calibrated to the actual activity in accounts, not just the stated purpose of the product
As the FCA's joint executive director of enforcement stated: "Nationwide failed to get a proper grip of the financial crime risks lurking within its customer base. It took too long to address its flawed systems and weak controls, meaning red flags were missed with serious consequences." AML Intelligence
OKX (Aux Cayes FinTech) — $504 Million
Regulator: US Department of Justice / FinCEN
Jurisdiction: United States
Discipline: AML / BSA / Sanctions
Date: 2025
Penalty type: Criminal plea / Civil money penalty
What happened:
OKX agreed to pay over $504 million to resolve charges that it wilfully violated the Bank Secrecy Act by failing to implement an adequate AML programme, failing to file SARs, and allowing US customers to use its platform in violation of sanctions regulations despite claiming to have geo-blocked them. In the highest-profile crypto case of the year, a major exchange pleaded guilty to operating an unlicensed money transmitting business and failing to maintain an effective AML programme. ComplyAdvantage
Key regulatory findings:
OKX knowingly allowed US customers to access its platform while claiming to restrict US access — geo-blocking controls were superficial and ineffective
No adequate Customer Identification Programme or AML controls were in place
OKX failed to file SARs despite processing billions of dollars in transactions with clear red flags
The platform processed transactions connected to sanctioned jurisdictions and designated parties
Senior management was aware of AML control deficiencies and failed to act
Compliance lessons:
Virtual asset platforms cannot claim to be outside US jurisdiction while actively serving US customers — the DOJ and FinCEN look through the corporate structure to the economic reality
Geo-blocking controls must be technically robust, regularly tested, and documented — stating in terms of service that US users are prohibited is not a compliance control
The complete absence of SAR filing despite billions in transactions is treated as evidence of wilfulness, not oversight
Sanctions and AML controls must be integrated — treating them as separate risk silos creates dangerous coverage gaps that regulators will pursue aggressively
KuCoin — $297 Million
Regulator: US Department of Justice
Jurisdiction: United States
Discipline: AML / BSA
Date: 2025
Penalty type: Criminal plea / Market exit
What happened:
KuCoin agreed to pay $297 million and exit the US market entirely to resolve federal charges including conspiracy to operate an unlicensed money transmitting business and wilful failure to implement AML controls. KuCoin had no Customer Identification Programme, allowing users to transact in complete anonymity, and processed billions in suspicious transactions.
Key regulatory findings:
KuCoin operated as an unlicensed money transmitting business by knowingly serving US customers
No Customer Identification Programme of any kind was implemented — users could open accounts and transact with no identity verification whatsoever
The platform processed transactions linked to darknet markets, ransomware actors, and other criminal enterprises
Leadership was found to be aware of legal obligations and made a conscious decision not to comply
Market exit from the United States was imposed as a condition of the resolution — not merely a financial penalty
Compliance lessons:
A CIP is the absolute foundation of BSA compliance — its complete absence is the most fundamental failure possible and is treated as evidence of wilfulness
Market exit requirements are becoming a standard enforcement outcome in US cryptocurrency cases — compliance failures can cost a firm its entire access to the world's largest financial market
The DOJ applies identical BSA standards to cryptocurrency exchanges and traditional financial institutions — the novelty of the technology provides no regulatory accommodation whatsoever
TikTok (ByteDance) — €530 Million
Regulator: Irish Data Protection Commission (DPC)
Jurisdiction: European Union
Discipline: Data Protection / GDPR — International Data Transfers
Date: May 2025
Penalty type: Administrative fine / Compliance order
What happened:
In May 2025, the Irish Data Protection Commission fined TikTok €530 million ($600 million) for transferring the personal data of European citizens to servers in China. TikTok's own assessment of Chinese law apparently revealed that it does not provide the same level of protection for personal data as the GDPR. The fine is the second-largest GDPR penalty ever issued, surpassed only by the €1.2 billion Meta fine of 2023. The DPC found that TikTok had failed to verify, guarantee, and demonstrate that the personal data of EU users transferred to China received an essentially equivalent level of protection to that guaranteed within the EU. Infosecurity Magazine
Key regulatory findings:
TikTok transferred EU user data to China without adequate safeguards and without conducting a sufficient Transfer Impact Assessment
TikTok's own internal legal analysis acknowledged that Chinese law did not provide equivalent protection to GDPR — yet transfers continued
The volume of data transferred, the sensitivity of the data, and the number of EU data subjects affected were all significant aggravating factors
The DPC issued both a financial penalty and a compliance order requiring TikTok to bring its data processing into compliance
Compliance lessons:
A Transfer Impact Assessment is not a procedural formality — it must genuinely assess whether the destination country's laws provide equivalent protection, and transfers must stop if they do not
Internal legal opinions acknowledging inadequate protection in a third country, combined with continued data transfers, will be treated by regulators as among the most serious possible aggravating factors
The scale of TikTok's EU user base and the volume of data transferred amplified what might otherwise have been a procedural violation into a fundamental breach of GDPR's data transfer framework
Following Meta's €1.2 billion fine in 2023, TikTok's €530 million fine in 2025 confirms that unlawful international data transfers are the single highest-value enforcement category in EU data protection law