Q2 2026: $931 Million in Penalties, One Theme — Firms That Had Controls and Didn't Use Them

TL;DR

• Corlytics tracked 37 major enforcement cases and $931 million in penalties from regulators worldwide in Q2 2026, the largest quarterly total in a year.
• The central finding: firms are almost never punished for missing frameworks. They’re penalized for having frameworks and not using them.
• Supervision lapses and ignored alerts appeared in nearly one-third of cases — escalation failure, not detection failure, is the industry’s biggest gap.
• In the US: Western Asset Management ($100M SEC), Foundations Investment Advisors ($1.2M SEC), Cash App ($45M, 46 state AGs), and, just after quarter-end, UBS ($125M FinCEN) all illustrate the same pattern at different scales.
• If you run an issues log or an alert system, the enforcement record suggests your most urgent audit is not whether the system exists — it’s whether you’re using it.

Updated October 22, 2026: this is a dated review of April through June 2026. Case facts and amounts were rechecked against the SEC, FinCEN, and state attorney general releases, and later developments are noted below.

The Q2 2026 enforcement quarter is out, and the headline number is $931 million. Thirty-seven major penalties above the $1 million mark. The largest quarterly total in a year.

The number isn’t the story. The pattern is.

Corlytics, which tracks regulatory enforcement activity globally, found that the central lesson from Q2 wasn’t that firms lacked compliance frameworks. It was that they had them and didn’t use them. Supervision lapses and ignored alerts appeared in roughly a third of the cases reviewed. The industry’s weakest point, according to the report, isn’t detection. It’s escalation.

That’s an uncomfortable finding for any team that’s spent the past few years building controls. If you have an issues tracker, an alert management workflow, or a policy on management overrides — and most organizations of any size now do — the Q2 data is asking you a specific question: is anyone actually using it?

What the data shows

The $931 million figure comes from Corlytics’ quarterly enforcement analysis, which covered penalties above $1 million from regulators worldwide. Its largest cases included non-US matters, so treat the total as a global benchmark; the US cases below are what matter for a US program. Of the 37 cases examined:

• Supervision lapses and ignored alerts appeared in nearly a third of cases — making escalation failure the single most common root cause.
• Individual conduct featured in 10 of the 37 actions, including penalties that reached firm leadership directly, not just the institution.
• The pattern was consistent across firm sizes. In the US, it appeared at a $100M level at a major asset manager and at a $1.2M level at a smaller registered investment adviser.

What distinguishes this quarter isn’t the dollar amount — it’s the consistency of the underlying failure. Regulators didn’t find companies without compliance programs. They found companies that had compliance programs operating with gaps no one escalated.

Four cases that define the pattern

Western Asset Management — $100 million (SEC, June 2026)

On June 5, 2026, the SEC imposed a $100 million civil penalty on Pasadena-based Western Asset Management for failing to detect and prevent its former co-Chief Investment Officer’s alleged cherry-picking scheme. The SEC’s November 2024 complaint against the co-CIO alleges that from January 2021 through October 2023 he placed trades and then delayed allocations until near or after daily settlement prices were set. The penalty goes to a Fair Fund for harmed investors, and the firm settled without admitting or denying the findings.

The SEC’s findings were specific: Western Asset was aware that the former co-CIO’s trading and allocation practices diverged from those of other portfolio managers, and it “knew or should have known about such practices.” Western Asset also failed to implement its own policies and procedures relating to reallocations and failed reasonably to supervise him.

Since Q2: On October 6, 2026, the SEC moved for a final judgment by consent against the former co-CIO, Ken Leech: a $3 million penalty, an officer-and-director bar, and a permanent injunction, subject to court approval. The SEC says that with the firm’s settlement, $103 million would go back to harmed investors. Leech pleaded guilty in June 2026 to obstruction of justice tied to misleading SEC testimony.

This is not a case about missing controls. The policies existed. The anomalies were visible. The failure was that the firm didn’t act on what it saw.

