What banks can learn from Fincen's penalty against BofA

• Key insight: Bank of America tuned its transaction-monitoring model to improve SAR yield, the share of flagged customers whose activity ends up in a SAR, and cut more than 8,200 cases in one 2021 recalibration.
• What's at stake: Fincen counted the "hundreds of millions of dollars" in compliance spending the bank likely saved as a financial gain from its violations, a signal that skimping on investigators carries a price.

Overview bullets generated by AI with editorial review.

Processing Content

For years, Bank of America let a piece of software decide which suspicious transactions a human would review. The bank built it partly because it didn't have enough investigators.

Federal regulators now say the bank kept that software tuned to spare its investigators and its budget, leaving billions of dollars in suspicious activity unreported as a result.

Internal tests showed the system was missing suspicious activity, but bank management "focused on the impact to the bank's resourcing rather than remediation sufficient to address the relevant issues," according to a consent order the Financial Crimes Enforcement Network, or Fincen, released Tuesday.

Fincen said in the order that the bank got financial gains out of the regulatory violations, in the form of "hundreds of millions of dollars in compliance-related expenditures" the bank likely saved.

In 2010, the bank built the system, which it calls Event Processor, partly because "there were not enough investigators to work all of the alerts" its monitoring rules generated, according to the order.

The bank re-tuned Event Processor in late 2023 after regulators pressured the bank on it. It said at the time that it expected its monthly volume of U.S. investigations to double, according to the order. The bank estimated it would need an "incremental 750" employees to keep up.

It also needed 800 consultants for a lookback (a review of past activity). That lookback found nearly 8,900 suspicious activity reports, or SARs, that the bank had failed to file, covering nearly $4 billion in transactions, according to the order.

In combination with a separate $750 million penalty from the Office of the Comptroller of the Currency, Fincen and the OCC together issued the bank a $1.2 billion penalty last week.

"Financial crime compliance is serious, and we are responsible for getting it right," a Bank of America spokesperson told American Banker. Bank executives told investors on Wednesday that the matter was resolved.

Every bank that monitors transactions makes the same kinds of choices Bank of America made: Which alerts signal the most risk, and how many add up to an investigation.

Fincen's order faults Bank of America not only for where it set those numbers but also for ignoring its own data about them.

How the model picked cases

Event Processor didn't send individual alerts to investigators. Each alert about a customer carried a weight between zero and 20 points, and a case opened only when the customer's total reached 20, a threshold "initially set by stakeholder judgment," according to the order.

Many types of alerts added their points every time they fired, so repeated activity could build toward an investigation. Others counted only once, however often they fired.

An alert for large aggregated incoming wires, for example, "could only ever contribute 1 point," whether it went off once or many times, according to the order.

Points also expired; an alert stopped counting toward the 20-point threshold after 13 months.

Ignoring its own numbers

Bank of America measured each type of alert by its SAR yield, which is the share of flagged customers whose activity ended up in a SAR.

The bank tracked that share for each alert type and for each score. This allowed it to track which alerts tended to generate SARs more frequently.

For example, alerts for large cash deposits at ATMs had a SAR yield of 56.75%. That means more than half of the customers flagged for large cash deposits at ATMs ended up in a SAR.

Despite large cash deposits at ATMs often correlating with suspicious activity, an alert for such activity was worth only one point, according to the order. The order doesn't say whether it was the kind of alert that added its points every time it fired or one that counted only once.

Fincen said this apparent contradiction arose many times; many of the alerts most likely to turn up suspicious activity carried the fewest points.

Fincen also found that, from 2018 to 2023, about 80% of the scoring changes Bank of America made were cuts. In other words, a vast majority of the time, when the bank re-scored an alert category, it reduced the number of points it generated against a customer. That meant fewer investigations.

The bank's testing also kept finding that customers just under the 20-point threshold were as likely to warrant a SAR as those just over it, suggesting the threshold was flawed.

During a formal review of the system in 2022, the bank found no statistically significant difference in SAR yield between customers scoring 15 to 19 and those scoring 20 or more points, according to the order.

