Why an $80M AML Penalty Shows KYC Can Fail After Approval

Why an $80M AML Penalty Shows KYC Can Fail After Approval

Even after passing KYC, a customer can still become a compliance risk later.

That is the lesson financial services teams should take from FinCEN’s March 2026 enforcement action against Canaccord Genuity LLC. FinCEN assessed an $80 million civil money penalty against the broker-dealer for Bank Secrecy Act violations and described it as the largest BSA penalty ever imposed against a broker-dealer.

The size of the penalty gets attention first. The more useful lesson sits underneath it.

A customer file can look complete at approval and still become unreliable later. Names change. Ownership changes. Phone numbers, addresses, and business details change. Transaction activity can move away from what the firm expected when the account opened.

That is where KYC starts to become less about onboarding and more about maintenance.

What Happened in the Canaccord AML Penalty

FinCEN said Canaccord failed to implement and maintain an effective AML program that met Bank Secrecy Act requirements. The agency also said the firm failed to conduct required due diligence on certain correspondent accounts and failed to file SARs.

FinCEN’s consent order said Canaccord failed to file at least 160 SARs tied to suspicious activity.

The SEC also brought a parallel action. The SEC said Canaccord failed to maintain an AML surveillance program reasonably designed to detect, investigate, and report suspicious activity in its equity trading business. The SEC order said Canaccord failed to file approximately 150 SARs tied to potentially manipulative or otherwise suspicious trading activity.

Those numbers come from separate agency actions, so they should not be treated as one combined total. They point to the same kind of operational problem, though. AML review can break down when customer data, monitoring alerts, and escalation records are not current enough to support the decisions being made.

Why Approved Customers Can Become AML Risks Later

A lot of KYC work is built around the moment a customer enters the system. The file gets reviewed. The risk rating gets assigned. The account is approved or rejected.

That makes sense as a starting point. It becomes a problem when the original file is treated as if it still reflects the customer months or years later.

A customer may open an account as a lower-risk business. Later, the company may add new control persons, move into a different product area, shift locations, or begin activity that no longer matches the stated purpose of the relationship.

The original KYC record may still look tidy. The risk picture may no longer match it.

That gap matters because FinCEN’s CDD Rule requires covered financial institutions to understand the nature and purpose of customer relationships, develop customer risk profiles, and conduct ongoing monitoring to identify suspicious transactions. It also requires institutions to maintain and update customer information on a risk basis.

The phrase “risk basis” matters here. Some records need more attention than others. Higher-risk customers, changed ownership, unusual activity, and missing contact details can all create reasons to take another look.

3 Customer Data Management Checks for AML Programs

1. Customer Data Signals That Need to Stay Current

KYC depends on data that still reflects the person or business being reviewed.

A customer profile may include:

• Legal name and known aliases
• Date of birth or business formation details
• Address, phone number, and email
• Occupation, business type, or industry
• Ownership information and control persons
• Source of funds and expected account activity
• Geographic exposure

For legal entity customers, ownership information can change the whole review. A business may add new owners, change control persons, open new locations, or move into a higher-risk line of business.

When that information gets stale, the weakness can show up in several places.

A review process may miss a relevant detail because the customer name, alias, or business record is incomplete. A transaction monitoring system may produce weak alerts because the customer risk profile no longer matches reality. A compliance analyst may spend time confirming basic details before reviewing the actual activity.

Even basic contact details matter. A disconnected number, outdated email, missing address, or mismatched business location may not prove suspicious activity on its own.

It can still weaken the file. It can slow reviews, create outreach problems, and make it harder to explain why a decision was made.

That is why data quality has to be treated as part of the AML workflow, not just a cleanup task for the CRM.

2. Skip Trace Has to Follow the Customer

Skip tracing often becomes necessary after onboarding, not just at the start.

A customer, owner, officer, related party, or business contact may become harder to locate or verify after the account is already open. A business can add new people. A person can change contact details or start using different identifiers. A company can shift locations or expand into new regions.

