Transaction Monitoring Failures: Budgets, Blind Spots and Ignored Internal Warnings

Transaction monitoring failures can give a whistleblower evidence of a bank’s decision to leave activity unseen. A staffing freeze, a canceled technology project or an excluded payment category can determine which transactions ever reach an investigator. If you worked on the system, challenged its coverage or explained the missing controls to management, you may know why the blind spot stayed open while the business kept moving money.

HSBC, Danske Bank, TD Bank and Standard Chartered show different parts of that pattern. The decision behind the missing alert can be as revealing as the transaction itself.

What Are the Red Flags for AML Transaction Monitoring?

Red flags for anti-money laundering transaction monitoring include excluded payment categories, disabled scenarios, stale thresholds, untested alert suppression and backlogs that grow while staffing stays fixed. Alert caps and ignored warnings matter because they connect what the system misses to a decision someone inside the bank made.

An alert cap makes the staffing decision particularly visible. In its criminal deferred prosecution agreement, U.S. Bancorp accepted responsibility for conduct that included limiting U.S. Bank’s transaction-monitoring alerts to staffing capacity. The available headcount helped determine how much suspicious activity reached review. A manager’s workload target had become a limit on detection.

What Is a False Positive in Transaction Monitoring?

A false positive in transaction monitoring is an alert that review does not substantiate as suspicious activity. The explanation for closing it matters, as does the testing behind a rule that prevents similar alerts from reaching an investigator.

Bank of America’s Financial Crimes Enforcement Network consent order shows the problem with assuming that low-scoring activity can safely wait. The bank admitted the order’s facts, including a system in which old alerts stopped contributing to a customer’s accumulated risk score. Its own testing found substantial suspicious activity below the threshold for investigation. The bank lowered that threshold in December 2023, and a later review identified missed suspicious activity reports.

The same order describes a senior executive directing a repeat test after an earlier test found suspicious activity below the investigation threshold. The second test blamed investigator inexperience and biased sampling for the earlier findings and supported keeping the threshold. The question for someone who worked on those tests is what changed: the system or the explanation.

FinCEN found that the monitoring gaps caused missed or delayed reporting of over $5 billion in suspicious activity. The bank relied heavily on law enforcement inquiries and other manual processes to identify activity its controls should have caught.

HSBC’s Staffing Freeze Left the U.S. Bank Short of People and Information

Under its 2012 criminal deferred prosecution agreement, HSBC admitted failures in its anti-money laundering program and its checks on foreign correspondent customers. The agreement’s factual attachment described a staffing freeze in 2007 intended to reduce costs and improve return on equity. The compliance function was severely understaffed.

The U.S. bank handled wire transfers and purchases of physical U.S. currency from HSBC Mexico.

In the same agreement, HSBC admitted that its U.S. bank kept Mexico in its lowest anti-money laundering risk category despite serious money-laundering risks. At group level, HSBC knew about significant deficiencies at the Mexican bank and admitted it did not pass that information to the U.S. bank.

The bank processing the money lacked information its own group possessed. The staffing freeze limited the people available to do the work. The failure to pass on the warning limited what those people knew. A group risk assessment and a local monitoring decision could therefore tell different stories about the same customer relationship.

For an insider, the relevant history reaches beyond an individual transfer. Staffing approvals explain the capacity decision. Risk classifications and internal warnings explain why the U.S. bank continued treating the relationship as it did.

Danske Canceled the Migration and Kept the Dollar Business

Danske Bank’s guilty plea tied a canceled technology migration to internal warnings and false assurances about its Estonian branch. The bank admitted conspiring to defraud U.S. banks that provided access to dollar clearing.

According to the plea’s factual attachment, the executive board canceled a centralized technology migration in 2008 because of its expense. A whistleblower’s warning in December 2013 and internal audits in early 2014 identified problems. The bank nevertheless misrepresented its controls and customer risks to preserve access to U.S. correspondent banks.

That correspondent relationship was central to the business. The Estonian branch’s customers needed a channel through which dollar payments could move. The U.S. banks providing that channel received assurances about the customers and controls behind the payments. Danske admitted that those assurances concealed the problems it knew about internally.

When one correspondent ended the relationship, Danske sought another and misrepresented why the earlier bank had left. The same control problem followed the business to the next proposed payment channel.

A project cancellation, an audit finding and an assurance sent to another bank can look like unrelated documents. Here they describe one sequence: a control improvement was canceled, warnings established the problem inside the bank, and the bank continued selling the relationship outside it. Someone who handled technology, branch operations or correspondent communications may understand a different part of that sequence.

