What if your transaction monitoring system found fewer cases than the tips that came in from outside? According to US regulators, that is close to what happened at Bank of America for several years.
On 13 October 2026, the US Treasury’s Financial Crimes Enforcement Network (FinCEN) assessed a $1.2 billion civil penalty against the bank. The Office of the Comptroller of the Currency (OCC) added a separate $750 million penalty. FinCEN credits the OCC amount, so the bank pays $450 million to Treasury under the FinCEN order.
The core finding was about transaction monitoring. Gaps in the bank’s in-house system led to missed and delayed detection and reporting of more than $5 billion of suspicious activity, according to FinCEN.
This is not only a story about one large bank. It is a case study in AML program failures that any firm can learn from. It shows how transaction monitoring fails in practice, and why firms of every size should test it.
What FinCEN found
The order covers 1 January 2018 to 1 July 2025. The bank admitted the Statement of Facts and Violations. Key findings include:
- The bank relied on a proprietary monitoring system, called Event Processor, as its main tool for spotting suspicious activity.
- Gaps in that system led to missed and delayed detection and reporting of more than $5 billion of suspicious activity.
- About $1 billion of that activity involved national security and other priority risks, such as Chinese money laundering networks and fraud.
- More than $600 million in transactions showed signs of potential trade-based money laundering involving salvaged vehicles.
- A material portion of suspicious activity reports (SARs) were filed more than six months after the activity.
Why transaction monitoring fails
The order is detailed, but the lessons are simple. They apply to banks, fintechs, payment firms and crypto businesses.
1. Thresholds that let risk through
Monitoring rules work with thresholds. If a threshold is set too high, suspicious activity stays below the line. After thresholds were changed in December 2023, a one-time limited lookback found nearly $4 billion of suspicious activity that would not have been timely investigated under the old settings.
2. Alerts that never turn into investigations
For several years, more than one-third of the bank’s suspicious activity investigations began with a referral from law enforcement, another institution or a manual source. They did not come from the monitoring system. When outside tips find more cases than your own system, the system is telling you something.
3. Reports that arrive too late
A suspicious activity report is only useful if it reaches investigators while the trail is fresh. Late filing weakens recovery, freezes and prosecutions.
4. Customer types nobody watched closely
The order says two online auto auction customers processed tens of billions of dollars in negotiable instrument deposits that were effectively not monitored. Over $600 million in suspicious money order deposits went unreported. Some customers and products simply fall outside the rules.
5. Promises that are not completed
The OCC said the bank knew for years that potentially suspicious activity was not escalated, and that many steps required by its December 2024 order were not completed. Regulators judge programs by what is done, not by what is planned.
How to test your own transaction monitoring
A monitoring system only finds what it was built to look for. These checks help any firm find gaps before a regulator does:
- Test thresholds against real cases. Re-run past confirmed cases and see which ones the system would have flagged.
- Track where investigations start. If many cases begin outside the system, review the rules.
- Measure filing time. Count the days from first alert to filed report.
- Map unmonitored products. List every product, channel and customer type, then confirm each is covered.
- Review typologies. Check for trade-based money laundering, mule accounts and crypto exposure.
- Document and close findings. Assign owners and dates, and check that fixes are finished.
Where investigators add value
Software raises alerts. People decide what they mean. Investigators trace the money, identify who stands behind an account, and explain a pattern in a way a regulator can follow. For firms facing a backlog, a lookback review or a monitoring validation, independent investigators can add capacity and a fresh view.
How CAT Investigators can help
CAT Investigators provides AML compliance services for banks, fintechs, crypto firms and corporates. Our fraud and money laundering specialists investigate complex alerts, support lookback reviews and test whether monitoring finds what it should. Our financial crime investigations team traces funds across borders and across chains.
To discuss an independent review of your controls, contact CAT Investigators.
Sources
- FinCEN, “FinCEN Assesses $1.2 Billion Penalty Against Bank of America,” 13 October 2026
- FinCEN, Consent Order No. 2026-03 (Bank of America, N.A.)
- OCC, News Release 2026-89, 13 October 2026
- Banking Dive, coverage of the OCC’s December 2024 order
The facts above describe regulators’ findings. They do not say the bank itself laundered money. This article is for general information and does not constitute legal advice.