Ongoing verification depends on current customer data. Poor data creates gaps in outreach and review. Those gaps create more manual work, more uncertainty, and more room for missed risk signals.

Skip Trace can help locate updated names, aliases, death record indicators, current and previous addresses, and phone numbers when available, so teams are not relying on outdated files.

Human review still matters. Skip tracing can return multiple possible matches, especially with common names, incomplete records, or overlapping data.

The value is not in replacing the reviewer. The value is in giving the reviewer cleaner inputs and more complete records before making a decision.

3. Data Append Can Support KYC Refresh Workflows

Customer data refresh often sounds simple until teams look at the actual files.

Records may live in CRMs, onboarding systems, spreadsheets, case tools, payment platforms, and older databases. Some files are complete. Others are missing phone numbers, emails, addresses, or business details.

That is where Data Append can support KYC and AML work. It can help fill missing fields before a refresh project, customer outreach effort, screening run, or internal review.

A compliance team may need to update contact information before reaching out to customers. Another team may need to enrich older records before reviewing higher-risk accounts. A firm may need to prepare a cleaner customer file before bulk review or customer outreach.

Cleaner records can make it easier to:

• Confirm whether customer files are still usable
• Reduce missing fields before screening
• Support KYC refresh outreach
• Give analysts better context when reviewing alerts
• Prepare older files for bulk review
• Keep clearer records for audit review

Data Append does not make the compliance decision. It supports the data layer that helps the review happen with fewer gaps.

Data cleanup is only part of the issue. The larger question is whether the process catches changes after approval.

The uncomfortable questions are usually operational.

• When was the last high-risk customer refresh?
• What actually triggers a customer data update? Are beneficial owner changes routed to rescreening?
• Are stale emails, disconnected numbers, or outdated addresses noticed before KYC outreach fails?

The same goes for review records. Can analysts see which customer data supported an alert decision? Are screening matches documented with resolution notes? Are SAR decisions recorded clearly enough for someone else to understand later?

FinCEN said regulators had repeatedly found weaknesses in Canaccord’s AML program. A finding is not the same as an operational fix. A written remediation plan does not help much if the same gaps remain inside the process.

Where Searchbug Helps in KYC and AML Compliance

Searchbug supports teams that need cleaner customer data and faster verification workflows.

For KYC and AML operations, Searchbug tools can support:

• **KYC/AML API** helps teams check customer identity and compliance-related risk signals inside existing workflows.
• Skip Trace helps locate updated names, addresses, phone numbers, and related contact details when older customer records no longer reflect the current person or business.
• Data Append helps fill missing customer fields such as phone numbers, emails, addresses, and business details before review or outreach.
• Bulk Data Processing helps teams clean and update larger customer files without building an API workflow.
• API workflows help teams run real-time data checks inside internal systems, CRMs, onboarding tools, or review processes.

These tools do not replace an AML program, legal review, or compliance judgment. They support the data layer that those processes depend on.

When customer data is incomplete or stale, onboarding checks become weaker. When risk signals are not refreshed, monitoring becomes harder. When records are not updated, analysts spend more time checking basics before they can review actual risk.

Searchbug provides data validation, enrichment, and screening tools used in customer verification, compliance, fraud prevention, and data quality workflows.

TL;DR

The $80M Canaccord penalty shows why financial services teams should review what happens after customer approval.

KYC is not finished when the account opens. Customer data needs to stay current. AML teams need records that support review, escalation, and reporting decisions.

Customer data refresh, Skip Trace, Data Append, and bulk file cleanup can all support a cleaner review process when older customer records no longer reflect the current customer.

For teams reviewing older customer files, Searchbug can help support KYC and AML cleanup work with Skip Trace, Data Append, Bulk Data Processing, and API workflows. You can also create a Free API Test Account with $10 in credits to test the tools first.

Not ready for an API? Bulk Data Processing can help clean larger files before your next KYC refresh, AML review, or customer data cleanup project.