Foundations Investment Advisors — $1.2 million (SEC, June 2026)

On June 8, 2026, the SEC settled charges against Arizona-based Foundations Investment Advisors, LLC and its former CEO, Bryon E. Rice, for breaches of fiduciary duty and failure to disclose conflicts of interest. The firm agreed to a $1.2 million civil penalty plus disgorgement; Rice agreed to a $354,675 penalty plus disgorgement. Neither admitted or denied the findings.

The violation involving Rice directly: the order finds that from March 2022 to June 2023 he bought an ETF in his personal account on 87 days through 279 trades while serving as CEO and on the investment committee that recommended the ETF to clients. He didn’t pre-clear any of those trades, as the firm’s code of ethics required.

The fine is smaller, but the structure of the violation is identical to the Western Asset case. The firm had a pre-clearance policy. A senior person didn’t follow it. Nobody enforced it. This happens at firms with sophisticated governance too, not just smaller shops.

UBS Financial Services — $125 million (FinCEN, August 2026)

FinCEN’s August 3, 2026 penalty against UBS is one of the clearest examples of the Q2 pattern, though technically it closed in the first days of Q3. FinCEN calls it the largest BSA penalty ever imposed on a broker-dealer. After a December 2018 consent order with FinCEN and a $14.5 million penalty, UBS failed to appropriately monitor more than 50,000 foreign currency wires worth more than $10 billion.

FinCEN says UBS “did not disclose these failings” to FinCEN, which learned of them through its own investigation following a regulatory examination. UBS admitted that it willfully violated the BSA. The order also requires a third-party lookback for undetected suspicious activity and an independent review of the AML program.

The regulator wasn’t told. A prior consent order covered the same ground. That’s the escalation failure pattern in its most explicit form.

Cash App / Block — $45 million (46 state AGs, July 2026)

On July 8, 2026, a bipartisan coalition of 46 attorneys general announced a $45 million settlement with Block over Cash App (our breakdown). It was announced a week after quarter-end. The states allege that Block told users their money was safe, implying bank-like protections; kept marketing while it knew fraud was rising; used minimal identity verification; went years without live phone support; and “failed to investigate and provide refunds as required by law.” Block must now staff live support, investigate fraud claims and reimburse unauthorized transactions as legally required, and honor at least $75 million and up to $120 million in consumer redress from its 2025 CFPB settlement.

These are allegations resolved by settlement, not adjudicated findings. They still illustrate the principle: the fraud-response process described to customers wasn’t operating the way it was supposed to, and the gap surfaced externally before anyone closed it internally.

The escalation gap vs. the detection gap

There’s a tendency in compliance programs to focus investment on detection: better alert rules, more sophisticated transaction monitoring, tighter scenario logic. Detection is necessary. But the Q2 data suggests that detection isn’t where the enforcement risk concentrates right now.

The risk is in what happens after detection.

An alert fires. A policy exception is logged. A finding is identified in an audit. What happens next? Who owns it? What’s the defined path to escalation if it isn’t resolved? How does senior management know about it? When does the board see it?

A common failure pattern: a compliance team has an open issues log, but the oldest items on it are months or years old with no documented progress. Findings are logged and then sit. When an examiner asks to see the issues log, they’re not just counting items — they’re looking at aging, at whether escalation happened, at whether management signed off on risk acceptance or just lost track of the finding.

The distinction matters because “we had it in our issues tracker” is not a defense if it’s been sitting there unresolved since the prior exam cycle.

What to audit in your own program

If the Q2 enforcement pattern describes your risk, there are four areas worth examining now:

1. Your open issues list. Sort by age. How many items have missed their target remediation dates without a documented extension request and approval? How many are classified as “in progress” with no recent activity? The issue isn’t the count — it’s the absence of documented movement and ownership.

2. Your alert dispositioning workflow. When an alert fires in your monitoring system, is it being investigated or cleared by a reason code? If someone can clear an alert without documenting the investigative basis, you have a documentation gap that an examiner will find before you do.

3. Your management override log. Every policy exception should leave a documented trail: what was overridden, who approved it, why, and whether there are any conditions on the override. If your override log is empty or if exceptions are informal, you’re creating the evidentiary gap that the Foundations case illustrated.

