U.S. Bancorp and U.S. Bank: The Bank That Stopped Testing Its Alert Caps

In the U.S. Bank and U.S. Bancorp AML alert caps case, the Financial Crimes Enforcement Network assessed U.S. Bank $185 million for monitoring and reporting failures, including limiting alerts to match the staff available to investigate them. The bank’s own testing showed that it was missing suspicious activity. It stopped the testing. For an insider who saw the settings, the staffing requests or the warnings, that decision is the heart of the case.

U.S. Bank National Association is the banking subsidiary of U.S. Bancorp. The agency’s February 15, 2018 civil assessment describes failures in transaction monitoring, customer review and reporting. The parent entered a separate deferred prosecution agreement that day. Together, the documents show how a limit on investigators became a limit on what the bank would investigate.

How U.S. Bank’s Alert Caps Worked

U.S. Bank configured its Searchspace monitoring software to generate a set number of alerts each month. The assessment’s account of the alert settings describes 22 scenario-based queries, with caps on the six that generated the most alerts. The caps remained even after testing showed substantial missed reporting because they allowed the bank to employ fewer investigators.

The Security Blanket and Queries tools scored activity for potential risk, then generated alerts on accounts or customers with the highest combined scores. A high-risk account could miss the cutoff simply because other accounts scored higher. The limit measured how many alerts the bank would accept, while suspicious activity continued beneath it.

A separate 90-day rule suppressed repeat alerts. Once an account had generated an alert, the same query would not generate another during that window, regardless of how suspicious the later activity looked or whether the earlier alert had produced a suspicious activity report. An old alert could therefore silence a new warning.

Even an alert that survived did not necessarily reach an investigator. A review of June 2013 wire activity found that more than 57,000 customers had triggered alerts, with possible duplicates in that count, but the bank reviewed fewer than 100 for suspicious activity.

The bank had a way to see what its limits were missing. Investigators sampled transactions immediately below the alert thresholds and checked whether they warranted SARs. In November 2011, anti-money laundering staff concluded that an average of 50% of transactions reviewed in that testing over the preceding year had resulted in a SAR. Employees wanted the thresholds lowered so more activity would be investigated.

In April 2012, the bank stopped the below-threshold testing instead. The test had supplied a reason to investigate more transactions. Management removed the test.

What Are the Red Flags for AML Transaction Monitoring?

At U.S. Bank, the red flags for AML transaction monitoring included staffing-based alert caps, tests that found missed suspicious activity, and warnings that failed to change the controls. The assessment traced those choices through internal notes, staffing memos and a presentation prepared for senior management.

For much of the period, the bank had between 25 and 30 anti-money laundering investigators. Staffing stayed largely unchanged apart from investigators added through acquisitions. Human resources and compliance employees also complained that below-market salaries were allowing competitors to recruit the bank’s investigators. An anti-money laundering employee’s internal notes put the operating decision plainly:

The warnings reached management. An anti-money laundering officer asked for additional staff as the workload increased. The agency found that the chief compliance officer chose to fit monitoring and alert review to the understaffed department. When employees prepared a presentation for the chief executive describing the alert caps and their consequences, the chief compliance officer removed the references to the caps and added favorable information about the program.

The bank also kept its regulator in the dark. The assessment says that compliance leaders discouraged new officers from disclosing the caps by telling them regulators already knew about the limits and had accepted them. In a memo, an anti-money laundering officer described the program as using smoke and mirrors to fool the Office of the Comptroller of the Currency.

The bank also lacked a meaningful independent check on its software. Despite repeated recommendations from that regulator, it did not obtain independent validation of Searchspace. Instead, the employee managing the system prepared documentation for another employee to read and sign off. The reviewer was told that he was making no representation that he was validating anything.

The 2024 Wharton Initiative on Financial Policy and Regulation paper Anti-Money Laundering: Opportunities for Improvement gives this staffing problem a wider context. It finds that growing report volumes alone cannot show whether detection is improving or institutions are producing more defensive reports. Its principle on capacity is direct:

U.S. Bank’s testing supplied a concrete measure of what additional review could uncover. The staffing limit prevailed even after that evidence existed.

What Are Violations of the Bank Secrecy Act?

In U.S. Bank’s case, the Financial Crimes Enforcement Network found Bank Secrecy Act violations in an inadequate anti-money laundering program, missed suspicious activity reports and inaccurate currency transaction reports. The failures extended beyond alert caps into transactions left outside monitoring and customer information the bank did not connect.

Customers and non-customers could make Western Union transfers at bank branches. The bank knew that non-customer transfers would bypass its automated monitoring system, yet continued processing them without adequate controls. Branch employees sent suspicious-activity referrals to compliance, but the anti-money laundering department did not investigate those referrals until June 2013. When a new anti-money laundering officer raised concerns in an email, the chief compliance officer chastised him for putting them in writing.

