When did your institution last test whether its monitoring settings still reflect its risks? Bank of America’s 2026 FinCEN consent order offers a practical reason to revisit that question, along with the connections between customer information, investigations, staffing and oversight.
For community banks and credit unions, the useful next step is a focused review of how controls work together in the business they operate today.
On October 13, 2026, Treasury announced enforcement actions against Bank of America, including a $1.2 billion FinCEN civil money penalty. FinCEN’s assessment credits $750 million payable to the OCC, leaving $450 million payable to Treasury under the FinCEN order. Those two amounts should not be added to the $1.2 billion assessment. See the Treasury announcement and FinCEN consent order.
FinCEN identified deficiencies in transaction monitoring, customer due diligence, foreign correspondent due diligence, testing and suspicious activity reporting. The conduct generally covered January 1, 2018 through July 1, 2025.
The order describes historical monitoring settings that included a 20-point investigation threshold and a 13-month event window. Both changed in December 2023. A subsequent lookback identified nearly 8,900 missed SARs involving almost $4 billion. FinCEN also found that 76% of risk-factor weights remained unchanged from 2018 to 2023. These findings give compliance teams concrete questions to bring to their own program reviews.
The following questions offer a practical agenda for reviewing your program. The consent order applies to Bank of America; it does not impose identical requirements on every institution. Apply these questions in light of your risk profile, applicable requirements and supervisory direction.
Ask why each significant threshold, scoring rule and aggregation window was selected. Review a risk-based sample of alerts, investigations and filed SARs, and examine activity below the investigation threshold where appropriate. Document what the testing shows and how the settings respond to your institution’s actual risks. Workload alone should not determine which potentially suspicious activity receives attention.
Establish a process for reviewing monitoring performance as customer behavior, products and risks change. Record the rationale for adjustments, approvals and post-change testing. Include alert suppressions, overrides and manual workarounds in that review. A setting that has stayed the same for years deserves an explanation supported by evidence.
Use qualified reviewers who are independent of the functions they test. Give material findings an accountable owner, a completion date and a clear measure of success. Report significant or overdue issues to the board or appropriate committee, and verify that remediation works before closing an issue. The FFIEC independent testing guidance addresses risk-based scope, independence and corrective-action tracking.
Map the products and channels your institution offers to the controls that monitor them. Consider cash, checks and other negotiable instruments, cards, wires, ACH and relevant cross-border activity. Check that data reaches the right systems accurately and completely. Repeat the review when a product launches, transaction patterns change or a manual process replaces an automated control.
Compare expected activity with what customers actually do. Consider material changes in transaction volumes, geography, counterparties, ownership and relevant investigative history. Make sure the people reviewing alerts can access useful context and that significant findings feed back into customer-risk decisions. The FFIEC customer due diligence guidance explains this ongoing, risk-based connection.
Where your institution maintains foreign correspondent accounts, examine the account purpose, anticipated activity, markets served, customer types and supervisory environment. Confirm that the depth of due diligence fits the relationship’s risks. If your institution does not offer these relationships, review whether onboarding and escalation controls are consistent with that position.
Trace the path from an alert or referral through investigation and any SAR filing. Review delays, handoffs, staffing constraints and the completeness of decisions and narratives. If a control gap suggests missed reporting, work with qualified BSA/AML professionals to determine an appropriate lookback scope and methodology. Follow applicable regulatory direction; a targeted review is not automatically sufficient for every deficiency.
Bring compliance, operations and leadership together around the most consequential gap. Agree on the corrective action, the resources it needs and the evidence that will demonstrate improvement. Keep unresolved risks visible until the fix has been tested.
Reliable data, documented decisions and timely follow-through help connect each part of the program. That is a useful place to begin your next BSA/AML discussion.
Reviewing your institution’s BSA/AML priorities? Explore BSA Guardian and BSA Compass, or talk with Finovifi about your team’s needs.”
This article is for informational purposes only and does not constitute legal advice. Consult qualified BSA/AML counsel regarding your institution’s circumstances.