SEC Fines Haywood $750K for Ignoring Its Own AML Policies

A Vancouver Broker-Dealer Pays $750,000 for SARs It Never Filed

Haywood Securities (USA) Inc., a broker-dealer registered with the SEC since 1997, agreed on September 11, 2026 to pay a $750,000 civil penalty and accept a censure to settle SEC claims that it failed to file suspicious activity reports on customer transactions its own compliance staff had already flagged. The settlement is documented in Exchange Act Release No. 34-106333, Administrative Proceeding File No. 3-22715, and was first reported in the trade press by Law360.

But here is the part the headlines are missing. The SEC did not allege that Haywood USA lacked an anti-money laundering program, or that its written policies were too thin. It alleged the opposite: the firm had policies requiring a SAR filing for transactions over $5,000 accompanied by specific red flags, identified those red flags, and then did not file.

That is a different kind of case, and it changes the risk calculus for every SEC-registered broker-dealer. Your compliance manual is not an aspirational document. Under Rule 17a-8, it is a federally enforceable commitment, and the gap between what it promises and what your operations actually do is the exposure.

Rule 17a-8 Turns Your AML Manual Into an Enforceable Standard

The SEC charged Haywood USA with violating Section 17(a) of the Securities Exchange Act of 1934 and Rule 17a-8 thereunder. Rule 17a-8 is short and consequential: it requires broker-dealers to comply with the reporting, recordkeeping, and record-retention obligations of the Bank Secrecy Act. Fail a FinCEN obligation, and you have automatically failed a securities rule the SEC can enforce directly.

The operative FinCEN requirement here is the SAR Rule, 31 C.F.R. § 1023.320. It requires a broker-dealer to file a SAR for any transaction involving at least $5,000 where the firm knows, suspects, or has reason to suspect the transaction involves suspicious or criminal activity. The filing is due no later than 30 calendar days after initial detection of the facts that may constitute a basis for filing.

The distinction most executives miss

There are two failure modes, and they are not equally dangerous.

• A program that is modest but faithfully executed leaves you arguing about the adequacy of a judgment call. That is a defensible posture.
• A program that is ambitious but unexecuted hands the regulator a written admission of what you believed the standard was, and then a documented record of not meeting it. That is what the Haywood order describes.

The SEC order found that Haywood USA identified red flags during account opening, customer due diligence, and subsequent account activity — including at least one customer with involvement with an individual convicted of running an investment fraud scheme — and still did not file SARs its own policies required. Detection was not the problem. Disposition was.

May 2021 to January 2026: Nearly Five Years of Detection Without Filing

The alleged conduct period runs from May 2021 to January 2026, according to reporting by Investment Executive. That is roughly fifty-six months, not a quarter of sloppiness.

A window that long is almost never an individual lapse. It is a process gap: red flags were being surfaced by the people doing account opening and monitoring, and nothing in the workflow forced a documented decision to file or not file within the 30-day clock. No owner, no log, no escalation, no testing that would have caught the pattern.

Remediation mitigated the outcome, but it did not prevent it. The SEC credited Haywood USA with strengthening its compliance program, adding AML compliance staff, and retaining an outside consultant to enhance testing of its AML policies and procedures. The firm still paid $750,000 and still took a censure. Read that as the enforcement signal it is: fixing the program after the fact earns credit on the penalty, not a pass on the charge.

For a founder or CEO, the practical lesson is about sequencing. Investment in AML staffing and independent testing is cheap relative to a censure that follows the firm into every counterparty diligence questionnaire, clearing relationship, and acquisition data room for years.

SEC Registration, Not Geography, Determines Your BSA Obligations

Haywood Securities (USA) Inc. is incorporated in British Columbia, keeps its principal place of business in Vancouver, and is the wholly-owned subsidiary of Haywood Securities Inc., an investment dealer regulated by the Canadian Investment Regulatory Organization. None of that mattered to the analysis.

What mattered is that the subsidiary has been registered with the SEC as a broker-dealer since 1997. US registration carries US Bank Secrecy Act obligations and US SAR filing duties, enforceable by the SEC through Rule 17a-8, regardless of where the desk sits or which home-country regulator supervises the parent.

This is the structural point for any cross-border group with a US-registered entity:

• Home-country supervision does not substitute for the SAR Rule. A CIRO-regulated parent's AML framework is not a defense to a § 1023.320 filing failure at the US broker-dealer.
• Shared compliance staff create shared blind spots. When one team runs AML for entities in two jurisdictions, the US 30-day filing clock is the requirement most likely to be absorbed into a general monitoring routine and lost.
• The US entity needs its own testable record. Red flag identification, escalation, and the file-or-not decision must be documented at the registered entity, in a form an examiner can reconstruct years later.

The SEC maintains a public AML source tool for broker-dealers that collects the applicable rules and guidance in one place. It is a reasonable starting inventory for any group that has grown a US registrant alongside a foreign parent.

What Your Leadership Team Should Decide This Quarter

If you run or sit on the board of an SEC-registered broker-dealer, the Haywood order converts into five specific asks. None of them require a new budget cycle.

Reconcile the manual to the workflow

1. Pull your AML policy and mark every affirmative commitment. Anywhere the document says the firm will file, escalate, review, or document something, treat that sentence as an enforceable obligation.
2. Sample the last twelve months of red flag events and confirm each one has a written disposition. An unresolved flag with no documented decision is the exact fact pattern the SEC described.
3. Name one accountable owner for the 30-day SAR clock. Not a committee. A person, with a backup, and a dated log.

Close the testing and reporting gap

• Independent testing must sample outcomes, not just procedures. A review that confirms the policy exists would have passed Haywood USA for years.
• Put SAR volume and red flag aging in front of the board quarterly. Zero filings over multiple quarters at a firm with active flags is a finding waiting to happen, not a clean record.
• If your US registrant shares AML staff with a foreign parent, staff the US function separately enough to own its own record. Cost of one additional AML hire versus a $750,000 penalty plus censure is not a close comparison.

One more decision belongs to the CEO rather than the compliance function: whether your written policies are calibrated to what your firm actually does. Overwritten policies are not conservative. They are a liability you authored.