When the Treasury hits a major bank with over $1.2 billion in penalties, compliance teams across the industry start asking the same questions in their Slack channels and Monday morning meetings. The Bank of America enforcement actions, $1.2 billion from FinCEN, $750 million from the OCC, and $11.6 million from OFAC, aren't just headline numbers. They're a breakdown of what happens when transaction monitoring systems fail and human oversight gaps compound over years.
Here's what compliance officers, CISOs, and AML program leads are actually asking right now.
Does our transaction monitoring system have the same blind spots?
Probably, if you haven't stress-tested it recently against your actual transaction patterns.
Bank of America failed to report $5 billion in suspicious transactions between January 2018 and July 2025. This wasn't a one-off technology glitch. It was a systemic failure in how the monitoring system was tuned, how alerts were triaged, and how escalation thresholds were set.
Your monitoring system likely uses rule-based scenarios or machine learning models trained on historical data. If those rules haven't been recalibrated in the last 18 months, you're operating on assumptions about customer behavior and risk typologies that may no longer hold. Start with a scenario effectiveness review: pull a sample of filed SARs from the last year and reverse-engineer whether your current alert logic would have caught them. If you're finding gaps, your tuning parameters need adjustment.
Also, check your alert disposition rates. If your analysts are clearing 95% of alerts as false positives, your thresholds are set too low and you're burning investigative capacity on noise instead of risk.
How do we know if our sanctions screening is actually working?
Test it with known-match scenarios and measure your hit rate accuracy, not just your throughput speed.
OFAC documented 475 apparent violations between September 2021 and April 2025, totaling approximately $14.8 million across sanctions programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism. These weren't sophisticated evasion schemes, they were transactions that should have triggered screening controls but didn't.
Run a quarterly sanctions control test: inject a set of OFAC SDN list names and known aliases into a test transaction batch and confirm your screening engine flags them before processing. Measure your false negative rate (matches you missed) and your false positive rate (legitimate transactions you blocked incorrectly). Both matter. A system that blocks everything is as operationally useless as one that blocks nothing.
Pay particular attention to name-matching algorithms. If you're using exact-match logic instead of fuzzy matching with transliteration support, you'll miss obvious variants. And if your screening happens at onboarding but not at ongoing transaction monitoring, you're vulnerable the moment OFAC updates the SDN list after your customer relationship begins.
What does 'deficient human oversight' actually mean in a consent order?
It means your analysts didn't have clear escalation criteria, your investigations lacked documentation standards, or your management wasn't reviewing disposition decisions with enough rigor.
The OCC's $750 million penalty cited a "deficient and ineffective anti-money laundering compliance program." When regulators use that language, they're not just criticizing your technology stack, they're finding gaps in governance, training, and quality assurance.
Effective human oversight requires three things: documented investigation procedures that specify what constitutes sufficient due diligence, a quality assurance program that samples closed alerts to verify analysts followed those procedures, and regular calibration sessions where your team reviews edge cases together to align on Impact Tolerance and escalation triggers.
If your AML analysts can't explain why they closed an alert without filing a SAR, or if their case notes wouldn't satisfy an examiner's questions six months later, you have a documentation and training problem that technology won't fix.
Should we be using AI for transaction monitoring now?
Only if you can explain how the model makes decisions and you've built a validation framework to catch model drift.
Machine learning can improve detection rates and reduce false positives compared to static rule-based systems. But regulators expect you to understand and document how your models work, what data they're trained on, and how you're monitoring for bias or degradation over time.
If you're considering an AI-based monitoring system, establish model governance first: define acceptable performance thresholds, document your training data sources and any exclusions, and build a monitoring dashboard that tracks precision and recall metrics over time. You need to know when your model stops performing as expected, and you need a remediation plan for when that happens.
And don't assume AI eliminates the need for human review. Regulators still expect a human analyst to investigate alerts, document their findings, and make the SAR filing decision. AI should help your analysts focus on the right cases, not replace their judgment.
How often should we be updating our AML risk assessment?
At minimum annually, but trigger an interim update whenever you add new products, enter new markets, or see regulatory guidance shift.
Bank of America's failures accumulated over multiple years, suggesting their risk assessment didn't keep pace with changes in their business model, customer base, or the threat environment. If your risk assessment still reflects your institution as it existed three years ago, it's not guiding your control design anymore, it's just compliance theater.
Your AML risk assessment should directly inform your transaction monitoring scenarios, your customer due diligence requirements, and your sanctions screening protocols. When you identify a new inherent risk, say, you're launching a new digital wallet product, you should be asking whether your existing monitoring scenarios will detect structuring or layering through that channel, or whether you need new rules.
What's the first thing we should do Monday morning?
Pull your last SAR filing volume report and your alert disposition metrics, then ask your AML leadership if they can explain any significant trends.
If your SAR filings have been flat or declining while your transaction volume has grown, that's a red flag. If your alert clearance rate has been climbing, that's another one. Both patterns suggest your monitoring system isn't keeping pace with your actual risk exposure.
Schedule a control effectiveness review with your AML leadership, your CISO, and your compliance officer. Focus on three questions: Do we have visibility into the transactions we need to monitor? Are our analysts equipped to investigate what they're seeing? And can we demonstrate to an examiner that we're making risk-based decisions, not just processing alerts?
Where to go from here
Start with FinCEN's consent order and the OCC's enforcement action, both are public and both detail specific control failures. Use them as a checklist against your own program.
Then review your transaction monitoring system documentation and your last model validation report if you're using AI or machine learning. If you can't explain how your system decides what's suspicious, neither can your examiners.
And if you're not already doing quarterly sanctions screening tests with known-match scenarios, add that to your control testing calendar now. The cost of a testing program is a rounding error compared to an OFAC settlement.
