The most important number in Bank of America's recent record AML enforcement action isn't the $1.2B penalty. It's 20 points.

The bank's transaction monitoring system was built to solve a problem every compliance team knows: there were not enough investigators to review every alert [1]. 

For more than a decade, it gave each alert for potentially suspicious activity a risk score, adding up the scores for each customer. Only when a customer's combined score reached 20 points was the activity sent to a human investigator for review. 

Until a customer's score reached that 20-point threshold, the alerts on their activity sat unreviewed, sometimes for more than a year, and some never reached an investigator at all.

The threshold, originally set through stakeholder judgement, remained unchanged until December 2023. A subsequent lookback identified nearly 8,900 Suspicious Activity Reports that should have been filed, covering almost $4B in activity [1].

That detail comes from FinCEN's consent order, published in October 2026 alongside coordinated actions by the OCC and OFAC [2][3], with much of the coverage focused on the size of the penalty. 

The order itself, which runs to more than 100 pages, offers something more useful: a detailed account of how controls at a large, well-resourced institution can drift over time.

Bank of America has been working to address these issues for several years, but the challenges the order describes are familiar across the industry. 

For compliance leaders, the findings raise questions that extend well beyond one institution.

A Threshold Is a Decision. Treat It Like One.

The bank's primary monitoring control was Event Processor (EP), a proprietary system first implemented in 2010. EP gave each alert a weighted score, grouped alerts by customer, and only created a case once a group reached 20 points within 13 months [1].

Below 20 points, suspicious activity waited

Simplify view of Event Processor, based on FinCEN's consent order

The design was not the problem in itself. The challenge was that it stood still. Between 2018 and 2023, around three-quarters of EP's risk factor weights never changed, and roughly 80% of those that did change went down [1].

The bank's own testing showed the cost. Activity scoring just below the threshold was producing SARs at higher rates than activity above it, and some risk factors worth a single point had SAR yields above 50%. Those findings were documented for years before the threshold moved [1].

Every threshold, weight and scoring rule in a monitoring programme is a risk decision. If nobody can show the evidence behind it, or when it was last tested against outcomes, the bank is simply assuming it still catches what it should. 

As customer activity evolves and criminal methods change, that assumption quietly weakens, and a gap only becomes visible when lookbacks or regulators reveal what was missed.

Suppression Is a Decision Too

The same pattern appears twice in the record, in two different systems.

In transaction monitoring, EP used rules to "rescore" or suppress certain activity. FinCEN found they were built in an ad hoc, subjective way, and not adequately tested. When the bank removed them in December 2023, around 150,000 active alert groups had been affected [1].

In sanctions screening, some flagged payments were released automatically by an alert suppression rule. That rule cleared alerts based on the same criteria as alerts an analyst had previously closed as false positives [5].

Learning from past decisions is valuable, but a rule that repeats yesterday's judgement without checking whether it still holds can reproduce yesterday's mistakes at scale. Suppression logic is a control in its own right, and it needs to be tested and governed like one.

Sanctions Screening Is Only as Strong as Its Controls

The sanctions element was the smallest part of the case: an $11.6m settlement for 475 apparent violations, which OFAC judged non-egregious [3].

The causes are worth reading closely, because most banks will recognise them. Payments went through blocked banks before the screening filter was updated to reflect a new designation. Analysts approved genuine matches as false positives. Poor alert calibration let designated individuals transact, and suppression released flagged payments [3][5].

However, there is a second lesson here. OFAC noted the violations were largely not voluntarily self-disclosed [3]. Identifying a violation is only part of remediation. Institutions must also assess their disclosure obligations as well as the potential enforcement implications of failing to report promptly.

If Others Are Finding Your Risk, What Is Your Monitoring Missing?

For several years, more than a third of the bank's suspicious activity investigations were triggered by law enforcement requests, subpoenas, other banks, and manual referrals, rather than by EP. In 2023, that share peaked at nearly half [1].

The Treasury's assessment was that this amounted to effectively outsourcing much of the detection to third parties [3]. 

A rising share of externally triggered cases is one of the clearest warning signs a monitoring programme can produce. Tracking their share, source, and eventual outcomes can help institutions assess whether their own controls are identifying the risks they were designed to catch.

The Bill Arrives as a Backlog

Correcting EP's threshold was expected to add around 16,000 investigations a month, doubling the bank's volume. The bank estimated it would need around 750 additional staff for the ongoing work, plus 800 consultants for the one-time lookback [1].

That is the real cost of a monitoring gap, beyond the penalty. It is years of unreviewed activity landing on investigators all at once, and SARs filed so late that their value to law enforcement had diminished.

This Is Not One Bank's Problem

Two years ago, TD Bank pleaded guilty to Bank Secrecy Act failures in what the Department of Justice called the largest BSA penalty it had ever imposed. The DOJ found TD Bank's transaction monitoring was effectively static from 2014 to 2022, with no new scenarios added, and that 92% of its transaction volume, roughly $18.3tn, went unmonitored [4].

The two cases are different in scale and conduct. But they reveal a common weakness: monitoring that did not keep pace with the bank's risks, products, and data, at two of the largest institutions in the US. 

The Treasury's message alongside the Bank of America action was clear: banks cannot rely on law enforcement or other institutions as a substitute for their own controls, and cannot ignore internal warnings that those controls are not working [3].

Five Questions Every Compliance Leader Should Be Asking

• When was each monitoring threshold last tested against outcomes, including the activity just below it?

• Can you list every suppression and auto-close rule, its owner and its last test?

• How quickly does a new sanctions designation reach your screening filters?

• What share of your investigations start outside your own monitoring?

• If an analyst cleared a true match today, how would you find out?

These findings reinforce the importance of compliance technology that offers more than processing alerts. Institutions need consistent investigations, documented reasoning, and the ability to review decisions against policies and evidence available at the time.

Silent Eight's Iris 7 AI Agents support this approach across financial crime compliance, helping institutions apply policy consistently when investigating alerts and produce explainable, auditable decisions. 

Together, these capabilities give compliance teams a stronger foundation for reviewing outcomes, identifying exceptions, and improving investigation quality at scale.

Bank of America’s case will be remembered for its size. For the rest of the industry, its value is in the detail: thresholds that need revisiting, rules that need testing, and warnings that need acting on. 

None of this requires new regulation. It requires banks to prove that their controls work – not just when they're implemented, but every day thereafter.