When your transaction monitoring system can't keep up with alert volumes, you've got two choices: hire more investigators or build a better system. Bank of America chose technology. That decision just cost them $1.2 billion in penalties from the OCC, FinCEN, and OFAC.
This case raises a question internal auditors face constantly: when does automation strengthen a compliance program, and when does it become a substitute for the human judgment you actually need?
The Question at Hand
Should your organization prioritize technology investment over compliance headcount when scaling your program? Bank of America's enforcement action provides a clear test case. In 2010, the bank documented that it didn't have enough investigators to handle all the alerts its detection channels generated. Management's response: build Event Processor, an in-house transaction monitoring system they described as the first of its kind.
That strategic bet failed. From 2015 to 2025, Bank of America's assets grew 59.1% while employee numbers stayed flat at 213,000. Event Processor couldn't scale with that growth. The system missed suspicious transactions, failed to incorporate internal intelligence from bank employees, and left the bank relying on law enforcement to flag problems. According to the OCC settlement, the bank is now hiring "thousands of investigators" to handle the workload.
So what's the right answer? Ask ten compliance officers and you'll get ten different frameworks for thinking about the tradeoff.
The Case for Technology-First Compliance
The argument for automation isn't without merit. Transaction volumes at large financial institutions run into the trillions. No amount of human review can match that scale. You need systems that can ingest data, apply risk models, and surface the highest-priority alerts for investigation.
Technology also brings consistency. A well-designed monitoring system applies the same logic to every transaction. It doesn't have bad days, doesn't miss patterns because someone called in sick, and doesn't introduce the cognitive biases that plague human decision-making.
Cost matters too. Hiring thousands of investigators means salaries, benefits, training, management overhead, and real estate. A technology platform has upfront development costs and ongoing maintenance, but the marginal cost per additional transaction is low. When you're trying to scale a compliance program without proportionally scaling costs, automation looks attractive.
And here's the kicker: hiring doesn't solve everything. You can throw people at a broken process and still get poor results. If your customer due diligence methodology is flawed, more investigators just means more people executing a flawed methodology. Technology forces you to document your logic, which can expose gaps in your risk model that manual processes hide.
The Case for People-First Compliance
The counterargument is equally compelling. Compliance isn't just pattern matching. It requires judgment about context, relationships, and intent. When Bank of America's Event Processor failed to incorporate intelligence from internal sources, that wasn't a technology limitation. It was a strategic choice to rely on automated risk scoring instead of human synthesis of qualitative information.
Experienced investigators develop intuition that no algorithm captures. They recognize when a transaction pattern looks wrong even if it doesn't trip any explicit rules. They know which customers to watch more closely based on behavioral changes that might not show up in structured data. They can interview relationship managers, pull together disparate information sources, and make judgment calls about whether something warrants a suspicious activity report.
Technology also creates brittleness. When Bank of America built Event Processor in 2010, they locked in assumptions about what suspicious activity looks like. As the risk landscape evolved through the 2010s and into the 2020s, those assumptions became stale. Russia invaded Ukraine, sanctions regimes expanded, and new money laundering typologies emerged. A people-first program adapts continuously. A technology-first program requires formal updates to detection logic, testing, and deployment cycles.
And here's what really matters: regulators expect you to know your customers. That's not a technical exercise. It's a relationship management exercise. When FinCEN and the OCC found that Bank of America couldn't build effective risk profiles for customers, that failure pointed directly at insufficient human engagement with the customer base.
Where Practitioners Actually Land
Most compliance officers don't choose one approach over the other. They're trying to find the right mix for their organization's risk profile, transaction volumes, and resource constraints.
The pattern you see in mature programs: technology handles the first layer of screening and monitoring, while people handle everything that requires judgment. Automated systems flag potential issues. Human investigators triage those alerts, conduct deeper analysis, and make the final call on whether to file a SAR or escalate to law enforcement.
The ratio between technology and people depends on your business model. A retail bank processing millions of consumer transactions needs heavy automation just to manage the volume. A private bank with fewer, higher-value relationships needs more intensive human due diligence per customer.
What doesn't work is what Bank of America tried: betting that technology alone can replace the human judgment layer entirely. The bank's own documentation showed Event Processor was built because they didn't have enough investigators. That's backwards. You build technology to make your investigators more effective, not to eliminate the need for investigators.
Our Take
Technology should amplify compliance capacity, not substitute for it. Bank of America's failure wasn't that they built Event Processor. It was that they treated Event Processor as a replacement for hiring adequate staff, then failed to invest the oversight and resources needed to make that technology strategy work.
If you're an internal auditor reviewing your organization's compliance technology investments, ask these questions: Does management view automation as a force multiplier for compliance staff, or as a way to avoid hiring? When the system generates alerts, do you have enough investigators to work them properly? When the system misses something, is there a human safety net that catches it?
The answer isn't to reject compliance technology. It's to recognize that technology and people solve different problems. Systems scale transaction monitoring. People exercise judgment about risk. You need both, and the balance between them should match your actual risk exposure, not your budget constraints.
Bank of America's assets grew 59.1% while staffing stayed flat. That's not automation success. That's strategic failure at the board and senior management level. The $1.2 billion penalty is the cost of getting that balance wrong.
