When the Financial Crimes Enforcement Network and the Office of the Comptroller of the Currency announced $1.21 billion in combined penalties against Bank of America for anti-money laundering (AML) lapses, it underscored a critical issue: AML programs often fail due to predictable, fixable mistakes that repeat across organizations of all sizes.
Why These Mistakes Keep Happening
AML compliance is a complex field. It requires both technical systems for monitoring transactions and human judgment to assess customer behavior and risk. Many organizations excel in one area but neglect the other.
Another issue is the division of AML responsibilities across IT, operations, compliance, and front-line staff, often without clear ownership of the entire process. When something goes wrong, it's usually because multiple teams assumed someone else was handling it.
Mistake 1: Treating Transaction Monitoring as a Technology Problem
Your team sets up a transaction monitoring system, expecting it to catch suspicious activity. Instead, it generates thousands of alerts, mostly false positives, leading analysts to clear queues rather than investigate.
Why it happens: Vendors often market these systems as complete solutions. However, they require careful configuration and can't differentiate between a genuine red flag and a legitimate business cycle.
The real consequence: Analysts experience alert fatigue and rush through alerts, potentially missing real money laundering activities.
The fix: Establish a feedback loop between analysts and monitoring rules. Regularly review a sample of cleared alerts to ensure proper documentation and adjust thresholds based on actual findings, not default settings.
Mistake 2: Separating Customer Due Diligence from Ongoing Monitoring
You collect Know Your Customer (KYC) documentation at account opening and then move on. The monitoring team watches transactions without checking if they align with the customer's stated business purpose.
Why it happens: Due diligence is often seen as a one-time checklist item. Monitoring focuses on patterns, not whether they make sense for the customer.
The real consequence: A customer might start moving large sums through their account without triggering alerts, as nobody checks against the original due diligence file.
The fix: Schedule regular reviews comparing transaction history with due diligence profiles. For higher-risk customers, do this annually. For others, trigger a review if transaction volume increases significantly over six months.
Mistake 3: Designing Escalation Paths That Nobody Uses
Your AML policy outlines a clear escalation procedure, but front-line staff hesitate to report suspicious activity, fearing they might wrongly accuse a customer.
Why it happens: Employees are reluctant to make judgment calls that feel accusatory.
The real consequence: Patterns go unnoticed because observations aren't shared.
The fix: Encourage staff to document anything unusual, not just suspicious. Use a simple form and emphasize that reporting isn't an accusation, but a data point for the compliance team to assess.
Mistake 4: Treating Training as Annual Compliance Theater
Your team completes annual AML training but encounters scenarios the training never addressed.
Why it happens: Generic training focuses on regulations and hypothetical examples, not real-world judgment calls.
The real consequence: Staff may not recognize suspicious activity or know how to respond.
The fix: Supplement annual training with quarterly scenario discussions tailored to each role. Use real-world examples to reinforce formal training.
Mistake 5: Assuming Compliance and Business Operate in Separate Lanes
Your sales team focuses on revenue, while compliance manages risk. They often clash when compliance says no to sales initiatives.
Why it happens: Compliance is seen as a control function, creating an adversarial dynamic.
The real consequence: Sales might onboard high-risk customers without early compliance input, complicating risk management later.
The fix: Embed a compliance liaison in business development for significant deals. This person helps gather necessary due diligence early, fostering collaboration rather than conflict.
Prevention Checklist
Incorporate these practices into your AML program:
Alert quality metrics: Track how many alerts lead to Suspicious Activity Reports (SARs) or account closures. If less than 2% result in action, adjust your rules.
Cross-team case reviews: Monthly, review a complex case with representatives from all relevant teams to identify information bottlenecks.
Customer risk rating updates: Automatically review accounts when transaction volume or patterns change significantly.
Front-line observation logs: Provide an easy way for employees to document unusual activities without concluding they're suspicious.
Role-specific scenario training: Conduct quarterly, role-specific training based on real patterns your organization has encountered.
Early-stage risk consultation: Make it easy for relationship managers to ask about due diligence needs before finalizing deals.
Periodic end-to-end testing: Annually test your processes with a realistic suspicious activity scenario to ensure they work as intended.
The penalties against Bank of America won't be the last major AML enforcement action. However, the mistakes leading to these penalties are visible and fixable if you examine how your program operates in practice, not just on paper.
