Regulators spent the third quarter of 2026 punishing failures that firms should have fixed long ago. Between July and September, authorities issued 25 fines of $1m or more, worth $2bn in total.
According to Corlytics, two data protection penalties made up 71% of that sum, and scrutiny of automated decision-making and senior accountability grew sharply.
The US again issued the most large fines. The four UBS penalties from different US agencies are counted here as one. Italy’s data regulator and Australia’s financial watchdog each imposed five, while the UK issued three.
Australian authorities covered the widest range of misconduct. ASX Limited was fined $16.3m for misleading statements, Latitude Group Holdings $13.9m and Fiducian Group $5.6m over misleading sustainability claims.
Data enforcement produced the biggest numbers. The Dutch Autoriteit Persoonsgegevens fined Uber $955m under Article 22 of GDPR because driver accounts were suspended automatically, with no human review, between 2018 and 2022. Ireland’s Data Protection Commission fined Google $457m after a six-year inquiry into location tracking.
In Italy, the GPDP fined Hera Comm $6.3m and EstEnergy $1.6m after a credit-scoring algorithm wrongly rejected customers. It also fined TIM $10.8m, BBVA $6.4m and IQVIA $7.9m.
Anti-money laundering failures remained a constant theme. A FinCEN-led action fined UBS Financial Services $125m for nearly two decades of customer due diligence lapses. Swedbank paid $50m to the NYDFS, and De Nederlandsche Bank fined ABN Amro €8.5m for repeatedly accepting weak client explanations. “These findings indicate a structural lack of depth in customer due diligence, which DNB considers serious,” the central bank said.
Supervision failures also drew penalties. FINRA fined Centaurus Financial $475,000 and American Portfolios $400,000.
FINRA executive vice president and head of enforcement Bill St. Louis said, “Member firms have a clear obligation to supervise their representatives’ product recommendations, including identifying patterns that appear to cause customers to incur unnecessary costs.”
In the UK, Crispin Odey received a £1.5m fine and an industry ban after losing his appeal against the FCA.
Washington’s campaign against “illegal DEI” has now produced $68.5m in penalties. Deloitte’s $21.5m settlement is the largest so far, following IBM’s $17m and PayPal’s $30m. The Deloitte case began as a qui tam action, and $4.3m of the settlement went to the American Alliance for Equal Rights.
This suggests whistleblowers can expect generous rewards. Separately, OFSI fined Citibank’s London branch £4m for Russia sanctions breaches and has doubled its maximum penalty to 100% of a breach’s value.
Corlytics head of non-financial risk solutions Gaspard Biosse Duplan argues that many firms have built an “illusion of controls”. Their large libraries of policies are not clearly linked to the risks they are meant to manage. Firms that cannot trace regulations through to risks and controls are likely to keep paying for it.
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