4. Your escalation path. If a compliance officer identifies today that a critical control has a monitoring gap, what is the documented process for escalating to senior management? To the board? If the answer is “email the CCO,” the escalation process is informal enough that you don’t have a record when it matters.

The OCC’s BaaS consent order from August 2026 identified governance and escalation deficiencies as central to its findings — the same pattern that appears across the Q2 global enforcement cases.

The individual accountability shift

Ten of the 37 Q2 cases involved enforcement action against individuals, not just institutions. This is part of a longer trend across SEC and DOJ enforcement toward personal accountability, but the Q2 data reinforces it.

Bryon Rice at Foundations paid a personal penalty. Western Asset’s former co-CIO has since agreed, subject to court approval, to a personal penalty and bars in the SEC’s case. The implication for senior compliance and risk professionals: the institutional penalty is not the only exposure when escalation fails.

If you are a CCO, a Chief Risk Officer, or a BSA/AML officer, the escalation path from your team to the board is also your personal documentation that you did what your role required when an issue was identified.

So what?

The Q2 2026 enforcement data doesn’t require any new regulation to understand. The lesson is already visible in the cases: build the control, then use it. Log the finding, then remediate it. Fire the alert, then investigate it. Identify the gap, then escalate it.

What makes this harder than it sounds: issues trackers fill up, alert volumes create noise, and escalation processes slow down when teams are under-resourced or when business pressure creates informal pressure to defer findings. The enforcement record doesn’t care about any of those reasons.

If your issues management process is where findings go to wait rather than where they get resolved and closed with evidence, the Q2 enforcement quarter is an accurate preview of what an examiner will eventually find.

The Issues Management Tracker & Template is built for this specific problem: tracking findings from identification through remediation with documented ownership, escalation steps, root cause analysis, and closure evidence — in the format examiners expect to see.

FAQ

What was the dominant enforcement theme in Q2 2026?

According to Corlytics’ quarterly enforcement report, global regulators handed out more than $931 million in penalties above $1 million across 37 cases in Q2 2026. The central finding was that firms were rarely punished for lacking frameworks — they were penalized for neglecting to update, escalate, and oversee the controls they already had. Supervision lapses and ignored alerts appeared in nearly a third of the cases.

What happened in the Western Asset Management SEC case?

On June 5, 2026, the SEC imposed a $100 million civil penalty on Western Asset Management for failing to detect and prevent its former co-Chief Investment Officer’s alleged cherry-picking scheme. The firm knew the co-CIO’s trading practices diverged from other portfolio managers but did not respond adequately. It also failed to implement its own internal trade reallocation policies.

What does “escalation failure” mean in enforcement terms?

Escalation failure means a firm detected a potential problem — an alert fired, an anomaly was noted, a flag was raised — but did not act on it with the required speed or rigor. The control worked; the process that follows the control didn’t. In Q2 2026, this was the single most common root cause pattern across major enforcement actions.

How does UBS’s 2026 AML penalty fit the pattern?

FinCEN’s $125 million penalty against UBS found that, after a 2018 consent order, the firm failed to appropriately monitor more than 50,000 foreign currency wires worth more than $10 billion. FinCEN says UBS did not disclose the failings, and FinCEN learned of them through its own investigation following a regulatory examination. The issue wasn’t that UBS lacked a monitoring obligation; it’s that the gap wasn’t surfaced to the regulator.

Does this enforcement pattern apply to fintechs or only large institutions?

It applies across firm sizes. Foundations Investment Advisors agreed to a $1.2 million penalty in June 2026; among the findings, its former CEO bought an ETF on 87 days through 279 trades without pre-clearing as its own code of ethics required. The pattern of having written controls and failing to use them is not size-dependent.

What should a compliance team audit after reading about Q2 2026 enforcement trends?

Four areas: (1) Open issues — which items are past due with no documented progress? (2) Alert dispositioning — are alerts actually being investigated or cleared by reason code? (3) Management override log — are exceptions documented with rationale and sign-off? (4) Escalation paths — if a control failure is identified today, what is the documented path to the board?