The $1.2 Billion AML Wake-Up Call

The consent order describes suspicious patterns that included repeated high-value credit card purchases at major retailers and shipping companies, payments from third parties to settle credit card balances, and large wires to China with generic descriptions such as “for goods” but no clear business rationale.

Other warning signs included repeated transfers to counterparties with limited online presence and businesses operating from residential addresses.

The order also highlighted gaps in monitoring negotiable instruments. Two corporate customers operating in the online auto auction sector deposited large volumes of money orders that were not effectively monitored. More than $600 million in suspicious money order deposits was not reported in a timely manner.

These examples show how suspicious activity can become harder to detect when monitoring controls do not adequately account for a customer’s products, transaction channels, counterparties, and expected activity.

Customer Due Diligence and Escalation Gaps

FinCEN also identified weaknesses in the bank’s CDD processes. Some customers received payments from unknown third parties or conducted transactions inconsistent with their expected activity. Internal concerns involving potential fraud, TBML, and possible narcotics trafficking did not always lead to timely action or reassessment of related customer relationships.

Effective CDD must do more than establish a customer’s identity at onboarding. It should provide an ongoing understanding of how the customer operates, who sends and receives funds, and whether actual activity aligns with the institution’s risk assessment.

When transaction monitoring identifies unusual activity, that information should inform customer risk ratings and decisions about whether enhanced due diligence, further investigation, or SAR filing is warranted. If these processes operate in silos, warning signs may be missed even when relevant information exists within the institution.

Why Testing and Remediation Matter

The consent order points to shortcomings in internal testing, audit, and remediation. Identifying a control weakness is only the first step. Institutions must determine its root cause, assess the impact on previously reviewed transactions, and verify that corrective actions work.

The bank estimated that lowering its monitoring threshold would double monthly investigation volumes and require approximately 750 additional staff. While resource constraints are a practical consideration, they cannot substitute for an effective risk-based approach. Thresholds should reflect the institution’s risk exposure, not simply the number of alerts investigators can manage.

Testing should therefore examine whether monitoring rules capture relevant suspicious patterns, whether alert suppression and scoring changes are appropriately governed, and whether investigations and SAR filings occur within a reasonable timeframe.

What the Consent Order Requires

The order requires significant independent review and remediation, including a lookback of suspicious activity reporting covering activity from January 2022 through completion of remediation. The review will consider areas such as credit card activity, negotiable instruments, cross-border transactions, and Event Groups that fell below previous investigation thresholds.

The bank must also undergo independent reviews of its interim and final transaction monitoring controls, CDD, foreign correspondent account due diligence, and relevant AML data governance. The order contemplates the use of advanced analytics and network analysis to help identify patterns of suspicious activity.

These requirements reflect the scale of the identified deficiencies and the need to assess not only whether controls have been updated, but whether they are effective in practice.

Key Takeaways for Financial Institutions

The Bank of America enforcement action highlights several priorities for AML compliance teams:

• Validate monitoring thresholds and rules. Periodically assess whether scoring methodologies and detection rules capture the institution’s actual risk exposure.
• Investigate activity below existing thresholds. A low alert score should not automatically end the inquiry when other risk indicators suggest suspicious behavior.
• Connect monitoring with CDD. Use transaction activity to inform customer risk assessments and ongoing due diligence.
• Strengthen governance over alert changes. Ensure that rescoring, suppression, and rule adjustments are documented, approved, and tested.
• Test remediation for effectiveness. Confirm that corrective actions address root causes and that previously missed activity has been appropriately assessed.
• Align resources with risk. Investigation capacity matters, but operational pressure should not determine whether suspicious activity receives appropriate scrutiny.

The Bank of America enforcement action illustrates how weaknesses across transaction monitoring, customer due diligence, and suspicious activity reporting can compound over time. Controls that appear functional on paper may still fail if their thresholds are poorly calibrated, investigations are delayed, or warning signs do not lead to appropriate escalation.

For financial institutions, the priority is not simply to generate more alerts. It is to build AML programs that identify meaningful risks, support timely decisions, and adapt as suspicious activity patterns change.