AML Consent Order Remediation Failures: The Order Still Runs the Business

An AML consent order can require a monitor, a lookback and proof that remediation has corrected the failures. The obligations reach the transactions a bank reviews, the customers an exchange serves and the growth its management wants. If you worked on the repair, you may know which payment types stayed outside monitoring, which test results reached management and whether the promised fix ever worked.

Bank of America’s Financial Crimes Enforcement Network consent order announced in October 2026 imposed a $1.2 billion civil penalty and required independent reviews of the repair. The bank admitted failures in its transaction monitoring, customer due diligence and suspicious activity reporting. The order requires a review of missed activity, testing of temporary safeguards and testing of the replacement controls.

The order describes a failure that survived earlier intervention. The Office of the Comptroller of the Currency required validation and a lookback in December 2024. Independent testing in 2025 still found critical problems with the bank’s transaction monitoring.

For someone inside compliance, operations or technology, that distinction matters. A new system can be ready to launch while the old system’s missed transactions remain unexamined. A project can reach its delivery date while investigators still lack the staff or information to make it work. The order reaches the work behind the completion report.

What a Monitor or Consultant Actually Tests

An independent anti-money laundering review tests whether the institution’s controls identify, investigate and report the activity they are supposed to catch. Bank of America’s order makes that test concrete: model performance, risk scores, investigation quality, responses to earlier testing, staffing, technology and oversight of exceptions all belong in the review.

The bank also admitted that its own independent testing failed to detect and describe problems with its main monitoring control. Some reports missed what the underlying data showed. When reports did identify problems, the response did not meaningfully change the system.

The bank’s interim controls review covers the period while repairs are underway. Its consultant must examine known monitoring gaps and test the transactions affected. Recommended safeguards can include manual reviews and analyses of particular products.

The later effectiveness review starts with the revised anti-money laundering system. It requires an initial test to find remaining gaps, then another review to validate the changes made in response. The consultant must also report which changes it verified the bank actually implemented. Calling the repair complete starts another examination of the repair.

Customer due diligence receives its own scrutiny. The order requires testing of how the bank understands customer relationships, develops risk profiles and updates customer information. It separately reaches accounts maintained for foreign financial institutions. A monitoring model depends on the customer information and risk judgments feeding it, as well as the transactions passing through it.

What Is an AML Settlement Lookback Looking For?

An AML settlement lookback examines earlier activity to identify suspicious transactions that should have been reported. The monitor’s lookback requirements turn evidence of noncompliance into specifics: which transactions entered the review, which were excluded, what the review found and what the institution did with those findings.

Bank of America’s required lookback begins with activity from January 2022 and extends through completion of the relevant monitoring remediation. The scope includes credit card payments, negotiable instruments such as money orders, cross-border transactions involving high-risk jurisdictions and groups of alerts that previously fell below the investigation threshold.

That last category gets to the heart of the problem. A transaction can exist in the bank’s data without ever reaching an investigator. The lookback must reach activity the earlier decision rules kept out of the queue.

The consultant proposes the scope and methodology, and FinCEN can change them. Quarterly progress reports allow the agency to expand the review’s period or scope within the specified bounds. The bank must make supporting work papers available to FinCEN and file reports identified as required by the consultant or agency.

The link between the missed activity and the repair is unusually useful to an insider. A model engineer may know which product never entered a data feed. An investigator may know which customer groups never reached review. The consultant’s coverage and testing can be compared with those underlying gaps.

What Are the Red Flags for AML Transaction Monitoring?

Red flags for AML transaction monitoring include excluded products, suppression rules that have not been adequately tested and test results that management leaves unanswered. Bank of America’s admitted failures show how these decisions can combine inside a working system.

Its Event Processor grouped alerts by customer and ordinarily sent a group for investigation only when its combined score reached 20 points. Testing found substantial suspicious activity below the threshold. The bank kept the threshold until December 2023, changing it only after extensive engagement with regulators.

The bank had the test results. It took regulatory pressure to change the threshold.

The system also assigned some risk factors a score of zero. The bank treated the affected activity as noise without adequately testing whether the suppression removed reportable suspicious activity. The score disappeared from the calculation. The transaction stayed in the business.

The new effectiveness review specifically reaches overrides, whitelists and similar exceptions, including whether the bank can explain and oversee them. The choice that removed an alert from review is part of what must be tested.

A trade-based money laundering indicator had a different blind spot. The bank used it only for activity already under investigation, rather than to generate alerts or trigger investigations. A tool built to recognize suspicious activity was waiting for another control to find it first.

