What the FinCEN Order Against Bank of America Teaches Compliance Officers

FinCEN found three willful violations.

1. No adequate AML program (31 U.S.C. § 5318(h)(1), 31 C.F.R. § 1020.210). The order concentrates on two pillars: internal controls, meaning the transaction monitoring system, and customer due diligence (CDD). Independent testing comes in as the function that should have caught both.

2. No proper due diligence on correspondent accounts for foreign financial institutions (31 U.S.C. § 5318(i), 31 C.F.R. § 1010.610). Here the accounts belonged to the bank's own foreign branches and affiliates.

3. Suspicious transactions not reported accurately and on time (31 U.S.C. § 5318(g), 31 C.F.R. § 1020.320). A SAR is due within 30 days of first detecting the facts. A material share of Bank of America's came more than six months after the activity.

On "willful": the order says plainly that it does not require bad intent. If your own testing tells you something is broken and you leave it, you are already in that territory.

FinCEN went through its ten enforcement factors. A few were given extra weight, and those are the ones worth studying:

• Harm to the mission. More than a third of investigations started from law enforcement or other outside input, not from the bank's own system. FinCEN said this contravened the purpose of the BSA.
• Financial gain. When the bank finally fixed its threshold, it estimated case volumes would double, needing about 750 more staff plus 800 consultants for a one-time lookback. FinCEN concluded the bank had saved hundreds of millions in compliance costs. It also kept high-revenue customers that compliance wanted gone.
• Systemic nature. One system, used bank-wide. The weakness ran through every business line.
• Management knowledge. By 2023 the BSA Officer and the head of the relevant business line had been briefed. The risks continued.
• Remediation and cooperation. Real fixes started after regulators and FinCEN got involved. Document productions were delayed, and the bank did not look into the historical activity on its own initiative.
• No voluntary disclosure.

The sentence I would put on a slide: management "focused on the impact to the Bank's resourcing rather than remediation sufficient to address the relevant issues."

What happened. Event Processor scored every alert, grouped alerts per customer, and opened a case only when the group reached 20 points within 13 months. Older alerts "retired" and stopped counting. Both numbers were "initially set by stakeholder judgment" and stayed unchanged until December 2023.

The bank's own tests kept pointing at the problem. In 2022 and early 2023, groups scoring 16 to 19 points, just under the line, produced SARs 38 to 45 percent of the time. Groups at 20 to 24, which did get investigated, produced them about 33 percent of the time. So the uninvestigated pile was richer than the investigated one. A 2022 validation said the threshold "needs to be justified". Another test showed that a different model setup would find far more SARs (85.4 percent against 20.2 percent on below-the-line samples). The bank rejected it, citing the "practical concern of pushing too many below-the-line event groups to cases".

After regulators stepped in, the threshold went to 10 or 12. The lookback found nearly 8,900 missed SARs worth about USD 4 billion.

Should have been: a threshold backed by evidence, with a written false-negative tolerance. The bank only introduced one (5 percent) near the end, and by then the below-the-line yield was seven to nine times higher. If testing shows you are missing SARs, add interim controls while the model gets fixed.

Several risk factors had SAR yields above 50 percent and a weight of 1 point. ATM large cash deposits, cash structuring, the HIDTA (drug trafficking area) flag. Reports from 2019, 2020 and 2022 all noticed. From 2018 to 2023, 76 percent of weights never changed, and around 80 percent of the changes that did happen were reductions.

The 2021 recalibration made things worse. Its stated aim was "so the whole system of weights has a better SAR yield", which in practice meant fewer cases: over 8,200 fewer. Of seven cash-structuring factors with yields of 50 percent or more, five had their weights cut.

The bank chased a prettier ratio instead of better coverage. High yield on a low weight is a signal to raise the weight. Instead, the model team's answer to a 2022 validation finding was that secondary factors were "redundant" and should be reduced to "improve the overall SAR yield". A factor with a 44 percent yield was called "poor" without explanation. That is six to eight times the missed-SAR tolerance the bank later adopted.

