The core of FinCEN’s case against Bank of America is a single system. The bank’s proprietary transaction monitoring platform, called Event Processor (EP), was its primary control for identifying and reporting suspicious activity. FinCEN’s consent order describes, in unusual detail, how that system was built, what the bank’s own testing said about it, and why the problems persisted for years. For compliance officers, it is the most useful document in the package, because the failures are not exotic. They are failures of calibration, testing, governance, and follow-through that exist in many programs.

How EP Worked

EP was introduced in 2010 as a proof of concept and was described internally as the first of its kind. Rather than send individual alerts to investigators, EP scored each alert with weighted risk factors (hundreds of them, weighted from 0 to 20 points) and rolled alerts together by customer into “Event Groups.” An Event Group became a case for human review only once its combined score reached 20 points. Alerts older than 13 months “retired” and stopped counting toward the score. The 20-point threshold and the 13-month window were set by what the bank’s documents call “stakeholder judgment,” and the threshold stayed in place until December 2023.

That design has two built-in hazards. A lot of activity can accumulate before any human looks at it, so investigations start late, in some instances more than a year after the underlying transactions. And if the weights are wrong, whole categories of genuinely suspicious behavior can drift below the line and expire without ever being reviewed.

The Evidence of Miscalibration Was in the Bank’s Own Reports

FinCEN’s findings rely heavily on internal documents. The bank measured “SAR yield,” the percentage of alerts that end up in a SAR. Its own testing repeatedly found risk factors carrying one-point weights but SAR yields above 50 percent. A 2019 report found that four risk factors added to an ATM large cash deposit model all had high SAR yields but each carried a one-point weight. An April 2020 report found no correlation between weights and SAR yields across fourteen large-wire alert types and called for a comprehensive review. A 2022 validation report called some weights “counterintuitive.”

The weights barely moved. From 2018 to 2023, 76 percent of risk factor weights were unchanged, and about 80 percent of the changes that did occur were decreases. A 2021 recalibration effort was driven by a goal of improving SAR yield and reducing case volume, and it cut weights on 106 risk factors while raising 17. It reduced the number of cases by over 8,200 and described the associated “SAR loss” as “permissible,” without explaining how the bank had decided that. A 2025 third-party review found that underweighted risk factors were still contributing to risk concentrating in lower-scoring Event Groups.

The Threshold Problem

The bank’s testing also showed that activity just below the 20-point line was as productive as activity above it. Event Groups scoring 16 to 19 points showed SAR yields of 38 to 45 percent in 2022 and early 2023, higher than the roughly 33 to 34 percent seen for groups at 20 to 24 points in the 2018 to 2020 testing. The 2022 validation report found no statistically significant yield difference between uncased groups at 15 to 19 points and cases, and said the 20-point threshold needed justification.

The bank’s response, according to FinCEN, was to defend the threshold. In one 2022 analysis, a more flexible model would have found far more SARs on below-the-line samples (85.4 percent versus 20.2 percent), but the bank rejected it out of concern about overwhelming investigative resources. And in 2023, when a test produced an unfavorable result (an 18 percent SAR yield below the line), the then-Global Head of Financial Crimes directed a senior manager to repeat the test. The second test deemed the first one incorrect and concluded the team was “confident that EP is working as intended.” FinCEN treats this episode as evidence about management’s attitude: the focus, it says, was on the impact on the bank’s resourcing, not on remediation sufficient to address the problem.

Rescoring, Suppression, and Auto-Promotion

EP “rescored” certain risk factors to zero or suppressed them, using lists and rules built in what FinCEN calls an “ad-hoc and subjective” way. When the bank discontinued rescoring in December 2023, about 150,000 active Event Groups had triggered it. The rescoring rules were not specifically covered by testing, even after a 2022 validation report flagged zeroed-out risk factors with SAR yields of 37, 53, and 58 percent. One suppression list was supposedly approved by compliance, but the bank’s records did not show that any such list was maintained.

One rescoring rule is a teaching point for every bank. Customers on the bank’s CTR exemption list, businesses allowed to be exempt from currency transaction reports, had structuring alerts rescored to zero. FinCEN reminds readers that a CTR exemption does not relieve a bank of its obligation to file SARs. One high-risk customer had more than 20 Event Groups with structured cash deposit alerts scored to zero, and only three reached the threshold.

On the other end, “auto-promote” risk factors, tied to external events like grand jury subpoenas, seizure warrants, and employee referrals, immediately created cases. For several years, more than one-third of cases came from these promote factors, nearly 50 percent in 2023. In other words, the system was frequently being told about suspicious activity by law enforcement rather than finding it.

Coverage Gaps: Negotiable Instruments and Credit Cards

EP had only limited coverage of negotiable instrument deposits. The bank did not monitor deposits of money orders and similar instruments purchased at other institutions. Between October 2020 and May 2025, two online auto auction customers processed tens of billions of dollars in negotiable instrument deposits, and the bank failed to report suspicious money order deposits totaling over $600 million, tied to potential trade-based money laundering with a southwest border nexus and to fraud. Another financial institution had flagged exactly this pattern to the bank, and the bank did not act on it. As of 2025, a third-party consultant found no coverage assessment had been done for negotiable instrument products. The bank installed a control for these deposits only after FinCEN’s investigation identified the issue.

Credit cards were a second gap. FinCEN found late SARs on hundreds of millions of dollars of transactions consistent with Chinese money laundering network typologies, including back-to-back credit card purchases. The bank had developed a “TBML Feature” in January 2024 but used it only on activity already under investigation, not to generate alerts proactively.

Independent Testing Did Not Catch It, or Did Not Matter

BSA programs require independent testing. FinCEN found that internal testing frequently documented the problems, with the underlying data in hand, but the reports failed to meaningfully address them, or the actions taken in response did not change EP. Testing focused on whether yields were statistically different, not on the cost of the activity being missed, and no objective benchmark, such as a false negative tolerance, existed until after FinCEN and the OCC became involved. Even a metric as basic as SAR yield was used to cut cases, not to ask whether the bank was missing suspicious activity.

The Remedy Gives the Scale of the Problem

After the regulators intervened, the bank cut the threshold to 10 or 12 points, shortened the window from 13 months to four, added a 5 percent false negative tolerance (with escalation to the Board at 7.5 percent), and ended rescoring. A one-time lookback found nearly 8,900 SARs not filed under the old thresholds, covering nearly $4 billion. The bank estimated its investigations would double, by about 16,000 per month, requiring 750 more staff plus 800 consultants for the lookback. FinCEN draws the obvious inference: the bank had likely saved hundreds of millions of dollars in compliance spending while the problem existed.

Lessons for Your Monitoring Program

Validate the logic, not just the code. Weights and thresholds need empirical support and a documented rationale. If your testing shows below-the-line activity is as productive as above-the-line activity, move the line or explain, in writing, why not.

Set tolerances before testing, not after. A false negative tolerance gives testing something to be measured against and gives management something to be accountable for.

Treat suppression logic as a high-risk change. Every rescoring or suppression rule needs a sponsor, a rationale, testing, and periodic review.

Watch the ratio of externally driven to internally detected cases. When a third or more of investigations start with subpoenas or referrals, your system is not doing the job it was built for.

Check coverage by product. Negotiable instruments, credit cards, and other less glamorous channels will be where criminals go when the core channels are tuned.

And do not protect the system. When a test result is inconvenient, the right response is to investigate it, not to re-run it until it comes out better.