When your transaction monitoring system can't keep up with your bank's growth, the issue isn't just technology. It's a resource allocation problem that starts at the top.
Bank of America's $1.2 billion settlement with U.S. regulators shows what happens when management chooses automation over staffing and fails to adjust for over a decade. The bank launched its Event Processor system in 2010 because "there were not enough investigators to work all of the alerts." This decision to prioritize technology over people led to failures in transaction monitoring, suspicious activity reporting, and customer due diligence.
This checklist will help you assess whether your AML program balances technology and human resources effectively before regulators intervene.
Prerequisites
Before starting this assessment, gather:
- Your current AML technology stack documentation
- Headcount data for investigators and analysts over the past three years
- Transaction volume trends for the same period
- Results from your most recent independent AML testing
- Any outstanding audit findings or regulatory feedback related to transaction monitoring
You'll also need input from compliance leadership, IT, and human resources.
AML Resource Balance Checklist
1. Your transaction monitoring system generates alerts you can actually investigate
Don't just count alerts. Track what percentage your team can meaningfully review on time. If you're routinely unable to work all alerts, you've got a capacity problem that technology alone won't fix.
Good looks like: You can document that 95% or more of alerts receive timely human review, with clear escalation procedures for overflow periods.
2. You've tested whether your monitoring system catches what it should
Run retrospective testing using known suspicious activity patterns. Does your system flag transactions that law enforcement later identifies as problematic?
Good looks like: Independent testing confirms your system detects a representative sample of suspicious activities relevant to your customer base, with documented evidence of detection rates.
3. Investigator headcount has kept pace with transaction volume growth
Calculate your transaction volume growth over the past three years. Compare that to investigator staffing growth. A 50% jump in transactions without corresponding staff increases means you're asking people to do more with less.
Good looks like: You can show a rational relationship between volume growth and staffing, with documented analysis supporting any efficiency gains from technology improvements.
4. You're not using technology to paper over known compliance gaps
Review your last three years of audit findings and regulatory feedback. If you've repeatedly responded with "we're upgrading the system" rather than "we're adding staff" or "we're improving training," you may be avoiding the real problem.
Good looks like: Your remediation plans address root causes, whether those are technology limitations, staffing shortages, or training gaps, with measurable milestones.
5. Senior management understands the compliance strategy they've chosen
Your board and C-suite should be able to articulate whether your AML program is technology-heavy, people-heavy, or balanced, and why that approach fits your risk profile. If they can't explain the strategy, they can't oversee its execution.
Good looks like: Board minutes reflect regular discussion of AML resource allocation, with documented decisions about technology investments versus hiring.
6. Customer due diligence doesn't depend on external prompting
Review a sample of enhanced due diligence cases. How many were triggered by internal monitoring versus tips from law enforcement or other external sources? Your risk assessment should drive your due diligence, not someone else's investigation.
Good looks like: At least 80% of enhanced due diligence cases originate from your own transaction monitoring, customer screening, or periodic reviews.
7. You can fix documented deficiencies within committed timeframes
Track how long it takes to close audit findings and regulatory issues. Persistent delays signal that you lack the resources to execute your compliance program, regardless of what your policies promise.
Good looks like: You close 90% or more of audit findings by their committed deadline, with clear documentation when delays occur and why.
8. Your technology vendor doesn't control your compliance outcomes
If you're dependent on a vendor's roadmap to fix critical monitoring gaps, you've outsourced too much control. You need enough in-house expertise to configure, test, and validate that systems do what you need.
Good looks like: You employ staff who can independently validate system performance, tune detection rules, and document why your configuration choices are appropriate for your risk profile.
Common Mistakes
Treating technology as a staffing substitute. Systems process data. People assess risk, exercise judgment, and make filing decisions. You need both.
Ignoring the feedback loop. If your independent testing keeps finding the same gaps, and you keep promising to fix them with software upgrades, you're not learning from the findings.
Assuming efficiency gains are automatic. Better technology can improve productivity, but only if you've invested in training, change management, and ongoing optimization. Don't cut staff the day you deploy a new system.
Forgetting that regulators expect timely remediation. The Office of the Comptroller of the Currency's frustration with Bank of America centered on the bank's "poor response" to known deficiencies. Promising to fix something is not the same as fixing it.
Next Steps
If you've identified gaps in this checklist, your next move depends on where the gaps cluster:
Technology gaps: Conduct independent testing of your transaction monitoring system's detection capabilities. Document what it misses and why, then build a remediation plan that addresses root causes, not just symptoms.
Staffing gaps: Calculate your investigator-to-alert ratio and compare it to industry benchmarks. If you're an outlier, build a business case for hiring that includes the cost of regulatory penalties and reputational damage from missed suspicious activity.
Governance gaps: Brief your board on your AML resource strategy. Make sure they understand the trade-offs you're making between technology investment and headcount, and get their explicit support for the path forward.
The question isn't whether to use technology in your AML program. It's whether you're using technology to enhance human judgment or replace it. Bank of America's settlement suggests that when you choose replacement over enhancement, you'd better be certain the technology actually works.