FinCEN adds a footnote worth keeping: SAR yield is a useful metric but not the only one, and it has to be read against your own risk profile.

What happened. The system could rescore risk factors to zero or suppress alerts for chosen entities. About 150,000 active event groups had hit such logic when it was switched off in December 2023. One list covered companies listed on certain stock exchanges, supposedly approved by compliance, but the bank's records show no such approved list.

The sharpest example involves the CTR exemption list. Customers on it had their cash-structuring alerts zeroed out. But a CTR exemption only removes the duty to file currency transaction reports. The regulation says in so many words that it does not reduce the SAR obligation. Customer B had more than 20 event groups with structured cash deposits rescored this way. Three ever became cases.

Should have been: every suppression rule treated as a control in its own right. Documented rationale, named owner, approved list under version control, periodic testing of what it hides. And a hard line between "exempt from reporting X" and "exempt from monitoring".

Some events created a case automatically: seizure warrants, grand jury subpoenas, employee referrals, 314(a) and 314(b) requests. For several years this route produced more than a third of all cases, and nearly half in 2023. For Customer B, 80 percent of AML cases between 2018 and 2023 contained at least one referral or external event. Points accumulating in the model were not what got that customer investigated.

FinCEN does not say outside input is bad. Cooperation with law enforcement and 314(b) sharing remain important. The problem is dependency. If your best detector is a subpoena, your own scenarios are not doing their job.

Should have been: a tracked metric for the share of cases that start from your own detection, with a rising external share treated as a model-performance finding.

The testing mostly asked whether SAR yield differed in a statistically significant way across the threshold. It did not ask what was being missed or whether that was growing. When a report found weights too low for high-yield alerts, the recommendation was to lower the weight of the one low-yield alert. And in 2023, when a test showed an 18 percent yield below the line, the then Global Head of Financial Crimes asked a senior manager to repeat it. The repeat called the earlier finding "incorrect", blamed investigator inexperience and biased sampling, and concluded the team was "confident that EP is working as intended". FinCEN names this episode in its enforcement factors.

I find this the most uncomfortable part of the order, because it is human and mundane. Nobody falsified anything. A result was inconvenient, so someone asked for it again.

Should have been: objective benchmarks agreed before the test, testers independent of the model owners, and a remediation log that tracks every finding to closure. A test that gets re-run until it passes is not independent testing.

Event Processor covered some purchases of negotiable instruments but not deposits, and could not tell a money order from a check. Credit cards were thin as well: the cash-structuring model only included card activity after a redevelopment in October 2024. A "TBML Feature" built in January 2024 was applied only to cases already under investigation. In 2025 the bank still had not done a coverage assessment for negotiable instruments.

Smaller examples show how general the gap was. A precious metals dealer received over 3,500 round-dollar instrument deposits worth almost USD 3 million. A self-described investment adviser deposited sequential round-dollar money orders for three years. Neither triggered an alert.

Should have been: a coverage matrix, products and channels against typologies, with the empty cells on a risk register with a date. A new FinCEN advisory is also a trigger to check whether your scenarios cover it.

Customer A runs an online marketplace for salvaged vehicles, a client since 1995, about USD 6 million a year in revenue for the bank, plus a lending relationship (the bank led a USD 200 million refinancing). By mid-2022 compliance counted more than 100 AML cases since 2020, around 90 percent fraud: business email compromise, romance scams, advance-fee fraud. The core problem, in compliance's words, was that the client "does not have visibility or understanding of source of funds". Third-party payments sat at the centre.

Compliance recommended closure in mid-2022 and expected "some pushback on the closure" given the "significant credit exposure". The relationship manager answered with a memo about a "large and valued client". More than six months later, in March 2023, the closure recommendation was withdrawn in return for four mitigations, mainly that Customer A would accept payments only from registered dealers. It did not. Third-party payments continued until June 2025, some money orders until about July 2025. In all that time the customer's risk profile and the monitoring were not adjusted.