The bank's testing in 2022 and early 2023 also had investigators look into a selection of customers scoring 16 to 19 points, which the system had not automatically sent to investigators.

That testing found that 38% to 45% of customers just under the 20-point threshold warranted a SAR filing. Compare that to the bank's 2018-2020 testing, when customers scoring 20 to 24 had yields of about 33% to 34%.

In other words, customers with just under 20 points actually warranted SARs more often than those just over it.

Despite the evidence that the 20-point threshold was flawed, the bank left it unchanged until late 2023, according to the order.

Tuning for a ratio

In 2021, Bank of America built what it called a "Risk Factor Calibration Model" to re-tune Event Processor. The aim was to adjust the scoring system such that the whole thing would have "a better SAR yield," according to an internal presentation the order quotes.

Michael Levi, a professor of criminology at Cardiff University in Wales, questioned the metric. On its face, "the share of reviewed alerts that end in a report is a strange metric," he told American Banker.

SAR yield ignores omissions, "and it assumes that judgments made to not report are sound," Levi said.

One way Bank of America could increase the SAR yield was by investigating fewer borderline cases and focusing only on very obviously suspicious cases. This would make it easier to finish an investigation with a SAR.

However, doing this would also mean investigating fewer cases overall, including some the bank should have reported, so it would file fewer SARs.

That is exactly what the recalibration did, according to the order. It cut more than 8,200 cases from investigators' queues, and the bank's own report acknowledged a resulting "SAR loss."

The report called that loss "permissible" without explaining how it reached that conclusion, according to the order.

Bank of America claimed that the recalibration penalized missed suspicious activity heavily. Such a system would ostensibly satisfy regulators wanting to make sure the bank didn't overlook suspicious activity.

However, the bank hadn't yet set any acceptable rate for missed suspicious activity, so "no objective benchmark existed" to check that claim, according to the order.

A late fix

In December 2023, following engagement with its regulators, Bank of America made a few changes to its transaction monitoring systems.

First, it lowered the 20-point threshold to 10 or 12 points, depending on the customer's alerts, according to the order.

Second, the bank shortened the 13-month window after which points expire. Under the new window, points expired after only four months.

Third, the bank established a 5% tolerance for missed suspicious activity. In other words, management would accept the system missing up to 5% of suspicious activity before stepping in.

Setting a 5% threshold is an unusual and inadvisable move, according to Ross Delston, a former banking regulator who is an attorney and financial crime expert.

"I've never seen a bank adopt an explicit 5% tolerance for missed suspicious activity, nor would I advise any client to write one down," Delston told American Banker.

"It's beguiling," Delston continued. "It has a surface appearance of objectivity, but regulators always ask the same question: On what basis do you accept this level of suspicious activity?"

The order does not indicate the basis Bank of America used for establishing the 5% tolerance.

The bank has since replaced it with lower, more granular thresholds for certain large transactions, such as those tied to Fincen's anti-money-laundering priorities, according to the order.

Fincen's penalty against the bank covers conduct from 2018 through July 2025, both before and after the change. Even after the changes in 2023, the bank missed activity tied to Chinese money-laundering networks, according to the order.

What it signals

Bank of America isn't the first big bank faulted after trying to reduce labor spending on financial crime investigations.

In 2018, Fincen found that U.S. Bank kept caps on its alerts "because those fixed caps permitted the bank to hire fewer employees and investigators."

Then, in 2024, Fincen found that TD Bank's tuning "focused on SAR conversion rates" (the share of alerts that become SARs).

The enforcement pattern suggests Fincen takes a dim view of banks that let cost and efficiency drive how they tune their monitoring systems or how many investigators they hire.

Attempting to cut corners tends to generate internal warnings, such as the ones Bank of America's internal testing of Event Processor produced. But these warnings are easy for executives to discount, according to Levi.

"As is common, these analyses could have been interpreted by senior management as compliance lobbying for more resources and risking doing less profitable business," Levi said.

In other words, Bank of America's senior management might have seen the warnings about Event Processor as merely a bid by the bank's compliance staff for a bigger budget — one that would also cost the bank profitable business.

"That's not an excuse, though," Levi said.