More reports alone cannot answer whether a repair worked. Anti-Money Laundering: Opportunities for Improvement, published by the Wharton Initiative on Financial Policy and Regulation in 2024, examines the difficulty of interpreting rising suspicious activity report volumes:

The paper’s point makes the testing question sharper. A higher filing count leaves unanswered whether the repaired control caught the activity it previously missed. Bank of America’s required transaction testing and follow-up verification address that question directly.

Why an AML Order Can Restrict Bank Growth

A bank AML asset growth restriction ties expansion to the institution’s control failures, while ongoing remediation costs keep drawing on its budget. TD’s annual report for fiscal 2025 described a US$434 billion average combined asset limit for its two affected U.S. banks.

The Office of the Comptroller of the Currency’s order also provides for potential further reductions of up to 7% at specified noncompliance checkpoints and restricts expansion decisions. The consequences therefore reach what the bank can become, as well as what it must repair.

That changes the importance of the remediation report inside the business. Management’s expansion plans and the evidence that controls work belong in the same conversation. The analyst testing a monitoring gap is examining something that matters to the bank’s capacity to grow.

An asset limit and a compliance budget describe different pressures. One constrains the balance sheet. The other pays for the work required to fix the program.

What AML Remediation Costs a Bank

Compliance spending pays for controls, systems and remedial work. The distinction becomes visible when an order requires both a civil penalty and investment inside the institution.

TD reported US$507 million in U.S. Bank Secrecy Act and AML remediation expenditure for fiscal 2025. It forecast approximately US$500 million pretax for fiscal 2026 remediation and related governance and control investments.

Coinbase’s January 2023 resolution with New York’s Department of Financial Services required a $50 million civil penalty and a separate commitment to invest the same amount in compliance over two years. The resolution addressed customer due diligence and monitoring backlogs. That commitment targeted the controls inside the company.

Paxos’s August 2025 order paired a $26.5 million penalty with a separate $22 million compliance commitment. The order addressed the department’s allegations of AML and customer due diligence deficiencies, including Paxos’s relationship with Binance.

The Wharton paper also explains why broader AML costs are difficult to measure: the work is often embedded in an institution’s wider compliance operations. For an insider, the useful question is what the spending changed. The consultant’s verified implementation findings connect the budget to the actual repair.

What an AML Monitor Must Test and Certify

The agency’s own order defines what the monitor must examine and certify. Binance’s FinCEN order set an initial five-year monitor term.

That assignment includes review of U.S. users, a suspicious activity lookback and review of the AML program. Later stages require validation, further validation and a final certification review. The monitor’s work also reaches specified compliance commitments to the Office of Foreign Assets Control and reporting requirements in the Commodity Futures Trading Commission consent orders. Overlapping agencies create specific obligations inside the same business.

TD’s FinCEN order set an initial four-year monitor term. Its final review asks whether the AML program is reasonably designed and implemented to prevent and detect Bank Secrecy Act violations. The assignment ends with an assessment of the operating program.

Standard Chartered illustrates a different transition. Its New York monitor ended on December 31, 2018, followed by a consultant under the Department of Financial Services transition order. A change in the form of oversight can carry continuing work with it.

What an Insider’s Records Add

An insider can connect the promised repair to the decisions that determined whether it worked. The testing history, approvals for exceptions, transaction coverage and staffing decisions explain how a control operated beneath its written description.

Bank of America’s order shows why the sequence matters. It describes testing that found missed activity, rules that suppressed risk scores and governance that failed to correct those weaknesses adequately. The new review requires objective criteria, examination of personnel and technology resources, and verification of implemented changes.

Someone who worked on those decisions can explain whether a known gap entered the remediation plan, whether the testing covered it and what management did with the result. A consultant’s review scope and a test’s underlying transaction population can answer different parts of that question. We work with insiders to connect the control, the warning and the response.

Suspicious activity report confidentiality is a separate issue we address with you and the appropriate whistleblower lawyers. The starting conversation is about what you saw happen inside the business.

What an AML Whistleblower Can Be Paid

The AML whistleblower law provides qualifying whistleblowers a combined share of 10% to 30% of the money collected in covered cases.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. The International Labour Organization’s review of whistleblower laws describes that separate program. We assess the conduct and the applicable whistleblower route with you.

When You Know What the Repair Missed

If you worked on a lookback, monitoring system or remediation program and know that a promised correction left the same gap open, speak with our whistleblower experts about the failed repair. We build the case around the decisions and evidence you can explain, and bring in AML whistleblower lawyers who understand bank controls and regulatory orders. We stay beside you as the case develops.