Bank of America agreed to pay $7.5 million to settle Securities and Exchange Commission allegations that its Merrill Lynch brokerage failed to properly file all required suspicious activity reports between April 2020 and September 2024. The settlement centers on gaps in Merrill's anti-money laundering controls caused by the way Bank of America's internal transaction-monitoring system flagged events for additional scrutiny. The case highlights compliance risks for large financial institutions when automated monitoring systems use risk thresholds that are not calibrated correctly, potentially affecting whether suspicious activity is reviewed, escalated, and reported to regulators under the U.S. anti-money laundering framework.
Bank of America's Monitoring System Assigned Risk Scores Below Investigation Threshold
According to the SEC's administrative action filed Monday, Merrill did not investigate all suspicious activity that should have been reviewed because of the way Bank of America's internal transaction-monitoring system flagged events for additional scrutiny. The SEC said Bank of America's software assigned certain events or transactions risk scores between 1 and 20. Events above the threshold were sent for further investigation. Internal reviews by the bank and Merrill found that some events scoring below 20 would have required suspicious activity reports if they had been investigated.
SEC Alleged Merrill Failed to Investigate Event Groups Scoring Below 20 Points
The SEC said Merrill failed to file numerous suspicious activity reports because certain event groups below the 20-point threshold were not investigated. "During the relevant period, Merrill failed to file numerous SARs due to its failure to investigate certain event groups with risk scores below 20," the SEC said. Suspicious activity reports, or SARs, are a core part of the U.S. anti-money laundering framework and are used to alert authorities to potentially improper transactions or conduct. The SEC's allegation was that Merrill's monitoring process failed to capture all activity that should have been investigated, and that failure resulted in missed filings.
Bank of America Changed Scoring System in December 2023 and Cooperated With SEC
Bank of America did not admit to the SEC's allegations, according to the administrative action. The bank changed the way its system scored events in December 2023, and the SEC said it considered the company's cooperation and remedial steps when calculating the penalty. Bank of America defended its broader anti-money laundering practices. "We maintain rigorous anti-money laundering practices," a spokesperson said in an emailed statement. "We have been engaged with regulators on this matter, and we continually review and enhance our AML systems to address evolving risks and report and detect suspicious activity."
Settlement Reinforces AML Compliance Review Requirements for Broker-Dealers
The case adds to regulatory pressure on financial firms that rely heavily on automated surveillance, risk scoring, and model-based monitoring. For broker-dealers, the settlement reinforces the need to review not only alerts that are generated, but also activity that falls just below alert thresholds. The case also shows how parent-company systems can create subsidiary-level exposure. The SEC's allegations involved Merrill's filings, but the monitoring framework was tied to Bank of America's software and escalation process.
FAQ
What did Bank of America agree to pay the SEC on Monday?
Bank of America agreed to pay $7.5 million to settle SEC allegations that its Merrill Lynch brokerage failed to properly file all required suspicious activity reports between April 2020 and September 2024.
Why did Merrill Lynch fail to file suspicious activity reports according to the SEC?
The SEC said Merrill failed to file numerous suspicious activity reports because certain event groups below the 20-point risk score threshold were not investigated, and internal reviews found that some events scoring below 20 would have required suspicious activity reports if they had been investigated.
What remedial action did Bank of America take in December 2023?
Bank of America changed the way its system scored events in December 2023, and the SEC considered the company's cooperation and remedial steps when calculating the penalty.
