Corlytics Says Data Fines Dwarfed AML Penalties in Q3 2026

Regulators issued 25 fines of $1 million or more between July and September, worth about $2bn in total, and two data protection penalties accounted for 71% of that sum, according to Corlytics’ third-quarter enforcement analysis.

The two penalties were against Uber and Google. For compliance teams, regulatory enforcement fines Q3 2026 show that automated decisions and location data now carry larger penalties than the quarter’s anti-money laundering (AML) failures.

The quarter’s total is more than double the $834.9 million Corlytics counted for the third quarter of 2025. It also compares with about $542 million in the first quarter of 2026, and 37 penalties of $1 million or more in the second quarter.

Regulatory enforcement fines Q3 2026 by country

The US again issued the most large fines. Corlytics counts the four UBS penalties from different US agencies as one.

Italy’s data protection authority, the Garante per la protezione dei dati personali (GPDP), and Australia’s financial regulators each imposed five fines of $1 million or more. The UK issued three.

Australian authorities covered the widest range of misconduct. ASX Limited was fined $16.3 million for misleading statements. Latitude Group Holdings was fined $13.9 million, and Fiducian Group $5.6 million over misleading sustainability claims.

Fines are reported in US dollars in the analysis. Penalties announced in other currencies, such as the euro and the pound, are shown here in the currency of the announcement where it is available.

The two fines behind the data protection total

The Dutch data protection authority, the Autoriteit Persoonsgegevens (AP), fined Uber B.V. €824,990,000, which Corlytics counts as $955 million. The AP found that Uber made fully automated decisions about drivers, in breach of Article 22 of the General Data Protection Regulation (GDPR). It also found that Uber did not give drivers enough information about those decisions, a breach of Article 13, according to the European Data Protection Board.

Driver accounts were suspended automatically, with no human review, between 2018 and 2022. Some were deactivated temporarily over suspected fraud or low customer ratings, and others permanently for persistently low ratings.

The case began with complaints from 171 French drivers. Because Uber’s European headquarters are in the Netherlands, the AP led the case under the GDPR’s one-stop-shop procedure. Uber has stopped the practices and has appealed, and there is no final judicial decision.

Ireland’s Data Protection Commission (DPC) fined Google €403 million, which Corlytics counts as $457 million. The fine followed a six-year inquiry into how Google processed location data through Web & App Activity, Location History and Location Accuracy between May 25, 2018 and February 4, 2020. The DPC announced it on September 21.

The DPC found failures on the GDPR’s principles of lawfulness, fairness and transparency, and on retention of location data. It ordered Google to bring its processing into compliance within six months. DPC Deputy Commissioner Graham Doyle said individuals “could have been unaware that their location was being used to, for example, influence them with ads”.

What the data fines mean for compliance teams

Article 22 restricts decisions based solely on automated processing that significantly affect a person. The Uber decision applies that rule to account deactivation in the gig economy, not only to credit and hiring. Banks and large companies that use automated decision-making in onboarding, fraud flags, credit scoring or workforce management fall under the same provision.

Italy supplied a financial services example. The GPDP fined Hera Comm $6.3 million and EstEnergy $1.6 million after a credit-scoring algorithm wrongly rejected customers. It also fined TIM $10.8 million, BBVA $6.4 million and IQVIA $7.9 million.

Together, these penalties put a number on data protection exposure for firms that automate customer or staff decisions. The cases turn on whether a person reviews the outcome and whether the individual was told how the decision was made. Both are questions that can be traced through documentation, which is where a data protection impact assessment would normally sit.

AML penalties in the quarter’s enforcement fines

AML failures remained a steady theme in Q3 2026 regulatory enforcement, but the individual fines were smaller. A FinCEN-led action fined UBS Financial Services $125 million for nearly two decades of customer due diligence lapses. Swedbank paid $50 million to the New York Department of Financial Services (NYDFS).

De Nederlandsche Bank (DNB) fined ABN Amro €8.5 million for repeatedly accepting weak client explanations. “These findings indicate a structural lack of depth in customer due diligence, which DNB considers serious,” the central bank said.

The three AML fines named in the analysis come to $175 million for the two dollar-denominated penalties, plus the €8.5 million from DNB. The Uber fine alone is more than seven times the combined dollar total. The UBS penalty, the largest AML item named, is about 13% of the Uber figure.

On sanctions, the UK’s Office of Financial Sanctions Implementation (OFSI) fined Citibank’s London branch £4 million for Russia sanctions breaches. OFSI has also doubled its maximum penalty to 100% of the value of a breach.

Senior accountability and supervision fines

Supervision failures also drew penalties. The US Financial Industry Regulatory Authority (FINRA) fined Centaurus Financial $475,000 and American Portfolios $400,000. Those amounts sit below the $1 million threshold used in the quarter’s count, but they show the kind of conduct regulators pursued.

“Member firms have a clear obligation to supervise their representatives’ product recommendations, including identifying patterns that appear to cause customers to incur unnecessary costs.”

Bill St. Louis, Executive Vice President and Head of Enforcement, FINRA

In the UK, Crispin Odey received a £1.5 million fine and an industry ban from the Financial Conduct Authority after losing his appeal. Cases against individuals sit alongside the Senior Managers and Certification Regime, which makes named executives answerable for failures in their areas.

In the US, the campaign against what the administration calls “illegal DEI” has now produced $68.5 million in penalties. Deloitte’s $21.5 million settlement is the largest so far, after IBM’s $17 million and PayPal’s $30 million. The Deloitte case began as a qui tam action, a lawsuit brought by a private party on the government’s behalf, and $4.3 million of the settlement went to the American Alliance for Equal Rights.

Weak controls behind the Q3 2026 regulatory enforcement fines

Corlytics head of non-financial risk solutions Gaspard Biosse Duplan said many firms have built an “illusion of controls”. Their large libraries of policies are not clearly linked to the risks they are meant to manage.

The analysis concludes that firms that cannot trace regulations through to risks and controls are likely to keep paying for it, as they did in the regulatory enforcement fines of Q3 2026. That is consistent with the quarter’s cases: a due diligence lapse that ran for almost two decades at UBS Financial Services, six years of location processing at Google, and four years of unreviewed deactivations at Uber.

The decisions most relevant to open questions are still moving. Uber’s appeal of the AP decision is pending, and the DPC has said it will publish its full Google decision later. Google’s six-month compliance period under the DPC order runs to March 2027.