Issue #27 | October 27, 2026 | 8 min read
The Brief
On October 13, FinCEN assessed Bank of America, N.A. $1.2 billion for willful Bank Secrecy Act violations, and the OCC added $750 million for the same program. The consent order is long, and the most useful pages are about testing.
This issue covers a transaction monitoring system that worked as designed, the validation reports that said the design was wrong, what happened to the one test nobody liked, and why $1.2 billion turns out to be $450 million in cash.
Main Feature
Bank of America Had the Evidence Its Threshold Was Wrong. Its Answer Was a Second Test.
FinCEN's order reads like a validation file: every defect was written down internally, and each fix was shaped by how many investigators the bank had.
Bank of America built its primary monitoring system, Event Processor, in 2010 because "there were not enough investigators to work all of the alerts." It's a scoring model. Each alert carries a weight between 0 and 20 points, alerts roll up by customer into event groups, and a human only looks once a group hits 20 points inside 13 months. FinCEN's order says that threshold was "initially set by stakeholder judgment." It stayed at 20 until December 2023.
FinCEN penalty: $1,200,000,000, with $750,000,000 credited for the OCC penalty
Cash to FinCEN: $450,000,000
OFAC: about $11.6 million for 475 apparent violations (separate, per Treasury)
Conduct period: Jan 1, 2018 to Jul 1, 2025
Late or missed: over $5 billion in suspicious activity, about $1 billion tied to Chinese money laundering networks, fraud, and trade-based laundering with a southwest border nexus
Lookback after the 2023 re-tune: nearly 8,900 unfiled SARs, nearly $4 billion
The bank's own testing started poking at the threshold early. Reports from 2018 through 2020 found event groups scoring 20 to 24 points produced SARs about 33 to 34 percent of the time. A 2019-2020 report found groups scoring 18 and 19 produced more SARs than groups at 20 or 21. Testing in 2022 and early 2023 put the 16 to 19 point band at 38 to 45 percent. The activity the system was told to ignore was more productive than the activity it escalated, and the gap was growing. A 2022 validation said the 20-point threshold "needs to be justified."
Here's where the order gets specific. In 2022, answering a testing finding, the bank itself tried an "unconstrained" threshold and found it would "uncover more SARs (85.4% vs. 20.2% on below-the-line samples)." The bank rejected it. The stated reason was the "practical concern of pushing too many below-the-line event groups to cases," because the "enormous below-the-line population" would "exhaust investigation resources." Then in 2023, according to FinCEN, the former Global Head of Financial Crimes directed a senior manager to repeat a test that had found an 18 percent SAR yield below the threshold. The second test called the first "incorrect" and "unreliable," blamed investigator inexperience and biased sampling, and concluded the team was "confident that EP is working as intended."
That is the finding to underline. The control didn't lack testing. It had a decade of it, and the output was filtered until it agreed with the status quo.
The recalibration work shows the same pattern. In late 2021 the bank built a Risk Factor Calibration Model. An internal presentation said the goal was to "calibrate [risk factors] so the whole system of weights has a better SAR yield." The result: 106 weights went down, 17 went up, and over 8,200 cases disappeared, with the SAR loss described as "permissible." Five of the seven cash structuring factors that earlier testing flagged for 50 percent-plus SAR yields got cut. From 2018 to 2023, 76 percent of risk weights never changed, and about 80 percent of the changes that did happen were decreases.
Then there were the rules that removed alerts entirely. EP "rescored" certain factors to zero, built on suppression lists developed in what the order calls an "ad-hoc and subjective fashion." One list excluded companies on a group of stock exchanges compliance had supposedly approved, but the bank couldn't produce a record of the approved list. Another zeroed structuring alerts for customers on the CTR exemption list, even though the exemption rule says it doesn't relieve a bank of its SAR obligation. One customer on that list had more than 20 event groups indicating possible money laundering, and only three ever became cases. When the logic was switched off in December 2023, about 150,000 active event groups had triggered it.