Customer risk ratings had another blind spot. The bank did not review relationships across its different business lines and omitted information such as citizenship and occupation. Someone evaluating one product could therefore miss the customer’s broader relationship with the bank. The agency found that high-risk customers conducted transactions with insufficient oversight.

Currency transaction reports failed in a different way. The bank entered the correct tax identification numbers for money services businesses but supplied the wrong beneficiary names. A law-enforcement search using the businesses’ names would return no matching reports. The information needed to identify the beneficiary was already inside the bank.

The later reviews show what those failures had hidden. The assessment’s account of the lookbacks records 2,121 late SARs reporting more than $700 million in suspicious activity from selected six-month periods. They exposed activity that the bank’s everyday controls had left unreported.

Payday-Lending Accounts Stayed Open After the Warnings

Under its deferred prosecution agreement, as described in the Justice Department’s account of the criminal case, U.S. Bancorp admitted facts about its anti-money laundering and reporting failures. Those facts included delayed reporting on a longtime customer’s illegal payday-lending business and concealment of alert caps from regulators. A bank employee left resource limitations out of internal meeting minutes to keep the OCC from seeing them.

The criminal case described sham accounts in the names of companies nominally owned by Native American tribes. The payday lender used those accounts for personal spending, including a vacation home and a professional Ferrari racing team. Employees servicing the accounts disregarded signs that the tribal companies concealed the lender’s ownership. The bank also received regulatory subpoenas concerning the business.

After news reports prompted an account review in September 2011, an anti-money laundering investigator warned supervisors about shell companies. The bank closed the tribal-company accounts but failed to file a SAR. It left the lender’s other accounts open and opened new ones, allowing over $176 million more from the illegal payday business to flow into the bank.

The criminal account also describes the bank learning of a Federal Trade Commission lawsuit in April 2012. It still did not file a SAR concerning the lender until a federal prosecutor’s subpoena arrived in November 2013. Closing one group of accounts had left the wider customer relationship in place.

Civil Assessments Reached the Bank and Its Parent

The Office of the Comptroller of the Currency separately assessed U.S. Bank a $75 million civil penalty for its compliance failures. The Federal Reserve’s separate order assessed $15 million against U.S. Bancorp over Bank Secrecy Act and anti-money laundering risk management and compliance.

The Financial Crimes Enforcement Network also recognized the bank’s subsequent investments in staffing and technology and its remedial efforts. That response addressed the same resources the earlier monitoring decisions had constrained.

Can a Corporate Officer Be Held Personally Liable?

Yes. U.S. Bank’s former chief operational risk officer consented to a $450,000 FinCEN civil assessment in 2020 and admitted his participation in the bank’s violations. In that civil action, he admitted that he had acted recklessly. The Office of the Comptroller of the Currency imposed a separate $50,000 civil assessment.

The FinCEN assessment describes the authority behind the role. The executive had overseen anti-money laundering compliance and supervised the compliance leadership. Two anti-money laundering officers warned him that the monitoring system was inadequate because of the caps. He received staffing warnings and supported funding for a replacement system, but the agency found that his actions failed to correct the deficiencies.

In November 2013, the anti-money laundering and compliance officers put alert caps first in a presentation of significant issues for the chief executive. The former risk executive reviewed it but did not raise the caps at the meeting. In May 2014, the anti-money laundering officer bypassed him and took the problem to the chief risk officer. The following month, questions from the OCC and reports from an internal complainant prompted an investigation into the bank’s practices.

The assessment also pointed to an earlier action against Wachovia Bank over staffing-based alert limits. Wachovia had tuned its monitoring to the compliance personnel available, without determining whether the alert volume matched the actual risk. The agency found that the U.S. Bank executive should have recognized that warning’s relevance or investigated it further. The same decision had already drawn regulatory action elsewhere.

The executive also stated in his agreement with FinCEN that he had held no financial-institution compliance-management role from June 2014 through February 26, 2020.

What Proof Do You Need as a Whistleblower?

For a case involving alert caps, we look with you for the connection between the monitoring settings, the activity they excluded and the people who knew the consequences. U.S. Bank’s assessments describe that connection through threshold tests, staffing requests, referral records, customer-risk information and management presentations.

A monitoring engineer may understand why an account failed to generate an alert. An investigator may know what a sample below the cutoff revealed. A branch employee may know which referrals went unanswered, while an auditor may understand what the validation actually tested. We work with you to connect that knowledge to the decisions that kept the controls from working.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. Bank Secrecy Act enforcement has its own whistleblower program, which we assess with you when the evidence concerns bank monitoring and reporting failures.

You Saw How the Limits Were Set

If you saw alert caps survive failed tests or staffing warnings disappear before reaching senior management, speak with our whistleblower experts about how the bank capped its alerts. We build the case with you, bring in money laundering whistleblower lawyers who understand bank monitoring and reporting failures, and stay beside you as the case develops.