TD Bank Left Ordinary Payment Categories Outside Monitoring

TD Bank admitted in the statement of facts accompanying its 2024 criminal guilty pleas that it excluded domestic automated clearing house transfers, most check activity and internal transfers between TD accounts from automated monitoring. These were ordinary ways customers moved money through the bank.

The admitted facts describe a budget policy that expected anti-money laundering spending to stay flat from year to year while the business grew. Employees repeatedly proposed ways to close the gaps. After the bank raised domestic ACH risk in 2012 because of the missing monitoring, an executive rejected a proposal to add scenarios. Employees raised the lack of ACH and check monitoring again in 2019 and 2020. Senior anti-money laundering leaders knew about the gap.

From January 1, 2018, through April 12, 2024, TD’s automated system left 92% of transaction volume unmonitored, encompassing approximately $18.3 trillion in transaction value. The same criminal statement separately identified three laundering networks that moved more than $670 million through TD accounts.

The bank’s treatment of Zelle makes the failure tangible. TD added Zelle activity to existing wire-monitoring scenarios without recalibrating them for Zelle’s lower values and higher volumes. The scenarios effectively targeted activity that could not occur under Zelle’s transaction limits.

In 2021, executives told the bank’s regulator that Zelle had scenario-based monitoring. Employees continued identifying the gap and advocating for appropriately calibrated rules. Management put the project on hold.

The bank told its regulator it monitored Zelle while using rules aimed at transactions the product effectively did not allow.

Standard Chartered’s Rulebook and Deployed Rules

New York’s Department of Financial Services alleged in its August 2014 consent order that implemented scenarios differed from the rulebook, contained errors or were incomplete, and that testing had failed to identify the problems.

The agency described a defect in the bank’s effort to repair its controls: the written description and the running system disagreed, and testing missed the difference. That gives an engineer, tester or auditor a concrete comparison to explain: the intended rule, the deployed version, the test result and the activity the defect could miss.

AML Monitoring Budget Decisions as Evidence After Internal Escalation

Anti-money laundering monitoring budget decisions become useful evidence after internal escalation when the records connect a known gap to the decision that kept it open. A budget approval establishes more when the accompanying request explains which transactions will remain outside review without the money.

The same connection applies to system versions and test results. The version identifies the rule actually running. Testing shows what it missed. An escalation identifies who received that finding. A project decision explains whether the bank funded the correction, postponed it or rejected it while the affected business continued.

Those records can sit with compliance, internal audit, onboarding, engineering, operations and the managers approving staffing or exceptions. The useful account follows the work across those functions.

Anti-Money Laundering: Opportunities for Improvement, published by the Wharton Initiative on Financial Policy and Regulation in 2024, examines why resources and information determine whether controls can work.

The paper also explains that public and private institutions hold different information and expertise. In these bank cases, the person who understood the staffing request or the failed test could explain something a payment record alone could not.

The Warning Shows What the Bank Knew

An internal warning can establish when a bank learned that its monitoring missed activity and what it chose to do next. Danske’s audit findings and TD’s repeated proposals show why the response belongs beside the warning itself.

A 2019 Central European University thesis, How Does Whistleblowing and Leaking Affect Anti-Money Laundering Policy Changes in the European Union, found that insider information helped expose laundering processes and influence policy. Its analysis emphasizes bank transfers and internal correspondence. Those records make the movement of money and the organization’s knowledge visible together.

If you found the gap through your compliance, audit or technology work, we can assess how your role and knowledge fit a whistleblower case. A rejected proposal may explain the missing control. An assurance sent after an audit may explain how a correspondent relationship continued. We assess those connections with you and identify the whistleblower route suited to the conduct.

The Bank Secrecy Act whistleblower program provides qualifying whistleblowers collectively 10% to 30% of qualifying collections from covered actions with monetary sanctions exceeding $1 million, but FinCEN says it will begin paying awards only after its regulations are final. We assess the applicable program and its reward rules with you.

A whistleblower case under the False Claims Act can pay 15% to 30% of what the government recovers. That is a separate program.

Who Kept the Blind Spot Open?

If you know which warning, staffing request or failed test management set aside, speak with our whistleblower experts about the monitoring gap. We build the case strategy around what you know and bring in anti-money laundering whistleblower lawyers who understand bank controls, correspondent relationships and the decisions behind them. We stay beside you as the case develops, connecting your knowledge of the system to the people who chose how it would operate.