Should have been: FinCEN is clear that closing is not the only acceptable answer. But if you keep a high-risk customer, the risk has to be mitigated and verified. That means an updated risk rating, monitoring aimed at the specific risk (here, third-party payments), a deadline, and a real consequence for missing it. The mitigation here was agreed and never checked. Escalation also needs a route that does not run through the revenue owner.

Customer B is a listed salvaged-vehicle platform. Years of alerts, investigations and law enforcement inquiries, and the rating stayed "Standard" until a grand jury subpoena in February 2020, then went to "Elevated" and "High" with no real change in due diligence. It was back at "Standard" by July 2022 and raised again after another subpoena in March 2023. In November 2023 the company publicly disclosed a DOJ investigation into its anti-money-laundering practices. The bank changed nothing.

The quarterly reviews of this "high-risk" customer did not mention that wires from its UAE affiliate had risen over 200 percent to about USD 1.1 billion in a single quarter, or that tens of billions in money orders were being deposited. The model was meant to pick up negative news. It missed the customer's own securities filing.

Should have been: a rating built from your own data (alerts, SARs, geography, products, adverse media), with external events adding to it, not driving it. And "High" has to change something: depth of due diligence, monitoring, review frequency. Here it was a label.

Customer C, a vehicle exporter, was onboarded with expected annual sales of USD 1 to 4 million. In about three years it processed more than USD 700 million in wires tied to high-risk jurisdictions, mostly Georgia. Its file did not even list its relationships in several high-risk countries. Wires involving Belarus and Georgia jumped right after Russia's invasion of Ukraine. Another bank sent a request for information in July 2022. The first SAR followed in August 2023 and covered roughly 10 percent of the activity. Most of the rest was reported in June 2025, after FinCEN's own information requests.

The bank exited Customer C in December 2023. It did not look again at Customers A and B, who had publicly disclosed commercial ties to it.

Should have been: a deviation check that fires when actual activity is orders of magnitude above expected, followed by a profile update and a SAR decision within the 30 days, not two years later. And when you exit one customer for suspicious activity, look at who else is connected to it.

From October 2020 to May 2025, Customers A and B received over 680,000 individual transactions, forming around 220,000 groups of suspicious deposits worth more than USD 660 million. The red flags were round-dollar amounts, sequential serial numbers, and repeated sets of three money orders adding up to between USD 2,900 and 3,000. That last one is a classic: buyers staying under the USD 3,000 level at which money services businesses must record identification. About one group in three was bought near the southwest border.

The warning came early. In September 2021 a money services business sent the bank a request for information about exactly this pattern. The bank answered that it saw no unusual velocity and no sign of illicit activity, and did not touch the profile or the monitoring. About 51,000 groups for Customer B and 72,000 for Customer A were processed after warning signs without timely reporting.

Should have been: an outside request describing a specific pattern means you test that pattern in your own data, not that you defend yourself. Negotiable instruments belong in the periodic reviews of customers who use them heavily. And sequential serial numbers or just-under-threshold sums are straightforward analytics.

Hundreds of millions of dollars matching Chinese money laundering network (CMLN) typologies were reported late or not at all. The customers presented as logistics or electronics businesses. The pattern: back-to-back card purchases at big retailers and shippers, large ACH and bill-pay payments to settle cards issued to other people, wires to China described only as "for goods", and repeated transfers to counterparties with no web presence at residential addresses. Some of it happened after the 2023 threshold cut. For small-business accounts the bank had no cap on additional cards, and card spending that routinely exceeded stated income did not trigger investigations.

Should have been: scenarios built from public advisories (FinCEN's August 2025 CMLN advisory lists credit card red flags), checked against every product. Cards in the customer risk assessment. And a business profile that has to match a business footprint: website, premises, real counterparties.

Until late 2024, bank policy allowed "simplified" due diligence for correspondent accounts of its own foreign branches and affiliates. FinCEN looked at twelve. The files said things like "treasury services" or "cash management", gave the name of the local regulator without describing the regime, and in places contained a chart of the parent's share price. The bank assumed these accounts mainly handled interbank settlement. In fact the branches served more than 250 non-bank financial institutions, money services businesses among them, whose flows look nothing like bank-to-bank settlement.