The other side of the system made things worse. Auto-promote rules pushed groups straight to investigation when a seizure warrant, grand jury subpoena, or employee referral arrived. For several years, more than a third of all cases came from those triggers, peaking at nearly 50 percent in 2023. The bank was outsourcing detection to law enforcement. The problem also reached an affiliate: the order notes a June 2026 SEC settlement with Merrill Lynch over missed SARs that it attributes to issues with EP.
Coverage had holes a threshold change couldn't fix. From October 2020 to May 2025, two online auto auction customers deposited tens of billions of dollars in negotiable instruments bought at other institutions. EP had only limited coverage of those deposits, so the bank didn't report suspicious money order deposits totaling over $600 million, tied to potential trade-based laundering with a southwest border nexus and to fraud. Another financial institution flagged the exact pattern to the bank, and it still didn't monitor or report it. Compliance staff had called one customer "too much risk and no evident way to control/mitigate," found more than 100 AML cases on it between 2020 and August 2022, about 90 percent fraud-related, and expected "pushback on the closure" because it was a "longstanding client" with "significant credit exposure." The relationship dated to 1995, and the bank had been lead agent on a $200 million refinancing in a facility worth over $1 billion. A third-party consultant found in 2025 that the bank still hadn't done a coverage assessment for negotiable instruments.
Now the arithmetic. FinCEN credited the OCC's $750 million against its $1.2 billion, so the bank pays $450 million to FinCEN and $750 million to the OCC. Add OFAC's roughly $11.6 million and the cash comes to about $1.21 billion, which is the "more than $1.21 billion" in Treasury's headline. Last week we noted the OCC amount appeared to be credited. The order confirms it. The order puts the bank's most recent annual net income at about $30.5 billion, so the cash is around 4 percent of one year's profit. The order also says that when the bank finally tuned EP, it estimated case volume would double and require 750 additional staff, plus 800 consultants for the lookback, and that the bank "had likely saved hundreds of millions of dollars in compliance-related expenditures." The penalty and the avoided cost are the same order of magnitude.
Red Flags in This Case
A case-creation threshold set by judgment, with no stated tolerance for missed suspicious activity
Validation reports showing below-the-threshold activity producing more SARs than activity above it
A test result that someone senior asked to be repeated
Rescoring and suppression lists with no approver on file and no testing of their own
More than a third of investigations triggered by subpoenas, seizure warrants, and referrals, rather than the monitoring system
A product line with tens of billions in deposits and no scenario watching it
The question for a program is who decides when a test result is final. At Bank of America the decision was made by the same function whose system was being tested, and the capacity argument kept winning. FinCEN's order doesn't say the threshold was impossible to fix. It says the fix would have cost money, and that the bank waited until regulators made the decision for it.
Source: FinCEN Consent Order, Bank of America, N.A., No. 2026-03 | U.S. Treasury, Oct. 13, 2026 | FinCEN, Oct. 13, 2026
Controls & Testing
Risk & Control Matrix
Risk | Control |
|---|---|
The case-creation threshold stays where judgment put it while test results move against it, and capacity drives the answer | A written false-negative tolerance approved by senior management and the board, annual below-the-line sampling, and a required documented response when the tolerance is breached, with any capacity gap reported separately from the risk decision |
Rescoring, suppression, and auto-promote rules remove or force alerts without governance | Inventory of every such rule with an approver, rationale, dated testing, and sunset review, plus a tracked share of cases originating from external triggers |
Products and customer segments sit outside monitoring scenarios | Product-to-scenario coverage assessment, refreshed when products or high-risk segments change, with periodic customer reviews required to cover every major activity type |
Unfavorable test results get reperformed or overridden by the function being tested | Independence rule: retests owned by model validation or internal audit, both versions retained, and the reason for any change documented and escalated |
Audit Test Steps
An audit program built around this typology could test for it by:
Pulling the last three years of threshold and tuning test reports for the primary monitoring system, comparing the productive-alert rate just below the case-creation threshold with the rate just above it, and testing whether any case where the lower band outperformed was escalated with a documented decision.