Should have been: the same program as for any foreign financial institution. The regulation has no intra-group exemption. Understand purpose and expected activity, assess the jurisdiction and the clients behind the account, and review actual activity against that. Ask whose money flows through, not just what type of institution is your direct counterparty.

Because the system aggregated activity over long periods before a human looked at it, a material share of SARs went out more than six months after the activity. Investigators sometimes could not review the underlying activity properly, so the SARs themselves were incomplete. The lookback after the threshold change produced over 8,000 SARs worth about USD 3.96 billion. Thirty-four of them had strong money laundering indicators: trade-based laundering with high-risk-country counterparties, correspondent wires involving a Russian petrochemical entity with sanctioned ownership, and healthcare cash structuring consistent with benefit fraud.

Should have been: time from first indicator to SAR measured as a KPI, with a tolerance. Aggregation windows serve detection, they should not delay it. And investigation staffing set by the volume your risk produces, not by the volume your budget expects.

Strictly, this is not a sanctions case. FinCEN does not enforce sanctions rules. OFAC does, and its USD 11 million penalty is a separate matter.

But the facts are full of evasion risk, and FinCEN says so. Customer A's wires involving jurisdictions bordering Russia reached volumes of up to USD 1.7 billion around the time of the February 2022 invasion. FinCEN had published alerts on Russian sanctions and export-control evasion in March and June 2022 and again in 2023. More than 18,000 wires worth about USD 850 million went through from September 2022 onward, after those alerts and after compliance had escalated internally. The bank's own March 2023 mitigation plan aimed to "eliminate the Bank receiving wires from sanctioned countries". And among the late SARs was one on correspondent wires involving a Russian petrochemical entity with sanctioned ownership.

The practical reading: sanctions risk is not only a screening problem. It is also a due diligence and monitoring problem. A payment can clear every screening check and still be a SAR.

At its own expense, the bank has to hire independent consultants, with FinCEN able to veto the choice, for:

1. A SAR lookback covering January 2022 until remediation is complete: credit cards, negotiable instruments, cross-border wires to high-risk jurisdictions, and the event groups that were never investigated. Priority risks are the southwest border and cartels, Chinese money laundering networks, Iran and Russia. The consultant may use supervised models, graph analytics and segmentation. Final report by December 2028, SARs due within 90 days after.
2. Effectiveness testing of suspicious activity monitoring: first the interim controls while the fix is under way, then the end state, with testing starting by October 2027. It explicitly covers risk weights, investigations, the bank's own testing and corrective actions, staffing, governance of overrides and whitelists, and the use of "responsible innovation".
3. Effectiveness testing of CDD and foreign correspondent due diligence, in two rounds, before and after the implementation plan.
4. A data governance review of BSA/AML-related data.

On innovation: FinCEN is open to advanced analytics, but it wants supervised models, labeled data, explainability and oversight. A machine learning model does not replace governance. It needs more of it.

1. Can you show the evidence behind every threshold and weight in your monitoring? "Expert judgment" is where you start, not where you stop.
2. Do you have a written false-negative tolerance, and what happens when you exceed it?
3. What share of your cases begins with your own detection, as opposed to external requests and referrals? Which way is it moving?
4. Is every suppression, rescoring or whitelist rule documented, owned and tested? Does any of it lean on a CTR exemption?
5. Do you have a coverage matrix of products and channels against typologies? Which cells are empty?
6. When another institution sends you a request about a specific pattern, does someone test that pattern in your data and write down the result?
7. Does a customer's risk rating come from your own data, or does it jump when a subpoena arrives?
8. Does your negative-news process pick up customers' own public filings?
9. For customers you keep against compliance's recommendation: who approved it, what was agreed, who verifies it, and by when?
10. Do periodic reviews of high-risk customers cover geography, volumes and every product the customer actually uses?
11. What is your median time from first indicator to SAR, and how long is the tail?
12. Do intra-group correspondent accounts get the same due diligence as third-party ones?