Obtaining the list of suppression, rescoring, and auto-close rules, confirming each has an approver and a dated test, and reperforming one against twelve months of alerts to count what it removed and how many of those alerts later matched a filed SAR.
Calculating by year the share of investigations opened because of subpoenas, law enforcement requests, 314(b) requests, or employee referrals, then reviewing a sample to see whether the automated system had alerted on the same customer beforehand.
Mapping every product on the bank's product list to a monitoring scenario, then taking any product with large deposit or payment volume and no scenario and sizing the unmonitored activity.
Requesting any test whose result was later reperformed, revised, or rejected, and checking who ordered the change, whether that person owned the system under test, whether the original report was retained, and whether a declined recommendation cited investigator capacity.
Intelligence Briefing
FinCEN issues an alert on Iranian abuse of religious charity networks. FIN-2026-Alert008, dated October 15, asks institutions to report possible diversion of religious tithes and khums payments to Iran or Iran-linked actors, including through hawala and cash couriers, and to use the key term "FIN-2026-IRANCHARITYABUSE" in SAR field 2 and the narrative. The red flags are plain: a charity that solicits donations with no visible charitable activity, large donations from unknown sources followed by wires to other nonprofits, efforts to avoid CTR filing, and payments from a charity the customer has no relationship with that are withdrawn in cash. FinCEN also warns that no single indicator is determinative, and reminds banks that legitimate charities should keep access to financial services.
Source: FinCEN, FIN-2026-Alert008, Oct. 15, 2026
OFAC sanctions a Hamas fundraising network that moved crypto from France. On October 2, Treasury designated a Gaza-based deputy in Hamas's military wing, two France-based fundraisers, and the two French associations they ran, saying the group collected more than $2 million between 2020 and 2026, about $1.5 million of it after October 7, 2023, and sent hundreds of thousands of dollars in cryptocurrency to the Gaza-based deputy. DOJ announced an indictment of the same Gaza-based figure alongside arrests in Florida, Louisiana, and France.
Source: U.S. Treasury, Oct. 2, 2026
Career Intel
Bank of America told FinCEN that retuning EP would double monthly US investigation volume and require 750 additional staff, plus 800 consultants for the lookback. Those are jobs. The ones with staying power sit in validation and testing: people who can compare the alert population just under a threshold with the population just over it, define a false-negative tolerance, and defend a finding when the system's owner would like it rerun. If you can write that test and hold the line when someone senior questions the sample, you have a profile the next round of undertakings will ask for by name.
AI in Financial Crimes Compliance
Bank of America's 2021 calibration model was a statistical optimizer, and it did exactly what it was asked. The objective was a better SAR yield, so it found a lower caseload, cut 187 points of risk weight across the system, and called the missed SARs "permissible." FinCEN's order says banks may find SAR yield a useful measure but it "is not the only metric that can be considered," and it faults the bank for having no false-negative benchmark at all.
Anyone now using machine learning to tune thresholds or rank alerts has the same exposure in a faster form. A model optimizes whatever you point it at. If the target is efficiency, expect efficiency, and ask what the model is allowed to miss before you ask how many alerts it saves.
Source: FinCEN Consent Order, Bank of America, N.A.
Tip Line
Got any idea for something you'd want to see covered here? Doesn't have to fit neatly into a category. If you think it's interesting, we probably will too.
Send it to [email protected].
If someone forwarded this to you, welcome.
The AML Brief goes out every Tuesday. Subscribe for free and get the Top 10 AML Red Flags cheat sheet as a thank-you:
[BUTTON: Subscribe → theamlbrief.com]
Already subscribed? Forward this to one colleague who works in financial crimes. That's how we grow.
The AML Brief | theamlbrief.com
Disclaimer: The AML Brief is an independent financial crimes intelligence publication. All content is sourced from publicly available regulatory documents, enforcement actions, and published research. Nothing published here constitutes legal, compliance, or regulatory advice. The AML Brief is not affiliated with any financial institution, regulator, law firm, or employer. For advice specific to your situation, consult a qualified attorney or compliance professional.